- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 1/2] Revert "scsi: hisi_sas: Modify v3 HW I/O processing when SATA_DISK_ERR bit is set and NCQ Error occurs"
by Yongqiang Liu 25 Aug '22

25 Aug '22

From: Xingui Yang <yangxingui(a)huawei.com> driver inclusion category: bugfix buzialla: https://gitee.com/openeuler/kernel/issues/I5NIU1 ----------------------------- This reverts commit fc8110704ff013b290836780cb25c9c399648e13. After an error occurs in the NCQ scenario, the policy similar to the ahci driver is used to handle NCQ exceptions. The libata interface ata_link_abort is invoked to process all I/Os on the link. Compared with the current solution, the code modification amount is small, and the possibility of NCQ being disabled decreases. That is, the probability of performance deterioration is low. So revert it. Signed-off-by: Xingui Yang <yangxingui(a)huawei.com> Reviewed-by: kang fenglong <kangfenglong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/scsi/hisi_sas/hisi_sas.h | 4 +- drivers/scsi/hisi_sas/hisi_sas_main.c | 81 ++------------------- drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 2 +- drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 2 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 97 +++++--------------------- 5 files changed, 24 insertions(+), 162 deletions(-) diff --git a/drivers/scsi/hisi_sas/hisi_sas.h b/drivers/scsi/hisi_sas/hisi_sas.h index 8628dfea9703..a791401be7b3 100644 --- a/drivers/scsi/hisi_sas/hisi_sas.h +++ b/drivers/scsi/hisi_sas/hisi_sas.h @@ -600,8 +600,7 @@ extern void hisi_sas_phy_enable(struct hisi_hba *hisi_hba, int phy_no, extern void hisi_sas_phy_down(struct hisi_hba *hisi_hba, int phy_no, int rdy); extern void hisi_sas_slot_task_free(struct hisi_hba *hisi_hba, struct sas_task *task, - struct hisi_sas_slot *slot, - bool need_lock); + struct hisi_sas_slot *slot); extern void hisi_sas_init_mem(struct hisi_hba *hisi_hba); extern void hisi_sas_rst_work_handler(struct work_struct *work); extern void hisi_sas_sync_rst_work_handler(struct work_struct *work); @@ -612,7 +611,6 @@ extern void hisi_sas_release_tasks(struct hisi_hba *hisi_hba); extern u8 hisi_sas_get_prog_phy_linkrate_mask(enum sas_linkrate max); extern void hisi_sas_controller_reset_prepare(struct hisi_hba *hisi_hba); extern void hisi_sas_controller_reset_done(struct hisi_hba *hisi_hba); -extern void hisi_sas_complete_disk_io(struct hisi_sas_device *sas_dev); extern void hisi_sas_debugfs_init(struct hisi_hba *hisi_hba); extern void hisi_sas_debugfs_exit(struct hisi_hba *hisi_hba); extern void hisi_sas_snapshot_regs(struct hisi_hba *hisi_hba); diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c index 5de1e8ba5c6a..93df1c6b94c7 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_main.c +++ b/drivers/scsi/hisi_sas/hisi_sas_main.c @@ -229,7 +229,7 @@ static void hisi_sas_slot_index_init(struct hisi_hba *hisi_hba) } void hisi_sas_slot_task_free(struct hisi_hba *hisi_hba, struct sas_task *task, - struct hisi_sas_slot *slot, bool need_lock) + struct hisi_sas_slot *slot) { unsigned long flags; int device_id = slot->device_id; @@ -260,13 +260,9 @@ void hisi_sas_slot_task_free(struct hisi_hba *hisi_hba, struct sas_task *task, } } - if (need_lock) { - spin_lock_irqsave(&sas_dev->lock, flags); - list_del_init(&slot->entry); - spin_unlock_irqrestore(&sas_dev->lock, flags); - } else { - list_del_init(&slot->entry); - } + spin_lock_irqsave(&sas_dev->lock, flags); + list_del_init(&slot->entry); + spin_unlock_irqrestore(&sas_dev->lock, flags); memset(slot, 0, offsetof(struct hisi_sas_slot, buf)); @@ -1015,7 +1011,7 @@ static void hisi_sas_do_release_task(struct hisi_hba *hisi_hba, struct sas_task task->task_done(task); } - hisi_sas_slot_task_free(hisi_hba, task, slot, true); + hisi_sas_slot_task_free(hisi_hba, task, slot); } static void hisi_sas_release_task(struct hisi_hba *hisi_hba, @@ -3751,73 +3747,6 @@ int hisi_sas_remove(struct platform_device *pdev) } EXPORT_SYMBOL_GPL(hisi_sas_remove); -void hisi_sas_complete_disk_io(struct hisi_sas_device *sas_dev) -{ - struct hisi_hba *hisi_hba; - struct device *dev; - struct domain_device *device; - struct hisi_sas_slot *slot, *slot2; - struct sas_task *task; - struct task_status_struct *ts; - struct sas_ha_struct *ha; - bool is_internal; - unsigned long flags; - - if (!sas_dev) - return; - - hisi_hba = sas_dev->hisi_hba; - dev = hisi_hba->dev; - device = sas_dev->sas_device; - spin_lock_irqsave(&sas_dev->lock, flags); - hisi_sas_dereg_device(hisi_hba, device); - list_for_each_entry_safe(slot, slot2, &sas_dev->list, entry) { - task = slot->task; - if (unlikely(!task || !task->lldd_task || !task->dev)) - continue; - - spin_lock_irqsave(&task->task_state_lock, flags); - if ((task->task_state_flags & SAS_TASK_STATE_ABORTED) || - (task->task_state_flags & SAS_TASK_STATE_DONE)) { - spin_unlock_irqrestore(&task->task_state_lock, flags); - dev_info(dev, "slot complete: iptt=%d task(%pK) already finished.\n", - slot->idx, task); - continue; - } - - task->task_state_flags |= SAS_TASK_STATE_DONE; - spin_unlock_irqrestore(&task->task_state_lock, flags); - - is_internal = slot->is_internal; - ts = &task->task_status; - device = task->dev; - ha = device->port->ha; - - memset(ts, 0, sizeof(*ts)); - ts->stat = SAS_ABORTED_TASK; - ts->resp = SAS_TASK_COMPLETE; - - hisi_sas_slot_task_free(hisi_hba, task, slot, false); - - if (!is_internal && (task->task_proto != SAS_PROTOCOL_SMP)) { - spin_lock_irqsave(&device->done_lock, flags); - if (test_bit(SAS_HA_FROZEN, &ha->state)) { - spin_unlock_irqrestore(&device->done_lock, - flags); - dev_info(dev, "slot complete: task(%pK) ignored\n ", - task); - continue; - } - spin_unlock_irqrestore(&device->done_lock, flags); - } - - if (task->task_done) - task->task_done(task); - } - spin_unlock_irqrestore(&sas_dev->lock, flags); -} -EXPORT_SYMBOL_GPL(hisi_sas_complete_disk_io); - bool hisi_sas_debugfs_enable = true; EXPORT_SYMBOL_GPL(hisi_sas_debugfs_enable); module_param_named(debugfs_enable, hisi_sas_debugfs_enable, bool, 0444); diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c index 6485e2b6456c..452665c641a6 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c @@ -1320,7 +1320,7 @@ static int slot_complete_v1_hw(struct hisi_hba *hisi_hba, } out: - hisi_sas_slot_task_free(hisi_hba, task, slot, true); + hisi_sas_slot_task_free(hisi_hba, task, slot); sts = ts->stat; if (task->task_done) diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c index bd0639fd5162..1c452f16b6e2 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c @@ -2480,7 +2480,7 @@ slot_complete_v2_hw(struct hisi_hba *hisi_hba, struct hisi_sas_slot *slot) } task->task_state_flags |= SAS_TASK_STATE_DONE; spin_unlock_irqrestore(&task->task_state_lock, flags); - hisi_sas_slot_task_free(hisi_hba, task, slot, true); + hisi_sas_slot_task_free(hisi_hba, task, slot); if (!is_internal && (task->task_proto != SAS_PROTOCOL_SMP)) { spin_lock_irqsave(&device->done_lock, flags); diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c index e84246c2331a..79026e887ee8 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c @@ -402,17 +402,6 @@ #define CMPLT_HDR_ERX_MSK (0x1 << CMPLT_HDR_ERX_OFF) #define CMPLT_HDR_ABORT_STAT_OFF 13 #define CMPLT_HDR_ABORT_STAT_MSK (0x7 << CMPLT_HDR_ABORT_STAT_OFF) -/* bit[9:2] Error Phase */ -#define ERR_PHASE_DQ_ENTRY_PARSING BIT(2) -#define ERR_PHASE_FRAME_LINK_STAGE BIT(3) -#define ERR_PHASE_CMD_TM_FRAME_SEND_STAGE BIT(4) -#define ERR_PHASE_DATA_FRAME_SEND_STAGE BIT(5) -#define ERR_PHASE_DATA_FRAME_REV_STAGE BIT(6) -#define ERR_PHASE_XFERDY_FRAME_REV_STAGE BIT(7) -#define ERR_PHASE_RESPONSE_FRAME_REV_STAGE BIT(8) -#define ERR_PHASE_DPH_SCHEDULING BIT(9) -#define ERR_PHASE_FRAME_REV_STAGE (ERR_PHASE_DATA_FRAME_REV_STAGE | \ - ERR_PHASE_XFERDY_FRAME_REV_STAGE | ERR_PHASE_RESPONSE_FRAME_REV_STAGE) /* abort_stat */ #define STAT_IO_NOT_VALID 0x1 #define STAT_IO_NO_DEVICE 0x2 @@ -424,19 +413,8 @@ #define CMPLT_HDR_DEV_ID_OFF 16 #define CMPLT_HDR_DEV_ID_MSK (0xffff << CMPLT_HDR_DEV_ID_OFF) /* dw3 */ -#define COMLT_HDR_SATA_DISK_ERR_OFF 16 -#define CMPLT_HDR_SATA_DISK_ERR_MSK (0x1 << COMLT_HDR_SATA_DISK_ERR_OFF) #define CMPLT_HDR_IO_IN_TARGET_OFF 17 #define CMPLT_HDR_IO_IN_TARGET_MSK (0x1 << CMPLT_HDR_IO_IN_TARGET_OFF) -/* bit[31:24] ERR_FIS_TYPE */ -#define CQ_PIO_DATA_FIS_TYPE BIT(24) -#define CQ_PIO_SETUP_FIS_TYPE BIT(25) -#define CQ_D2H_FIS_TYPE BIT(26) -#define CQ_WT_PIO_SETUP_FIS_TYPE BIT(27) -#define CQ_WT_DMA_SETUP_FIS_TYPE BIT(28) -#define CQ_RD_DMA_SETUP_FIS_TYPE BIT(29) -#define CQ_DMA_ACTIVE_FIS_TYPE BIT(30) -#define CQ_SDB_FIS_TYPE BIT(31) /* ITCT header */ /* qw0 */ @@ -2255,26 +2233,6 @@ static void hisi_sas_set_sense_data(struct sas_task *task, } } -static bool is_err_fis(u32 dw0) -{ - /* 0x3 means abnormal completion */ - return ((dw0 & CMPLT_HDR_CMPLT_MSK) == 0x3) && - (dw0 & ERR_PHASE_FRAME_REV_STAGE); -} - -static bool is_ncq_err(struct hisi_sas_complete_v3_hdr *complete_hdr) -{ - u32 dw0, dw3; - - dw0 = le32_to_cpu(complete_hdr->dw0); - dw3 = le32_to_cpu(complete_hdr->dw3); - - if (!is_err_fis(dw0) || !(dw3 & CMPLT_HDR_SATA_DISK_ERR_MSK)) - return false; - - return dw3 & CQ_SDB_FIS_TYPE; -} - static void slot_err_v3_hw(struct hisi_hba *hisi_hba, struct sas_task *task, struct hisi_sas_slot *slot) @@ -2378,24 +2336,16 @@ slot_complete_v3_hw(struct hisi_hba *hisi_hba, struct hisi_sas_slot *slot) if (unlikely(!task || !task->lldd_task || !task->dev)) return -EINVAL; - spin_lock_irqsave(&task->task_state_lock, flags); - if (task->task_state_flags & SAS_TASK_STATE_ABORTED || - task->task_state_flags & SAS_TASK_STATE_DONE) { - spin_unlock_irqrestore(&task->task_state_lock, flags); - dev_info(dev, "slot complete: iptt=%d task(%pK) already finished.\n", - slot->idx, task); - return SAS_ABORTED_TASK; - } - task->task_state_flags &= - ~(SAS_TASK_STATE_PENDING | SAS_TASK_AT_INITIATOR); - task->task_state_flags |= SAS_TASK_STATE_DONE; - spin_unlock_irqrestore(&task->task_state_lock, flags); - ts = &task->task_status; device = task->dev; ha = device->port->ha; sas_dev = device->lldd_dev; + spin_lock_irqsave(&task->task_state_lock, flags); + task->task_state_flags &= + ~(SAS_TASK_STATE_PENDING | SAS_TASK_AT_INITIATOR); + spin_unlock_irqrestore(&task->task_state_lock, flags); + memset(ts, 0, sizeof(*ts)); ts->resp = SAS_TASK_COMPLETE; @@ -2486,9 +2436,6 @@ slot_complete_v3_hw(struct hisi_hba *hisi_hba, struct hisi_sas_slot *slot) iu->resp_data[0]); } if (unlikely(slot->abort)) { - spin_lock_irqsave(&task->task_state_lock, flags); - task->task_state_flags &= ~SAS_TASK_STATE_DONE; - spin_unlock_irqrestore(&task->task_state_lock, flags); sas_task_abort(task); return ts->stat; } @@ -2552,7 +2499,15 @@ slot_complete_v3_hw(struct hisi_hba *hisi_hba, struct hisi_sas_slot *slot) out: sts = ts->stat; - hisi_sas_slot_task_free(hisi_hba, task, slot, true); + spin_lock_irqsave(&task->task_state_lock, flags); + if (task->task_state_flags & SAS_TASK_STATE_ABORTED) { + spin_unlock_irqrestore(&task->task_state_lock, flags); + dev_info(dev, "slot complete: task(%pK) aborted\n", task); + return SAS_ABORTED_TASK; + } + task->task_state_flags |= SAS_TASK_STATE_DONE; + spin_unlock_irqrestore(&task->task_state_lock, flags); + hisi_sas_slot_task_free(hisi_hba, task, slot); if (!is_internal && (task->task_proto != SAS_PROTOCOL_SMP)) { spin_lock_irqsave(&device->done_lock, flags); @@ -2588,32 +2543,12 @@ static void cq_tasklet_v3_hw(unsigned long val) while (rd_point != wr_point) { struct hisi_sas_complete_v3_hdr *complete_hdr; struct device *dev = hisi_hba->dev; - u32 dw0, dw1, dw3; int iptt; complete_hdr = &complete_queue[rd_point]; - dw0 = le32_to_cpu(complete_hdr->dw0); - dw1 = le32_to_cpu(complete_hdr->dw1); - dw3 = le32_to_cpu(complete_hdr->dw3); - iptt = dw1 & CMPLT_HDR_IPTT_MSK; - /* - * check for NCQ error and current iptt is invalid, all NCQ - * commands should be aborted - */ - if (unlikely(is_ncq_err(complete_hdr))) { - int device_id = (dw1 & CMPLT_HDR_DEV_ID_MSK) >> - CMPLT_HDR_DEV_ID_OFF; - struct hisi_sas_device *sas_dev = - &hisi_hba->devices[device_id]; - struct hisi_sas_itct *itct = - &hisi_hba->itct[device_id]; - - dev_err(dev, "erroneous completion ncq err dev id=%d sas_addr=0x%llx CQ hdr: 0x%x 0x%x 0x%x 0x%x\n", - device_id, itct->sas_addr, dw0, dw1, - complete_hdr->act, dw3); - hisi_sas_complete_disk_io(sas_dev); - } else if (likely(iptt < HISI_SAS_COMMAND_ENTRIES_V3_HW)) { + iptt = (complete_hdr->dw1) & CMPLT_HDR_IPTT_MSK; + if (likely(iptt < HISI_SAS_COMMAND_ENTRIES_V3_HW)) { slot = &hisi_hba->slot_info[iptt]; slot->cmplt_queue_slot = rd_point; slot->cmplt_queue = queue; -- 2.25.1

1 1

[PATCH openEuler-22.09 v3 000/391] BPF CO-RE support
by Zheng Zengkai 24 Aug '22

24 Aug '22

This set introduces CO-RE support in the kernel. There are several reasons to add such support: 1.It's a step toward signed BPF programs. 2.It allows golang like languages that struggle to adopt libbpf to take advantage of CO-RE powers. 3.Currently the field accessed by 'ldx [R1 + 10]' insn is recognized by the verifier purely based on +10 offset. If R1 points to a union the verifier picks one of the fields at this offset. With CO-RE the kernel can disambiguate the field access. Alan Maguire (5): libbpf: bpf__find_by_name[_kind] should use btf__get_nr_types() libbpf: BTF dumper support for typed data libbpf: Clarify/fix unaligned data issues for btf typed dump libbpf: Avoid use of __int128 in typed dump display libbpf: Propagate errors when retrieving enum value for typed data display Alexei Starovoitov (55): bpf: Optimize program stats bpf: Run sleepable programs with migration disabled bpf: Compute program stats for sleepable programs bpf: Add per-program recursion prevention mechanism selftest/bpf: Add a recursion test bpf: Count the number of times recursion was prevented selftests/bpf: Improve recursion selftest bpf: Allows per-cpu maps and map-in-map in sleepable programs selftests/bpf: Add a test for map-in-map and per-cpu maps in sleepable progs bpf: Clear per_cpu pointers during bpf_prog_realloc bpf: Dont allow vmlinux BTF to be used in map_create and prog_load. libbpf: Remove unused field. bpf: Introduce bpf_sys_bpf() helper and program type. bpf: Introduce bpfptr_t user/kernel pointer. bpf: Prepare bpf syscall to be used from kernel and user space. libbpf: Support for syscall program type bpf: Make btf_load command to be bpfptr_t compatible. bpf: Introduce fd_idx bpf: Add bpf_btf_find_by_name_kind() helper. bpf: Add bpf_sys_close() helper. libbpf: Change the order of data and text relocations. libbpf: Add bpf_object pointer to kernel_supports(). libbpf: Preliminary support for fd_idx libbpf: Generate loader program out of BPF ELF file. libbpf: Cleanup temp FDs when intermediate sys_bpf fails. libbpf: Introduce bpf_map__initial_value(). bpftool: Use syscall/loader program in "prog load" and "gen skeleton" command. selftests/bpf: Convert few tests to light skeleton. selftests/bpf: Convert atomics test to light skeleton. selftests/bpf: Convert test printk to use rodata. selftests/bpf: Convert test trace_printk to lskel. bpf: Add cmd alias BPF_PROG_RUN bpf: Prepare bpf_prog_put() to be called from irq context. bpf: Factor out bpf_spin_lock into helpers. libbpf: Cleanup the layering between CORE and bpf_program. libbpf: Split bpf_core_apply_relo() into bpf_program independent helper. libbpf: Move CO-RE types into relo_core.h. libbpf: Split CO-RE logic into relo_core.c. libbpf: Make gen_loader data aligned. libbpf: Replace btf__type_by_id() with btf_type_by_id(). bpf: Rename btf_member accessors. bpf: Prepare relo_core.c for kernel duty. bpf: Define enum bpf_core_relo_kind as uapi. bpf: Pass a set of bpf_core_relo-s to prog_load command. bpf: Add bpf_core_add_cands() and wire it into bpf_core_apply_relo_insn(). libbpf: Use CO-RE in the kernel in light skeleton. libbpf: Support init of inner maps in light skeleton. libbpf: Clean gen_loader's attach kind. selftests/bpf: Improve inner_map test coverage. selftests/bpf: Convert map_ptr_kern test to use light skeleton. selftests/bpf: Additional test for CO-RE in the kernel. selftests/bpf: Add CO-RE relocations to verifier scale test. libbpf: Reduce bpf_core_apply_relo_insn() stack usage. bpf: Silence purge_cand_cache build warning. libbpf: Fix gen_loader assumption on number of programs. Andrei Matei (1): libbpf: Fail early when loading programs with unspecified type Andrew Delgadillo (1): selftests/bpf: Drop the need for LLVM's llc Andrii Nakryiko (148): libbpf: Factor out common operations in BTF writing APIs selftest/bpf: Relax btf_dedup test checks libbpf: Unify and speed up BTF string deduplication libbpf: Implement basic split BTF support selftests/bpf: Add split BTF basic test selftests/bpf: Add checking of raw type dump in BTF writer APIs selftests libbpf: Support BTF dedup of split BTFs libbpf: Accomodate DWARF/compiler bug with duplicated identical arrays selftests/bpf: Add split BTF dedup selftests tools/bpftool: Add bpftool support for split BTF bpf: Add in-kernel split BTF support bpf: Assign ID to vmlinux BTF and return extra info for BTF in GET_OBJ_INFO kbuild: Build kernel module BTFs if BTF is enabled and pahole supports it bpf: Load and verify kernel module BTFs tools/bpftool: Add support for in-kernel and named BTF in `btf show` bpf: Compile out btf_parse_module() if module BTF is not enabled bpf: Sanitize BTF data pointer after module is loaded tools/bpftool: Emit name <anon> for anonymous BTFs libbpf: Add base BTF accessor tools/bpftool: Auto-detect split BTFs in common cases bpf: Keep module's btf_data_size intact after load libbpf: Add internal helper to load BTF data by FD libbpf: Refactor CO-RE relocs to not assume a single BTF object libbpf: Add kernel module BTF support for CO-RE relocations selftests/bpf: Add bpf_testmod kernel module for testing selftests/bpf: Add support for marking sub-tests as skipped selftests/bpf: Add CO-RE relocs selftest relying on kernel module BTF bpf: Remove hard-coded btf_vmlinux assumption from BPF verifier bpf: Allow to specify kernel module BTFs when attaching BPF programs libbpf: Factor out low-level BPF program loading helper libbpf: Support attachment of BPF tracing programs to kernel modules selftests/bpf: Add tp_btf CO-RE reloc test for modules kbuild: Skip module BTF generation for out-of-tree external modules selftests/bpf: fix bpf_testmod.ko recompilation logic libbpf: Support modules in bpf_program__set_attach_target() API bpf: Allow empty module BTFs libbpf: Add user-space variants of BPF_CORE_READ() family of macros libbpf: Add non-CO-RE variants of BPF_CORE_READ() macro family selftests/bpf: Add tests for user- and non-CO-RE BPF_CORE_READ() variants libbpf: Clarify kernel type use with USER variants of CORE reading macros selftests/bpf: Sync RCU before unloading bpf_testmod bpf: Support BPF ksym variables in kernel modules libbpf: Support kernel module ksym externs selftests/bpf: Test kernel module ksym externs selftests/bpf: Don't exit on failed bpf_testmod unload libbpf: Stop using feature-detection Makefiles libbpf: provide NULL and KERNEL_VERSION macros in bpf_helpers.h libbpf: Expose btf_type_by_id() internally libbpf: Generalize BTF and BTF.ext type ID and strings iteration libbpf: Rename internal memory-management helpers libbpf: Extract internal set-of-strings datastructure APIs libbpf: Add generic BTF type shallow copy API libbpf: Add BPF static linker APIs libbpf: Add BPF static linker BTF and BTF.ext support bpftool: Add ability to specify custom skeleton object name bpftool: Add `gen object` command to perform BPF static linking selftests/bpf: Pass all BPF .o's through BPF static linker selftests/bpf: Add multi-file statically linked BPF object file test libbpf: Skip BTF fixup if object file has no BTF libbpf: Constify few bpf_program getters libbpf: Preserve empty DATASEC BTFs during static linking libbpf: Fix memory leak when emitting final btf_ext libbpf: Add bpf_map__inner_map API libbpf: Suppress compiler warning when using SEC() macro with externs libbpf: Mark BPF subprogs with hidden visibility as static for BPF verifier libbpf: Allow gaps in BPF program sections to support overriden weak functions libbpf: Refactor BTF map definition parsing libbpf: Factor out symtab and relos sanity checks libbpf: Make few internal helpers available outside of libbpf.c libbpf: Extend sanity checking ELF symbols with externs validation libbpf: Tighten BTF type ID rewriting with error checking libbpf: Add linker extern resolution support for functions and global variables libbpf: Support extern resolution for BTF-defined maps in .maps section libbpf: Support BTF_KIND_FLOAT during type compatibility checks in CO-RE bpftool: Strip const/volatile/restrict modifiers from .bss and .data vars libbpf: Add per-file linker opts selftests/bpf: Stop using static variables for passing data to/from user-space bpftool: Stop emitting static variables in BPF skeleton libbpf: Fix ELF symbol visibility update logic libbpf: Treat STV_INTERNAL same as STV_HIDDEN for functions libbpf: Reject static maps libbpf: Reject static entry-point BPF programs libbpf: Add libbpf_set_strict_mode() API to turn on libbpf 1.0 behaviors libbpf: Streamline error reporting for low-level APIs libbpf: Streamline error reporting for high-level APIs bpftool: Set errno on skeleton failures and propagate errors libbpf: Move few APIs from 0.4 to 0.5 version libbpf: Refactor header installation portions of Makefile libbpf: Install skel_internal.h header used from light skeletons selftests/bpf: Add remaining ASSERT_xxx() variants libbpf: Fix build with latest gcc/binutils with LTO libbpf: Make libbpf_version.h non-auto-generated selftests/bpf: Update selftests to always provide "struct_ops" SEC libbpf: Ensure BPF prog types are set before relocations libbpf: Simplify BPF program auto-attach code libbpf: Minimize explicit iterator of section definition array libbpf: Use pre-setup sec_def in libbpf_find_attach_btf_id() selftests/bpf: Stop using relaxed_core_relocs which has no effect libbpf: Deprecated bpf_object_open_opts.relaxed_core_relocs libbpf: Allow skipping attach_func_name in bpf_program__set_attach_target() libbpf: Schedule open_opts.attach_prog_fd deprecation since v0.7 libbpf: Constify all high-level program attach APIs selftests/bpf: Turn on libbpf 1.0 mode and fix all IS_ERR checks selftests/bpf: Switch fexit_bpf2bpf selftest to set_attach_target() API libbpf: Add "tc" SEC_DEF which is a better name for "classifier" libbpf: Refactor internal sec_def handling to enable pluggability libbpf: Reduce reliance of attach_fns on sec_def internals libbpf: Add API that copies all BTF types from one BTF object to another libbpf: Deprecate btf__finalize_data() and move it into libbpf.c libbpf: Extract ELF processing state into separate struct libbpf: Use Elf64-specific types explicitly for dealing with ELF libbpf: Remove assumptions about uniqueness of .rodata/.data/.bss maps bpftool: Support multiple .rodata/.data internal maps in skeleton bpftool: Improve skeleton generation for data maps without DATASEC type libbpf: Support multiple .rodata.* and .data.* BPF maps selftests/bpf: Demonstrate use of custom .rodata/.data sections libbpf: Simplify look up by name of internal maps selftests/bpf: Switch to ".bss"/".rodata"/".data" lookups for internal maps libbpf: Fix off-by-one bug in bpf_core_apply_relo() libbpf: Add ability to fetch bpf_program's underlying instructions libbpf: Deprecate multi-instance bpf_program APIs libbpf: Deprecate ambiguously-named bpf_program__size() API libbpf: Detect corrupted ELF symbols section libbpf: Improve sanity checking during BTF fix up libbpf: Validate that .BTF and .BTF.ext sections contain data libbpf: Fix section counting logic libbpf: Improve ELF relo sanitization libbpf: Rename DECLARE_LIBBPF_OPTS into LIBBPF_OPTS selftests/bpf: Pass sanitizer flags to linker through LDFLAGS libbpf: Free up resources used by inner map definition selftests/bpf: Fix memory leaks in btf_type_c_dump() helper selftests/bpf: Free per-cpu values array in bpf_iter selftest selftests/bpf: Free inner strings index in btf selftest selftests/bpf: Avoid duplicate btf__parse() call libbpf: Load global data maps lazily on legacy kernels libbpf: Fix potential misaligned memory access in btf_ext__new() libbpf: Don't call libc APIs with NULL pointers libbpf: Fix glob_syms memory leak in bpf_linker libbpf: Fix using invalidated memory in bpf_linker selftests/bpf: Fix possible NULL passed to memcpy() with zero size selftests/bpf: Prevent misaligned memory access in get_stack_raw_tp test selftests/bpf: Fix misaligned memory access in queue_stack_map test selftests/bpf: Prevent out-of-bounds stack access in test_bpffs selftests/bpf: Fix misaligned accesses in xdp and xdp_bpf2bpf tests libbpf: Cleanup struct bpf_core_cand. libbpf: Fix non-C89 loop variable declaration in gen_loader.c selftests/bpf: Fix GCC11 compiler warnings in -O2 mode libbpf: Fix logic for finding matching program for CO-RE relocation Arnaldo Carvalho de Melo (1): libbpf: Provide GELF_ST_VISIBILITY() define for older libelf Brendan Jackman (15): tools/resolve_btfids: Fix some error messages bpf: Fix cold build of test_progs-no_alu32 bpf: Clarify return value of probe str helpers bpf: x86: Factor out emission of ModR/M for *(reg + off) bpf: x86: Factor out emission of REX byte bpf: x86: Factor out a lookup table for some ALU opcodes bpf: Rename BPF_XADD and prepare to encode other atomics in .imm bpf: Move BPF_STX reserved field check into BPF_STX verifier code bpf: Add BPF_FETCH field / create atomic_fetch_add instruction bpf: Add instructions for atomic_[cmp]xchg bpf: Pull out a macro for interpreting atomic ALU operations bpf: Add bitwise atomic instructions bpf: Add tests for new BPF atomic operations bpf: Document new atomic instructions bpf: Rename fixup_bpf_calls and add some comments Cong Wang (1): bpf: Clear percpu pointers in bpf_prog_clone_free() Daniel Xu (1): libbpf: Do not close un-owned FD 0 on errors Dave Marchevsky (1): bpf: Add verified_insns to bpf_prog_info and fdinfo Dmitrii Banshchikov (7): bpf: Rename bpf_reg_state variables bpf: Extract nullable reg type conversion into a helper function bpf: Support pointers in global func args selftests/bpf: Add unit tests for pointers in global functions bpf: Drop imprecise log message selftests/bpf: Fix a compiler warning in global func test bpf: Use MAX_BPF_FUNC_REG_ARGS macro Florent Revest (6): selftests/bpf: Fix the ASSERT_ERR_PTR macro bpf: Factorize bpf_trace_printk and bpf_seq_printf bpf: Add a ARG_PTR_TO_CONST_STR argument type bpf: Add a bpf_snprintf helper libbpf: Introduce a BPF_SNPRINTF helper macro libbpf: Move BPF_SEQ_PRINTF and BPF_SNPRINTF to bpf_helpers.h Florian Lehner (2): selftests/bpf: Print reason when a tester could not run a program selftests/bpf: Avoid errno clobbering Gary Lin (3): bpf,x64: Pad NOPs to make images converge more easily test_bpf: Remove EXPECTED_FAIL flag from bpf_fill_maxinsns11 selftests/bpf: Add verifier tests for x64 jit jump padding Hao Luo (1): libbpf: Support weak typed ksyms. Hengqi Chen (5): libbpf: Fix KERNEL_VERSION macro tools/resolve_btfids: Emit warnings and patch zero id for missing symbols libbpf: Add btf__load_vmlinux_btf/btf__load_module_btf libbpf: Support uniform BTF-defined key/value specification across all BPF maps libbpf: Support static initialization of BPF_MAP_TYPE_PROG_ARRAY Ian Rogers (3): bpf, libbpf: Avoid unused function warning on bpf_tail_call_static tools/bpftool: Add -Wall when building BPF programs libbpf: Add NULL check to add_dummy_ksym_var Ilya Leoshkevich (6): selftests/bpf: Copy extras in out-of-srctree builds bpf: Add BTF_KIND_FLOAT to uapi libbpf: Fix whitespace in btf_add_composite() comment libbpf: Add BTF_KIND_FLOAT support bpf: Generate BTF_KIND_FLOAT when linking vmlinux libbpf: Use __BYTE_ORDER__ Jason Wang (1): libbpf: Fix comment typo Jean-Philippe Brucker (12): tools: Factor HOSTCC, HOSTLD, HOSTAR definitions tools/runqslower: Use Makefile.include tools/runqslower: Enable out-of-tree build tools/runqslower: Build bpftool using HOSTCC tools/bpftool: Fix build slowdown selftests/bpf: Enable cross-building selftests/bpf: Fix out-of-tree build selftests/bpf: Move generated test files to $(TEST_GEN_FILES) selftests/bpf: Fix installation of urandom_read selftests/bpf: Install btf_dump test cases tools/bpftool: Fix cross-build tools/runqslower: Fix cross-build Jiri Olsa (5): tools/resolve_btfids: Warn when having multiple IDs for single type libbpf: Use string table index from index table if needed perf build: Move feature cleanup under tools/build selftests/bpf: Add re-attach test to fentry_test selftests/bpf: Add re-attach test to fexit_test Joe Stringer (1): tools: Sync uapi bpf.h header with latest changes Jonathan Edwards (1): libbpf: Add extra BPF_PROG_TYPE check to bpf_object__probe_loading Kumar Kartikeya Dwivedi (22): libbpf: Add various netlink helpers libbpf: Add low level TC-BPF management API libbpf: Remove unneeded check for flags during tc detach libbpf: Set NLM_F_EXCL when creating qdisc libbpf: Fix segfault in static linker for objects without BTF libbpf: Fix segfault in light skeleton for objects without BTF bpf: Introduce BPF support for kernel module function calls bpf: Be conservative while processing invalid kfunc calls bpf: btf: Introduce helpers for dynamic BTF set registration tools: Allow specifying base BTF file in resolve_btfids libbpf: Support kernel module function calls libbpf: Resolve invalid weak kfunc calls with imm = 0, off = 0 libbpf: Update gen_loader to emit BTF_KIND_FUNC relocations bpf: selftests: Add selftests for module kfunc support bpf: Add bpf_kallsyms_lookup_name helper libbpf: Add typeless ksym support to gen_loader libbpf: Add weak ksym support to gen_loader selftests/bpf: Add weak/typeless ksym test for light skeleton libbpf: Perform map fd cleanup for gen_loader in case of error bpf: Change bpf_kallsyms_lookup_name size type to ARG_CONST_SIZE_OR_ZERO libbpf: Avoid double stores for success/failure case of ksym relocations libbpf: Avoid reload of imm for weak, unresolved, repeating ksym Lorenz Bauer (2): bpf: Consolidate shared test timing code bpf: Add PROG_TEST_RUN support for sk_lookup programs Martin KaFai Lau (10): bpf: Simplify freeing logic in linfo and jited_linfo bpf: Refactor btf_check_func_arg_match bpf: Support bpf program calling kernel function bpf: Support kernel function call in x86-32 libbpf: Refactor bpf_object__resolve_ksyms_btf_id libbpf: Refactor codes for finding btf id of a kernel symbol libbpf: Rename RELO_EXTERN to RELO_EXTERN_VAR libbpf: Record extern sym relocation first libbpf: Support extern kernel function bpf: selftests: Add kfunc_call test Martynas Pumputis (1): selftests/bpf: Check inner map deletion Matt Smith (3): libbpf: Change bpf_object_skeleton data field to const pointer bpftool: Provide a helper method for accessing skeleton's embedded ELF data selftests/bpf: Add checks for X__elf_bytes() skeleton helper Mauricio Vásquez (1): libbpf: Fix memory leak in btf__dedup() Michal Suchanek (1): libbpf: Fix pr_warn type warnings on 32bit Pedro Tammela (2): libbpf: Avoid inline hint definition from 'linux/stddef.h' libbpf: Clarify flags in ringbuf helpers Quentin Monnet (17): libbpf: Return non-null error on failures in libbpf_find_prog_btf_id() libbpf: Rename btf__load() as btf__load_into_kernel() libbpf: Rename btf__get_from_id() as btf__load_from_kernel_by_id() tools: Free BTF objects at various locations tools: Replace btf__get_from_id() with btf__load_from_kernel_by_id() libbpf: Add split BTF support for btf__load_from_kernel_by_id() tools: bpftool: Support dumping split BTF by id libbpf: Add LIBBPF_DEPRECATED_SINCE macro for scheduling API deprecations libbpf: Skip re-installing headers file if source is older than target bpftool: Remove unused includes to <bpf/bpf_gen_internal.h> bpftool: Install libbpf headers instead of including the dir tools/resolve_btfids: Install libbpf headers when building tools/runqslower: Install libbpf headers when building bpf: preload: Install libbpf headers when building bpf: iterators: Install libbpf headers when building selftests/bpf: Better clean up for runqslower in test_bpftool_build.sh bpftool: Add install-bin target to install binary only Rafael David Tinoco (1): libbpf: Add bpf object kern_version attribute setter Sedat Dilek (1): tools: Factor Clang, LLC and LLVM utils definitions Shuyi Cheng (2): libbpf: Introduce 'btf_custom_path' to 'bpf_obj_open_opts' libbpf: Add "bool skipped" to struct bpf_map Song Liu (3): bpftool: Add Makefile target bootstrap perf build: Support build BPF skeletons with perf perf stat: Enable counting events for BPF programs Stanislav Fomichev (2): libbpf: Cap retries in sys_bpf_prog_load libbpf: Skip bpf_object__probe_loading for light skeleton Toke Høiland-Jørgensen (5): bpf: Return target info when a tracing bpf_link is queried libbpf: Restore errno return for functions that were already returning it libbpf: Don't crash on object files with no symbol tables libbpf: Ignore STT_SECTION symbols in 'maps' section libbpf: Properly ignore STT_SECTION symbols in legacy map definitions Wang Hai (1): libbpf: Simplify the return expression of bpf_object__init_maps function Wang Qing (1): bpf, btf: Remove the duplicate btf_ids.h include Wedson Almeida Filho (1): bpf: Refactor check_cfg to use a structured loop. Yauheni Kaliuta (7): selftests/bpf: test_progs/sockopt_sk: Remove version selftests/bpf: test_progs/sockopt_sk: Convert to use BPF skeleton selftests/bpf: Pass page size from userspace in sockopt_sk selftests/bpf: Pass page size from userspace in map_ptr selftests/bpf: mmap: Use runtime page size selftests/bpf: ringbuf: Use runtime page size selftests/bpf: ringbuf_multi: Use runtime page size Yonghong Song (26): bpf: Permit size-0 datasec bpf: Refactor BPF_PSEUDO_CALL checking as a helper function bpf: Factor out visit_func_call_insn() in check_cfg() bpf: Factor out verbose_invalid_scalar() bpf: Refactor check_func_call() to allow callback function bpf: Change return value of verifier function add_subprog() bpf: Add bpf_for_each_map_elem() helper libbpf: Move function is_ldimm64() earlier in libbpf.c libbpf: Support subprog address relocation selftests/bpf: Fix test_cpp compilation failure with clang bpftool: Fix a clang compilation warning libbpf: Add support for new llvm bpf relocations bpf: Emit better log message if bpf_iter ctx arg btf_id == 0 btf: Change BTF_KIND_* macros to enums bpf: Support for new btf kind BTF_KIND_TAG libbpf: Rename btf_{hash,equal}_int to btf_{hash,equal}_int_tag libbpf: Add support for BTF_KIND_TAG bpftool: Add support for BTF_KIND_TAG bpf: Rename BTF_KIND_TAG to BTF_KIND_DECL_TAG bpf: Add BTF_KIND_DECL_TAG typedef support docs/bpf: Update documentation for BTF_KIND_DECL_TAG typedef support bpf: Support BTF_KIND_TYPE_TAG for btf_type_tag attributes libbpf: Support BTF_KIND_TYPE_TAG bpftool: Support BTF_KIND_TYPE_TAG docs/bpf: Update documentation for BTF_KIND_TYPE_TAG support libbpf: Fix a couple of missed btf_type_tag handling in btf.c Documentation/ABI/testing/sysfs-kernel-btf | 8 + Documentation/bpf/btf.rst | 40 +- Documentation/networking/filter.rst | 61 +- arch/arm/net/bpf_jit_32.c | 7 +- arch/arm64/net/bpf_jit_comp.c | 16 +- arch/mips/net/ebpf_jit.c | 11 +- arch/powerpc/net/bpf_jit_comp64.c | 25 +- arch/riscv/net/bpf_jit_comp32.c | 20 +- arch/riscv/net/bpf_jit_comp64.c | 16 +- arch/s390/net/bpf_jit_comp.c | 27 +- arch/sparc/net/bpf_jit_comp_64.c | 17 +- arch/x86/net/bpf_jit_comp.c | 408 +- arch/x86/net/bpf_jit_comp32.c | 204 +- drivers/net/ethernet/netronome/nfp/bpf/fw.h | 4 +- drivers/net/ethernet/netronome/nfp/bpf/jit.c | 14 +- drivers/net/ethernet/netronome/nfp/bpf/main.h | 4 +- .../net/ethernet/netronome/nfp/bpf/verifier.c | 15 +- include/linux/bpf.h | 153 +- include/linux/bpf_types.h | 2 + include/linux/bpf_verifier.h | 48 +- include/linux/bpfptr.h | 76 + include/linux/btf.h | 143 +- include/linux/filter.h | 45 +- include/linux/module.h | 4 + include/uapi/linux/bpf.h | 256 +- include/uapi/linux/btf.h | 57 +- kernel/bpf/Makefile | 4 + kernel/bpf/bpf_iter.c | 29 +- kernel/bpf/bpf_struct_ops.c | 6 +- kernel/bpf/btf.c | 1457 ++++- kernel/bpf/core.c | 157 +- kernel/bpf/disasm.c | 56 +- kernel/bpf/hashtab.c | 4 +- kernel/bpf/helpers.c | 326 +- kernel/bpf/preload/Makefile | 25 +- kernel/bpf/preload/iterators/Makefile | 38 +- kernel/bpf/preload/iterators/iterators.bpf.c | 1 - kernel/bpf/syscall.c | 363 +- kernel/bpf/sysfs_btf.c | 2 +- kernel/bpf/trampoline.c | 77 +- kernel/bpf/verifier.c | 1676 +++++- kernel/module.c | 36 + kernel/trace/bpf_trace.c | 375 +- lib/Kconfig.debug | 9 + lib/test_bpf.c | 21 +- net/bpf/test_run.c | 321 +- net/core/filter.c | 2 + net/ipv4/bpf_tcp_ca.c | 7 +- samples/bpf/bpf_insn.h | 4 +- samples/bpf/cookie_uid_helper_example.c | 8 +- samples/bpf/sock_example.c | 2 +- samples/bpf/test_cgrp2_attach.c | 5 +- scripts/Makefile.modfinal | 25 +- scripts/link-vmlinux.sh | 7 +- .../bpf/bpftool/Documentation/bpftool-gen.rst | 78 +- tools/bpf/bpftool/Makefile | 55 +- tools/bpf/bpftool/bash-completion/bpftool | 17 +- tools/bpf/bpftool/btf.c | 80 +- tools/bpf/bpftool/btf_dumper.c | 6 +- tools/bpf/bpftool/gen.c | 651 +- tools/bpf/bpftool/main.c | 20 +- tools/bpf/bpftool/main.h | 2 + tools/bpf/bpftool/map.c | 14 +- tools/bpf/bpftool/net.c | 2 +- tools/bpf/bpftool/prog.c | 139 +- tools/bpf/bpftool/xlated_dumper.c | 3 + tools/bpf/resolve_btfids/Makefile | 19 +- tools/bpf/resolve_btfids/main.c | 66 +- tools/bpf/runqslower/Makefile | 71 +- tools/build/Makefile | 8 +- tools/build/Makefile.feature | 4 +- tools/build/feature/Makefile | 4 +- tools/include/linux/filter.h | 24 +- tools/include/uapi/linux/bpf.h | 968 ++- tools/include/uapi/linux/btf.h | 57 +- tools/lib/bpf/.gitignore | 2 - tools/lib/bpf/Build | 2 +- tools/lib/bpf/Makefile | 104 +- tools/lib/bpf/bpf.c | 273 +- tools/lib/bpf/bpf.h | 1 + tools/lib/bpf/bpf_core_read.h | 169 +- tools/lib/bpf/bpf_gen_internal.h | 65 + tools/lib/bpf/bpf_helpers.h | 108 +- tools/lib/bpf/bpf_prog_linfo.c | 18 +- tools/lib/bpf/bpf_tracing.h | 44 +- tools/lib/bpf/btf.c | 2097 ++++--- tools/lib/bpf/btf.h | 99 +- tools/lib/bpf/btf_dump.c | 910 ++- tools/lib/bpf/gen_loader.c | 1126 ++++ tools/lib/bpf/libbpf.c | 5335 +++++++++-------- tools/lib/bpf/libbpf.h | 172 +- tools/lib/bpf/libbpf.map | 50 + tools/lib/bpf/libbpf_common.h | 26 +- tools/lib/bpf/libbpf_errno.c | 7 +- tools/lib/bpf/libbpf_internal.h | 302 +- tools/lib/bpf/libbpf_legacy.h | 60 + tools/lib/bpf/libbpf_version.h | 9 + tools/lib/bpf/linker.c | 2901 +++++++++ tools/lib/bpf/netlink.c | 593 +- tools/lib/bpf/nlattr.h | 48 + tools/lib/bpf/relo_core.c | 1322 ++++ tools/lib/bpf/relo_core.h | 57 + tools/lib/bpf/ringbuf.c | 26 +- tools/lib/bpf/skel_internal.h | 123 + tools/lib/bpf/strset.c | 176 + tools/lib/bpf/strset.h | 21 + tools/lib/bpf/xsk.c | 4 +- tools/perf/Documentation/perf-stat.txt | 18 + tools/perf/Makefile.config | 9 + tools/perf/Makefile.perf | 58 +- tools/perf/builtin-stat.c | 82 +- tools/perf/util/Build | 1 + tools/perf/util/bpf-event.c | 11 +- tools/perf/util/bpf_counter.c | 320 + tools/perf/util/bpf_counter.h | 72 + tools/perf/util/bpf_skel/.gitignore | 3 + .../util/bpf_skel/bpf_prog_profiler.bpf.c | 93 + tools/perf/util/evsel.c | 5 + tools/perf/util/evsel.h | 5 + tools/perf/util/python.c | 21 + tools/perf/util/stat-display.c | 4 +- tools/perf/util/stat.c | 2 +- tools/perf/util/target.c | 34 +- tools/perf/util/target.h | 10 + tools/scripts/Makefile.include | 18 + tools/testing/selftests/bpf/.gitignore | 2 + tools/testing/selftests/bpf/Makefile | 200 +- tools/testing/selftests/bpf/bench.c | 1 + .../selftests/bpf/benchs/bench_rename.c | 2 +- .../selftests/bpf/benchs/bench_ringbufs.c | 6 +- .../selftests/bpf/benchs/bench_trigger.c | 2 +- .../selftests/bpf/bpf_testmod/.gitignore | 6 + .../selftests/bpf/bpf_testmod/Makefile | 20 + .../bpf/bpf_testmod/bpf_testmod-events.h | 36 + .../selftests/bpf/bpf_testmod/bpf_testmod.c | 76 + .../selftests/bpf/bpf_testmod/bpf_testmod.h | 14 + tools/testing/selftests/bpf/btf_helpers.c | 264 + tools/testing/selftests/bpf/btf_helpers.h | 19 + .../selftests/bpf/prog_tests/atomics.c | 246 + .../selftests/bpf/prog_tests/attach_probe.c | 12 +- .../selftests/bpf/prog_tests/bpf_iter.c | 34 +- .../selftests/bpf/prog_tests/bpf_tcp_ca.c | 8 +- tools/testing/selftests/bpf/prog_tests/btf.c | 166 +- .../bpf/prog_tests/btf_dedup_split.c | 325 + .../selftests/bpf/prog_tests/btf_dump.c | 10 +- .../selftests/bpf/prog_tests/btf_endian.c | 4 +- .../selftests/bpf/prog_tests/btf_map_in_map.c | 33 - .../selftests/bpf/prog_tests/btf_split.c | 99 + .../selftests/bpf/prog_tests/btf_write.c | 47 +- .../bpf/prog_tests/cg_storage_multi.c | 84 +- .../bpf/prog_tests/cgroup_attach_multi.c | 6 +- .../selftests/bpf/prog_tests/cgroup_link.c | 16 +- .../bpf/prog_tests/cgroup_skb_sk_lookup.c | 2 +- .../selftests/bpf/prog_tests/core_autosize.c | 2 +- .../selftests/bpf/prog_tests/core_kern.c | 14 + .../bpf/prog_tests/core_read_macros.c | 64 + .../selftests/bpf/prog_tests/core_reloc.c | 105 +- .../selftests/bpf/prog_tests/fentry_fexit.c | 22 +- .../selftests/bpf/prog_tests/fentry_test.c | 58 +- .../selftests/bpf/prog_tests/fexit_bpf2bpf.c | 68 +- .../selftests/bpf/prog_tests/fexit_stress.c | 4 +- .../selftests/bpf/prog_tests/fexit_test.c | 58 +- .../selftests/bpf/prog_tests/flow_dissector.c | 2 +- .../bpf/prog_tests/flow_dissector_reattach.c | 10 +- .../bpf/prog_tests/get_stack_raw_tp.c | 24 +- .../prog_tests/get_stackid_cannot_attach.c | 9 +- .../selftests/bpf/prog_tests/global_data.c | 11 +- .../bpf/prog_tests/global_data_init.c | 2 +- .../bpf/prog_tests/global_func_args.c | 60 + .../selftests/bpf/prog_tests/hashmap.c | 9 +- .../selftests/bpf/prog_tests/kfree_skb.c | 23 +- .../selftests/bpf/prog_tests/kfunc_call.c | 59 + .../selftests/bpf/prog_tests/ksyms_btf.c | 65 +- .../selftests/bpf/prog_tests/ksyms_module.c | 62 + .../selftests/bpf/prog_tests/link_pinning.c | 7 +- .../selftests/bpf/prog_tests/map_ptr.c | 21 +- tools/testing/selftests/bpf/prog_tests/mmap.c | 24 +- .../selftests/bpf/prog_tests/obj_name.c | 8 +- .../selftests/bpf/prog_tests/perf_branches.c | 4 +- .../selftests/bpf/prog_tests/perf_buffer.c | 2 +- .../bpf/prog_tests/perf_event_stackmap.c | 3 +- .../selftests/bpf/prog_tests/probe_user.c | 7 +- .../selftests/bpf/prog_tests/prog_run_xattr.c | 2 +- .../bpf/prog_tests/queue_stack_map.c | 12 +- .../bpf/prog_tests/raw_tp_test_run.c | 4 +- .../selftests/bpf/prog_tests/rdonly_maps.c | 9 +- .../selftests/bpf/prog_tests/recursion.c | 41 + .../bpf/prog_tests/reference_tracking.c | 2 +- .../selftests/bpf/prog_tests/resolve_btfids.c | 9 +- .../selftests/bpf/prog_tests/ringbuf.c | 27 +- .../selftests/bpf/prog_tests/ringbuf_multi.c | 23 +- .../bpf/prog_tests/select_reuseport.c | 53 +- .../selftests/bpf/prog_tests/send_signal.c | 5 +- .../selftests/bpf/prog_tests/sk_lookup.c | 2 +- .../selftests/bpf/prog_tests/skeleton.c | 41 +- .../selftests/bpf/prog_tests/snprintf_btf.c | 4 +- .../selftests/bpf/prog_tests/sock_fields.c | 14 +- .../selftests/bpf/prog_tests/sockmap_basic.c | 6 +- .../selftests/bpf/prog_tests/sockmap_ktls.c | 2 +- .../selftests/bpf/prog_tests/sockmap_listen.c | 10 +- .../selftests/bpf/prog_tests/sockopt_sk.c | 66 +- .../bpf/prog_tests/stacktrace_build_id_nmi.c | 3 +- .../selftests/bpf/prog_tests/stacktrace_map.c | 2 +- .../bpf/prog_tests/stacktrace_map_raw_tp.c | 5 +- .../selftests/bpf/prog_tests/static_linked.c | 35 + .../bpf/prog_tests/tcp_hdr_options.c | 15 +- .../selftests/bpf/prog_tests/test_bpffs.c | 4 +- .../bpf/prog_tests/test_global_funcs.c | 8 + .../selftests/bpf/prog_tests/test_overhead.c | 12 +- .../selftests/bpf/prog_tests/trace_printk.c | 25 +- .../bpf/prog_tests/trampoline_count.c | 18 +- .../selftests/bpf/prog_tests/udp_limit.c | 7 +- tools/testing/selftests/bpf/prog_tests/xdp.c | 11 +- .../selftests/bpf/prog_tests/xdp_bpf2bpf.c | 8 +- .../selftests/bpf/prog_tests/xdp_link.c | 8 +- tools/testing/selftests/bpf/progs/atomics.c | 154 + tools/testing/selftests/bpf/progs/bpf_cubic.c | 6 +- .../bpf/progs/bpf_iter_bpf_hash_map.c | 1 - .../selftests/bpf/progs/bpf_iter_bpf_map.c | 1 - .../selftests/bpf/progs/bpf_iter_ipv6_route.c | 1 - .../selftests/bpf/progs/bpf_iter_netlink.c | 1 - .../selftests/bpf/progs/bpf_iter_task.c | 1 - .../selftests/bpf/progs/bpf_iter_task_btf.c | 1 - .../selftests/bpf/progs/bpf_iter_task_file.c | 1 - .../selftests/bpf/progs/bpf_iter_task_stack.c | 1 - .../selftests/bpf/progs/bpf_iter_tcp4.c | 1 - .../selftests/bpf/progs/bpf_iter_tcp6.c | 1 - .../selftests/bpf/progs/bpf_iter_test_kern4.c | 4 +- .../selftests/bpf/progs/bpf_iter_udp4.c | 1 - .../selftests/bpf/progs/bpf_iter_udp6.c | 1 - tools/testing/selftests/bpf/progs/core_kern.c | 104 + .../selftests/bpf/progs/core_reloc_types.h | 17 + tools/testing/selftests/bpf/progs/kfree_skb.c | 4 +- .../selftests/bpf/progs/kfunc_call_test.c | 47 + .../bpf/progs/kfunc_call_test_subprog.c | 42 + tools/testing/selftests/bpf/progs/lsm.c | 69 + .../selftests/bpf/progs/map_ptr_kern.c | 20 +- tools/testing/selftests/bpf/progs/recursion.c | 46 + .../testing/selftests/bpf/progs/sockopt_sk.c | 11 +- tools/testing/selftests/bpf/progs/tailcall3.c | 2 +- tools/testing/selftests/bpf/progs/tailcall4.c | 2 +- tools/testing/selftests/bpf/progs/tailcall5.c | 2 +- .../selftests/bpf/progs/tailcall_bpf2bpf2.c | 2 +- .../selftests/bpf/progs/tailcall_bpf2bpf4.c | 2 +- .../selftests/bpf/progs/test_cls_redirect.c | 4 +- .../bpf/progs/test_core_read_macros.c | 50 + .../bpf/progs/test_core_reloc_module.c | 96 + .../selftests/bpf/progs/test_global_func10.c | 29 + .../selftests/bpf/progs/test_global_func11.c | 19 + .../selftests/bpf/progs/test_global_func12.c | 21 + .../selftests/bpf/progs/test_global_func13.c | 24 + .../selftests/bpf/progs/test_global_func14.c | 21 + .../selftests/bpf/progs/test_global_func15.c | 22 + .../selftests/bpf/progs/test_global_func16.c | 22 + .../selftests/bpf/progs/test_global_func9.c | 132 + .../bpf/progs/test_global_func_args.c | 91 + .../selftests/bpf/progs/test_ksyms_module.c | 50 + .../selftests/bpf/progs/test_ksyms_weak.c | 56 + .../bpf/progs/test_map_in_map_invalid.c | 26 + tools/testing/selftests/bpf/progs/test_mmap.c | 2 - .../selftests/bpf/progs/test_rdonly_maps.c | 6 +- .../selftests/bpf/progs/test_ringbuf.c | 5 +- .../selftests/bpf/progs/test_ringbuf_multi.c | 1 - .../selftests/bpf/progs/test_skeleton.c | 20 +- .../selftests/bpf/progs/test_sockmap_listen.c | 2 +- .../selftests/bpf/progs/test_static_linked1.c | 30 + .../selftests/bpf/progs/test_static_linked2.c | 31 + .../selftests/bpf/progs/test_subprogs.c | 13 + .../selftests/bpf/progs/test_verif_scale2.c | 4 +- .../selftests/bpf/progs/trace_printk.c | 6 +- .../selftests/bpf/test_bpftool_build.sh | 4 + .../selftests/bpf/test_cgroup_storage.c | 2 +- tools/testing/selftests/bpf/test_maps.c | 231 +- tools/testing/selftests/bpf/test_progs.c | 79 +- tools/testing/selftests/bpf/test_progs.h | 83 +- .../selftests/bpf/test_tcpnotify_user.c | 7 +- tools/testing/selftests/bpf/test_verifier.c | 103 +- .../selftests/bpf/verifier/atomic_and.c | 77 + .../selftests/bpf/verifier/atomic_cmpxchg.c | 96 + .../selftests/bpf/verifier/atomic_fetch_add.c | 106 + .../selftests/bpf/verifier/atomic_or.c | 77 + .../selftests/bpf/verifier/atomic_xchg.c | 46 + .../selftests/bpf/verifier/atomic_xor.c | 77 + tools/testing/selftests/bpf/verifier/calls.c | 35 +- tools/testing/selftests/bpf/verifier/ctx.c | 7 +- .../selftests/bpf/verifier/dead_code.c | 10 +- .../bpf/verifier/direct_packet_access.c | 4 +- tools/testing/selftests/bpf/verifier/jit.c | 24 + .../testing/selftests/bpf/verifier/leak_ptr.c | 10 +- .../selftests/bpf/verifier/meta_access.c | 4 +- tools/testing/selftests/bpf/verifier/unpriv.c | 3 +- .../bpf/verifier/value_illegal_alu.c | 2 +- tools/testing/selftests/bpf/verifier/xadd.c | 18 +- tools/testing/selftests/tc-testing/Makefile | 3 +- 294 files changed, 25168 insertions(+), 6337 deletions(-) create mode 100644 include/linux/bpfptr.h create mode 100644 tools/lib/bpf/bpf_gen_internal.h create mode 100644 tools/lib/bpf/gen_loader.c create mode 100644 tools/lib/bpf/libbpf_legacy.h create mode 100644 tools/lib/bpf/libbpf_version.h create mode 100644 tools/lib/bpf/linker.c create mode 100644 tools/lib/bpf/relo_core.c create mode 100644 tools/lib/bpf/relo_core.h create mode 100644 tools/lib/bpf/skel_internal.h create mode 100644 tools/lib/bpf/strset.c create mode 100644 tools/lib/bpf/strset.h create mode 100644 tools/perf/util/bpf_counter.c create mode 100644 tools/perf/util/bpf_counter.h create mode 100644 tools/perf/util/bpf_skel/.gitignore create mode 100644 tools/perf/util/bpf_skel/bpf_prog_profiler.bpf.c create mode 100644 tools/testing/selftests/bpf/bpf_testmod/.gitignore create mode 100644 tools/testing/selftests/bpf/bpf_testmod/Makefile create mode 100644 tools/testing/selftests/bpf/bpf_testmod/bpf_testmod-events.h create mode 100644 tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.c create mode 100644 tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.h create mode 100644 tools/testing/selftests/bpf/btf_helpers.c create mode 100644 tools/testing/selftests/bpf/btf_helpers.h create mode 100644 tools/testing/selftests/bpf/prog_tests/atomics.c create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_dedup_split.c create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_split.c create mode 100644 tools/testing/selftests/bpf/prog_tests/core_kern.c create mode 100644 tools/testing/selftests/bpf/prog_tests/core_read_macros.c create mode 100644 tools/testing/selftests/bpf/prog_tests/global_func_args.c create mode 100644 tools/testing/selftests/bpf/prog_tests/kfunc_call.c create mode 100644 tools/testing/selftests/bpf/prog_tests/ksyms_module.c create mode 100644 tools/testing/selftests/bpf/prog_tests/recursion.c create mode 100644 tools/testing/selftests/bpf/prog_tests/static_linked.c create mode 100644 tools/testing/selftests/bpf/progs/atomics.c create mode 100644 tools/testing/selftests/bpf/progs/core_kern.c create mode 100644 tools/testing/selftests/bpf/progs/kfunc_call_test.c create mode 100644 tools/testing/selftests/bpf/progs/kfunc_call_test_subprog.c create mode 100644 tools/testing/selftests/bpf/progs/recursion.c create mode 100644 tools/testing/selftests/bpf/progs/test_core_read_macros.c create mode 100644 tools/testing/selftests/bpf/progs/test_core_reloc_module.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func10.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func11.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func12.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func13.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func14.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func15.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func16.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func9.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func_args.c create mode 100644 tools/testing/selftests/bpf/progs/test_ksyms_module.c create mode 100644 tools/testing/selftests/bpf/progs/test_ksyms_weak.c create mode 100644 tools/testing/selftests/bpf/progs/test_map_in_map_invalid.c create mode 100644 tools/testing/selftests/bpf/progs/test_static_linked1.c create mode 100644 tools/testing/selftests/bpf/progs/test_static_linked2.c create mode 100644 tools/testing/selftests/bpf/verifier/atomic_and.c create mode 100644 tools/testing/selftests/bpf/verifier/atomic_cmpxchg.c create mode 100644 tools/testing/selftests/bpf/verifier/atomic_fetch_add.c create mode 100644 tools/testing/selftests/bpf/verifier/atomic_or.c create mode 100644 tools/testing/selftests/bpf/verifier/atomic_xchg.c create mode 100644 tools/testing/selftests/bpf/verifier/atomic_xor.c -- 2.20.1

1 391

[PATCH openEuler-1.0-LTS 1/2] netfilter: nf_tables: do not allow SET_ID to refer to another table
by Yongqiang Liu 23 Aug '22

23 Aug '22

From: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> mainline inclusion from mainline-v6.0-rc1 commit 470ee20e069a6d05ae549f7d0ef2bdbcee6a81b2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5MEZD CVE: CVE-2022-2586 -------------------------------- When doing lookups for sets on the same batch by using its ID, a set from a different table can be used. Then, when the table is removed, a reference to the set may be kept after the set is freed, leading to a potential use-after-free. When looking for sets by ID, use the table that was used for the lookup by name, and only return sets belonging to that same table. This fixes CVE-2022-2586, also reported as ZDI-CAN-17470. Reported-by: Team Orca of Sea Security (@seasecresponse) Fixes: 958bee14d071 ("netfilter: nf_tables: use new transaction infrastructure to handle sets") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> conflict: net/netfilter/nf_tables_api.c Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/netfilter/nf_tables_api.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index c857c77bd727..ea9039ee8098 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -3039,6 +3039,7 @@ static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table, } static struct nft_set *nft_set_lookup_byid(const struct net *net, + const struct nft_table *table, const struct nlattr *nla, u8 genmask) { struct nft_trans *trans; @@ -3049,6 +3050,7 @@ static struct nft_set *nft_set_lookup_byid(const struct net *net, struct nft_set *set = nft_trans_set(trans); if (id == nft_trans_set_id(trans) && + set->table == table && nft_active_genmask(set, genmask)) return set; } @@ -3069,7 +3071,7 @@ struct nft_set *nft_set_lookup_global(const struct net *net, if (!nla_set_id) return set; - set = nft_set_lookup_byid(net, nla_set_id, genmask); + set = nft_set_lookup_byid(net, table, nla_set_id, genmask); } return set; } -- 2.25.1

1 1

[PATCH openEuler-22.09 v4 00/21] scheduler BPF: preempt, pick next task, select core and samples
by Zheng Zengkai 22 Aug '22

22 Aug '22

This patchset aims to introduce tag mechanism, that is, the tag field is added to struct task_struct and struct task_group. Users can use the file system interface to mark different tags for specific workloads. Other kernel subsystem can use the helper function to set different tags for workloads. The sched bpf prog obtains the tags to detect different workloads. It also aims to add new BPF hooks to the schduler in select_task_rq_fair() and entity_before() which use to impact the "select rq" and "pick next task" process. The helper functions is also added to obtanin kernel state like cpu statistics and cpu topology. In addition to that, there are cpumask ops helpers collection, a lib for sched bpf prog, and the samples. Chen Hui (11): sched: programmable: Add a tag for the task group sched: programmable: Add user interface of task group tag sched: programmable: Add a tag for the task sched: programmable: Add user interface of task tag sched: programmable: add bpf_sched_task_tag_of helper function sched: programmable: Add convenient helper functions to convert sched entity samples/bpf: Update bpf loader for sched section names bpf: sched: Add four helper functions to get cpu stat bpf:programmable: Add cpumask ops collection sched: programmable: Add lib for sched programmable sched: programmable: Add three hooks in select_task_rq_fair() Guan Jing (2): sched: programmable: Add hook for pick next task samples: bpf: Add bpf sched pick task sample Hui Tang (3): bpf:programmable: Add helper func to check cpu share cache bpf:programmable: Add helper func to set cpus_ptr in task samples:bpf: Add samples for cfs select core Ren Zhijie (5): sched: programmable: Fix sched bpf hook cfs_check_preempt_tick sched: programmable: add bpf_sched_tg_tag_of helper function samples: bpf: Add bpf sched preempt sample program sched: programmable: Add helpers to set tag of task or task_group sched: programmable: Add helper function for cpu topology. fs/proc/base.c | 65 ++++ include/linux/bpf_topology.h | 46 +++ include/linux/sched.h | 85 +++++ include/linux/sched_hook_defs.h | 5 + include/uapi/linux/bpf.h | 151 +++++++++ init/init_task.c | 3 + kernel/bpf/helpers.c | 12 + kernel/bpf/verifier.c | 4 +- kernel/sched/Makefile | 3 +- kernel/sched/bpf_sched.c | 436 ++++++++++++++++++++++++ kernel/sched/bpf_topology.c | 97 ++++++ kernel/sched/core.c | 103 ++++++ kernel/sched/fair.c | 64 +++- kernel/sched/sched.h | 8 + samples/bpf/Makefile | 9 + samples/bpf/bpf_load.c | 8 +- samples/bpf/sched_pick_task_kern.c | 56 ++++ samples/bpf/sched_pick_task_user.c | 94 ++++++ samples/bpf/sched_preempt_kern.c | 147 +++++++++ samples/bpf/sched_preempt_user.c | 140 ++++++++ samples/bpf/sched_select_core_kern.c | 259 +++++++++++++++ samples/bpf/sched_select_core_user.c | 125 +++++++ scripts/bpf_helpers_doc.py | 20 ++ tools/include/uapi/linux/bpf.h | 151 +++++++++ tools/lib/bpf/libbpf_sched.h | 473 +++++++++++++++++++++++++++ 25 files changed, 2558 insertions(+), 6 deletions(-) create mode 100644 include/linux/bpf_topology.h create mode 100644 kernel/sched/bpf_topology.c create mode 100644 samples/bpf/sched_pick_task_kern.c create mode 100644 samples/bpf/sched_pick_task_user.c create mode 100644 samples/bpf/sched_preempt_kern.c create mode 100644 samples/bpf/sched_preempt_user.c create mode 100644 samples/bpf/sched_select_core_kern.c create mode 100644 samples/bpf/sched_select_core_user.c create mode 100644 tools/lib/bpf/libbpf_sched.h -- 2.33.0

1 21

[PATCH openEuler-1.0-LTS 1/2] x86/speculation: Add RSB VM Exit protections
by Yongqiang Liu 19 Aug '22

19 Aug '22

From: Daniel Sneddon <daniel.sneddon(a)linux.intel.com> stable inclusion from stable-v4.19.255 commit b6c5011934a15762cd694e36fe74f2f2f93eac9b category: bugfix bugzilla: 187492, https://gitee.com/src-openeuler/kernel/issues/I5N1SO CVE: CVE-2022-26373 -------------------------------- commit 2b1299322016731d56807aa49254a5ea3080b6b3 upstream. tl;dr: The Enhanced IBRS mitigation for Spectre v2 does not work as documented for RET instructions after VM exits. Mitigate it with a new one-entry RSB stuffing mechanism and a new LFENCE. == Background == Indirect Branch Restricted Speculation (IBRS) was designed to help mitigate Branch Target Injection and Speculative Store Bypass, i.e. Spectre, attacks. IBRS prevents software run in less privileged modes from affecting branch prediction in more privileged modes. IBRS requires the MSR to be written on every privilege level change. To overcome some of the performance issues of IBRS, Enhanced IBRS was introduced. eIBRS is an "always on" IBRS, in other words, just turn it on once instead of writing the MSR on every privilege level change. When eIBRS is enabled, more privileged modes should be protected from less privileged modes, including protecting VMMs from guests. == Problem == Here's a simplification of how guests are run on Linux' KVM: void run_kvm_guest(void) { // Prepare to run guest VMRESUME(); // Clean up after guest runs } The execution flow for that would look something like this to the processor: 1. Host-side: call run_kvm_guest() 2. Host-side: VMRESUME 3. Guest runs, does "CALL guest_function" 4. VM exit, host runs again 5. Host might make some "cleanup" function calls 6. Host-side: RET from run_kvm_guest() Now, when back on the host, there are a couple of possible scenarios of post-guest activity the host needs to do before executing host code: * on pre-eIBRS hardware (legacy IBRS, or nothing at all), the RSB is not touched and Linux has to do a 32-entry stuffing. * on eIBRS hardware, VM exit with IBRS enabled, or restoring the host IBRS=1 shortly after VM exit, has a documented side effect of flushing the RSB except in this PBRSB situation where the software needs to stuff the last RSB entry "by hand". IOW, with eIBRS supported, host RET instructions should no longer be influenced by guest behavior after the host retires a single CALL instruction. However, if the RET instructions are "unbalanced" with CALLs after a VM exit as is the RET in #6, it might speculatively use the address for the instruction after the CALL in #3 as an RSB prediction. This is a problem since the (untrusted) guest controls this address. Balanced CALL/RET instruction pairs such as in step #5 are not affected. == Solution == The PBRSB issue affects a wide variety of Intel processors which support eIBRS. But not all of them need mitigation. Today, X86_FEATURE_RETPOLINE triggers an RSB filling sequence that mitigates PBRSB. Systems setting RETPOLINE need no further mitigation - i.e., eIBRS systems which enable retpoline explicitly. However, such systems (X86_FEATURE_IBRS_ENHANCED) do not set RETPOLINE and most of them need a new mitigation. Therefore, introduce a new feature flag X86_FEATURE_RSB_VMEXIT_LITE which triggers a lighter-weight PBRSB mitigation versus RSB Filling at vmexit. The lighter-weight mitigation performs a CALL instruction which is immediately followed by a speculative execution barrier (INT3). This steers speculative execution to the barrier -- just like a retpoline -- which ensures that speculation can never reach an unbalanced RET. Then, ensure this CALL is retired before continuing execution with an LFENCE. In other words, the window of exposure is opened at VM exit where RET behavior is troublesome. While the window is open, force RSB predictions sampling for RET targets to a dead end at the INT3. Close the window with the LFENCE. There is a subset of eIBRS systems which are not vulnerable to PBRSB. Add these systems to the cpu_vuln_whitelist[] as NO_EIBRS_PBRSB. Future systems that aren't vulnerable will set ARCH_CAP_PBRSB_NO. [ bp: Massage, incorporate review comments from Andy Cooper. ] [ Pawan: Update commit message to replace RSB_VMEXIT with RETPOLINE ] Signed-off-by: Daniel Sneddon <daniel.sneddon(a)linux.intel.com> Co-developed-by: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> Signed-off-by: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> Signed-off-by: Borislav Petkov <bp(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> conflict: arch/x86/include/asm/cpufeatures.h arch/x86/kernel/cpu/common.c Signed-off-by: Chen Jiahao <chenjiahao16(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Reviewed-by: Liao Chang <liaochang1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- Documentation/admin-guide/hw-vuln/spectre.rst | 8 +++ arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/msr-index.h | 4 ++ arch/x86/include/asm/nospec-branch.h | 15 +++++ arch/x86/kernel/cpu/bugs.c | 61 ++++++++++++++++++- arch/x86/kernel/cpu/common.c | 12 +++- arch/x86/kvm/vmx.c | 6 +- 7 files changed, 102 insertions(+), 6 deletions(-) diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst index 3a6e1fcad3c0..a4cb79d0dd57 100644 --- a/Documentation/admin-guide/hw-vuln/spectre.rst +++ b/Documentation/admin-guide/hw-vuln/spectre.rst @@ -422,6 +422,14 @@ The possible values in this file are: 'RSB filling' Protection of RSB on context switch enabled ============= =========================================== + - EIBRS Post-barrier Return Stack Buffer (PBRSB) protection status: + + =========================== ======================================================= + 'PBRSB-eIBRS: SW sequence' CPU is affected and protection of RSB on VMEXIT enabled + 'PBRSB-eIBRS: Vulnerable' CPU is vulnerable + 'PBRSB-eIBRS: Not affected' CPU is not affected by PBRSB + =========================== ======================================================= + Full mitigation might require a microcode update from the CPU vendor. When the necessary microcode is not available, the kernel will report vulnerability. diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h index 249cd7a5ade5..46f860f8ea25 100644 --- a/arch/x86/include/asm/cpufeatures.h +++ b/arch/x86/include/asm/cpufeatures.h @@ -304,6 +304,7 @@ #define X86_FEATURE_CQM_MBM_LOCAL (11*32+ 3) /* LLC Local MBM monitoring */ #define X86_FEATURE_FENCE_SWAPGS_USER (11*32+ 4) /* "" LFENCE in user entry SWAPGS path */ #define X86_FEATURE_FENCE_SWAPGS_KERNEL (11*32+ 5) /* "" LFENCE in kernel entry SWAPGS path */ +#define X86_FEATURE_RSB_VMEXIT_LITE (11*32+ 6) /* "" Fill RSB on VM exit when EIBRS is enabled */ /* Intel-defined CPU features, CPUID level 0x00000007:1 (EAX), word 12 */ #define X86_FEATURE_AVX512_BF16 (12*32+ 5) /* AVX512 BFLOAT16 instructions */ @@ -421,5 +422,6 @@ #define X86_BUG_ITLB_MULTIHIT X86_BUG(23) /* CPU may incur MCE during certain page attribute changes */ #define X86_BUG_SRBDS X86_BUG(24) /* CPU may leak RNG bits if not mitigated */ #define X86_BUG_MMIO_STALE_DATA X86_BUG(25) /* CPU is affected by Processor MMIO Stale Data vulnerabilities */ +#define X86_BUG_EIBRS_PBRSB X86_BUG(26) /* EIBRS is vulnerable to Post Barrier RSB Predictions */ #endif /* _ASM_X86_CPUFEATURES_H */ diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h index a29505c3d14d..8688bd4a5e89 100644 --- a/arch/x86/include/asm/msr-index.h +++ b/arch/x86/include/asm/msr-index.h @@ -120,6 +120,10 @@ * bit available to control VERW * behavior. */ +#define ARCH_CAP_PBRSB_NO BIT(24) /* + * Not susceptible to Post-Barrier + * Return Stack Buffer Predictions. + */ #define MSR_IA32_FLUSH_CMD 0x0000010b #define L1D_FLUSH BIT(0) /* diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h index 0a8214895698..1f2a6f183d18 100644 --- a/arch/x86/include/asm/nospec-branch.h +++ b/arch/x86/include/asm/nospec-branch.h @@ -54,6 +54,14 @@ jnz 771b; \ add $(BITS_PER_LONG/8) * nr, sp; +/* Sequence to mitigate PBRSB on eIBRS CPUs */ +#define __ISSUE_UNBALANCED_RET_GUARD(sp) \ + call 881f; \ + int3; \ +881: \ + add $(BITS_PER_LONG/8), sp; \ + lfence; + #ifdef __ASSEMBLY__ /* @@ -269,6 +277,13 @@ static inline void vmexit_fill_RSB(void) : "=r" (loops), ASM_CALL_CONSTRAINT : : "memory" ); #endif + asm volatile (ANNOTATE_NOSPEC_ALTERNATIVE + ALTERNATIVE("jmp 920f", + __stringify(__ISSUE_UNBALANCED_RET_GUARD(%0)), + X86_FEATURE_RSB_VMEXIT_LITE) + "920:" + : ASM_CALL_CONSTRAINT + : : "memory" ); } static __always_inline diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index 32cd95cc8eab..3ba948bbd77d 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -1043,6 +1043,49 @@ static enum spectre_v2_mitigation __init spectre_v2_select_retpoline(void) return SPECTRE_V2_RETPOLINE; } +static void __init spectre_v2_determine_rsb_fill_type_at_vmexit(enum spectre_v2_mitigation mode) +{ + /* + * Similar to context switches, there are two types of RSB attacks + * after VM exit: + * + * 1) RSB underflow + * + * 2) Poisoned RSB entry + * + * When retpoline is enabled, both are mitigated by filling/clearing + * the RSB. + * + * When IBRS is enabled, while #1 would be mitigated by the IBRS branch + * prediction isolation protections, RSB still needs to be cleared + * because of #2. Note that SMEP provides no protection here, unlike + * user-space-poisoned RSB entries. + * + * eIBRS should protect against RSB poisoning, but if the EIBRS_PBRSB + * bug is present then a LITE version of RSB protection is required, + * just a single call needs to retire before a RET is executed. + */ + switch (mode) { + case SPECTRE_V2_NONE: + /* These modes already fill RSB at vmexit */ + case SPECTRE_V2_LFENCE: + case SPECTRE_V2_RETPOLINE: + case SPECTRE_V2_EIBRS_RETPOLINE: + return; + + case SPECTRE_V2_EIBRS_LFENCE: + case SPECTRE_V2_EIBRS: + if (boot_cpu_has_bug(X86_BUG_EIBRS_PBRSB)) { + setup_force_cpu_cap(X86_FEATURE_RSB_VMEXIT_LITE); + pr_info("Spectre v2 / PBRSB-eIBRS: Retire a single CALL on VMEXIT\n"); + } + return; + } + + pr_warn_once("Unknown Spectre v2 mode, disabling RSB mitigation at VM exit"); + dump_stack(); +} + static void __init spectre_v2_select_mitigation(void) { enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline(); @@ -1135,6 +1178,8 @@ static void __init spectre_v2_select_mitigation(void) setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW); pr_info("Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch\n"); + spectre_v2_determine_rsb_fill_type_at_vmexit(mode); + /* * Retpoline means the kernel is safe because it has no indirect * branches. Enhanced IBRS protects firmware too, so, enable restricted @@ -1854,6 +1899,19 @@ static char *ibpb_state(void) return ""; } +static char *pbrsb_eibrs_state(void) +{ + if (boot_cpu_has_bug(X86_BUG_EIBRS_PBRSB)) { + if (boot_cpu_has(X86_FEATURE_RSB_VMEXIT_LITE) || + boot_cpu_has(X86_FEATURE_RETPOLINE)) + return ", PBRSB-eIBRS: SW sequence"; + else + return ", PBRSB-eIBRS: Vulnerable"; + } else { + return ", PBRSB-eIBRS: Not affected"; + } +} + static ssize_t spectre_v2_show_state(char *buf) { if (spectre_v2_enabled == SPECTRE_V2_LFENCE) @@ -1866,12 +1924,13 @@ static ssize_t spectre_v2_show_state(char *buf) spectre_v2_enabled == SPECTRE_V2_EIBRS_LFENCE) return sprintf(buf, "Vulnerable: eIBRS+LFENCE with unprivileged eBPF and SMT\n"); - return sprintf(buf, "%s%s%s%s%s%s\n", + return sprintf(buf, "%s%s%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled], ibpb_state(), boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "", stibp_state(), boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "", + pbrsb_eibrs_state(), spectre_v2_module_string()); } diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index a6099acc9a94..d457c46ac0a4 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -1032,6 +1032,7 @@ static void identify_cpu_without_cpuid(struct cpuinfo_x86 *c) #define NO_SWAPGS BIT(6) #define NO_ITLB_MULTIHIT BIT(7) #define NO_SPECTRE_V2 BIT(8) +#define NO_EIBRS_PBRSB BIT(9) #define VULNWL(_vendor, _family, _model, _whitelist) \ { X86_VENDOR_##_vendor, _family, _model, X86_FEATURE_ANY, _whitelist } @@ -1071,7 +1072,7 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = { VULNWL_INTEL(ATOM_GOLDMONT, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT), VULNWL_INTEL(ATOM_GOLDMONT_X, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT), - VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT), + VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_EIBRS_PBRSB), /* * Technically, swapgs isn't serializing on AMD (despite it previously @@ -1081,7 +1082,9 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = { * good enough for our purposes. */ - VULNWL_INTEL(ATOM_TREMONT_X, NO_ITLB_MULTIHIT), + VULNWL_INTEL(ATOM_TREMONT, NO_EIBRS_PBRSB), + VULNWL_INTEL(ATOM_TREMONT_L, NO_EIBRS_PBRSB), + VULNWL_INTEL(ATOM_TREMONT_X, NO_ITLB_MULTIHIT | NO_EIBRS_PBRSB), /* AMD Family 0xf - 0x12 */ VULNWL_AMD(0x0f, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT), @@ -1242,6 +1245,11 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c) !arch_cap_mmio_immune(ia32_cap)) setup_force_cpu_bug(X86_BUG_MMIO_STALE_DATA); + if (cpu_has(c, X86_FEATURE_IBRS_ENHANCED) && + !cpu_matches(cpu_vuln_whitelist, NO_EIBRS_PBRSB) && + !(ia32_cap & ARCH_CAP_PBRSB_NO)) + setup_force_cpu_bug(X86_BUG_EIBRS_PBRSB); + if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN)) return; diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index 1869d1c4dcd0..7ab18b5a8e96 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -11008,6 +11008,9 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) #endif ); + /* Eliminate branch target predictions from guest mode */ + vmexit_fill_RSB(); + vmx_enable_fb_clear(vmx); /* @@ -11030,9 +11033,6 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) x86_spec_ctrl_restore_host(vmx->spec_ctrl, 0); - /* Eliminate branch target predictions from guest mode */ - vmexit_fill_RSB(); - /* All fields are clean at this point */ if (static_branch_unlikely(&enable_evmcs)) current_evmcs->hv_clean_fields |= -- 2.25.1

1 1

[PATCH openEuler-22.09 v4 0/3] Add sample BMC for Redis
by Zheng Zengkai 18 Aug '22

18 Aug '22

BMC is an in-kernel key-value cache implemented in BPF and proposed by paper [1]. The paper discussed BMC for memcached, obtaining at least 6x performance speedup. This patchset implements a sample BMC for Redis. [1] https://www.usenix.org/conference/nsdi21/presentation/ghigoff v4: - Rebase v3: - Fix build warning v2: - Reimplement in XDP Xu Kuohai (3): bpf: Add helper bpf_tcp_udpate_seq to synchronize tcp seq/ack bpf: Add xdp load and store helpers samples: bpf: Add sample BMC for Redis include/uapi/linux/bpf.h | 27 ++ net/core/filter.c | 98 +++++ samples/bpf/Makefile | 3 + samples/bpf/bmc/bpf.c | 485 +++++++++++++++++++++ samples/bpf/bmc/common.h | 21 + samples/bpf/bmc/tool.c | 763 +++++++++++++++++++++++++++++++++ tools/include/uapi/linux/bpf.h | 27 ++ 7 files changed, 1424 insertions(+) create mode 100644 samples/bpf/bmc/bpf.c create mode 100644 samples/bpf/bmc/common.h create mode 100644 samples/bpf/bmc/tool.c -- 2.20.1

1 3

20.03 LTS SP3不支持Intel 第十代Core I CPU i7-10700 集成核心显卡Intel® UHD Graphics 630
by zhuxbin 18 Aug '22

18 Aug '22

您好 Intel 第十代Core I CPU i7-10700 集成核心显卡Intel® UHD Graphics 630 安装openeuler 20.03 LTS SP3,图形界面安装UKUI，OS内核 linux 4.19.90-2206.3.0.0155.oel.x86_64 。外接DELL, ASUS, LG等多个不同厂商主流商用显示器，发现显示器型号不能识别，显示分辨率无法调节，安装OpenEuler21.09 图形界面UKUI,kernel版本5.10可以正常识别显示器型号，可以调整显示分辨率。请问openeuler 20.03 LTS SP3是否支持Intel® UHD Graphics 630显卡，是否有解决方案，盼复，谢谢！

1 0

openEuler Kernel SIG例会
by openEuler conference 18 Aug '22

18 Aug '22

您好！ Kernel SIG 邀请您参加 2022-08-19 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG例会会议内容： 1.arm64: add machine check safe support特性回合评审,PR78； 2.Add memory reliable feature特性回合评审,PR79；会议链接：https://us06web.zoom.us/j/88345524477?pwd=WHAvcmcza0JnY1JhekNVdUJzUE04UT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-08-19 14:00, The subject of the conference is openEuler Kernel SIG例会, Summary: 1.arm64: add machine check safe support特性回合评审,PR78； 2.Add memory reliable feature特性回合评审,PR79； You can join the meeting at https://us06web.zoom.us/j/88345524477?pwd=WHAvcmcza0JnY1JhekNVdUJzUE04UT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH] Add description of openEuler kernel header format
by Zheng Zengkai 18 Aug '22

18 Aug '22

This patch list and descript typical openEuler kernel header format. Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- openeuler_patch_header.lg | 178 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 178 insertions(+) create mode 100644 openeuler_patch_header.lg diff --git a/openeuler_patch_header.lg b/openeuler_patch_header.lg new file mode 100644 index 000000000000..a874d140cd1c --- /dev/null +++ b/openeuler_patch_header.lg @@ -0,0 +1,178 @@ +Patch format definition + +[M] stands for “mandatory” +[O] stands for “option” +$category can be: bug preparation, bugfix, perf, feature, doc, other… + +If category is feature, then we also need to add feature name like below: +category: feature +feature: YYY (the feature name) + +If the patch is related to gitee issue, then we need add the corresponding tag +like below. +for example: +bugzilla: https://gitee.com/openeuler/kernel/issues/I4OM1C + +Additional changelog should include at least one of the flollwing: +1) Why we should apply this patch +2) What real problem in product does this patch resolved +3) How could we reproduce this bug or how to test +4) Other useful information for help to understand this patch or problem + +The detail information is very useful for porting patch to another kenrel +branch. + +stable patch header format: + +origin patch title + +stable inclusion [M] +from $stable-version [M] +commit $id [M] +category: $category [M] +bugzilla: $gitee-issue-url [M] +CVE: $cve-id or NA [O] + +Reference: patch URLs + +additional changelog [O] + +------------------------------------------ + +original changelog + +Signed-off-by: $author $name(a)huawei.com [M] + +($stable-version would be stable-4.19.110, stable-4.19.111, etc… +$id would be stable commit) + +mainline patch header format: + +origin patch title + +mainline inclusion [M] +from $mainline-version [M] +commit $id [M] +category: $category [M] +bugzilla: $gitee-issue-url [M] +CVE: $cve-id or NA [M] + +Reference: patch URLs + +additional changelog [O] + +------------------------------------------- + +original changelog + +Signed-off-by: $author $name(a)huawei.com [M] + +($mainline-version could be mainline-5.5, mainline-5.6, etc…) + +HULK patch header format: + +origin patch title + +hulk inclusion [M] +category: $category [M] +bugzilla: $gitee-issue-url [M] +CVE: $cve-id or NA [M] + +------------------------------------------ + +changelog + +Signed-off-by: $author $name(a)huawei.com [M] + +distribution patch header format: + +origin patch title + +dist inclusion [M] +from $dist-version [M] +commit $id [O] +category: $category [O] +bugzilla: $gitee-issue-url [O] + +additional changelog [O] + +----------------------------------------- + +original changelog + +Signed-off-by: $author $name(a)huawei.com [M] + +($dist-version could be centos-7.5, centos-7.7, etc…) + +EulerOS patch header format: + +origin patch title + +euleros inclusion [M] +category: $category [M] +bugzilla: $gitee-issue-url [O] + +---------------------------------------- + +changelog + +Signed-off-by: $author $name(a)huawei.com [M] + +Driver patch header format: + +origin patch title + +driver inclusion [M] +category: $category [M] +bugzilla: $gitee-issue-url [O] + +additional changelog [O] + +--------------------------------------- + +original changelog + +Signed-off-by: $author $name(a)huawei.com [M] + +======== + +Examples + +mm: introduce memmap_alloc() to unify memory map allocation + +mainline inclusion +from mainline-v5.15-rc1 +commit c803b3c8b3b70f306ee6300bf8acdd70ffd1441a +category: bugfix +bugzilla: 186414, https://gitee.com/openeuler/kernel/issues/I5K7IY +CVE: NA + +Reference: +https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c803b3c8b3b70f306ee6300bf8acdd70ffd1441a + +-------------------------------- + +There are several places that allocate memory for the memory map: +alloc_node_mem_map() for FLATMEM, sparse_buffer_init() and +__populate_section_memmap() for SPARSEMEM. + +The memory allocated in the FLATMEM case is zeroed and it is never +poisoned, regardless of CONFIG_PAGE_POISON setting. + +The memory allocated in the SPARSEMEM cases is not zeroed and it is +implicitly poisoned inside memblock if CONFIG_PAGE_POISON is set. + +Introduce memmap_alloc() wrapper for memblock allocators that will be used +for both FLATMEM and SPARSEMEM cases and will makei memory map zeroing and +poisoning consistent for different memory models. + +Link: https://lkml.kernel.org/r/20210714123739.16493-4-rppt@kernel.org +Signed-off-by: Mike Rapoport <rppt(a)linux.ibm.com> +Cc: Michal Simek <monstr(a)monstr.eu> +Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> +Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> +Conflicts: + mm/page_alloc.c +Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> +Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> +Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> -- 2.20.1

1 0

[PATCH openEuler-1.0-LTS] Revert "blk-mq: fix null pointer dereference in blk_mq_queue_tag_busy_ite"
by Yongqiang Liu 18 Aug '22

18 Aug '22

From: Li Nan <linan122(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187497, https://gitee.com/openeuler/kernel/issues/I5MT95 CVE: NA -------------------------------- This reverts commit 64ba823fd4272f7d624bbfb4bd6e3c89aa6f423c. Commit fea9f92f1748 introduce the bug. It is a patch for performance optimization and this version doesn't have to backport it. blk_mq_queue_tag_busy_iter() won't access q->tag_set->flags or reference other fields in q that is uninitialized at present. 64ba823fd427 will make io hang for special scsi drivers(e.x. ata_piix). Revert it. Signed-off-by: Li Nan <linan122(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- block/blk-mq-tag.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c index c24802fe6ab2..bee92ab06a5e 100644 --- a/block/blk-mq-tag.c +++ b/block/blk-mq-tag.c @@ -374,13 +374,6 @@ void blk_mq_queue_tag_busy_iter(struct request_queue *q, busy_iter_fn *fn, struct blk_mq_hw_ctx *hctx; int i; - /* - * For dm, it can run here after register_disk, but the queue has not - * been initialized yet. Check QUEUE_FLAG_REGISTERED prevent null point - * access. - */ - if (!test_bit(QUEUE_FLAG_REGISTERED, &q->queue_flags)) - return; /* * __blk_mq_update_nr_hw_queues will update the nr_hw_queues and * queue_hw_ctx after freeze the queue, so we use q_usage_counter -- 2.25.1

1 0

[PATCH openEuler-22.09 00/26] bring total memory reliable features to
by Zheng Zengkai 18 Aug '22

18 Aug '22

Memory reliable feature is a memory tiering mechanism. It is based on kernel mirror feature, which splits memory into two sperate regions, mirrored(reliable) region and non-mirrored (non-reliable) region. for kernel mirror feature: allocate kernel memory from mirrored region by default allocate user memory from non-mirrored region by default non-mirrored region will be arranged into ZONE_MOVABLE. for kernel reliable feature, it has additional features below: normal user tasks never alloc memory from mirrored region with userspace apis(malloc, mmap, etc.) special user tasks will allocate memory from mirrored region by default tmpfs/pagecache allocate memory from mirrored region by default upper limit of mirrored region allcated for user tasks, tmpfs and pagecache Support Reliable fallback mechanism which allows special user tasks, tmpfs and pagecache can fallback to alloc non-mirrored region, it's the default setting. In order to fulfil the goal ___GFP_RELIABILITY flag added for alloc memory from mirrored region. the high_zoneidx for special user tasks/tmpfs/pagecache is set to ZONE_NORMAL. normal user tasks could only alloc from ZONE_MOVABLE. This patch is just the main framework, memory reliable support for special user tasks, pagecache and tmpfs has own patches. To enable this function, mirrored(reliable) memory is needed and "kernelcore=reliable" should be added to kernel parameters. Chen Wandun (4): mm: Add cmdline for the reliable memory usage of page cache proc/meminfo: Add "FileCache" item in /proc/meminfo mm: add "ReliableFileCache" item in /proc/meminfo mm: Add support for limiting the usage of reliable memory in pagecache Ma Wupeng (17): mm: Drop shmem reliable related log during startup mm: Export static key mem_reliable mm: Export mem_reliable_status() for checking memory reliable status mm: Refactor code in reliable_report_meminfo() mm: Count reliable memory info based on zone info mm: Disable memory reliable when kdump is in progress mm: Clear GFP_RELIABLE if the conditions are not met mm: thp: Add memory reliable support for hugepaged collapse mm: Add reliable memory use limit for user tasks mm: Introduce fallback mechanism for memory reliable mm: Introduce shmem mirrored memory limit for memory reliable mm: Introduce reliable_debug=S to control shmem use mirrored memory mm: Introduce proc interface to disable memory reliable features mm: Show debug info about memory reliable if oom occurs mm: Update reliable flag in memory allocaion for reliable task only in task context mm/memblock: Introduce ability to alloc memory from specify memory reigon mm/hugetlb: Hugetlb use non-mirrored memory if memory reliable is enabled Peng Wu (3): mm: Add kernel param for memory reliable mm: Add reliable_nr_page for accounting reliable memory proc: Count reliable memory usage of reliable tasks Yu Liao (1): mm: Add sysctl to clear free list pages Zhou Guanghui (1): shmem: Count and show reliable shmem info .../admin-guide/kernel-parameters.txt | 13 + Documentation/admin-guide/sysctl/vm.rst | 13 + Documentation/filesystems/proc.rst | 8 + fs/proc/task_mmu.c | 1 + include/linux/mem_reliable.h | 124 ++++- include/linux/memblock.h | 5 + include/linux/mm.h | 6 +- include/linux/mm_inline.h | 4 + include/linux/mm_types.h | 3 +- include/linux/mmzone.h | 5 + kernel/events/uprobes.c | 2 + lib/show_mem.c | 1 + mm/Kconfig | 13 + mm/Makefile | 2 + mm/clear_freelist_page.c | 187 +++++++ mm/filemap.c | 9 +- mm/huge_memory.c | 8 + mm/hugetlb.c | 17 +- mm/khugepaged.c | 34 +- mm/ksm.c | 2 + mm/mem_reliable.c | 507 ++++++++++++++++-- mm/memblock.c | 107 ++++ mm/memory.c | 12 + mm/migrate.c | 10 + mm/mmap.c | 1 + mm/page_alloc.c | 135 ++++- mm/rmap.c | 5 + mm/shmem.c | 21 +- mm/swapfile.c | 2 + mm/userfaultfd.c | 1 + mm/vmscan.c | 2 + 31 files changed, 1183 insertions(+), 77 deletions(-) create mode 100644 mm/clear_freelist_page.c -- 2.20.1

1 26

[PATCH openEuler-22.09 v2 000/391] BPF CO-RE support
by Zheng Zengkai 17 Aug '22

17 Aug '22

This set introduces CO-RE support in the kernel. There are several reasons to add such support: 1.It's a step toward signed BPF programs. 2.It allows golang like languages that struggle to adopt libbpf to take advantage of CO-RE powers. 3.Currently the field accessed by 'ldx [R1 + 10]' insn is recognized by the verifier purely based on +10 offset. If R1 points to a union the verifier picks one of the fields at this offset. With CO-RE the kernel can disambiguate the field access. Alan Maguire (5): libbpf: bpf__find_by_name[_kind] should use btf__get_nr_types() libbpf: BTF dumper support for typed data libbpf: Clarify/fix unaligned data issues for btf typed dump libbpf: Avoid use of __int128 in typed dump display libbpf: Propagate errors when retrieving enum value for typed data display Alexei Starovoitov (55): bpf: Optimize program stats bpf: Run sleepable programs with migration disabled bpf: Compute program stats for sleepable programs bpf: Add per-program recursion prevention mechanism selftest/bpf: Add a recursion test bpf: Count the number of times recursion was prevented selftests/bpf: Improve recursion selftest bpf: Allows per-cpu maps and map-in-map in sleepable programs selftests/bpf: Add a test for map-in-map and per-cpu maps in sleepable progs bpf: Clear per_cpu pointers during bpf_prog_realloc bpf: Dont allow vmlinux BTF to be used in map_create and prog_load. libbpf: Remove unused field. bpf: Introduce bpf_sys_bpf() helper and program type. bpf: Introduce bpfptr_t user/kernel pointer. bpf: Prepare bpf syscall to be used from kernel and user space. libbpf: Support for syscall program type bpf: Make btf_load command to be bpfptr_t compatible. bpf: Introduce fd_idx bpf: Add bpf_btf_find_by_name_kind() helper. bpf: Add bpf_sys_close() helper. libbpf: Change the order of data and text relocations. libbpf: Add bpf_object pointer to kernel_supports(). libbpf: Preliminary support for fd_idx libbpf: Generate loader program out of BPF ELF file. libbpf: Cleanup temp FDs when intermediate sys_bpf fails. libbpf: Introduce bpf_map__initial_value(). bpftool: Use syscall/loader program in "prog load" and "gen skeleton" command. selftests/bpf: Convert few tests to light skeleton. selftests/bpf: Convert atomics test to light skeleton. selftests/bpf: Convert test printk to use rodata. selftests/bpf: Convert test trace_printk to lskel. bpf: Add cmd alias BPF_PROG_RUN bpf: Prepare bpf_prog_put() to be called from irq context. bpf: Factor out bpf_spin_lock into helpers. libbpf: Cleanup the layering between CORE and bpf_program. libbpf: Split bpf_core_apply_relo() into bpf_program independent helper. libbpf: Move CO-RE types into relo_core.h. libbpf: Split CO-RE logic into relo_core.c. libbpf: Make gen_loader data aligned. libbpf: Replace btf__type_by_id() with btf_type_by_id(). bpf: Rename btf_member accessors. bpf: Prepare relo_core.c for kernel duty. bpf: Define enum bpf_core_relo_kind as uapi. bpf: Pass a set of bpf_core_relo-s to prog_load command. bpf: Add bpf_core_add_cands() and wire it into bpf_core_apply_relo_insn(). libbpf: Use CO-RE in the kernel in light skeleton. libbpf: Support init of inner maps in light skeleton. libbpf: Clean gen_loader's attach kind. selftests/bpf: Improve inner_map test coverage. selftests/bpf: Convert map_ptr_kern test to use light skeleton. selftests/bpf: Additional test for CO-RE in the kernel. selftests/bpf: Add CO-RE relocations to verifier scale test. libbpf: Reduce bpf_core_apply_relo_insn() stack usage. bpf: Silence purge_cand_cache build warning. libbpf: Fix gen_loader assumption on number of programs. Andrei Matei (1): libbpf: Fail early when loading programs with unspecified type Andrew Delgadillo (1): selftests/bpf: Drop the need for LLVM's llc Andrii Nakryiko (148): libbpf: Factor out common operations in BTF writing APIs selftest/bpf: Relax btf_dedup test checks libbpf: Unify and speed up BTF string deduplication libbpf: Implement basic split BTF support selftests/bpf: Add split BTF basic test selftests/bpf: Add checking of raw type dump in BTF writer APIs selftests libbpf: Support BTF dedup of split BTFs libbpf: Accomodate DWARF/compiler bug with duplicated identical arrays selftests/bpf: Add split BTF dedup selftests tools/bpftool: Add bpftool support for split BTF bpf: Add in-kernel split BTF support bpf: Assign ID to vmlinux BTF and return extra info for BTF in GET_OBJ_INFO kbuild: Build kernel module BTFs if BTF is enabled and pahole supports it bpf: Load and verify kernel module BTFs tools/bpftool: Add support for in-kernel and named BTF in `btf show` bpf: Compile out btf_parse_module() if module BTF is not enabled bpf: Sanitize BTF data pointer after module is loaded tools/bpftool: Emit name <anon> for anonymous BTFs libbpf: Add base BTF accessor tools/bpftool: Auto-detect split BTFs in common cases bpf: Keep module's btf_data_size intact after load libbpf: Add internal helper to load BTF data by FD libbpf: Refactor CO-RE relocs to not assume a single BTF object libbpf: Add kernel module BTF support for CO-RE relocations selftests/bpf: Add bpf_testmod kernel module for testing selftests/bpf: Add support for marking sub-tests as skipped selftests/bpf: Add CO-RE relocs selftest relying on kernel module BTF bpf: Remove hard-coded btf_vmlinux assumption from BPF verifier bpf: Allow to specify kernel module BTFs when attaching BPF programs libbpf: Factor out low-level BPF program loading helper libbpf: Support attachment of BPF tracing programs to kernel modules selftests/bpf: Add tp_btf CO-RE reloc test for modules kbuild: Skip module BTF generation for out-of-tree external modules selftests/bpf: fix bpf_testmod.ko recompilation logic libbpf: Support modules in bpf_program__set_attach_target() API bpf: Allow empty module BTFs libbpf: Add user-space variants of BPF_CORE_READ() family of macros libbpf: Add non-CO-RE variants of BPF_CORE_READ() macro family selftests/bpf: Add tests for user- and non-CO-RE BPF_CORE_READ() variants libbpf: Clarify kernel type use with USER variants of CORE reading macros selftests/bpf: Sync RCU before unloading bpf_testmod bpf: Support BPF ksym variables in kernel modules libbpf: Support kernel module ksym externs selftests/bpf: Test kernel module ksym externs selftests/bpf: Don't exit on failed bpf_testmod unload libbpf: Stop using feature-detection Makefiles libbpf: provide NULL and KERNEL_VERSION macros in bpf_helpers.h libbpf: Expose btf_type_by_id() internally libbpf: Generalize BTF and BTF.ext type ID and strings iteration libbpf: Rename internal memory-management helpers libbpf: Extract internal set-of-strings datastructure APIs libbpf: Add generic BTF type shallow copy API libbpf: Add BPF static linker APIs libbpf: Add BPF static linker BTF and BTF.ext support bpftool: Add ability to specify custom skeleton object name bpftool: Add `gen object` command to perform BPF static linking selftests/bpf: Pass all BPF .o's through BPF static linker selftests/bpf: Add multi-file statically linked BPF object file test libbpf: Skip BTF fixup if object file has no BTF libbpf: Constify few bpf_program getters libbpf: Preserve empty DATASEC BTFs during static linking libbpf: Fix memory leak when emitting final btf_ext libbpf: Add bpf_map__inner_map API libbpf: Suppress compiler warning when using SEC() macro with externs libbpf: Mark BPF subprogs with hidden visibility as static for BPF verifier libbpf: Allow gaps in BPF program sections to support overriden weak functions libbpf: Refactor BTF map definition parsing libbpf: Factor out symtab and relos sanity checks libbpf: Make few internal helpers available outside of libbpf.c libbpf: Extend sanity checking ELF symbols with externs validation libbpf: Tighten BTF type ID rewriting with error checking libbpf: Add linker extern resolution support for functions and global variables libbpf: Support extern resolution for BTF-defined maps in .maps section libbpf: Support BTF_KIND_FLOAT during type compatibility checks in CO-RE bpftool: Strip const/volatile/restrict modifiers from .bss and .data vars libbpf: Add per-file linker opts selftests/bpf: Stop using static variables for passing data to/from user-space bpftool: Stop emitting static variables in BPF skeleton libbpf: Fix ELF symbol visibility update logic libbpf: Treat STV_INTERNAL same as STV_HIDDEN for functions libbpf: Reject static maps libbpf: Reject static entry-point BPF programs libbpf: Add libbpf_set_strict_mode() API to turn on libbpf 1.0 behaviors libbpf: Streamline error reporting for low-level APIs libbpf: Streamline error reporting for high-level APIs bpftool: Set errno on skeleton failures and propagate errors libbpf: Move few APIs from 0.4 to 0.5 version libbpf: Refactor header installation portions of Makefile libbpf: Install skel_internal.h header used from light skeletons selftests/bpf: Add remaining ASSERT_xxx() variants libbpf: Fix build with latest gcc/binutils with LTO libbpf: Make libbpf_version.h non-auto-generated selftests/bpf: Update selftests to always provide "struct_ops" SEC libbpf: Ensure BPF prog types are set before relocations libbpf: Simplify BPF program auto-attach code libbpf: Minimize explicit iterator of section definition array libbpf: Use pre-setup sec_def in libbpf_find_attach_btf_id() selftests/bpf: Stop using relaxed_core_relocs which has no effect libbpf: Deprecated bpf_object_open_opts.relaxed_core_relocs libbpf: Allow skipping attach_func_name in bpf_program__set_attach_target() libbpf: Schedule open_opts.attach_prog_fd deprecation since v0.7 libbpf: Constify all high-level program attach APIs selftests/bpf: Turn on libbpf 1.0 mode and fix all IS_ERR checks selftests/bpf: Switch fexit_bpf2bpf selftest to set_attach_target() API libbpf: Add "tc" SEC_DEF which is a better name for "classifier" libbpf: Refactor internal sec_def handling to enable pluggability libbpf: Reduce reliance of attach_fns on sec_def internals libbpf: Add API that copies all BTF types from one BTF object to another libbpf: Deprecate btf__finalize_data() and move it into libbpf.c libbpf: Extract ELF processing state into separate struct libbpf: Use Elf64-specific types explicitly for dealing with ELF libbpf: Remove assumptions about uniqueness of .rodata/.data/.bss maps bpftool: Support multiple .rodata/.data internal maps in skeleton bpftool: Improve skeleton generation for data maps without DATASEC type libbpf: Support multiple .rodata.* and .data.* BPF maps selftests/bpf: Demonstrate use of custom .rodata/.data sections libbpf: Simplify look up by name of internal maps selftests/bpf: Switch to ".bss"/".rodata"/".data" lookups for internal maps libbpf: Fix off-by-one bug in bpf_core_apply_relo() libbpf: Add ability to fetch bpf_program's underlying instructions libbpf: Deprecate multi-instance bpf_program APIs libbpf: Deprecate ambiguously-named bpf_program__size() API libbpf: Detect corrupted ELF symbols section libbpf: Improve sanity checking during BTF fix up libbpf: Validate that .BTF and .BTF.ext sections contain data libbpf: Fix section counting logic libbpf: Improve ELF relo sanitization libbpf: Rename DECLARE_LIBBPF_OPTS into LIBBPF_OPTS selftests/bpf: Pass sanitizer flags to linker through LDFLAGS libbpf: Free up resources used by inner map definition selftests/bpf: Fix memory leaks in btf_type_c_dump() helper selftests/bpf: Free per-cpu values array in bpf_iter selftest selftests/bpf: Free inner strings index in btf selftest selftests/bpf: Avoid duplicate btf__parse() call libbpf: Load global data maps lazily on legacy kernels libbpf: Fix potential misaligned memory access in btf_ext__new() libbpf: Don't call libc APIs with NULL pointers libbpf: Fix glob_syms memory leak in bpf_linker libbpf: Fix using invalidated memory in bpf_linker selftests/bpf: Fix possible NULL passed to memcpy() with zero size selftests/bpf: Prevent misaligned memory access in get_stack_raw_tp test selftests/bpf: Fix misaligned memory access in queue_stack_map test selftests/bpf: Prevent out-of-bounds stack access in test_bpffs selftests/bpf: Fix misaligned accesses in xdp and xdp_bpf2bpf tests libbpf: Cleanup struct bpf_core_cand. libbpf: Fix non-C89 loop variable declaration in gen_loader.c selftests/bpf: Fix GCC11 compiler warnings in -O2 mode libbpf: Fix logic for finding matching program for CO-RE relocation Arnaldo Carvalho de Melo (1): libbpf: Provide GELF_ST_VISIBILITY() define for older libelf Brendan Jackman (15): tools/resolve_btfids: Fix some error messages bpf: Fix cold build of test_progs-no_alu32 bpf: Clarify return value of probe str helpers bpf: x86: Factor out emission of ModR/M for *(reg + off) bpf: x86: Factor out emission of REX byte bpf: x86: Factor out a lookup table for some ALU opcodes bpf: Rename BPF_XADD and prepare to encode other atomics in .imm bpf: Move BPF_STX reserved field check into BPF_STX verifier code bpf: Add BPF_FETCH field / create atomic_fetch_add instruction bpf: Add instructions for atomic_[cmp]xchg bpf: Pull out a macro for interpreting atomic ALU operations bpf: Add bitwise atomic instructions bpf: Add tests for new BPF atomic operations bpf: Document new atomic instructions bpf: Rename fixup_bpf_calls and add some comments Cong Wang (1): bpf: Clear percpu pointers in bpf_prog_clone_free() Daniel Xu (1): libbpf: Do not close un-owned FD 0 on errors Dave Marchevsky (1): bpf: Add verified_insns to bpf_prog_info and fdinfo Dmitrii Banshchikov (7): bpf: Rename bpf_reg_state variables bpf: Extract nullable reg type conversion into a helper function bpf: Support pointers in global func args selftests/bpf: Add unit tests for pointers in global functions bpf: Drop imprecise log message selftests/bpf: Fix a compiler warning in global func test bpf: Use MAX_BPF_FUNC_REG_ARGS macro Florent Revest (6): selftests/bpf: Fix the ASSERT_ERR_PTR macro bpf: Factorize bpf_trace_printk and bpf_seq_printf bpf: Add a ARG_PTR_TO_CONST_STR argument type bpf: Add a bpf_snprintf helper libbpf: Introduce a BPF_SNPRINTF helper macro libbpf: Move BPF_SEQ_PRINTF and BPF_SNPRINTF to bpf_helpers.h Florian Lehner (2): selftests/bpf: Print reason when a tester could not run a program selftests/bpf: Avoid errno clobbering Gary Lin (3): bpf,x64: Pad NOPs to make images converge more easily test_bpf: Remove EXPECTED_FAIL flag from bpf_fill_maxinsns11 selftests/bpf: Add verifier tests for x64 jit jump padding Hao Luo (1): libbpf: Support weak typed ksyms. Hengqi Chen (5): libbpf: Fix KERNEL_VERSION macro tools/resolve_btfids: Emit warnings and patch zero id for missing symbols libbpf: Add btf__load_vmlinux_btf/btf__load_module_btf libbpf: Support uniform BTF-defined key/value specification across all BPF maps libbpf: Support static initialization of BPF_MAP_TYPE_PROG_ARRAY Ian Rogers (3): bpf, libbpf: Avoid unused function warning on bpf_tail_call_static tools/bpftool: Add -Wall when building BPF programs libbpf: Add NULL check to add_dummy_ksym_var Ilya Leoshkevich (6): selftests/bpf: Copy extras in out-of-srctree builds bpf: Add BTF_KIND_FLOAT to uapi libbpf: Fix whitespace in btf_add_composite() comment libbpf: Add BTF_KIND_FLOAT support bpf: Generate BTF_KIND_FLOAT when linking vmlinux libbpf: Use __BYTE_ORDER__ Jason Wang (1): libbpf: Fix comment typo Jean-Philippe Brucker (12): tools: Factor HOSTCC, HOSTLD, HOSTAR definitions tools/runqslower: Use Makefile.include tools/runqslower: Enable out-of-tree build tools/runqslower: Build bpftool using HOSTCC tools/bpftool: Fix build slowdown selftests/bpf: Enable cross-building selftests/bpf: Fix out-of-tree build selftests/bpf: Move generated test files to $(TEST_GEN_FILES) selftests/bpf: Fix installation of urandom_read selftests/bpf: Install btf_dump test cases tools/bpftool: Fix cross-build tools/runqslower: Fix cross-build Jiri Olsa (5): tools/resolve_btfids: Warn when having multiple IDs for single type libbpf: Use string table index from index table if needed perf build: Move feature cleanup under tools/build selftests/bpf: Add re-attach test to fentry_test selftests/bpf: Add re-attach test to fexit_test Joe Stringer (1): tools: Sync uapi bpf.h header with latest changes Jonathan Edwards (1): libbpf: Add extra BPF_PROG_TYPE check to bpf_object__probe_loading Kumar Kartikeya Dwivedi (22): libbpf: Add various netlink helpers libbpf: Add low level TC-BPF management API libbpf: Remove unneeded check for flags during tc detach libbpf: Set NLM_F_EXCL when creating qdisc libbpf: Fix segfault in static linker for objects without BTF libbpf: Fix segfault in light skeleton for objects without BTF bpf: Introduce BPF support for kernel module function calls bpf: Be conservative while processing invalid kfunc calls bpf: btf: Introduce helpers for dynamic BTF set registration tools: Allow specifying base BTF file in resolve_btfids libbpf: Support kernel module function calls libbpf: Resolve invalid weak kfunc calls with imm = 0, off = 0 libbpf: Update gen_loader to emit BTF_KIND_FUNC relocations bpf: selftests: Add selftests for module kfunc support bpf: Add bpf_kallsyms_lookup_name helper libbpf: Add typeless ksym support to gen_loader libbpf: Add weak ksym support to gen_loader selftests/bpf: Add weak/typeless ksym test for light skeleton libbpf: Perform map fd cleanup for gen_loader in case of error bpf: Change bpf_kallsyms_lookup_name size type to ARG_CONST_SIZE_OR_ZERO libbpf: Avoid double stores for success/failure case of ksym relocations libbpf: Avoid reload of imm for weak, unresolved, repeating ksym Lorenz Bauer (2): bpf: Consolidate shared test timing code bpf: Add PROG_TEST_RUN support for sk_lookup programs Martin KaFai Lau (10): bpf: Simplify freeing logic in linfo and jited_linfo bpf: Refactor btf_check_func_arg_match bpf: Support bpf program calling kernel function bpf: Support kernel function call in x86-32 libbpf: Refactor bpf_object__resolve_ksyms_btf_id libbpf: Refactor codes for finding btf id of a kernel symbol libbpf: Rename RELO_EXTERN to RELO_EXTERN_VAR libbpf: Record extern sym relocation first libbpf: Support extern kernel function bpf: selftests: Add kfunc_call test Martynas Pumputis (1): selftests/bpf: Check inner map deletion Matt Smith (3): libbpf: Change bpf_object_skeleton data field to const pointer bpftool: Provide a helper method for accessing skeleton's embedded ELF data selftests/bpf: Add checks for X__elf_bytes() skeleton helper Mauricio Vásquez (1): libbpf: Fix memory leak in btf__dedup() Michal Suchanek (1): libbpf: Fix pr_warn type warnings on 32bit Pedro Tammela (2): libbpf: Avoid inline hint definition from 'linux/stddef.h' libbpf: Clarify flags in ringbuf helpers Quentin Monnet (17): libbpf: Return non-null error on failures in libbpf_find_prog_btf_id() libbpf: Rename btf__load() as btf__load_into_kernel() libbpf: Rename btf__get_from_id() as btf__load_from_kernel_by_id() tools: Free BTF objects at various locations tools: Replace btf__get_from_id() with btf__load_from_kernel_by_id() libbpf: Add split BTF support for btf__load_from_kernel_by_id() tools: bpftool: Support dumping split BTF by id libbpf: Add LIBBPF_DEPRECATED_SINCE macro for scheduling API deprecations libbpf: Skip re-installing headers file if source is older than target bpftool: Remove unused includes to <bpf/bpf_gen_internal.h> bpftool: Install libbpf headers instead of including the dir tools/resolve_btfids: Install libbpf headers when building tools/runqslower: Install libbpf headers when building bpf: preload: Install libbpf headers when building bpf: iterators: Install libbpf headers when building selftests/bpf: Better clean up for runqslower in test_bpftool_build.sh bpftool: Add install-bin target to install binary only Rafael David Tinoco (1): libbpf: Add bpf object kern_version attribute setter Sedat Dilek (1): tools: Factor Clang, LLC and LLVM utils definitions Shuyi Cheng (2): libbpf: Introduce 'btf_custom_path' to 'bpf_obj_open_opts' libbpf: Add "bool skipped" to struct bpf_map Song Liu (3): bpftool: Add Makefile target bootstrap perf build: Support build BPF skeletons with perf perf stat: Enable counting events for BPF programs Stanislav Fomichev (2): libbpf: Cap retries in sys_bpf_prog_load libbpf: Skip bpf_object__probe_loading for light skeleton Toke Høiland-Jørgensen (5): bpf: Return target info when a tracing bpf_link is queried libbpf: Restore errno return for functions that were already returning it libbpf: Don't crash on object files with no symbol tables libbpf: Ignore STT_SECTION symbols in 'maps' section libbpf: Properly ignore STT_SECTION symbols in legacy map definitions Wang Hai (1): libbpf: Simplify the return expression of bpf_object__init_maps function Wang Qing (1): bpf, btf: Remove the duplicate btf_ids.h include Wedson Almeida Filho (1): bpf: Refactor check_cfg to use a structured loop. Yauheni Kaliuta (7): selftests/bpf: test_progs/sockopt_sk: Remove version selftests/bpf: test_progs/sockopt_sk: Convert to use BPF skeleton selftests/bpf: Pass page size from userspace in sockopt_sk selftests/bpf: Pass page size from userspace in map_ptr selftests/bpf: mmap: Use runtime page size selftests/bpf: ringbuf: Use runtime page size selftests/bpf: ringbuf_multi: Use runtime page size Yonghong Song (26): bpf: Permit size-0 datasec bpf: Refactor BPF_PSEUDO_CALL checking as a helper function bpf: Factor out visit_func_call_insn() in check_cfg() bpf: Factor out verbose_invalid_scalar() bpf: Refactor check_func_call() to allow callback function bpf: Change return value of verifier function add_subprog() bpf: Add bpf_for_each_map_elem() helper libbpf: Move function is_ldimm64() earlier in libbpf.c libbpf: Support subprog address relocation selftests/bpf: Fix test_cpp compilation failure with clang bpftool: Fix a clang compilation warning libbpf: Add support for new llvm bpf relocations bpf: Emit better log message if bpf_iter ctx arg btf_id == 0 btf: Change BTF_KIND_* macros to enums bpf: Support for new btf kind BTF_KIND_TAG libbpf: Rename btf_{hash,equal}_int to btf_{hash,equal}_int_tag libbpf: Add support for BTF_KIND_TAG bpftool: Add support for BTF_KIND_TAG bpf: Rename BTF_KIND_TAG to BTF_KIND_DECL_TAG bpf: Add BTF_KIND_DECL_TAG typedef support docs/bpf: Update documentation for BTF_KIND_DECL_TAG typedef support bpf: Support BTF_KIND_TYPE_TAG for btf_type_tag attributes libbpf: Support BTF_KIND_TYPE_TAG bpftool: Support BTF_KIND_TYPE_TAG docs/bpf: Update documentation for BTF_KIND_TYPE_TAG support libbpf: Fix a couple of missed btf_type_tag handling in btf.c Documentation/ABI/testing/sysfs-kernel-btf | 8 + Documentation/bpf/btf.rst | 40 +- Documentation/networking/filter.rst | 61 +- arch/arm/net/bpf_jit_32.c | 7 +- arch/arm64/net/bpf_jit_comp.c | 16 +- arch/mips/net/ebpf_jit.c | 11 +- arch/powerpc/net/bpf_jit_comp64.c | 25 +- arch/riscv/net/bpf_jit_comp32.c | 20 +- arch/riscv/net/bpf_jit_comp64.c | 16 +- arch/s390/net/bpf_jit_comp.c | 27 +- arch/sparc/net/bpf_jit_comp_64.c | 17 +- arch/x86/net/bpf_jit_comp.c | 408 +- arch/x86/net/bpf_jit_comp32.c | 204 +- drivers/net/ethernet/netronome/nfp/bpf/fw.h | 4 +- drivers/net/ethernet/netronome/nfp/bpf/jit.c | 14 +- drivers/net/ethernet/netronome/nfp/bpf/main.h | 4 +- .../net/ethernet/netronome/nfp/bpf/verifier.c | 15 +- include/linux/bpf.h | 153 +- include/linux/bpf_types.h | 2 + include/linux/bpf_verifier.h | 48 +- include/linux/bpfptr.h | 76 + include/linux/btf.h | 143 +- include/linux/filter.h | 45 +- include/linux/module.h | 4 + include/uapi/linux/bpf.h | 257 +- include/uapi/linux/btf.h | 57 +- kernel/bpf/Makefile | 4 + kernel/bpf/bpf_iter.c | 29 +- kernel/bpf/bpf_struct_ops.c | 6 +- kernel/bpf/btf.c | 1457 ++++- kernel/bpf/core.c | 157 +- kernel/bpf/disasm.c | 56 +- kernel/bpf/hashtab.c | 4 +- kernel/bpf/helpers.c | 326 +- kernel/bpf/preload/Makefile | 25 +- kernel/bpf/preload/iterators/Makefile | 38 +- kernel/bpf/preload/iterators/iterators.bpf.c | 1 - kernel/bpf/syscall.c | 363 +- kernel/bpf/sysfs_btf.c | 2 +- kernel/bpf/trampoline.c | 77 +- kernel/bpf/verifier.c | 1676 +++++- kernel/module.c | 36 + kernel/trace/bpf_trace.c | 375 +- lib/Kconfig.debug | 9 + lib/test_bpf.c | 21 +- net/bpf/test_run.c | 321 +- net/core/filter.c | 2 + net/ipv4/bpf_tcp_ca.c | 7 +- samples/bpf/bpf_insn.h | 4 +- samples/bpf/cookie_uid_helper_example.c | 8 +- samples/bpf/sock_example.c | 2 +- samples/bpf/test_cgrp2_attach.c | 5 +- scripts/Makefile.modfinal | 25 +- scripts/link-vmlinux.sh | 7 +- .../bpf/bpftool/Documentation/bpftool-gen.rst | 78 +- tools/bpf/bpftool/Makefile | 55 +- tools/bpf/bpftool/bash-completion/bpftool | 17 +- tools/bpf/bpftool/btf.c | 80 +- tools/bpf/bpftool/btf_dumper.c | 6 +- tools/bpf/bpftool/gen.c | 651 +- tools/bpf/bpftool/main.c | 20 +- tools/bpf/bpftool/main.h | 2 + tools/bpf/bpftool/map.c | 14 +- tools/bpf/bpftool/net.c | 2 +- tools/bpf/bpftool/prog.c | 139 +- tools/bpf/bpftool/xlated_dumper.c | 3 + tools/bpf/resolve_btfids/Makefile | 19 +- tools/bpf/resolve_btfids/main.c | 66 +- tools/bpf/runqslower/Makefile | 71 +- tools/build/Makefile | 8 +- tools/build/Makefile.feature | 4 +- tools/build/feature/Makefile | 4 +- tools/include/linux/filter.h | 24 +- tools/include/uapi/linux/bpf.h | 969 ++- tools/include/uapi/linux/btf.h | 57 +- tools/lib/bpf/.gitignore | 2 - tools/lib/bpf/Build | 2 +- tools/lib/bpf/Makefile | 104 +- tools/lib/bpf/bpf.c | 273 +- tools/lib/bpf/bpf.h | 1 + tools/lib/bpf/bpf_core_read.h | 169 +- tools/lib/bpf/bpf_gen_internal.h | 65 + tools/lib/bpf/bpf_helpers.h | 108 +- tools/lib/bpf/bpf_prog_linfo.c | 18 +- tools/lib/bpf/bpf_tracing.h | 44 +- tools/lib/bpf/btf.c | 2097 ++++--- tools/lib/bpf/btf.h | 99 +- tools/lib/bpf/btf_dump.c | 910 ++- tools/lib/bpf/gen_loader.c | 1126 ++++ tools/lib/bpf/libbpf.c | 5335 +++++++++-------- tools/lib/bpf/libbpf.h | 172 +- tools/lib/bpf/libbpf.map | 50 + tools/lib/bpf/libbpf_common.h | 26 +- tools/lib/bpf/libbpf_errno.c | 7 +- tools/lib/bpf/libbpf_internal.h | 302 +- tools/lib/bpf/libbpf_legacy.h | 60 + tools/lib/bpf/libbpf_version.h | 9 + tools/lib/bpf/linker.c | 2901 +++++++++ tools/lib/bpf/netlink.c | 593 +- tools/lib/bpf/nlattr.h | 48 + tools/lib/bpf/relo_core.c | 1322 ++++ tools/lib/bpf/relo_core.h | 57 + tools/lib/bpf/ringbuf.c | 26 +- tools/lib/bpf/skel_internal.h | 123 + tools/lib/bpf/strset.c | 176 + tools/lib/bpf/strset.h | 21 + tools/lib/bpf/xsk.c | 4 +- tools/perf/Documentation/perf-stat.txt | 18 + tools/perf/Makefile.config | 9 + tools/perf/Makefile.perf | 58 +- tools/perf/builtin-stat.c | 82 +- tools/perf/util/Build | 1 + tools/perf/util/bpf-event.c | 11 +- tools/perf/util/bpf_counter.c | 320 + tools/perf/util/bpf_counter.h | 72 + tools/perf/util/bpf_skel/.gitignore | 3 + .../util/bpf_skel/bpf_prog_profiler.bpf.c | 93 + tools/perf/util/evsel.c | 5 + tools/perf/util/evsel.h | 5 + tools/perf/util/python.c | 21 + tools/perf/util/stat-display.c | 4 +- tools/perf/util/stat.c | 2 +- tools/perf/util/target.c | 34 +- tools/perf/util/target.h | 10 + tools/scripts/Makefile.include | 18 + tools/testing/selftests/bpf/.gitignore | 2 + tools/testing/selftests/bpf/Makefile | 200 +- tools/testing/selftests/bpf/bench.c | 1 + .../selftests/bpf/benchs/bench_rename.c | 2 +- .../selftests/bpf/benchs/bench_ringbufs.c | 6 +- .../selftests/bpf/benchs/bench_trigger.c | 2 +- .../selftests/bpf/bpf_testmod/.gitignore | 6 + .../selftests/bpf/bpf_testmod/Makefile | 20 + .../bpf/bpf_testmod/bpf_testmod-events.h | 36 + .../selftests/bpf/bpf_testmod/bpf_testmod.c | 76 + .../selftests/bpf/bpf_testmod/bpf_testmod.h | 14 + tools/testing/selftests/bpf/btf_helpers.c | 264 + tools/testing/selftests/bpf/btf_helpers.h | 19 + .../selftests/bpf/prog_tests/atomics.c | 246 + .../selftests/bpf/prog_tests/attach_probe.c | 12 +- .../selftests/bpf/prog_tests/bpf_iter.c | 34 +- .../selftests/bpf/prog_tests/bpf_tcp_ca.c | 8 +- tools/testing/selftests/bpf/prog_tests/btf.c | 166 +- .../bpf/prog_tests/btf_dedup_split.c | 325 + .../selftests/bpf/prog_tests/btf_dump.c | 10 +- .../selftests/bpf/prog_tests/btf_endian.c | 4 +- .../selftests/bpf/prog_tests/btf_map_in_map.c | 33 - .../selftests/bpf/prog_tests/btf_split.c | 99 + .../selftests/bpf/prog_tests/btf_write.c | 47 +- .../bpf/prog_tests/cg_storage_multi.c | 84 +- .../bpf/prog_tests/cgroup_attach_multi.c | 6 +- .../selftests/bpf/prog_tests/cgroup_link.c | 16 +- .../bpf/prog_tests/cgroup_skb_sk_lookup.c | 2 +- .../selftests/bpf/prog_tests/core_autosize.c | 2 +- .../selftests/bpf/prog_tests/core_kern.c | 14 + .../bpf/prog_tests/core_read_macros.c | 64 + .../selftests/bpf/prog_tests/core_reloc.c | 105 +- .../selftests/bpf/prog_tests/fentry_fexit.c | 22 +- .../selftests/bpf/prog_tests/fentry_test.c | 58 +- .../selftests/bpf/prog_tests/fexit_bpf2bpf.c | 68 +- .../selftests/bpf/prog_tests/fexit_stress.c | 4 +- .../selftests/bpf/prog_tests/fexit_test.c | 58 +- .../selftests/bpf/prog_tests/flow_dissector.c | 2 +- .../bpf/prog_tests/flow_dissector_reattach.c | 10 +- .../bpf/prog_tests/get_stack_raw_tp.c | 24 +- .../prog_tests/get_stackid_cannot_attach.c | 9 +- .../selftests/bpf/prog_tests/global_data.c | 11 +- .../bpf/prog_tests/global_data_init.c | 2 +- .../bpf/prog_tests/global_func_args.c | 60 + .../selftests/bpf/prog_tests/hashmap.c | 9 +- .../selftests/bpf/prog_tests/kfree_skb.c | 23 +- .../selftests/bpf/prog_tests/kfunc_call.c | 59 + .../selftests/bpf/prog_tests/ksyms_btf.c | 65 +- .../selftests/bpf/prog_tests/ksyms_module.c | 62 + .../selftests/bpf/prog_tests/link_pinning.c | 7 +- .../selftests/bpf/prog_tests/map_ptr.c | 21 +- tools/testing/selftests/bpf/prog_tests/mmap.c | 24 +- .../selftests/bpf/prog_tests/obj_name.c | 8 +- .../selftests/bpf/prog_tests/perf_branches.c | 4 +- .../selftests/bpf/prog_tests/perf_buffer.c | 2 +- .../bpf/prog_tests/perf_event_stackmap.c | 3 +- .../selftests/bpf/prog_tests/probe_user.c | 7 +- .../selftests/bpf/prog_tests/prog_run_xattr.c | 2 +- .../bpf/prog_tests/queue_stack_map.c | 12 +- .../bpf/prog_tests/raw_tp_test_run.c | 4 +- .../selftests/bpf/prog_tests/rdonly_maps.c | 9 +- .../selftests/bpf/prog_tests/recursion.c | 41 + .../bpf/prog_tests/reference_tracking.c | 2 +- .../selftests/bpf/prog_tests/resolve_btfids.c | 9 +- .../selftests/bpf/prog_tests/ringbuf.c | 27 +- .../selftests/bpf/prog_tests/ringbuf_multi.c | 23 +- .../bpf/prog_tests/select_reuseport.c | 53 +- .../selftests/bpf/prog_tests/send_signal.c | 5 +- .../selftests/bpf/prog_tests/sk_lookup.c | 2 +- .../selftests/bpf/prog_tests/skeleton.c | 41 +- .../selftests/bpf/prog_tests/snprintf_btf.c | 4 +- .../selftests/bpf/prog_tests/sock_fields.c | 14 +- .../selftests/bpf/prog_tests/sockmap_basic.c | 6 +- .../selftests/bpf/prog_tests/sockmap_ktls.c | 2 +- .../selftests/bpf/prog_tests/sockmap_listen.c | 10 +- .../selftests/bpf/prog_tests/sockopt_sk.c | 66 +- .../bpf/prog_tests/stacktrace_build_id_nmi.c | 3 +- .../selftests/bpf/prog_tests/stacktrace_map.c | 2 +- .../bpf/prog_tests/stacktrace_map_raw_tp.c | 5 +- .../selftests/bpf/prog_tests/static_linked.c | 35 + .../bpf/prog_tests/tcp_hdr_options.c | 15 +- .../selftests/bpf/prog_tests/test_bpffs.c | 4 +- .../bpf/prog_tests/test_global_funcs.c | 8 + .../selftests/bpf/prog_tests/test_overhead.c | 12 +- .../selftests/bpf/prog_tests/trace_printk.c | 25 +- .../bpf/prog_tests/trampoline_count.c | 18 +- .../selftests/bpf/prog_tests/udp_limit.c | 7 +- tools/testing/selftests/bpf/prog_tests/xdp.c | 11 +- .../selftests/bpf/prog_tests/xdp_bpf2bpf.c | 8 +- .../selftests/bpf/prog_tests/xdp_link.c | 8 +- tools/testing/selftests/bpf/progs/atomics.c | 154 + tools/testing/selftests/bpf/progs/bpf_cubic.c | 6 +- .../bpf/progs/bpf_iter_bpf_hash_map.c | 1 - .../selftests/bpf/progs/bpf_iter_bpf_map.c | 1 - .../selftests/bpf/progs/bpf_iter_ipv6_route.c | 1 - .../selftests/bpf/progs/bpf_iter_netlink.c | 1 - .../selftests/bpf/progs/bpf_iter_task.c | 1 - .../selftests/bpf/progs/bpf_iter_task_btf.c | 1 - .../selftests/bpf/progs/bpf_iter_task_file.c | 1 - .../selftests/bpf/progs/bpf_iter_task_stack.c | 1 - .../selftests/bpf/progs/bpf_iter_tcp4.c | 1 - .../selftests/bpf/progs/bpf_iter_tcp6.c | 1 - .../selftests/bpf/progs/bpf_iter_test_kern4.c | 4 +- .../selftests/bpf/progs/bpf_iter_udp4.c | 1 - .../selftests/bpf/progs/bpf_iter_udp6.c | 1 - tools/testing/selftests/bpf/progs/core_kern.c | 104 + .../selftests/bpf/progs/core_reloc_types.h | 17 + tools/testing/selftests/bpf/progs/kfree_skb.c | 4 +- .../selftests/bpf/progs/kfunc_call_test.c | 47 + .../bpf/progs/kfunc_call_test_subprog.c | 42 + tools/testing/selftests/bpf/progs/lsm.c | 69 + .../selftests/bpf/progs/map_ptr_kern.c | 20 +- tools/testing/selftests/bpf/progs/recursion.c | 46 + .../testing/selftests/bpf/progs/sockopt_sk.c | 11 +- tools/testing/selftests/bpf/progs/tailcall3.c | 2 +- tools/testing/selftests/bpf/progs/tailcall4.c | 2 +- tools/testing/selftests/bpf/progs/tailcall5.c | 2 +- .../selftests/bpf/progs/tailcall_bpf2bpf2.c | 2 +- .../selftests/bpf/progs/tailcall_bpf2bpf4.c | 2 +- .../selftests/bpf/progs/test_cls_redirect.c | 4 +- .../bpf/progs/test_core_read_macros.c | 50 + .../bpf/progs/test_core_reloc_module.c | 96 + .../selftests/bpf/progs/test_global_func10.c | 29 + .../selftests/bpf/progs/test_global_func11.c | 19 + .../selftests/bpf/progs/test_global_func12.c | 21 + .../selftests/bpf/progs/test_global_func13.c | 24 + .../selftests/bpf/progs/test_global_func14.c | 21 + .../selftests/bpf/progs/test_global_func15.c | 22 + .../selftests/bpf/progs/test_global_func16.c | 22 + .../selftests/bpf/progs/test_global_func9.c | 132 + .../bpf/progs/test_global_func_args.c | 91 + .../selftests/bpf/progs/test_ksyms_module.c | 50 + .../selftests/bpf/progs/test_ksyms_weak.c | 56 + .../bpf/progs/test_map_in_map_invalid.c | 26 + tools/testing/selftests/bpf/progs/test_mmap.c | 2 - .../selftests/bpf/progs/test_rdonly_maps.c | 6 +- .../selftests/bpf/progs/test_ringbuf.c | 5 +- .../selftests/bpf/progs/test_ringbuf_multi.c | 1 - .../selftests/bpf/progs/test_skeleton.c | 20 +- .../selftests/bpf/progs/test_sockmap_listen.c | 2 +- .../selftests/bpf/progs/test_static_linked1.c | 30 + .../selftests/bpf/progs/test_static_linked2.c | 31 + .../selftests/bpf/progs/test_subprogs.c | 13 + .../selftests/bpf/progs/test_verif_scale2.c | 4 +- .../selftests/bpf/progs/trace_printk.c | 6 +- .../selftests/bpf/test_bpftool_build.sh | 4 + .../selftests/bpf/test_cgroup_storage.c | 2 +- tools/testing/selftests/bpf/test_maps.c | 231 +- tools/testing/selftests/bpf/test_progs.c | 79 +- tools/testing/selftests/bpf/test_progs.h | 83 +- .../selftests/bpf/test_tcpnotify_user.c | 7 +- tools/testing/selftests/bpf/test_verifier.c | 103 +- .../selftests/bpf/verifier/atomic_and.c | 77 + .../selftests/bpf/verifier/atomic_cmpxchg.c | 96 + .../selftests/bpf/verifier/atomic_fetch_add.c | 106 + .../selftests/bpf/verifier/atomic_or.c | 77 + .../selftests/bpf/verifier/atomic_xchg.c | 46 + .../selftests/bpf/verifier/atomic_xor.c | 77 + tools/testing/selftests/bpf/verifier/calls.c | 35 +- tools/testing/selftests/bpf/verifier/ctx.c | 7 +- .../selftests/bpf/verifier/dead_code.c | 10 +- .../bpf/verifier/direct_packet_access.c | 4 +- tools/testing/selftests/bpf/verifier/jit.c | 24 + .../testing/selftests/bpf/verifier/leak_ptr.c | 10 +- .../selftests/bpf/verifier/meta_access.c | 4 +- tools/testing/selftests/bpf/verifier/unpriv.c | 3 +- .../bpf/verifier/value_illegal_alu.c | 2 +- tools/testing/selftests/bpf/verifier/xadd.c | 18 +- tools/testing/selftests/tc-testing/Makefile | 3 +- 294 files changed, 25170 insertions(+), 6337 deletions(-) create mode 100644 include/linux/bpfptr.h create mode 100644 tools/lib/bpf/bpf_gen_internal.h create mode 100644 tools/lib/bpf/gen_loader.c create mode 100644 tools/lib/bpf/libbpf_legacy.h create mode 100644 tools/lib/bpf/libbpf_version.h create mode 100644 tools/lib/bpf/linker.c create mode 100644 tools/lib/bpf/relo_core.c create mode 100644 tools/lib/bpf/relo_core.h create mode 100644 tools/lib/bpf/skel_internal.h create mode 100644 tools/lib/bpf/strset.c create mode 100644 tools/lib/bpf/strset.h create mode 100644 tools/perf/util/bpf_counter.c create mode 100644 tools/perf/util/bpf_counter.h create mode 100644 tools/perf/util/bpf_skel/.gitignore create mode 100644 tools/perf/util/bpf_skel/bpf_prog_profiler.bpf.c create mode 100644 tools/testing/selftests/bpf/bpf_testmod/.gitignore create mode 100644 tools/testing/selftests/bpf/bpf_testmod/Makefile create mode 100644 tools/testing/selftests/bpf/bpf_testmod/bpf_testmod-events.h create mode 100644 tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.c create mode 100644 tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.h create mode 100644 tools/testing/selftests/bpf/btf_helpers.c create mode 100644 tools/testing/selftests/bpf/btf_helpers.h create mode 100644 tools/testing/selftests/bpf/prog_tests/atomics.c create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_dedup_split.c create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_split.c create mode 100644 tools/testing/selftests/bpf/prog_tests/core_kern.c create mode 100644 tools/testing/selftests/bpf/prog_tests/core_read_macros.c create mode 100644 tools/testing/selftests/bpf/prog_tests/global_func_args.c create mode 100644 tools/testing/selftests/bpf/prog_tests/kfunc_call.c create mode 100644 tools/testing/selftests/bpf/prog_tests/ksyms_module.c create mode 100644 tools/testing/selftests/bpf/prog_tests/recursion.c create mode 100644 tools/testing/selftests/bpf/prog_tests/static_linked.c create mode 100644 tools/testing/selftests/bpf/progs/atomics.c create mode 100644 tools/testing/selftests/bpf/progs/core_kern.c create mode 100644 tools/testing/selftests/bpf/progs/kfunc_call_test.c create mode 100644 tools/testing/selftests/bpf/progs/kfunc_call_test_subprog.c create mode 100644 tools/testing/selftests/bpf/progs/recursion.c create mode 100644 tools/testing/selftests/bpf/progs/test_core_read_macros.c create mode 100644 tools/testing/selftests/bpf/progs/test_core_reloc_module.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func10.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func11.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func12.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func13.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func14.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func15.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func16.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func9.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func_args.c create mode 100644 tools/testing/selftests/bpf/progs/test_ksyms_module.c create mode 100644 tools/testing/selftests/bpf/progs/test_ksyms_weak.c create mode 100644 tools/testing/selftests/bpf/progs/test_map_in_map_invalid.c create mode 100644 tools/testing/selftests/bpf/progs/test_static_linked1.c create mode 100644 tools/testing/selftests/bpf/progs/test_static_linked2.c create mode 100644 tools/testing/selftests/bpf/verifier/atomic_and.c create mode 100644 tools/testing/selftests/bpf/verifier/atomic_cmpxchg.c create mode 100644 tools/testing/selftests/bpf/verifier/atomic_fetch_add.c create mode 100644 tools/testing/selftests/bpf/verifier/atomic_or.c create mode 100644 tools/testing/selftests/bpf/verifier/atomic_xchg.c create mode 100644 tools/testing/selftests/bpf/verifier/atomic_xor.c -- 2.20.1

1 391

[PATCH openEuler-22.09 00/13] arm64: add machine checksafe support
by Zheng Zengkai 17 Aug '22

17 Aug '22

With the increase of memory capacity and density, the probability of memory error increases. The increasing size and density of server RAM in the data center and cloud have shown increased uncorrectable memory errors. Currently, the kernel has a mechanism to recover from hardware memory errors. This patchset provides an new recovery mechanism. For arm64, the hardware memory error handling is do_sea() which divided into two cases: 1. The user state consumed the memory errors, the solution is kill the user process and isolate the error page. 2. The kernel state consumed the memory errors, the solution is panic. For case 2, Undifferentiated panic maybe not the optimal choice, it can be handled better, in some scenarios, we can avoid panic, such as uaccess, if the uaccess fails due to memory error, only the user process will be affected, kill the user process and isolate the user page with hardware memory errors is a better choice. Tong Tiangen (13): Revert "arm64: ras: copy_from_user scenario support uce kernel recovery" Revert "arm64: config: enable CONFIG_ARM64_UCE_KERNEL_RECOVERY" uaccess: add generic fallback version of copy_mc_to_user() arm64: extable: add new extable type "__mc_ex_table" arm64: add support for machine check error safe arm64: copy_form/to_user support machine check safe arm64: get/put_user support machine check safe arm64: add cow to machine check safe arm64: introduce copy_mc_to_kernel() implementation arm64: add dump_user_range() to machine check safe arm64: add machine check safe sysctl interface arm64/__mc_ex_table: search_module_mc_extables should not use num_exentries arm64/__mc_ex_table: fix compile error when CONFIG_ARCH_HAS_COPY_MC=n Documentation/admin-guide/sysctl/kernel.rst | 38 ++-- arch/arm64/Kconfig | 14 +- arch/arm64/configs/openeuler_defconfig | 1 - arch/arm64/include/asm/asm-uaccess.h | 5 + arch/arm64/include/asm/assembler.h | 26 ++- arch/arm64/include/asm/exception.h | 13 -- arch/arm64/include/asm/extable.h | 1 + arch/arm64/include/asm/mte.h | 4 + arch/arm64/include/asm/page.h | 10 + arch/arm64/include/asm/processor.h | 2 + arch/arm64/include/asm/string.h | 5 + arch/arm64/include/asm/uaccess.h | 70 +++++-- arch/arm64/lib/Makefile | 10 +- arch/arm64/lib/copy_from_user.S | 19 +- arch/arm64/lib/copy_page_mc.S | 80 ++++++++ arch/arm64/lib/copy_to_user.S | 10 +- arch/arm64/lib/memcpy_mc.S | 73 ++++++++ arch/arm64/lib/mte.S | 19 ++ arch/arm64/mm/Makefile | 2 - arch/arm64/mm/copypage.c | 43 ++++- arch/arm64/mm/extable.c | 12 ++ arch/arm64/mm/fault.c | 36 +++- arch/arm64/mm/uce_kernel_recovery.c | 198 -------------------- arch/powerpc/include/asm/uaccess.h | 1 + arch/x86/include/asm/uaccess.h | 1 + fs/coredump.c | 2 + include/asm-generic/vmlinux.lds.h | 19 +- include/linux/extable.h | 23 +++ include/linux/highmem.h | 8 + include/linux/module.h | 11 ++ include/linux/sched.h | 1 + include/linux/uaccess.h | 9 + kernel/extable.c | 29 +++ kernel/module.c | 38 ++++ kernel/sysctl.c | 11 ++ lib/iov_iter.c | 12 +- mm/memory.c | 2 +- scripts/sorttable.h | 29 +++ 38 files changed, 589 insertions(+), 298 deletions(-) create mode 100644 arch/arm64/lib/copy_page_mc.S create mode 100644 arch/arm64/lib/memcpy_mc.S delete mode 100644 arch/arm64/mm/uce_kernel_recovery.c -- 2.20.1

1 13

[PATCH openEuler-22.09 00/21] sched: programmable: Fix sched bpf hook
by Zheng Zengkai 17 Aug '22

17 Aug '22

sched: programmable: Fix sched bpf hook cfs_check_preempt_tick Chen Hui (11): sched: programmable: Add a tag for the task group sched: programmable: Add user interface of task group tag sched: programmable: Add a tag for the task sched: programmable: Add user interface of task tag sched: programmable: add bpf_sched_task_tag_of helper function sched: programmable: Add convenient helper functions to convert sched entity samples/bpf: Update bpf loader for sched section names bpf: sched: Add four helper functions to get cpu stat bpf:programmable: Add cpumask ops collection sched: programmable: Add lib for sched programmable sched: programmable: Add three hooks in select_task_rq_fair() Guan Jing (2): sched: programmable: Add hook for pick next task samples: bpf: Add bpf sched pick task sample Hui Tang (3): bpf:programmable: Add helper func to check cpu share cache bpf:programmable: Add helper func to set cpus_ptr in task samples:bpf: Add samples for cfs select core Ren Zhijie (5): sched: programmable: Fix sched bpf hook cfs_check_preempt_tick sched: programmable: add bpf_sched_tg_tag_of helper function samples: bpf: Add bpf sched preempt sample program sched: programmable: Add helpers to set tag of task or task_group sched: programmable: Add helper function for cpu topology. fs/proc/base.c | 65 ++++ include/linux/bpf_topology.h | 46 +++ include/linux/sched.h | 85 +++++ include/linux/sched_hook_defs.h | 5 + include/uapi/linux/bpf.h | 151 +++++++++ init/init_task.c | 3 + kernel/bpf/helpers.c | 12 + kernel/bpf/verifier.c | 4 +- kernel/sched/Makefile | 3 +- kernel/sched/bpf_sched.c | 433 ++++++++++++++++++++++++ kernel/sched/bpf_topology.c | 97 ++++++ kernel/sched/core.c | 103 ++++++ kernel/sched/fair.c | 64 +++- kernel/sched/sched.h | 8 + samples/bpf/Makefile | 9 + samples/bpf/bpf_load.c | 8 +- samples/bpf/sched_pick_task_kern.c | 56 ++++ samples/bpf/sched_pick_task_user.c | 94 ++++++ samples/bpf/sched_preempt_kern.c | 147 +++++++++ samples/bpf/sched_preempt_user.c | 140 ++++++++ samples/bpf/sched_select_core_kern.c | 259 +++++++++++++++ samples/bpf/sched_select_core_user.c | 125 +++++++ scripts/bpf_helpers_doc.py | 20 ++ tools/include/uapi/linux/bpf.h | 151 +++++++++ tools/lib/bpf/libbpf_sched.h | 473 +++++++++++++++++++++++++++ 25 files changed, 2555 insertions(+), 6 deletions(-) create mode 100644 include/linux/bpf_topology.h create mode 100644 kernel/sched/bpf_topology.c create mode 100644 samples/bpf/sched_pick_task_kern.c create mode 100644 samples/bpf/sched_pick_task_user.c create mode 100644 samples/bpf/sched_preempt_kern.c create mode 100644 samples/bpf/sched_preempt_user.c create mode 100644 samples/bpf/sched_select_core_kern.c create mode 100644 samples/bpf/sched_select_core_user.c create mode 100644 tools/lib/bpf/libbpf_sched.h -- 2.20.1

1 21

[PATCH openEuler-5.10 01/31] io_uring:drop identity before creating a private one
by Zheng Zengkai 17 Aug '22

17 Aug '22

From: Li Lingfeng <lilingfeng3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187387, https://gitee.com/openeuler/kernel/issues/I5KTEM CVE: NA -------------------------------- When we need to create a private copy of io_identity, we will get the use of current task's private structs, whitch means we should increase their reference counts. If we have grabed some other structs before, we should drop them and clear related flags. Otherwise, leak of old structs and uaf of new structs may occur. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- fs/io_uring.c | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/fs/io_uring.c b/fs/io_uring.c index faa81d48c812..257e4af176e6 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -1364,6 +1364,47 @@ static bool io_identity_cow(struct io_kiocb *req) return true; } +static void io_drop_identity(struct io_kiocb *req) +{ + struct io_identity *id = req->work.identity; + + if (req->work.flags & IO_WQ_WORK_MM) { + mmdrop(id->mm); + req->work.flags &= ~IO_WQ_WORK_MM; + } +#ifdef CONFIG_BLK_CGROUP + if (req->work.flags & IO_WQ_WORK_BLKCG) { + css_put(id->blkcg_css); + req->work.flags &= ~IO_WQ_WORK_BLKCG; + } +#endif + if (req->work.flags & IO_WQ_WORK_CREDS) { + put_cred(id->creds); + req->work.flags &= ~IO_WQ_WORK_CREDS; + } + if (req->work.flags & IO_WQ_WORK_FILES) { + put_files_struct(req->work.identity->files); + put_nsproxy(req->work.identity->nsproxy); + req->work.flags &= ~IO_WQ_WORK_FILES; + } + if (req->work.flags & IO_WQ_WORK_CANCEL) + req->work.flags &= ~IO_WQ_WORK_CANCEL; + if (req->work.flags & IO_WQ_WORK_FS) { + struct fs_struct *fs = id->fs; + + spin_lock(&id->fs->lock); + if (--fs->users) + fs = NULL; + spin_unlock(&id->fs->lock); + + if (fs) + free_fs_struct(fs); + req->work.flags &= ~IO_WQ_WORK_FS; + } + if (req->work.flags & IO_WQ_WORK_FSIZE) + req->work.flags &= ~IO_WQ_WORK_FSIZE; +} + static bool io_grab_identity(struct io_kiocb *req) { const struct io_op_def *def = &io_op_defs[req->opcode]; @@ -1469,6 +1510,7 @@ static void io_prep_async_work(struct io_kiocb *req) if (io_grab_identity(req)) return; + io_drop_identity(req); if (!io_identity_cow(req)) return; -- 2.20.1

1 30

CCSA-运营商行业操作系统规范内核SYSCALL学习交流
by 丁强 17 Aug '22

17 Aug '22

各位好，我是移动丁强，目前在中国通信标准化协会（CCSA）中牵头做操作系统相关的行业规范，目前涉及到kernel的SYSCALL特性部分，想和各位学习交流一下，方便的话可以加我微信详谈，我的手机13575459962（微信同号），感谢大家！丁强中国移动通信集团浙江有限公司云计算支撑中心 Mobile: 13575459962 E-mail: 13575459962(a)139.xn--com()-jt2hu4k dingqiang5(a)zj.chinamobile.com

1 0

[PATCH openEuler-5.10-LTS v2 00/82] Backport 5.10.118 LTS
by Zheng Zengkai 17 Aug '22

17 Aug '22

Backport 5.10.118 LTS patches from upstream. git cherry-pick v5.10.117..v5.10.118~1 -s Already merged(5): 911b36267855 floppy: use a statically allocated error counter 55c820c1b2b6 Revert "drm/i915/opregion: check port number bounds for SWSCI display power state" aca18bacdb71 ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame() f3f2247ac31c Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE"" 3ee8e109c3c3 perf: Fix sys_perf_event_open() race against self Context conflict: 00d8b06a4ed4 rtc: mc146818-lib: Fix the AltCentury for AMD platforms Skiped(1): e2cfa7b0935c Revert "swiotlb: fix info leak with DMA_FROM_DEVICE" KABI changed(8): 633be494c3ca include/uapi/linux/xfrm.h: Fix XFRM_MSG_MAPPING ABI breakage 47f04f95edb1 xfrm: fix "disable_policy" flag use when arriving from different devices 0d2e9d8000ef xfrm: rework default policy structure 57c1bbe7098b xfrm: fix dflt policy check when there is no policy configured 9856c3a129dd xfrm: notify default policy on update 20fd28df4049 xfrm: make user policy API complete ab610ee1d1a1 net: xfrm: fix shift-out-of-bounce 5b7f84b1f9f4 xfrm: Add possibility to set the default to block if we have no policy Total patches: 96 - 5 - 1 - 8 = 82 Al Viro (1): Fix double fget() in vhost_net_set_backend() Alex Elder (1): net: ipa: record proper RX transaction count Andre Przywara (1): rtc: sun6i: Fix time overflow handling Andreas Gruenbacher (1): gfs2: Disable page faults during lockless buffered reads Andrew Lunn (1): net: bridge: Clear offload_fwd_mark when passing frame up bridge interface. Anton Eidelman (1): nvme-multipath: fix hang when disk goes live over reconnect Ard Biesheuvel (2): ARM: 9196/1: spectre-bhb: enable for Cortex-A15 ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2 Catalin Marinas (1): arm64: mte: Ensure the cleared tags are visible before setting the PTE Christophe JAILLET (2): net: systemport: Fix an error handling path in bcm_sysport_probe() net/qla3xxx: Fix a test in ql_reset_work() Codrin Ciubotariu (1): clk: at91: generated: consider range when calculating best rate David Gow (1): um: Cleanup syscall_handler_t definition/cast, fix warning David Howells (1): afs: Fix afs_getattr() to refetch file status if callback break occurred Duoming Zhou (1): NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc Felix Fietkau (1): mac80211: fix rx reordering with non explicit / psmp ack policy Gleb Chesnokov (1): scsi: qla2xxx: Fix missed DMA unmap for aborted commands Grant Grundler (4): net: atlantic: fix "frag[0] not initialized" net: atlantic: reduce scope of is_rsc_complete net: atlantic: add check for MAX_SKB_FRAGS net: atlantic: verify hw_head_ lies within TX buffer ring Guo Xuenan (1): fs: fix an infinite loop in iomap_fiemap Haibo Chen (1): gpio: gpio-vf610: do not touch other bits when set the target bit Hangyu Hua (1): drm/dp/mst: fix a possible memory leak in fetch_monitor_name() Harini Katakam (1): net: macb: Increment rx bd head after allocating skb and buffer Hugo Villeneuve (1): rtc: pcf2127: fix bug when reading alarm registers Ilya Dryomov (1): libceph: fix potential use-after-free on linger ping and resends Jae Hyun Yoo (4): ARM: dts: aspeed-g6: remove FWQSPID group in pinctrl dtsi pinctrl: pinctrl-aspeed-g6: remove FWQSPID group in pinctrl ARM: dts: aspeed-g6: fix SPI1/SPI2 quad pin group dt-bindings: pinctrl: aspeed-g6: remove FWQSPID group Jakob Koschel (1): drbd: remove usage of list iterator variable after loop Jeff LaBundy (1): Input: add bounds checking to input_set_capability() Jens Axboe (1): io_uring: always grab file table for deferred statx Jessica Yu (2): module: treat exit sections the same as init sections when !CONFIG_MODULE_UNLOAD module: check for exit sections in layout_sections() instead of module_init_section() Jiasheng Jiang (1): net: af_key: add check for pfkey_broadcast in function pfkey_process Johannes Berg (1): nl80211: fix locking in nl80211_set_tx_bitrate_mask() Jérôme Pouiller (1): dma-buf: fix use of DMA_BUF_SET_NAME_{A,B} in userspace Kai-Heng Feng (1): ALSA: hda/realtek: Enable headset mic on Lenovo P360 Kevin Mitchell (1): igb: skip phy status check where unavailable Kieran Frewen (1): nl80211: validate S1G channel width Krzysztof Kozlowski (1): riscv: dts: sifive: fu540-c000: align dma node name with dtschema Marek Vasut (1): Input: ili210x - fix reset timing Mario Limonciello (1): rtc: mc146818-lib: Fix the AltCentury for AMD platforms Maxim Mikityanskiy (1): net/mlx5e: Properly block LRO when XDP is enabled Michael S. Tsirkin (1): tools/virtio: compile with -pthread Monish Kumar R (1): nvme-pci: add quirks for Samsung X5 SSDs Nicolas Dichtel (1): selftests: add ping test with ping_group_range tuned Niklas Schnelle (1): s390/pci: improve zpci_dev reference counting Ondrej Mosnacek (2): selinux: fix bad cleanup on error in hashtab_duplicate() crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ Paolo Abeni (1): net/sched: act_pedit: sanitize shift argument before usage Paul Greenwalt (1): ice: fix possible under reporting of ethtool Tx and Rx statistics Peter Zijlstra (1): crypto: x86/chacha20 - Avoid spurious jumps to other functions Prakruthi Deepak Heragu (1): arm64: paravirt: Use RCU read locks to guard stolen_time Rafael J. Wysocki (1): PCI/PM: Avoid putting Elo i2 PCIe Ports in D3cold Ryusuke Konishi (2): nilfs2: fix lockdep warnings in page operations for btree nodes nilfs2: fix lockdep warnings during disk space reclamation Sasha Neftin (3): igc: Remove _I_PHY_ID checking igc: Remove phy->type checking igc: Update I226_K device ID Schspa Shi (1): usb: gadget: fix race when gadget driver register via ioctl Sean Christopherson (1): KVM: x86/mmu: Update number of zapped pages even if page list is stable Shreyas K K (1): arm64: Enable repeat tlbi workaround on KRYO4XX gold CPUs Takashi Iwai (2): ALSA: usb-audio: Restore Rane SL-1 quirk ALSA: wavefront: Proper check of get_user() error Thomas Richter (1): perf bench numa: Address compiler error on s390 Tzung-Bi Shih (1): platform/chrome: cros_ec_debugfs: detach log reader wq from devm Uwe Kleine-König (1): gpio: mvebu/pwm: Refuse requests with inverted polarity Vincent Bernat (1): net: evaluate net.ipvX.conf.all.disable_policy and disable_xfrm Vincent Whitchurch (1): rtc: fix use-after-free on device removal Werner Sembach (1): ALSA: hda/realtek: Add quirk for TongFang devices with pop noise Xiaoke Wang (1): MIPS: lantiq: check the return value of kzalloc() Yang Yingliang (3): ethernet: tulip: fix missing pci_disable_device() on error in tulip_init_one() net: stmmac: fix missing pci_disable_device() on error in stmmac_pci_probe() i2c: mt7621: fix missing clk_disable_unprepare() on error in mtk_i2c_probe() Zheng Yongjun (2): Input: stmfts - fix reference leak in stmfts_input_open crypto: stm32 - fix reference leak in stm32_crc_remove Zhu Lingshan (1): vhost_vdpa: don't setup irq offloading when irq_num < 0 Zixuan Fu (2): net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup() Documentation/arm64/silicon-errata.rst | 3 + .../pinctrl/aspeed,ast2600-pinctrl.yaml | 2 +- arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi | 9 +- arch/arm/kernel/entry-armv.S | 2 +- arch/arm/mm/proc-v7-bugs.c | 1 + arch/arm64/kernel/cpu_errata.c | 2 + arch/arm64/kernel/mte.c | 3 + arch/arm64/kernel/paravirt.c | 29 +- arch/mips/lantiq/falcon/sysctrl.c | 2 + arch/mips/lantiq/xway/gptu.c | 2 + arch/mips/lantiq/xway/sysctrl.c | 46 ++- arch/riscv/boot/dts/sifive/fu540-c000.dtsi | 2 +- arch/s390/pci/pci.c | 1 + arch/s390/pci/pci_bus.h | 3 +- arch/s390/pci/pci_clp.c | 9 +- arch/s390/pci/pci_event.c | 7 +- arch/x86/crypto/chacha-avx512vl-x86_64.S | 4 +- arch/x86/kvm/mmu/mmu.c | 10 +- arch/x86/um/shared/sysdep/syscalls_64.h | 5 +- drivers/block/drbd/drbd_main.c | 7 +- drivers/clk/at91/clk-generated.c | 4 + drivers/crypto/qcom-rng.c | 1 + drivers/crypto/stm32/stm32-crc32.c | 4 +- drivers/gpio/gpio-mvebu.c | 3 + drivers/gpio/gpio-vf610.c | 8 +- drivers/gpu/drm/drm_dp_mst_topology.c | 1 + drivers/i2c/busses/i2c-mt7621.c | 10 +- drivers/input/input.c | 19 ++ drivers/input/touchscreen/ili210x.c | 4 +- drivers/input/touchscreen/stmfts.c | 8 +- .../net/ethernet/aquantia/atlantic/aq_ring.c | 20 +- .../aquantia/atlantic/hw_atl/hw_atl_b0.c | 7 + drivers/net/ethernet/broadcom/bcmsysport.c | 6 +- drivers/net/ethernet/cadence/macb_main.c | 2 +- drivers/net/ethernet/dec/tulip/tulip_core.c | 5 +- drivers/net/ethernet/intel/ice/ice_main.c | 7 +- drivers/net/ethernet/intel/igb/igb_main.c | 3 +- drivers/net/ethernet/intel/igc/igc_base.c | 10 +- drivers/net/ethernet/intel/igc/igc_hw.h | 1 + drivers/net/ethernet/intel/igc/igc_main.c | 18 +- drivers/net/ethernet/intel/igc/igc_phy.c | 6 +- .../net/ethernet/mellanox/mlx5/core/en_main.c | 7 + drivers/net/ethernet/qlogic/qla3xxx.c | 3 +- .../net/ethernet/stmicro/stmmac/stmmac_pci.c | 4 +- drivers/net/ipa/gsi.c | 6 +- drivers/net/vmxnet3/vmxnet3_drv.c | 6 + drivers/nvme/host/core.c | 1 + drivers/nvme/host/multipath.c | 25 +- drivers/nvme/host/nvme.h | 4 + drivers/nvme/host/pci.c | 5 +- drivers/pci/pci.c | 10 + drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c | 14 +- drivers/platform/chrome/cros_ec_debugfs.c | 12 +- drivers/rtc/class.c | 9 + drivers/rtc/rtc-mc146818-lib.c | 16 +- drivers/rtc/rtc-pcf2127.c | 3 +- drivers/rtc/rtc-sun6i.c | 14 +- drivers/scsi/qla2xxx/qla_target.c | 3 + drivers/usb/gadget/legacy/raw_gadget.c | 2 + drivers/vhost/net.c | 15 +- drivers/vhost/vdpa.c | 5 +- fs/afs/inode.c | 14 +- fs/gfs2/file.c | 4 +- fs/io_uring.c | 6 +- fs/ioctl.c | 2 +- fs/nilfs2/btnode.c | 23 +- fs/nilfs2/btnode.h | 1 + fs/nilfs2/btree.c | 27 +- fs/nilfs2/dat.c | 4 +- fs/nilfs2/gcinode.c | 7 +- fs/nilfs2/inode.c | 159 ++++++++- fs/nilfs2/mdt.c | 43 ++- fs/nilfs2/mdt.h | 6 +- fs/nilfs2/nilfs.h | 16 +- fs/nilfs2/page.c | 7 +- fs/nilfs2/segment.c | 9 +- fs/nilfs2/super.c | 5 +- include/linux/ceph/osd_client.h | 3 + include/linux/mc146818rtc.h | 2 + include/uapi/linux/dma-buf.h | 4 +- kernel/module.c | 18 +- net/bridge/br_input.c | 7 + net/ceph/osd_client.c | 302 +++++++----------- net/ipv4/route.c | 12 +- net/key/af_key.c | 6 +- net/mac80211/rx.c | 3 +- net/nfc/nci/data.c | 2 +- net/nfc/nci/hci.c | 4 +- net/sched/act_pedit.c | 4 + net/wireless/nl80211.c | 18 +- security/selinux/ss/hashtab.c | 3 +- sound/isa/wavefront/wavefront_synth.c | 3 +- sound/pci/hda/patch_realtek.c | 9 + sound/usb/quirks-table.h | 9 + tools/perf/bench/numa.c | 2 +- tools/testing/selftests/net/fcnal-test.sh | 12 + tools/virtio/Makefile | 3 +- 97 files changed, 786 insertions(+), 433 deletions(-) -- 2.20.1

1 82

[PATCH openEuler-5.10-LTS 00/66] Backport 5.10.117 LTS
by Zheng Zengkai 16 Aug '22

16 Aug '22

Backport 5.10.117 LTS patches from upstream. git cherry-pick v5.10.116..v5.10.117~1 -s Complicts: Already merged(2): e68b60ae29de1 SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() 29f077d07051 io_uring: always use original task when preparing req identity Context conflict: 7e849dbe604d cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp() Total patches: 68 - 2 = 66 Alexandra Winter (3): s390/ctcm: fix variable dereferenced before check s390/ctcm: fix potential memory leak s390/lcs: fix variable dereferenced before check Andreas Gruenbacher (1): gfs2: Fix filesystem block deallocation for short writes AngeloGioacchino Del Regno (2): serial: 8250_mtk: Fix UART_EFR register address serial: 8250_mtk: Fix register address for XON/XOFF character Camel Guo (1): hwmon: (tmp401) Add OF device ID table ChiYuan Huang (1): usb: typec: tcpci_mt6360: Update for BMC PHY setting Christophe JAILLET (1): drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name() Dan Aloni (1): nfs: fix broken handling of the softreval mount option Dan Vacura (1): usb: gadget: uvc: allow for application to cleanly shutdown Daniel Starke (1): tty: n_gsm: fix mux activation issues in gsm_config() Eric Dumazet (2): netlink: do not reset transport header in netlink_recvmsg() tcp: resalt the secret every 10 seconds Ethan Yang (1): USB: serial: qcserial: add support for Sierra Wireless EM7590 Florian Fainelli (2): net: bcmgenet: Check for Wake-on-LAN interrupt probe deferral net: dsa: bcm_sf2: Fix Wake-on-LAN with mac_link_down() Francesco Dolcini (1): net: phy: Fix race condition on link status change Guangguan Wang (1): net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending Guenter Roeck (1): iwlwifi: iwl-dbg: Use del_timer_sync() before freeing Gustavo A. R. Silva (1): SUNRPC: Fix fall-through warnings for Clang Jeff Layton (1): ceph: fix setting of xattrs on async created inodes Jesse Brandeburg (1): dim: initialize all struct fields Ji-Ze Hong (Peter Hong) (1): hwmon: (f71882fg) Fix negative temperature Jiapeng Chong (1): sfc: Use swap() instead of open coding it Joel Savitz (1): selftests: vm: Makefile: rename TARGETS to VMTARGETS Johannes Berg (1): mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection Lokesh Dhoundiyal (1): ipv4: drop dst in multicast routing path Manikanta Pubbisetty (1): mac80211: Reset MBSSID parameters upon connection Manuel Ullmann (1): net: atlantic: always deep reset on pm op, fixing up my null deref regression Mark Brown (3): ASoC: max98090: Reject invalid values in custom control put() ASoC: max98090: Generate notifications on changes for custom control ASoC: ops: Validate input values in snd_soc_put_volsw_range() Matthew Hagan (1): net: sfp: Add tx-fault workaround for Huawei MA5671A SFP ONT Maxim Mikityanskiy (1): tls: Fix context leak on tls_device_down Miaoqian Lin (1): slimbus: qcom: Fix IRQ check in qcom_slim_probe Michael Tretter (1): usb: gadget: uvc: rename function to be more consistent Mike Rapoport (1): arm[64]/memremap: don't abuse pfn_valid() to ensure presence of linear map Nicolas Dichtel (1): ping: fix address binding wrt vrf Paolo Abeni (1): net/sched: act_pedit: really ensure the skb is writable Randy Dunlap (1): hwmon: (ltq-cputemp) restrict it to SOC_XWAY Robin Murphy (1): drm/nouveau/tegra: Stop using iommu_present() Scott Chen (1): USB: serial: pl2303: add device id for HP LM930 Display Sergey Ryazanov (1): usb: cdc-wdm: fix reading stuck on device close Shravya Kumbham (1): net: emaclite: Don't advertise 1000BASE-T and do auto negotiation Sven Eckelmann (1): batman-adv: Don't skb_split skbuffs with frag_list Sven Schnelle (1): s390: disable -Warray-bounds Sven Schwermer (2): USB: serial: option: add Fibocom L610 modem USB: serial: option: add Fibocom MA510 modem Taehee Yoo (2): net: sfc: fix memory leak due to ptp channel net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe() Tariq Toukan (1): net: Fix features skip in for_each_netdev_feature() Thiébaud Weksteen (1): firmware_loader: use kernel credentials when reading firmware Trond Myklebust (3): SUNRPC: Clean up scheduling of autoclose SUNRPC: Prevent immediate close+reconnect SUNRPC: Don't call connect() more than once on a TCP socket Uwe Kleine-König (1): usb: typec: tcpci: Don't skip cleanup in .remove() on error Vladimir Oltean (4): net: mscc: ocelot: fix last VCAP IS1/IS2 filter persisting in hardware when deleted net: mscc: ocelot: fix VCAP IS2 filters matching on both lookups net: mscc: ocelot: restrict tc-trap actions to VCAP IS2 lookup 0 net: mscc: ocelot: avoid corrupting hardware counters when moving VCAP filters Waiman Long (1): cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp() Xiaomeng Tong (1): i40e: i40e_main: fix a missing check on list iterator Yang Yingliang (2): ionic: fix missing pci_release_regions() on error in ionic_probe() tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe() Zack Rusin (1): drm/vmwgfx: Initialize drm_mode_fb_cmd2 arch/arm/include/asm/io.h | 3 ++ arch/arm/mm/ioremap.c | 8 ++++ arch/arm64/include/asm/io.h | 4 ++ arch/arm64/mm/ioremap.c | 9 ++++ arch/s390/Makefile | 10 +++++ drivers/base/firmware_loader/main.c | 17 +++++++ drivers/gpu/drm/nouveau/nouveau_backlight.c | 9 ++-- .../drm/nouveau/nvkm/engine/device/tegra.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +- drivers/hwmon/Kconfig | 2 +- drivers/hwmon/f71882fg.c | 5 ++- drivers/hwmon/tmp401.c | 11 +++++ drivers/net/dsa/bcm_sf2.c | 3 ++ .../ethernet/aquantia/atlantic/aq_pci_func.c | 4 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 4 ++ drivers/net/ethernet/intel/i40e/i40e_main.c | 27 +++++------ drivers/net/ethernet/mscc/ocelot_flower.c | 5 ++- drivers/net/ethernet/mscc/ocelot_vcap.c | 9 +++- .../ethernet/pensando/ionic/ionic_bus_pci.c | 3 +- drivers/net/ethernet/sfc/ef10.c | 5 +++ drivers/net/ethernet/sfc/efx_channels.c | 21 +++++---- drivers/net/ethernet/sfc/ptp.c | 14 +++++- drivers/net/ethernet/sfc/ptp.h | 1 + drivers/net/ethernet/xilinx/xilinx_emaclite.c | 15 ------- drivers/net/phy/phy.c | 45 ++++++++++++++++--- drivers/net/phy/sfp.c | 12 ++++- .../net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 2 +- drivers/net/wireless/mac80211_hwsim.c | 3 ++ drivers/s390/net/ctcm_mpc.c | 6 +-- drivers/s390/net/ctcm_sysfs.c | 5 ++- drivers/s390/net/lcs.c | 7 +-- drivers/slimbus/qcom-ctrl.c | 4 +- drivers/tty/n_gsm.c | 12 +++-- drivers/tty/serial/8250/8250_mtk.c | 22 +++++---- drivers/tty/serial/digicolor-usart.c | 5 +-- drivers/usb/class/cdc-wdm.c | 1 + drivers/usb/gadget/function/f_uvc.c | 32 +++++++++++-- drivers/usb/gadget/function/uvc.h | 2 + drivers/usb/gadget/function/uvc_v4l2.c | 3 +- drivers/usb/serial/option.c | 4 ++ drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + drivers/usb/serial/qcserial.c | 2 + drivers/usb/typec/tcpm/tcpci.c | 2 +- drivers/usb/typec/tcpm/tcpci_mt6360.c | 26 +++++++++++ fs/ceph/file.c | 16 +++++-- fs/gfs2/bmap.c | 11 +++-- fs/nfs/fs_context.c | 2 +- include/linux/netdev_features.h | 4 +- include/linux/sunrpc/xprtsock.h | 1 + include/net/tc_act/tc_pedit.h | 1 + kernel/cgroup/cpuset.c | 7 ++- lib/dim/net_dim.c | 44 +++++++++--------- net/batman-adv/fragmentation.c | 11 +++++ net/core/secure_seq.c | 12 +++-- net/ipv4/ping.c | 15 ++++++- net/ipv4/route.c | 1 + net/mac80211/mlme.c | 6 +++ net/netlink/af_netlink.c | 1 - net/sched/act_pedit.c | 26 +++++++++-- net/smc/smc_rx.c | 4 +- net/sunrpc/rpc_pipe.c | 1 + net/sunrpc/xprt.c | 29 +++++++----- net/sunrpc/xprtsock.c | 21 +++++---- net/tls/tls_device.c | 3 ++ sound/soc/codecs/max98090.c | 5 ++- sound/soc/soc-ops.c | 18 +++++++- tools/testing/selftests/vm/Makefile | 10 ++--- 68 files changed, 468 insertions(+), 171 deletions(-) -- 2.20.1

1 66

[PATCH openEuler-5.10-LTS 01/22] drivers/perf: hisi: Add driver for HiSilicon PCIe PMU
by Zheng Zengkai 16 Aug '22

16 Aug '22

From: Qi Liu <liuqi115(a)huawei.com> mainline inclusion from mainline-v5.17-rc1 commit 8404b0fbc7fb category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5AZ87 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------------------------------------------------- PCIe PMU Root Complex Integrated End Point(RCiEP) device is supported to sample bandwidth, latency, buffer occupation etc. Each PMU RCiEP device monitors multiple Root Ports, and each RCiEP is registered as a PMU in /sys/bus/event_source/devices, so users can select target PMU, and use filter to do further sets. Filtering options contains: event - select the event. port - select target Root Ports. Information of Root Ports are shown under sysfs. bdf - select requester_id of target EP device. trig_len - set trigger condition for starting event statistics. trig_mode - set trigger mode. 0 means starting to statistic when bigger than trigger condition, and 1 means smaller. thr_len - set threshold for statistics. thr_mode - set threshold mode. 0 means count when bigger than threshold, and 1 means smaller. Acked-by: Krzysztof Wilczyński <kw(a)linux.com> Reviewed-by: John Garry <john.garry(a)huawei.com> Signed-off-by: Qi Liu <liuqi115(a)huawei.com> Reviewed-by: Shaokun Zhang <zhangshaokun(a)hisilicon.com> Link: https://lore.kernel.org/r/20211202080633.2919-3-liuqi115@huawei.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Wangming Shao <shaowangming(a)h-partners.com> Reviewed-by: Junhao He <hejunhao3(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- MAINTAINERS | 2 + drivers/perf/hisilicon/Kconfig | 9 + drivers/perf/hisilicon/Makefile | 2 + drivers/perf/hisilicon/hisi_pcie_pmu.c | 951 +++++++++++++++++++++++++ include/linux/cpuhotplug.h | 3 + 5 files changed, 967 insertions(+) create mode 100644 drivers/perf/hisilicon/hisi_pcie_pmu.c diff --git a/MAINTAINERS b/MAINTAINERS index 23a23bd94c00..d3d6cad63b94 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -7976,8 +7976,10 @@ F: Documentation/devicetree/bindings/misc/hisilicon-hikey-usb.yaml HISILICON PMU DRIVER M: Shaokun Zhang <zhangshaokun(a)hisilicon.com> +M: Qi Liu <liuqi115(a)huawei.com> S: Supported W: http://www.hisilicon.com +F: Documentation/admin-guide/perf/hisi-pcie-pmu.rst F: Documentation/admin-guide/perf/hisi-pmu.rst F: drivers/perf/hisilicon diff --git a/drivers/perf/hisilicon/Kconfig b/drivers/perf/hisilicon/Kconfig index c5d1b7019fff..5546218b5598 100644 --- a/drivers/perf/hisilicon/Kconfig +++ b/drivers/perf/hisilicon/Kconfig @@ -5,3 +5,12 @@ config HISI_PMU help Support for HiSilicon SoC L3 Cache performance monitor, Hydra Home Agent performance monitor and DDR Controller performance monitor. + +config HISI_PCIE_PMU + tristate "HiSilicon PCIE PERF PMU" + depends on PCI && ARM64 + help + Provide support for HiSilicon PCIe performance monitoring unit (PMU) + RCiEP devices. + Adds the PCIe PMU into perf events system for monitoring latency, + bandwidth etc. diff --git a/drivers/perf/hisilicon/Makefile b/drivers/perf/hisilicon/Makefile index 7643c9f93e36..506ed39e3266 100644 --- a/drivers/perf/hisilicon/Makefile +++ b/drivers/perf/hisilicon/Makefile @@ -2,3 +2,5 @@ obj-$(CONFIG_HISI_PMU) += hisi_uncore_pmu.o hisi_uncore_l3c_pmu.o \ hisi_uncore_hha_pmu.o hisi_uncore_ddrc_pmu.o hisi_uncore_sllc_pmu.o \ hisi_uncore_pa_pmu.o + +obj-$(CONFIG_HISI_PCIE_PMU) += hisi_pcie_pmu.o diff --git a/drivers/perf/hisilicon/hisi_pcie_pmu.c b/drivers/perf/hisilicon/hisi_pcie_pmu.c new file mode 100644 index 000000000000..2f18838754ec --- /dev/null +++ b/drivers/perf/hisilicon/hisi_pcie_pmu.c @@ -0,0 +1,951 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * This driver adds support for PCIe PMU RCiEP device. Related + * perf events are bandwidth, latency etc. + * + * Copyright (C) 2021 HiSilicon Limited + * Author: Qi Liu <liuqi115(a)huawei.com> + */ +#include <linux/bitfield.h> +#include <linux/bitmap.h> +#include <linux/bug.h> +#include <linux/device.h> +#include <linux/err.h> +#include <linux/interrupt.h> +#include <linux/irq.h> +#include <linux/kernel.h> +#include <linux/list.h> +#include <linux/module.h> +#include <linux/pci.h> +#include <linux/perf_event.h> + +#define DRV_NAME "hisi_pcie_pmu" +/* Define registers */ +#define HISI_PCIE_GLOBAL_CTRL 0x00 +#define HISI_PCIE_EVENT_CTRL 0x010 +#define HISI_PCIE_CNT 0x090 +#define HISI_PCIE_EXT_CNT 0x110 +#define HISI_PCIE_INT_STAT 0x150 +#define HISI_PCIE_INT_MASK 0x154 +#define HISI_PCIE_REG_BDF 0xfe0 +#define HISI_PCIE_REG_VERSION 0xfe4 +#define HISI_PCIE_REG_INFO 0xfe8 + +/* Define command in HISI_PCIE_GLOBAL_CTRL */ +#define HISI_PCIE_GLOBAL_EN 0x01 +#define HISI_PCIE_GLOBAL_NONE 0 + +/* Define command in HISI_PCIE_EVENT_CTRL */ +#define HISI_PCIE_EVENT_EN BIT_ULL(20) +#define HISI_PCIE_RESET_CNT BIT_ULL(22) +#define HISI_PCIE_INIT_SET BIT_ULL(34) +#define HISI_PCIE_THR_EN BIT_ULL(26) +#define HISI_PCIE_TARGET_EN BIT_ULL(32) +#define HISI_PCIE_TRIG_EN BIT_ULL(52) + +/* Define offsets in HISI_PCIE_EVENT_CTRL */ +#define HISI_PCIE_EVENT_M GENMASK_ULL(15, 0) +#define HISI_PCIE_THR_MODE_M GENMASK_ULL(27, 27) +#define HISI_PCIE_THR_M GENMASK_ULL(31, 28) +#define HISI_PCIE_TARGET_M GENMASK_ULL(52, 36) +#define HISI_PCIE_TRIG_MODE_M GENMASK_ULL(53, 53) +#define HISI_PCIE_TRIG_M GENMASK_ULL(59, 56) + +#define HISI_PCIE_MAX_COUNTERS 8 +#define HISI_PCIE_REG_STEP 8 +#define HISI_PCIE_THR_MAX_VAL 10 +#define HISI_PCIE_TRIG_MAX_VAL 10 +#define HISI_PCIE_MAX_PERIOD (GENMASK_ULL(63, 0)) +#define HISI_PCIE_INIT_VAL BIT_ULL(63) + +struct hisi_pcie_pmu { + struct perf_event *hw_events[HISI_PCIE_MAX_COUNTERS]; + struct hlist_node node; + struct pci_dev *pdev; + struct pmu pmu; + void __iomem *base; + int irq; + u32 identifier; + /* Minimum and maximum BDF of root ports monitored by PMU */ + u16 bdf_min; + u16 bdf_max; + int on_cpu; +}; + +struct hisi_pcie_reg_pair { + u16 lo; + u16 hi; +}; + +#define to_pcie_pmu(p) (container_of((p), struct hisi_pcie_pmu, pmu)) +#define GET_PCI_DEVFN(bdf) ((bdf) & 0xff) + +#define HISI_PCIE_PMU_FILTER_ATTR(_name, _config, _hi, _lo) \ + static u64 hisi_pcie_get_##_name(struct perf_event *event) \ + { \ + return FIELD_GET(GENMASK(_hi, _lo), event->attr._config); \ + } \ + +HISI_PCIE_PMU_FILTER_ATTR(event, config, 16, 0); +HISI_PCIE_PMU_FILTER_ATTR(thr_len, config1, 3, 0); +HISI_PCIE_PMU_FILTER_ATTR(thr_mode, config1, 4, 4); +HISI_PCIE_PMU_FILTER_ATTR(trig_len, config1, 8, 5); +HISI_PCIE_PMU_FILTER_ATTR(trig_mode, config1, 9, 9); +HISI_PCIE_PMU_FILTER_ATTR(port, config2, 15, 0); +HISI_PCIE_PMU_FILTER_ATTR(bdf, config2, 31, 16); + +static ssize_t hisi_pcie_format_sysfs_show(struct device *dev, struct device_attribute *attr, + char *buf) +{ + struct dev_ext_attribute *eattr; + + eattr = container_of(attr, struct dev_ext_attribute, attr); + + return sysfs_emit(buf, "%s\n", (char *)eattr->var); +} + +static ssize_t hisi_pcie_event_sysfs_show(struct device *dev, struct device_attribute *attr, + char *buf) +{ + struct perf_pmu_events_attr *pmu_attr = + container_of(attr, struct perf_pmu_events_attr, attr); + + return sysfs_emit(buf, "config=0x%llx\n", pmu_attr->id); +} + +#define HISI_PCIE_PMU_FORMAT_ATTR(_name, _format) \ + (&((struct dev_ext_attribute[]){ \ + { .attr = __ATTR(_name, 0444, hisi_pcie_format_sysfs_show, \ + NULL), \ + .var = (void *)_format } \ + })[0].attr.attr) + +#define HISI_PCIE_PMU_EVENT_ATTR(_name, _id) \ + (&((struct perf_pmu_events_attr[]) { \ + { .attr = __ATTR(_name, 0444, hisi_pcie_event_sysfs_show, NULL), \ + .id = _id, } \ + })[0].attr.attr) + +static ssize_t cpumask_show(struct device *dev, struct device_attribute *attr, char *buf) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(dev_get_drvdata(dev)); + + return cpumap_print_to_pagebuf(true, buf, cpumask_of(pcie_pmu->on_cpu)); +} +static DEVICE_ATTR_RO(cpumask); + +static ssize_t identifier_show(struct device *dev, struct device_attribute *attr, char *buf) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(dev_get_drvdata(dev)); + + return sysfs_emit(buf, "%#x\n", pcie_pmu->identifier); +} +static DEVICE_ATTR_RO(identifier); + +static ssize_t bus_show(struct device *dev, struct device_attribute *attr, char *buf) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(dev_get_drvdata(dev)); + + return sysfs_emit(buf, "%#04x\n", PCI_BUS_NUM(pcie_pmu->bdf_min)); +} +static DEVICE_ATTR_RO(bus); + +static struct hisi_pcie_reg_pair +hisi_pcie_parse_reg_value(struct hisi_pcie_pmu *pcie_pmu, u32 reg_off) +{ + u32 val = readl_relaxed(pcie_pmu->base + reg_off); + struct hisi_pcie_reg_pair regs = { + .lo = val, + .hi = val >> 16, + }; + + return regs; +} + +/* + * Hardware counter and ext_counter work together for bandwidth, latency, bus + * utilization and buffer occupancy events. For example, RX memory write latency + * events(index = 0x0010), counter counts total delay cycles and ext_counter + * counts RX memory write PCIe packets number. + * + * As we don't want PMU driver to process these two data, "delay cycles" can + * be treated as an independent event(index = 0x0010), "RX memory write packets + * number" as another(index = 0x10010). BIT 16 is used to distinguish and 0-15 + * bits are "real" event index, which can be used to set HISI_PCIE_EVENT_CTRL. + */ +#define EXT_COUNTER_IS_USED(idx) ((idx) & BIT(16)) + +static u32 hisi_pcie_get_real_event(struct perf_event *event) +{ + return hisi_pcie_get_event(event) & GENMASK(15, 0); +} + +static u32 hisi_pcie_pmu_get_offset(u32 offset, u32 idx) +{ + return offset + HISI_PCIE_REG_STEP * idx; +} + +static u32 hisi_pcie_pmu_readl(struct hisi_pcie_pmu *pcie_pmu, u32 reg_offset, + u32 idx) +{ + u32 offset = hisi_pcie_pmu_get_offset(reg_offset, idx); + + return readl_relaxed(pcie_pmu->base + offset); +} + +static void hisi_pcie_pmu_writel(struct hisi_pcie_pmu *pcie_pmu, u32 reg_offset, u32 idx, u32 val) +{ + u32 offset = hisi_pcie_pmu_get_offset(reg_offset, idx); + + writel_relaxed(val, pcie_pmu->base + offset); +} + +static u64 hisi_pcie_pmu_readq(struct hisi_pcie_pmu *pcie_pmu, u32 reg_offset, u32 idx) +{ + u32 offset = hisi_pcie_pmu_get_offset(reg_offset, idx); + + return readq_relaxed(pcie_pmu->base + offset); +} + +static void hisi_pcie_pmu_writeq(struct hisi_pcie_pmu *pcie_pmu, u32 reg_offset, u32 idx, u64 val) +{ + u32 offset = hisi_pcie_pmu_get_offset(reg_offset, idx); + + writeq_relaxed(val, pcie_pmu->base + offset); +} + +static void hisi_pcie_pmu_config_filter(struct perf_event *event) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + u64 reg = HISI_PCIE_INIT_SET; + u64 port, trig_len, thr_len; + + /* Config HISI_PCIE_EVENT_CTRL according to event. */ + reg |= FIELD_PREP(HISI_PCIE_EVENT_M, hisi_pcie_get_real_event(event)); + + /* Config HISI_PCIE_EVENT_CTRL according to root port or EP device. */ + port = hisi_pcie_get_port(event); + if (port) + reg |= FIELD_PREP(HISI_PCIE_TARGET_M, port); + else + reg |= HISI_PCIE_TARGET_EN | + FIELD_PREP(HISI_PCIE_TARGET_M, hisi_pcie_get_bdf(event)); + + /* Config HISI_PCIE_EVENT_CTRL according to trigger condition. */ + trig_len = hisi_pcie_get_trig_len(event); + if (trig_len) { + reg |= FIELD_PREP(HISI_PCIE_TRIG_M, trig_len); + reg |= FIELD_PREP(HISI_PCIE_TRIG_MODE_M, hisi_pcie_get_trig_mode(event)); + reg |= HISI_PCIE_TRIG_EN; + } + + /* Config HISI_PCIE_EVENT_CTRL according to threshold condition. */ + thr_len = hisi_pcie_get_thr_len(event); + if (thr_len) { + reg |= FIELD_PREP(HISI_PCIE_THR_M, thr_len); + reg |= FIELD_PREP(HISI_PCIE_THR_MODE_M, hisi_pcie_get_thr_mode(event)); + reg |= HISI_PCIE_THR_EN; + } + + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EVENT_CTRL, hwc->idx, reg); +} + +static void hisi_pcie_pmu_clear_filter(struct perf_event *event) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EVENT_CTRL, hwc->idx, HISI_PCIE_INIT_SET); +} + +static bool hisi_pcie_pmu_valid_requester_id(struct hisi_pcie_pmu *pcie_pmu, u32 bdf) +{ + struct pci_dev *root_port, *pdev; + u16 rp_bdf; + + pdev = pci_get_domain_bus_and_slot(pci_domain_nr(pcie_pmu->pdev->bus), PCI_BUS_NUM(bdf), + GET_PCI_DEVFN(bdf)); + if (!pdev) + return false; + + root_port = pcie_find_root_port(pdev); + if (!root_port) { + pci_dev_put(pdev); + return false; + } + + pci_dev_put(pdev); + rp_bdf = pci_dev_id(root_port); + return rp_bdf >= pcie_pmu->bdf_min && rp_bdf <= pcie_pmu->bdf_max; +} + +static bool hisi_pcie_pmu_valid_filter(struct perf_event *event, + struct hisi_pcie_pmu *pcie_pmu) +{ + u32 requester_id = hisi_pcie_get_bdf(event); + + if (hisi_pcie_get_thr_len(event) > HISI_PCIE_THR_MAX_VAL) + return false; + + if (hisi_pcie_get_trig_len(event) > HISI_PCIE_TRIG_MAX_VAL) + return false; + + if (requester_id) { + if (!hisi_pcie_pmu_valid_requester_id(pcie_pmu, requester_id)) + return false; + } + + return true; +} + +static bool hisi_pcie_pmu_cmp_event(struct perf_event *target, + struct perf_event *event) +{ + return hisi_pcie_get_real_event(target) == hisi_pcie_get_real_event(event); +} + +static bool hisi_pcie_pmu_validate_event_group(struct perf_event *event) +{ + struct perf_event *sibling, *leader = event->group_leader; + struct perf_event *event_group[HISI_PCIE_MAX_COUNTERS]; + int counters = 1; + int num; + + event_group[0] = leader; + if (!is_software_event(leader)) { + if (leader->pmu != event->pmu) + return false; + + if (leader != event && !hisi_pcie_pmu_cmp_event(leader, event)) + event_group[counters++] = event; + } + + for_each_sibling_event(sibling, event->group_leader) { + if (is_software_event(sibling)) + continue; + + if (sibling->pmu != event->pmu) + return false; + + for (num = 0; num < counters; num++) { + if (hisi_pcie_pmu_cmp_event(event_group[num], sibling)) + break; + } + + if (num == counters) + event_group[counters++] = sibling; + } + + return counters <= HISI_PCIE_MAX_COUNTERS; +} + +static int hisi_pcie_pmu_event_init(struct perf_event *event) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + + event->cpu = pcie_pmu->on_cpu; + + if (EXT_COUNTER_IS_USED(hisi_pcie_get_event(event))) + hwc->event_base = HISI_PCIE_EXT_CNT; + else + hwc->event_base = HISI_PCIE_CNT; + + if (event->attr.type != event->pmu->type) + return -ENOENT; + + /* Sampling is not supported. */ + if (is_sampling_event(event) || event->attach_state & PERF_ATTACH_TASK) + return -EOPNOTSUPP; + + if (!hisi_pcie_pmu_valid_filter(event, pcie_pmu)) + return -EINVAL; + + if (!hisi_pcie_pmu_validate_event_group(event)) + return -EINVAL; + + return 0; +} + +static u64 hisi_pcie_pmu_read_counter(struct perf_event *event) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + u32 idx = event->hw.idx; + + return hisi_pcie_pmu_readq(pcie_pmu, event->hw.event_base, idx); +} + +static int hisi_pcie_pmu_find_related_event(struct hisi_pcie_pmu *pcie_pmu, + struct perf_event *event) +{ + struct perf_event *sibling; + int idx; + + for (idx = 0; idx < HISI_PCIE_MAX_COUNTERS; idx++) { + sibling = pcie_pmu->hw_events[idx]; + if (!sibling) + continue; + + if (!hisi_pcie_pmu_cmp_event(sibling, event)) + continue; + + /* Related events must be used in group */ + if (sibling->group_leader == event->group_leader) + return idx; + else + return -EINVAL; + } + + return idx; +} + +static int hisi_pcie_pmu_get_event_idx(struct hisi_pcie_pmu *pcie_pmu) +{ + int idx; + + for (idx = 0; idx < HISI_PCIE_MAX_COUNTERS; idx++) { + if (!pcie_pmu->hw_events[idx]) + return idx; + } + + return -EINVAL; +} + +static void hisi_pcie_pmu_event_update(struct perf_event *event) +{ + struct hw_perf_event *hwc = &event->hw; + u64 new_cnt, prev_cnt, delta; + + do { + prev_cnt = local64_read(&hwc->prev_count); + new_cnt = hisi_pcie_pmu_read_counter(event); + } while (local64_cmpxchg(&hwc->prev_count, prev_cnt, + new_cnt) != prev_cnt); + + delta = (new_cnt - prev_cnt) & HISI_PCIE_MAX_PERIOD; + local64_add(delta, &event->count); +} + +static void hisi_pcie_pmu_read(struct perf_event *event) +{ + hisi_pcie_pmu_event_update(event); +} + +static void hisi_pcie_pmu_set_period(struct perf_event *event) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + int idx = hwc->idx; + + local64_set(&hwc->prev_count, HISI_PCIE_INIT_VAL); + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_CNT, idx, HISI_PCIE_INIT_VAL); + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EXT_CNT, idx, HISI_PCIE_INIT_VAL); +} + +static void hisi_pcie_pmu_enable_counter(struct hisi_pcie_pmu *pcie_pmu, struct hw_perf_event *hwc) +{ + u32 idx = hwc->idx; + u64 val; + + val = hisi_pcie_pmu_readq(pcie_pmu, HISI_PCIE_EVENT_CTRL, idx); + val |= HISI_PCIE_EVENT_EN; + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EVENT_CTRL, idx, val); +} + +static void hisi_pcie_pmu_disable_counter(struct hisi_pcie_pmu *pcie_pmu, struct hw_perf_event *hwc) +{ + u32 idx = hwc->idx; + u64 val; + + val = hisi_pcie_pmu_readq(pcie_pmu, HISI_PCIE_EVENT_CTRL, idx); + val &= ~HISI_PCIE_EVENT_EN; + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EVENT_CTRL, idx, val); +} + +static void hisi_pcie_pmu_enable_int(struct hisi_pcie_pmu *pcie_pmu, struct hw_perf_event *hwc) +{ + u32 idx = hwc->idx; + + hisi_pcie_pmu_writel(pcie_pmu, HISI_PCIE_INT_MASK, idx, 0); +} + +static void hisi_pcie_pmu_disable_int(struct hisi_pcie_pmu *pcie_pmu, struct hw_perf_event *hwc) +{ + u32 idx = hwc->idx; + + hisi_pcie_pmu_writel(pcie_pmu, HISI_PCIE_INT_MASK, idx, 1); +} + +static void hisi_pcie_pmu_reset_counter(struct hisi_pcie_pmu *pcie_pmu, int idx) +{ + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EVENT_CTRL, idx, HISI_PCIE_RESET_CNT); + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EVENT_CTRL, idx, HISI_PCIE_INIT_SET); +} + +static void hisi_pcie_pmu_start(struct perf_event *event, int flags) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + int idx = hwc->idx; + u64 prev_cnt; + + if (WARN_ON_ONCE(!(hwc->state & PERF_HES_STOPPED))) + return; + + WARN_ON_ONCE(!(hwc->state & PERF_HES_UPTODATE)); + hwc->state = 0; + + hisi_pcie_pmu_config_filter(event); + hisi_pcie_pmu_enable_counter(pcie_pmu, hwc); + hisi_pcie_pmu_enable_int(pcie_pmu, hwc); + hisi_pcie_pmu_set_period(event); + + if (flags & PERF_EF_RELOAD) { + prev_cnt = local64_read(&hwc->prev_count); + hisi_pcie_pmu_writeq(pcie_pmu, hwc->event_base, idx, prev_cnt); + } + + perf_event_update_userpage(event); +} + +static void hisi_pcie_pmu_stop(struct perf_event *event, int flags) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + + hisi_pcie_pmu_event_update(event); + hisi_pcie_pmu_disable_int(pcie_pmu, hwc); + hisi_pcie_pmu_disable_counter(pcie_pmu, hwc); + hisi_pcie_pmu_clear_filter(event); + WARN_ON_ONCE(hwc->state & PERF_HES_STOPPED); + hwc->state |= PERF_HES_STOPPED; + + if (hwc->state & PERF_HES_UPTODATE) + return; + + hwc->state |= PERF_HES_UPTODATE; +} + +static int hisi_pcie_pmu_add(struct perf_event *event, int flags) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + int idx; + + hwc->state = PERF_HES_STOPPED | PERF_HES_UPTODATE; + + /* Check all working events to find a related event. */ + idx = hisi_pcie_pmu_find_related_event(pcie_pmu, event); + if (idx < 0) + return idx; + + /* Current event shares an enabled counter with the related event */ + if (idx < HISI_PCIE_MAX_COUNTERS) { + hwc->idx = idx; + goto start_count; + } + + idx = hisi_pcie_pmu_get_event_idx(pcie_pmu); + if (idx < 0) + return idx; + + hwc->idx = idx; + pcie_pmu->hw_events[idx] = event; + /* Reset Counter to avoid previous statistic interference. */ + hisi_pcie_pmu_reset_counter(pcie_pmu, idx); + +start_count: + if (flags & PERF_EF_START) + hisi_pcie_pmu_start(event, PERF_EF_RELOAD); + + return 0; +} + +static void hisi_pcie_pmu_del(struct perf_event *event, int flags) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + + hisi_pcie_pmu_stop(event, PERF_EF_UPDATE); + pcie_pmu->hw_events[hwc->idx] = NULL; + perf_event_update_userpage(event); +} + +static void hisi_pcie_pmu_enable(struct pmu *pmu) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(pmu); + int num; + + for (num = 0; num < HISI_PCIE_MAX_COUNTERS; num++) { + if (pcie_pmu->hw_events[num]) + break; + } + + if (num == HISI_PCIE_MAX_COUNTERS) + return; + + writel(HISI_PCIE_GLOBAL_EN, pcie_pmu->base + HISI_PCIE_GLOBAL_CTRL); +} + +static void hisi_pcie_pmu_disable(struct pmu *pmu) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(pmu); + + writel(HISI_PCIE_GLOBAL_NONE, pcie_pmu->base + HISI_PCIE_GLOBAL_CTRL); +} + +static irqreturn_t hisi_pcie_pmu_irq(int irq, void *data) +{ + struct hisi_pcie_pmu *pcie_pmu = data; + irqreturn_t ret = IRQ_NONE; + struct perf_event *event; + u32 overflown; + int idx; + + for (idx = 0; idx < HISI_PCIE_MAX_COUNTERS; idx++) { + overflown = hisi_pcie_pmu_readl(pcie_pmu, HISI_PCIE_INT_STAT, idx); + if (!overflown) + continue; + + /* Clear status of interrupt. */ + hisi_pcie_pmu_writel(pcie_pmu, HISI_PCIE_INT_STAT, idx, 1); + event = pcie_pmu->hw_events[idx]; + if (!event) + continue; + + hisi_pcie_pmu_event_update(event); + hisi_pcie_pmu_set_period(event); + ret = IRQ_HANDLED; + } + + return ret; +} + +static int hisi_pcie_pmu_irq_register(struct pci_dev *pdev, struct hisi_pcie_pmu *pcie_pmu) +{ + int irq, ret; + + ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_MSI); + if (ret < 0) { + pci_err(pdev, "Failed to enable MSI vectors: %d\n", ret); + return ret; + } + + irq = pci_irq_vector(pdev, 0); + ret = request_irq(irq, hisi_pcie_pmu_irq, IRQF_NOBALANCING | IRQF_NO_THREAD, DRV_NAME, + pcie_pmu); + if (ret) { + pci_err(pdev, "Failed to register IRQ: %d\n", ret); + pci_free_irq_vectors(pdev); + return ret; + } + + pcie_pmu->irq = irq; + + return 0; +} + +static void hisi_pcie_pmu_irq_unregister(struct pci_dev *pdev, struct hisi_pcie_pmu *pcie_pmu) +{ + free_irq(pcie_pmu->irq, pcie_pmu); + pci_free_irq_vectors(pdev); +} + +static int hisi_pcie_pmu_online_cpu(unsigned int cpu, struct hlist_node *node) +{ + struct hisi_pcie_pmu *pcie_pmu = hlist_entry_safe(node, struct hisi_pcie_pmu, node); + + if (pcie_pmu->on_cpu == -1) { + pcie_pmu->on_cpu = cpu; + WARN_ON(irq_set_affinity(pcie_pmu->irq, cpumask_of(cpu))); + } + + return 0; +} + +static int hisi_pcie_pmu_offline_cpu(unsigned int cpu, struct hlist_node *node) +{ + struct hisi_pcie_pmu *pcie_pmu = hlist_entry_safe(node, struct hisi_pcie_pmu, node); + unsigned int target; + + /* Nothing to do if this CPU doesn't own the PMU */ + if (pcie_pmu->on_cpu != cpu) + return 0; + + pcie_pmu->on_cpu = -1; + /* Choose a new CPU from all online cpus. */ + target = cpumask_first(cpu_online_mask); + if (target >= nr_cpu_ids) { + pci_err(pcie_pmu->pdev, "There is no CPU to set\n"); + return 0; + } + + perf_pmu_migrate_context(&pcie_pmu->pmu, cpu, target); + /* Use this CPU for event counting */ + pcie_pmu->on_cpu = target; + WARN_ON(irq_set_affinity(pcie_pmu->irq, cpumask_of(target))); + + return 0; +} + +static struct attribute *hisi_pcie_pmu_events_attr[] = { + HISI_PCIE_PMU_EVENT_ATTR(rx_mwr_latency, 0x0010), + HISI_PCIE_PMU_EVENT_ATTR(rx_mwr_cnt, 0x10010), + HISI_PCIE_PMU_EVENT_ATTR(rx_mrd_latency, 0x0210), + HISI_PCIE_PMU_EVENT_ATTR(rx_mrd_cnt, 0x10210), + HISI_PCIE_PMU_EVENT_ATTR(tx_mrd_latency, 0x0011), + HISI_PCIE_PMU_EVENT_ATTR(tx_mrd_cnt, 0x10011), + HISI_PCIE_PMU_EVENT_ATTR(rx_mrd_flux, 0x1005), + HISI_PCIE_PMU_EVENT_ATTR(rx_mrd_time, 0x11005), + HISI_PCIE_PMU_EVENT_ATTR(tx_mrd_flux, 0x2004), + HISI_PCIE_PMU_EVENT_ATTR(tx_mrd_time, 0x12004), + NULL +}; + +static struct attribute_group hisi_pcie_pmu_events_group = { + .name = "events", + .attrs = hisi_pcie_pmu_events_attr, +}; + +static struct attribute *hisi_pcie_pmu_format_attr[] = { + HISI_PCIE_PMU_FORMAT_ATTR(event, "config:0-16"), + HISI_PCIE_PMU_FORMAT_ATTR(thr_len, "config1:0-3"), + HISI_PCIE_PMU_FORMAT_ATTR(thr_mode, "config1:4"), + HISI_PCIE_PMU_FORMAT_ATTR(trig_len, "config1:5-8"), + HISI_PCIE_PMU_FORMAT_ATTR(trig_mode, "config1:9"), + HISI_PCIE_PMU_FORMAT_ATTR(port, "config2:0-15"), + HISI_PCIE_PMU_FORMAT_ATTR(bdf, "config2:16-31"), + NULL +}; + +static const struct attribute_group hisi_pcie_pmu_format_group = { + .name = "format", + .attrs = hisi_pcie_pmu_format_attr, +}; + +static struct attribute *hisi_pcie_pmu_bus_attrs[] = { + &dev_attr_bus.attr, + NULL +}; + +static const struct attribute_group hisi_pcie_pmu_bus_attr_group = { + .attrs = hisi_pcie_pmu_bus_attrs, +}; + +static struct attribute *hisi_pcie_pmu_cpumask_attrs[] = { + &dev_attr_cpumask.attr, + NULL +}; + +static const struct attribute_group hisi_pcie_pmu_cpumask_attr_group = { + .attrs = hisi_pcie_pmu_cpumask_attrs, +}; + +static struct attribute *hisi_pcie_pmu_identifier_attrs[] = { + &dev_attr_identifier.attr, + NULL +}; + +static const struct attribute_group hisi_pcie_pmu_identifier_attr_group = { + .attrs = hisi_pcie_pmu_identifier_attrs, +}; + +static const struct attribute_group *hisi_pcie_pmu_attr_groups[] = { + &hisi_pcie_pmu_events_group, + &hisi_pcie_pmu_format_group, + &hisi_pcie_pmu_bus_attr_group, + &hisi_pcie_pmu_cpumask_attr_group, + &hisi_pcie_pmu_identifier_attr_group, + NULL +}; + +static int hisi_pcie_alloc_pmu(struct pci_dev *pdev, struct hisi_pcie_pmu *pcie_pmu) +{ + struct hisi_pcie_reg_pair regs; + u16 sicl_id, core_id; + char *name; + + regs = hisi_pcie_parse_reg_value(pcie_pmu, HISI_PCIE_REG_BDF); + pcie_pmu->bdf_min = regs.lo; + pcie_pmu->bdf_max = regs.hi; + + regs = hisi_pcie_parse_reg_value(pcie_pmu, HISI_PCIE_REG_INFO); + sicl_id = regs.hi; + core_id = regs.lo; + + name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "hisi_pcie%u_core%u", sicl_id, core_id); + if (!name) + return -ENOMEM; + + pcie_pmu->pdev = pdev; + pcie_pmu->on_cpu = -1; + pcie_pmu->identifier = readl(pcie_pmu->base + HISI_PCIE_REG_VERSION); + pcie_pmu->pmu = (struct pmu) { + .name = name, + .module = THIS_MODULE, + .event_init = hisi_pcie_pmu_event_init, + .pmu_enable = hisi_pcie_pmu_enable, + .pmu_disable = hisi_pcie_pmu_disable, + .add = hisi_pcie_pmu_add, + .del = hisi_pcie_pmu_del, + .start = hisi_pcie_pmu_start, + .stop = hisi_pcie_pmu_stop, + .read = hisi_pcie_pmu_read, + .task_ctx_nr = perf_invalid_context, + .attr_groups = hisi_pcie_pmu_attr_groups, + .capabilities = PERF_PMU_CAP_NO_EXCLUDE, + }; + + return 0; +} + +static int hisi_pcie_init_pmu(struct pci_dev *pdev, struct hisi_pcie_pmu *pcie_pmu) +{ + int ret; + + pcie_pmu->base = pci_ioremap_bar(pdev, 2); + if (!pcie_pmu->base) { + pci_err(pdev, "Ioremap failed for pcie_pmu resource\n"); + return -ENOMEM; + } + + ret = hisi_pcie_alloc_pmu(pdev, pcie_pmu); + if (ret) + goto err_iounmap; + + ret = hisi_pcie_pmu_irq_register(pdev, pcie_pmu); + if (ret) + goto err_iounmap; + + ret = cpuhp_state_add_instance(CPUHP_AP_PERF_ARM_HISI_PCIE_PMU_ONLINE, &pcie_pmu->node); + if (ret) { + pci_err(pdev, "Failed to register hotplug: %d\n", ret); + goto err_irq_unregister; + } + + ret = perf_pmu_register(&pcie_pmu->pmu, pcie_pmu->pmu.name, -1); + if (ret) { + pci_err(pdev, "Failed to register PCIe PMU: %d\n", ret); + goto err_hotplug_unregister; + } + + return ret; + +err_hotplug_unregister: + cpuhp_state_remove_instance_nocalls( + CPUHP_AP_PERF_ARM_HISI_PCIE_PMU_ONLINE, &pcie_pmu->node); + +err_irq_unregister: + hisi_pcie_pmu_irq_unregister(pdev, pcie_pmu); + +err_iounmap: + iounmap(pcie_pmu->base); + + return ret; +} + +static void hisi_pcie_uninit_pmu(struct pci_dev *pdev) +{ + struct hisi_pcie_pmu *pcie_pmu = pci_get_drvdata(pdev); + + perf_pmu_unregister(&pcie_pmu->pmu); + cpuhp_state_remove_instance_nocalls( + CPUHP_AP_PERF_ARM_HISI_PCIE_PMU_ONLINE, &pcie_pmu->node); + hisi_pcie_pmu_irq_unregister(pdev, pcie_pmu); + iounmap(pcie_pmu->base); +} + +static int hisi_pcie_init_dev(struct pci_dev *pdev) +{ + int ret; + + ret = pcim_enable_device(pdev); + if (ret) { + pci_err(pdev, "Failed to enable PCI device: %d\n", ret); + return ret; + } + + ret = pcim_iomap_regions(pdev, BIT(2), DRV_NAME); + if (ret < 0) { + pci_err(pdev, "Failed to request PCI mem regions: %d\n", ret); + return ret; + } + + pci_set_master(pdev); + + return 0; +} + +static int hisi_pcie_pmu_probe(struct pci_dev *pdev, const struct pci_device_id *id) +{ + struct hisi_pcie_pmu *pcie_pmu; + int ret; + + pcie_pmu = devm_kzalloc(&pdev->dev, sizeof(*pcie_pmu), GFP_KERNEL); + if (!pcie_pmu) + return -ENOMEM; + + ret = hisi_pcie_init_dev(pdev); + if (ret) + return ret; + + ret = hisi_pcie_init_pmu(pdev, pcie_pmu); + if (ret) + return ret; + + pci_set_drvdata(pdev, pcie_pmu); + + return ret; +} + +static void hisi_pcie_pmu_remove(struct pci_dev *pdev) +{ + hisi_pcie_uninit_pmu(pdev); + pci_set_drvdata(pdev, NULL); +} + +static const struct pci_device_id hisi_pcie_pmu_ids[] = { + { PCI_DEVICE(PCI_VENDOR_ID_HUAWEI, 0xa12d) }, + { 0, } +}; +MODULE_DEVICE_TABLE(pci, hisi_pcie_pmu_ids); + +static struct pci_driver hisi_pcie_pmu_driver = { + .name = DRV_NAME, + .id_table = hisi_pcie_pmu_ids, + .probe = hisi_pcie_pmu_probe, + .remove = hisi_pcie_pmu_remove, +}; + +static int __init hisi_pcie_module_init(void) +{ + int ret; + + ret = cpuhp_setup_state_multi(CPUHP_AP_PERF_ARM_HISI_PCIE_PMU_ONLINE, + "AP_PERF_ARM_HISI_PCIE_PMU_ONLINE", + hisi_pcie_pmu_online_cpu, + hisi_pcie_pmu_offline_cpu); + if (ret) { + pr_err("Failed to setup PCIe PMU hotplug: %d\n", ret); + return ret; + } + + ret = pci_register_driver(&hisi_pcie_pmu_driver); + if (ret) + cpuhp_remove_multi_state(CPUHP_AP_PERF_ARM_HISI_PCIE_PMU_ONLINE); + + return ret; +} +module_init(hisi_pcie_module_init); + +static void __exit hisi_pcie_module_exit(void) +{ + pci_unregister_driver(&hisi_pcie_pmu_driver); + cpuhp_remove_multi_state(CPUHP_AP_PERF_ARM_HISI_PCIE_PMU_ONLINE); +} +module_exit(hisi_pcie_module_exit); + +MODULE_DESCRIPTION("HiSilicon PCIe PMU driver"); +MODULE_LICENSE("GPL v2"); +MODULE_AUTHOR("Qi Liu <liuqi115(a)huawei.com>"); diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h index b98b9eb7d5f8..24e7be132046 100644 --- a/include/linux/cpuhotplug.h +++ b/include/linux/cpuhotplug.h @@ -178,6 +178,9 @@ enum cpuhp_state { CPUHP_AP_PERF_ARM_HISI_L3_ONLINE, CPUHP_AP_PERF_ARM_HISI_PA_ONLINE, CPUHP_AP_PERF_ARM_HISI_SLLC_ONLINE, + #ifndef __GENKSYMS__ + CPUHP_AP_PERF_ARM_HISI_PCIE_PMU_ONLINE, + #endif CPUHP_AP_PERF_ARM_L2X0_ONLINE, CPUHP_AP_PERF_ARM_QCOM_L2_ONLINE, CPUHP_AP_PERF_ARM_QCOM_L3_ONLINE, -- 2.20.1

1 21

[PATCH openEuler-1.0-LTS] blk-mq: fix null pointer dereference in blk_mq_queue_tag_busy_ite
by Yongqiang Liu 16 Aug '22

16 Aug '22

From: Li Nan <linan122(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187489, https://gitee.com/openeuler/kernel/issues/I5MKPP CVE: NA -------------------------------- The q->tag_set can be NULL in blk_mq_queue_tag_busy_ite() while queue has not been initialized: CPU0 CPU1 dm_mq_init_request_queue md->tag_set = kzalloc_node blk_mq_init_allocated_queue q->mq_ops = set->ops; diskstats_show part_get_stat_info if(q->mq_ops) blk_mq_in_flight_with_stat blk_mq_queue_tag_busy_ite if (blk_mq_is_shared_tags(q->tag_set->flags)) //q->tag_set is null here q->tag_set = set blk_register_queue blk_queue_flag_set(QUEUE_FLAG_REGISTERED, q) There is same bug when cat /sys/block/[device]/inflight. Fix it by checking the flag 'QUEUE_FLAG_REGISTERED'. Althrough this may cause some io not to be counted temporarily, it doesn't hurt in real user case. Signed-off-by: Li Nan <linan122(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- block/blk-mq-tag.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c index bee92ab06a5e..c24802fe6ab2 100644 --- a/block/blk-mq-tag.c +++ b/block/blk-mq-tag.c @@ -374,6 +374,13 @@ void blk_mq_queue_tag_busy_iter(struct request_queue *q, busy_iter_fn *fn, struct blk_mq_hw_ctx *hctx; int i; + /* + * For dm, it can run here after register_disk, but the queue has not + * been initialized yet. Check QUEUE_FLAG_REGISTERED prevent null point + * access. + */ + if (!test_bit(QUEUE_FLAG_REGISTERED, &q->queue_flags)) + return; /* * __blk_mq_update_nr_hw_queues will update the nr_hw_queues and * queue_hw_ctx after freeze the queue, so we use q_usage_counter -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] arm64: Avoid premature usercopy failure for __arch_copy_to_user_generic_read
by Yongqiang Liu 16 Aug '22

16 Aug '22

From: Tong Tiangen <tongtiangen(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5MJU8 CVE: NA --------------------------------- Commit 1b1b4dede457 ("arm64: Avoid premature usercopy failure") fixes an usercopy failure issues, it introduced a variable srcin and used it in fixup routine, but the variable is not initialized in __arch_copy_to_user_generic_read(), this will cause an illegal pointer issue in fixup. Fixes: 1b1b4dede457 ("arm64: Avoid premature usercopy failure") Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> Tested-by: yongqiang Liu <liuyongqiang13(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/arm64/lib/copy_to_user.S | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/lib/copy_to_user.S b/arch/arm64/lib/copy_to_user.S index 84b7a16e82b5..6214e4972141 100644 --- a/arch/arm64/lib/copy_to_user.S +++ b/arch/arm64/lib/copy_to_user.S @@ -77,6 +77,7 @@ ENDPROC(__arch_copy_to_user) ENTRY(__arch_copy_to_user_generic_read) uaccess_enable_not_uao x3, x4, x5 add end, x0, x2 + mov srcin, x1 #include "copy_template_generic_read.S" uaccess_disable_not_uao x3, x4 -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] net_sched: cls_route: remove from list when handle is 0
by Yongqiang Liu 16 Aug '22

16 Aug '22

From: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> mainline inclusion from mainline-v6.0-rc1 commit 9ad36309e2719a884f946678e0296be10f0bb4c1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5LJLR CVE: CVE-2022-2588 -------------------------------- When a route filter is replaced and the old filter has a 0 handle, the old one won't be removed from the hashtable, while it will still be freed. The test was there since before commit 1109c00547fc ("net: sched: RCU cls_route"), when a new filter was not allocated when there was an old one. The old filter was reused and the reinserting would only be necessary if an old filter was replaced. That was still wrong for the same case where the old handle was 0. Remove the old filter from the list independently from its handle value. This fixes CVE-2022-2588, also reported as ZDI-CAN-17440. Reported-by: Zhenpeng Lin <zplin(a)u.northwestern.edu> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> Reviewed-by: Kamal Mostafa <kamal(a)canonical.com> Cc: <stable(a)vger.kernel.org> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Link: https://lore.kernel.org/r/20220809170518.164662-1-cascardo@canonical.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Xu Jia <xujia39(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/sched/cls_route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c index 0a0a22a0666d..c13903441ac1 100644 --- a/net/sched/cls_route.c +++ b/net/sched/cls_route.c @@ -528,7 +528,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb, rcu_assign_pointer(f->next, f1); rcu_assign_pointer(*fp, f); - if (fold && fold->handle && f->handle != fold->handle) { + if (fold) { th = to_hash(fold->handle); h = from_hash(fold->handle >> 16); b = rtnl_dereference(head->table[th]); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] Revert "x86/unwind/orc: Change REG_SP_INDIRECT"
by Yongqiang Liu 15 Aug '22

15 Aug '22

From: Yipeng Zou <zouyipeng(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5MC71 CVE: NA --------------------------------- This reverts commit 657a6bec17a04e9223a099608084ab5adc2582df. This patch was backport from mainline and intend to fix REG_SP_INDIRECT type in orc unwinder.The patch was fix an objtools problem on mainline, which The upstream commit havn't been merged in hulk-4.19,and it led to parse the sp value form orc data was wrong. So we need revert this patch. Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/x86/kernel/unwind_orc.c | 5 +---- tools/objtool/orc_dump.c | 2 +- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c index 3ff76f88e220..6c5d3b22ac61 100644 --- a/arch/x86/kernel/unwind_orc.c +++ b/arch/x86/kernel/unwind_orc.c @@ -450,7 +450,7 @@ bool unwind_next_frame(struct unwind_state *state) break; case ORC_REG_SP_INDIRECT: - sp = state->sp; + sp = state->sp + orc->sp_offset; indirect = true; break; @@ -500,9 +500,6 @@ bool unwind_next_frame(struct unwind_state *state) if (indirect) { if (!deref_stack_reg(state, sp, &sp)) goto err; - - if (orc->sp_reg == ORC_REG_SP_INDIRECT) - sp += orc->sp_offset; } /* Find IP, SP and possibly regs: */ diff --git a/tools/objtool/orc_dump.c b/tools/objtool/orc_dump.c index ba28830aace2..faa444270ee3 100644 --- a/tools/objtool/orc_dump.c +++ b/tools/objtool/orc_dump.c @@ -64,7 +64,7 @@ static void print_reg(unsigned int reg, int offset) if (reg == ORC_REG_BP_INDIRECT) printf("(bp%+d)", offset); else if (reg == ORC_REG_SP_INDIRECT) - printf("(sp)%+d", offset); + printf("(sp%+d)", offset); else if (reg == ORC_REG_UNDEFINED) printf("(und)"); else -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/3] scsi: iscsi: Add helper functions to manage iscsi_cls_conn
by Yongqiang Liu 15 Aug '22

15 Aug '22

From: Wenchao Hao <haowenchao(a)huawei.com> mainline inclusion from mainline-v5.18-rc1 commit ad515cada7dac3cdf5e1ad77a0ed696f5f34e0ab category: bugfix bugzilla: 187381, https://gitee.com/openeuler/kernel/issues/I5LBFL CVE: NA -------------------------------- - iscsi_alloc_conn(): Allocate and initialize iscsi_cls_conn - iscsi_add_conn(): Expose iscsi_cls_conn to userspace via sysfs - iscsi_remove_conn(): Remove iscsi_cls_conn from sysfs Link: https://lore.kernel.org/r/20220310015759.3296841-2-haowenchao@huawei.com Reviewed-by: Mike Christie <michael.christie(a)oracle.com> Signed-off-by: Wenchao Hao <haowenchao(a)huawei.com> Signed-off-by: Wu Bo <wubo40(a)huawei.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Conflict: drivers/scsi/scsi_transport_iscsi.c Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/scsi/scsi_transport_iscsi.c | 89 +++++++++++++++++++++++++++++ include/scsi/scsi_transport_iscsi.h | 4 ++ 2 files changed, 93 insertions(+) diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c index bd699906828f..eba74ac58735 100644 --- a/drivers/scsi/scsi_transport_iscsi.c +++ b/drivers/scsi/scsi_transport_iscsi.c @@ -2201,6 +2201,95 @@ void iscsi_free_session(struct iscsi_cls_session *session) } EXPORT_SYMBOL_GPL(iscsi_free_session); +/** + * iscsi_alloc_conn - alloc iscsi class connection + * @session: iscsi cls session + * @dd_size: private driver data size + * @cid: connection id + */ +struct iscsi_cls_conn * +iscsi_alloc_conn(struct iscsi_cls_session *session, int dd_size, uint32_t cid) +{ + struct iscsi_transport *transport = session->transport; + struct iscsi_cls_conn *conn; + + conn = kzalloc(sizeof(*conn) + dd_size, GFP_KERNEL); + if (!conn) + return NULL; + if (dd_size) + conn->dd_data = &conn[1]; + + mutex_init(&conn->ep_mutex); + INIT_LIST_HEAD(&conn->conn_list); + conn->transport = transport; + conn->cid = cid; + + /* this is released in the dev's release function */ + if (!get_device(&session->dev)) + goto free_conn; + + dev_set_name(&conn->dev, "connection%d:%u", session->sid, cid); + device_initialize(&conn->dev); + conn->dev.parent = &session->dev; + conn->dev.release = iscsi_conn_release; + + return conn; + +free_conn: + kfree(conn); + return NULL; +} +EXPORT_SYMBOL_GPL(iscsi_alloc_conn); + +/** + * iscsi_add_conn - add iscsi class connection + * @conn: iscsi cls connection + * + * This will expose iscsi_cls_conn to sysfs so make sure the related + * resources for sysfs attributes are initialized before calling this. + */ +int iscsi_add_conn(struct iscsi_cls_conn *conn) +{ + int err; + unsigned long flags; + struct iscsi_cls_session *session = iscsi_dev_to_session(conn->dev.parent); + + err = device_add(&conn->dev); + if (err) { + iscsi_cls_session_printk(KERN_ERR, session, + "could not register connection's dev\n"); + return err; + } + transport_register_device(&conn->dev); + + spin_lock_irqsave(&connlock, flags); + list_add(&conn->conn_list, &connlist); + spin_unlock_irqrestore(&connlock, flags); + + return 0; +} +EXPORT_SYMBOL_GPL(iscsi_add_conn); + +/** + * iscsi_remove_conn - remove iscsi class connection from sysfs + * @conn: iscsi cls connection + * + * Remove iscsi_cls_conn from sysfs, and wait for previous + * read/write of iscsi_cls_conn's attributes in sysfs to finish. + */ +void iscsi_remove_conn(struct iscsi_cls_conn *conn) +{ + unsigned long flags; + + spin_lock_irqsave(&connlock, flags); + list_del(&conn->conn_list); + spin_unlock_irqrestore(&connlock, flags); + + transport_unregister_device(&conn->dev); + device_del(&conn->dev); +} +EXPORT_SYMBOL_GPL(iscsi_remove_conn); + /** * iscsi_create_conn - create iscsi class connection * @session: iscsi cls session diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h index 848ba2822a21..105458b20cd8 100644 --- a/include/scsi/scsi_transport_iscsi.h +++ b/include/scsi/scsi_transport_iscsi.h @@ -446,6 +446,10 @@ extern struct iscsi_cls_session *iscsi_create_session(struct Scsi_Host *shost, unsigned int target_id); extern void iscsi_remove_session(struct iscsi_cls_session *session); extern void iscsi_free_session(struct iscsi_cls_session *session); +extern struct iscsi_cls_conn *iscsi_alloc_conn(struct iscsi_cls_session *sess, + int dd_size, uint32_t cid); +extern int iscsi_add_conn(struct iscsi_cls_conn *conn); +extern void iscsi_remove_conn(struct iscsi_cls_conn *conn); extern struct iscsi_cls_conn *iscsi_create_conn(struct iscsi_cls_session *sess, int dd_size, uint32_t cid); extern void iscsi_put_conn(struct iscsi_cls_conn *conn); -- 2.25.1

1 2

[PATCH 1/2] PCI: Add config control for phytium ACS quirks
by Laibin Qiu 15 Aug '22

15 Aug '22

From: Zheng Zengkai <zhengzengkai(a)huawei.com> phytium inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I41AUQ -------------------------------------- Use CONFIG_ARCH_PHYTIUM to control phytium ACS quirks. Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- drivers/pci/quirks.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c index 99657b9bc82e..c389cef5c7bd 100644 --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -4646,10 +4646,12 @@ static const struct pci_dev_acs_enabled { { PCI_VENDOR_ID_ZHAOXIN, 0x9083, pci_quirk_mf_endpoint_acs }, /* Zhaoxin Root/Downstream Ports */ { PCI_VENDOR_ID_ZHAOXIN, PCI_ANY_ID, pci_quirk_zhaoxin_pcie_ports_acs }, +#ifdef CONFIG_ARCH_PHYTIUM /* because PLX switch Vendor id is 0x10b5 on phytium cpu */ { 0x10b5, PCI_ANY_ID, pci_quirk_xgene_acs }, /* because rootcomplex Vendor id is 0x17cd on phytium cpu */ { 0x17cd, PCI_ANY_ID, pci_quirk_xgene_acs }, +#endif { 0 } }; -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/2] sched: Fix null-ptr-deref in free_fair_sched_group
by Yongqiang Liu 15 Aug '22

15 Aug '22

From: Hui Tang <tanghui20(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187419, https://gitee.com/openeuler/kernel/issues/I5LIPL CVE: NA ------------------------------- do_el0_svc+0x50/0x11c arch/arm64/kernel/syscall.c:217 el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353 el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369 el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683 ================================================================== BUG: KASAN: null-ptr-deref in rq_of kernel/sched/sched.h:1118 [inline] BUG: KASAN: null-ptr-deref in unthrottle_qos_sched_group kernel/sched/fair.c:7619 [inline] BUG: KASAN: null-ptr-deref in free_fair_sched_group+0x124/0x320 kernel/sched/fair.c:12131 Read of size 8 at addr 0000000000000130 by task syz-executor100/223 CPU: 3 PID: 223 Comm: syz-executor100 Not tainted 5.10.0 #6 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x40c arch/arm64/kernel/stacktrace.c:132 show_stack+0x30/0x40 arch/arm64/kernel/stacktrace.c:196 __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1b4/0x248 lib/dump_stack.c:118 __kasan_report mm/kasan/report.c:551 [inline] kasan_report+0x18c/0x210 mm/kasan/report.c:564 check_memory_region_inline mm/kasan/generic.c:187 [inline] __asan_load8+0x98/0xc0 mm/kasan/generic.c:253 rq_of kernel/sched/sched.h:1118 [inline] unthrottle_qos_sched_group kernel/sched/fair.c:7619 [inline] free_fair_sched_group+0x124/0x320 kernel/sched/fair.c:12131 sched_free_group kernel/sched/core.c:7767 [inline] sched_create_group+0x48/0xc0 kernel/sched/core.c:7798 cpu_cgroup_css_alloc+0x18/0x40 kernel/sched/core.c:7930 css_create+0x7c/0x4a0 kernel/cgroup/cgroup.c:5328 cgroup_apply_control_enable+0x288/0x340 kernel/cgroup/cgroup.c:3135 cgroup_apply_control kernel/cgroup/cgroup.c:3217 [inline] cgroup_subtree_control_write+0x668/0x8b0 kernel/cgroup/cgroup.c:3375 cgroup_file_write+0x1a8/0x37c kernel/cgroup/cgroup.c:3909 kernfs_fop_write_iter+0x220/0x2f4 fs/kernfs/file.c:296 call_write_iter include/linux/fs.h:1960 [inline] new_sync_write+0x260/0x370 fs/read_write.c:515 vfs_write+0x3dc/0x4ac fs/read_write.c:602 ksys_write+0xfc/0x200 fs/read_write.c:655 __do_sys_write fs/read_write.c:667 [inline] __se_sys_write fs/read_write.c:664 [inline] __arm64_sys_write+0x50/0x60 fs/read_write.c:664 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline] invoke_syscall arch/arm64/kernel/syscall.c:48 [inline] el0_svc_common.constprop.0+0xf4/0x414 arch/arm64/kernel/syscall.c:155 do_el0_svc+0x50/0x11c arch/arm64/kernel/syscall.c:217 el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353 el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369 el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683 So add check for tg->cfs_rq[i] before unthrottle_qos_sched_group() called. Signed-off-by: Hui Tang <tanghui20(a)huawei.com> Reviewed-by: Zhang Qiao <zhangqiao22(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/sched/fair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index bcc72537b6fa..a34ca843bf0a 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -10878,7 +10878,7 @@ void free_fair_sched_group(struct task_group *tg) for_each_possible_cpu(i) { #ifdef CONFIG_QOS_SCHED - if (tg->cfs_rq) + if (tg->cfs_rq && tg->cfs_rq[i]) unthrottle_qos_sched_group(tg->cfs_rq[i]); #endif if (tg->cfs_rq) -- 2.25.1

1 1

[PATCH openEuler-22.09 000/379] BPF CO-RE support
by Zheng Zengkai 12 Aug '22

12 Aug '22

Backport BPF CO-RE support patches for openEuler-22.09 Alan Maguire (5): libbpf: bpf__find_by_name[_kind] should use btf__get_nr_types() libbpf: BTF dumper support for typed data libbpf: Clarify/fix unaligned data issues for btf typed dump libbpf: Avoid use of __int128 in typed dump display libbpf: Propagate errors when retrieving enum value for typed data display Alexei Starovoitov (47): bpf: Optimize program stats bpf: Run sleepable programs with migration disabled bpf: Compute program stats for sleepable programs bpf: Add per-program recursion prevention mechanism selftest/bpf: Add a recursion test bpf: Count the number of times recursion was prevented selftests/bpf: Improve recursion selftest bpf: Allows per-cpu maps and map-in-map in sleepable programs selftests/bpf: Add a test for map-in-map and per-cpu maps in sleepable progs bpf: Clear per_cpu pointers during bpf_prog_realloc bpf: Dont allow vmlinux BTF to be used in map_create and prog_load. libbpf: Remove unused field. bpf: Introduce bpf_sys_bpf() helper and program type. bpf: Introduce bpfptr_t user/kernel pointer. bpf: Prepare bpf syscall to be used from kernel and user space. libbpf: Support for syscall program type bpf: Make btf_load command to be bpfptr_t compatible. bpf: Introduce fd_idx bpf: Add bpf_btf_find_by_name_kind() helper. bpf: Add bpf_sys_close() helper. libbpf: Change the order of data and text relocations. libbpf: Add bpf_object pointer to kernel_supports(). libbpf: Preliminary support for fd_idx libbpf: Generate loader program out of BPF ELF file. libbpf: Cleanup temp FDs when intermediate sys_bpf fails. libbpf: Introduce bpf_map__initial_value(). bpftool: Use syscall/loader program in "prog load" and "gen skeleton" command. bpf: Add cmd alias BPF_PROG_RUN bpf: Prepare bpf_prog_put() to be called from irq context. bpf: Factor out bpf_spin_lock into helpers. libbpf: Cleanup the layering between CORE and bpf_program. libbpf: Split bpf_core_apply_relo() into bpf_program independent helper. libbpf: Move CO-RE types into relo_core.h. libbpf: Split CO-RE logic into relo_core.c. libbpf: Make gen_loader data aligned. libbpf: Replace btf__type_by_id() with btf_type_by_id(). bpf: Rename btf_member accessors. bpf: Prepare relo_core.c for kernel duty. bpf: Define enum bpf_core_relo_kind as uapi. bpf: Pass a set of bpf_core_relo-s to prog_load command. bpf: Add bpf_core_add_cands() and wire it into bpf_core_apply_relo_insn(). libbpf: Use CO-RE in the kernel in light skeleton. libbpf: Support init of inner maps in light skeleton. libbpf: Clean gen_loader's attach kind. libbpf: Reduce bpf_core_apply_relo_insn() stack usage. bpf: Silence purge_cand_cache build warning. libbpf: Fix gen_loader assumption on number of programs. Andrei Matei (1): libbpf: Fail early when loading programs with unspecified type Andrew Delgadillo (1): selftests/bpf: Drop the need for LLVM's llc Andrii Nakryiko (149): libbpf: Factor out common operations in BTF writing APIs selftest/bpf: Relax btf_dedup test checks libbpf: Unify and speed up BTF string deduplication libbpf: Implement basic split BTF support selftests/bpf: Add split BTF basic test selftests/bpf: Add checking of raw type dump in BTF writer APIs selftests libbpf: Support BTF dedup of split BTFs libbpf: Accomodate DWARF/compiler bug with duplicated identical arrays selftests/bpf: Add split BTF dedup selftests tools/bpftool: Add bpftool support for split BTF bpf: Add in-kernel split BTF support bpf: Assign ID to vmlinux BTF and return extra info for BTF in GET_OBJ_INFO kbuild: Build kernel module BTFs if BTF is enabled and pahole supports it bpf: Load and verify kernel module BTFs tools/bpftool: Add support for in-kernel and named BTF in `btf show` bpf: Compile out btf_parse_module() if module BTF is not enabled bpf: Sanitize BTF data pointer after module is loaded tools/bpftool: Emit name <anon> for anonymous BTFs libbpf: Add base BTF accessor tools/bpftool: Auto-detect split BTFs in common cases bpf: Keep module's btf_data_size intact after load libbpf: Add internal helper to load BTF data by FD libbpf: Refactor CO-RE relocs to not assume a single BTF object libbpf: Add kernel module BTF support for CO-RE relocations selftests/bpf: Add bpf_testmod kernel module for testing selftests/bpf: Add support for marking sub-tests as skipped selftests/bpf: Add CO-RE relocs selftest relying on kernel module BTF bpf: Remove hard-coded btf_vmlinux assumption from BPF verifier bpf: Allow to specify kernel module BTFs when attaching BPF programs libbpf: Factor out low-level BPF program loading helper libbpf: Support attachment of BPF tracing programs to kernel modules selftests/bpf: Add tp_btf CO-RE reloc test for modules selftests/bpf: Add fentry/fexit/fmod_ret selftest for kernel module kbuild: Skip module BTF generation for out-of-tree external modules selftests/bpf: fix bpf_testmod.ko recompilation logic libbpf: Support modules in bpf_program__set_attach_target() API selftests/bpf: Work-around EBUSY errors from hashmap update/delete bpf: Allow empty module BTFs libbpf: Add user-space variants of BPF_CORE_READ() family of macros libbpf: Add non-CO-RE variants of BPF_CORE_READ() macro family selftests/bpf: Add tests for user- and non-CO-RE BPF_CORE_READ() variants libbpf: Clarify kernel type use with USER variants of CORE reading macros selftests/bpf: Sync RCU before unloading bpf_testmod bpf: Support BPF ksym variables in kernel modules libbpf: Support kernel module ksym externs selftests/bpf: Test kernel module ksym externs selftests/bpf: Don't exit on failed bpf_testmod unload libbpf: Stop using feature-detection Makefiles libbpf: provide NULL and KERNEL_VERSION macros in bpf_helpers.h libbpf: Expose btf_type_by_id() internally libbpf: Generalize BTF and BTF.ext type ID and strings iteration libbpf: Rename internal memory-management helpers libbpf: Extract internal set-of-strings datastructure APIs libbpf: Add generic BTF type shallow copy API libbpf: Add BPF static linker APIs libbpf: Add BPF static linker BTF and BTF.ext support bpftool: Add ability to specify custom skeleton object name bpftool: Add `gen object` command to perform BPF static linking selftests/bpf: Pass all BPF .o's through BPF static linker selftests/bpf: Add multi-file statically linked BPF object file test libbpf: Skip BTF fixup if object file has no BTF libbpf: Constify few bpf_program getters libbpf: Preserve empty DATASEC BTFs during static linking libbpf: Fix memory leak when emitting final btf_ext libbpf: Add bpf_map__inner_map API libbpf: Suppress compiler warning when using SEC() macro with externs libbpf: Mark BPF subprogs with hidden visibility as static for BPF verifier libbpf: Allow gaps in BPF program sections to support overriden weak functions libbpf: Refactor BTF map definition parsing libbpf: Factor out symtab and relos sanity checks libbpf: Make few internal helpers available outside of libbpf.c libbpf: Extend sanity checking ELF symbols with externs validation libbpf: Tighten BTF type ID rewriting with error checking libbpf: Add linker extern resolution support for functions and global variables libbpf: Support extern resolution for BTF-defined maps in .maps section libbpf: Support BTF_KIND_FLOAT during type compatibility checks in CO-RE bpftool: Strip const/volatile/restrict modifiers from .bss and .data vars libbpf: Add per-file linker opts selftests/bpf: Stop using static variables for passing data to/from user-space bpftool: Stop emitting static variables in BPF skeleton libbpf: Fix ELF symbol visibility update logic libbpf: Treat STV_INTERNAL same as STV_HIDDEN for functions libbpf: Reject static maps libbpf: Reject static entry-point BPF programs libbpf: Add libbpf_set_strict_mode() API to turn on libbpf 1.0 behaviors libbpf: Streamline error reporting for low-level APIs libbpf: Streamline error reporting for high-level APIs bpftool: Set errno on skeleton failures and propagate errors libbpf: Move few APIs from 0.4 to 0.5 version libbpf: Refactor header installation portions of Makefile libbpf: Install skel_internal.h header used from light skeletons selftests/bpf: Add remaining ASSERT_xxx() variants libbpf: Fix build with latest gcc/binutils with LTO libbpf: Make libbpf_version.h non-auto-generated selftests/bpf: Update selftests to always provide "struct_ops" SEC libbpf: Ensure BPF prog types are set before relocations libbpf: Simplify BPF program auto-attach code libbpf: Minimize explicit iterator of section definition array libbpf: Use pre-setup sec_def in libbpf_find_attach_btf_id() selftests/bpf: Stop using relaxed_core_relocs which has no effect libbpf: Deprecated bpf_object_open_opts.relaxed_core_relocs libbpf: Allow skipping attach_func_name in bpf_program__set_attach_target() libbpf: Schedule open_opts.attach_prog_fd deprecation since v0.7 libbpf: Constify all high-level program attach APIs selftests/bpf: Turn on libbpf 1.0 mode and fix all IS_ERR checks selftests/bpf: Switch fexit_bpf2bpf selftest to set_attach_target() API libbpf: Add "tc" SEC_DEF which is a better name for "classifier" libbpf: Add API that copies all BTF types from one BTF object to another libbpf: Deprecate btf__finalize_data() and move it into libbpf.c libbpf: Extract ELF processing state into separate struct libbpf: Refactor internal sec_def handling to enable pluggability libbpf: Reduce reliance of attach_fns on sec_def internals libbpf: Use Elf64-specific types explicitly for dealing with ELF libbpf: Remove assumptions about uniqueness of .rodata/.data/.bss maps bpftool: Support multiple .rodata/.data internal maps in skeleton bpftool: Improve skeleton generation for data maps without DATASEC type libbpf: Support multiple .rodata.* and .data.* BPF maps selftests/bpf: Demonstrate use of custom .rodata/.data sections libbpf: Simplify look up by name of internal maps selftests/bpf: Switch to ".bss"/".rodata"/".data" lookups for internal maps libbpf: Fix off-by-one bug in bpf_core_apply_relo() libbpf: Add ability to fetch bpf_program's underlying instructions libbpf: Deprecate multi-instance bpf_program APIs libbpf: Deprecate ambiguously-named bpf_program__size() API libbpf: Detect corrupted ELF symbols section libbpf: Improve sanity checking during BTF fix up libbpf: Validate that .BTF and .BTF.ext sections contain data libbpf: Fix section counting logic libbpf: Improve ELF relo sanitization libbpf: Deprecate bpf_program__load() API libbpf: Rename DECLARE_LIBBPF_OPTS into LIBBPF_OPTS selftests/bpf: Pass sanitizer flags to linker through LDFLAGS libbpf: Free up resources used by inner map definition selftests/bpf: Fix memory leaks in btf_type_c_dump() helper selftests/bpf: Free per-cpu values array in bpf_iter selftest selftests/bpf: Free inner strings index in btf selftest selftests/bpf: Avoid duplicate btf__parse() call libbpf: Load global data maps lazily on legacy kernels libbpf: Fix potential misaligned memory access in btf_ext__new() libbpf: Don't call libc APIs with NULL pointers libbpf: Fix glob_syms memory leak in bpf_linker libbpf: Fix using invalidated memory in bpf_linker selftests/bpf: Fix possible NULL passed to memcpy() with zero size selftests/bpf: Prevent misaligned memory access in get_stack_raw_tp test selftests/bpf: Fix misaligned memory access in queue_stack_map test selftests/bpf: Prevent out-of-bounds stack access in test_bpffs selftests/bpf: Fix misaligned accesses in xdp and xdp_bpf2bpf tests libbpf: Cleanup struct bpf_core_cand. libbpf: Fix non-C89 loop variable declaration in gen_loader.c Arnaldo Carvalho de Melo (1): libbpf: Provide GELF_ST_VISIBILITY() define for older libelf Brendan Jackman (15): tools/resolve_btfids: Fix some error messages bpf: Fix cold build of test_progs-no_alu32 bpf: Clarify return value of probe str helpers bpf: x86: Factor out emission of ModR/M for *(reg + off) bpf: x86: Factor out emission of REX byte bpf: x86: Factor out a lookup table for some ALU opcodes bpf: Rename BPF_XADD and prepare to encode other atomics in .imm bpf: Move BPF_STX reserved field check into BPF_STX verifier code bpf: Add BPF_FETCH field / create atomic_fetch_add instruction bpf: Add instructions for atomic_[cmp]xchg bpf: Pull out a macro for interpreting atomic ALU operations bpf: Add bitwise atomic instructions bpf: Add tests for new BPF atomic operations bpf: Document new atomic instructions bpf: Rename fixup_bpf_calls and add some comments Cong Wang (1): bpf: Clear percpu pointers in bpf_prog_clone_free() Daniel Xu (1): libbpf: Do not close un-owned FD 0 on errors Dave Marchevsky (1): bpf: Add verified_insns to bpf_prog_info and fdinfo Dmitrii Banshchikov (7): bpf: Rename bpf_reg_state variables bpf: Extract nullable reg type conversion into a helper function bpf: Support pointers in global func args selftests/bpf: Add unit tests for pointers in global functions bpf: Drop imprecise log message selftests/bpf: Fix a compiler warning in global func test bpf: Use MAX_BPF_FUNC_REG_ARGS macro Florent Revest (7): bpf: Be less specific about socket cookies guarantees selftests/bpf: Fix the ASSERT_ERR_PTR macro bpf: Factorize bpf_trace_printk and bpf_seq_printf bpf: Add a ARG_PTR_TO_CONST_STR argument type bpf: Add a bpf_snprintf helper libbpf: Introduce a BPF_SNPRINTF helper macro libbpf: Move BPF_SEQ_PRINTF and BPF_SNPRINTF to bpf_helpers.h Florian Lehner (2): selftests/bpf: Print reason when a tester could not run a program selftests/bpf: Avoid errno clobbering Gary Lin (3): bpf,x64: Pad NOPs to make images converge more easily test_bpf: Remove EXPECTED_FAIL flag from bpf_fill_maxinsns11 selftests/bpf: Add verifier tests for x64 jit jump padding Hao Luo (1): libbpf: Support weak typed ksyms. Hengqi Chen (8): libbpf: Fix KERNEL_VERSION macro tools/resolve_btfids: Emit warnings and patch zero id for missing symbols libbpf: Add btf__load_vmlinux_btf/btf__load_module_btf libbpf: Support uniform BTF-defined key/value specification across all BPF maps libbpf: Deprecate bpf_object__unload() API since v0.6 libbpf: Deprecate bpf_{map,program}__{prev,next} APIs since v0.7 selftests/bpf: Switch to new bpf_object__next_{map,program} APIs libbpf: Support static initialization of BPF_MAP_TYPE_PROG_ARRAY Ian Rogers (3): bpf, libbpf: Avoid unused function warning on bpf_tail_call_static tools/bpftool: Add -Wall when building BPF programs libbpf: Add NULL check to add_dummy_ksym_var Ilya Leoshkevich (5): selftests/bpf: Copy extras in out-of-srctree builds bpf: Add BTF_KIND_FLOAT to uapi libbpf: Fix whitespace in btf_add_composite() comment libbpf: Add BTF_KIND_FLOAT support bpf: Generate BTF_KIND_FLOAT when linking vmlinux Jason Wang (1): libbpf: Fix comment typo Jean-Philippe Brucker (12): tools: Factor HOSTCC, HOSTLD, HOSTAR definitions tools/runqslower: Use Makefile.include tools/runqslower: Enable out-of-tree build tools/runqslower: Build bpftool using HOSTCC tools/bpftool: Fix build slowdown selftests/bpf: Enable cross-building selftests/bpf: Fix out-of-tree build selftests/bpf: Move generated test files to $(TEST_GEN_FILES) selftests/bpf: Fix installation of urandom_read selftests/bpf: Install btf_dump test cases tools/bpftool: Fix cross-build tools/runqslower: Fix cross-build Jiri Olsa (3): tools/resolve_btfids: Warn when having multiple IDs for single type libbpf: Use string table index from index table if needed perf build: Move feature cleanup under tools/build Joe Stringer (1): tools: Sync uapi bpf.h header with latest changes Jonathan Edwards (1): libbpf: Add extra BPF_PROG_TYPE check to bpf_object__probe_loading Kumar Kartikeya Dwivedi (14): libbpf: Add various netlink helpers libbpf: Add low level TC-BPF management API libbpf: Remove unneeded check for flags during tc detach libbpf: Set NLM_F_EXCL when creating qdisc libbpf: Fix segfault in static linker for objects without BTF libbpf: Fix segfault in light skeleton for objects without BTF libbpf: Update gen_loader to emit BTF_KIND_FUNC relocations bpf: Add bpf_kallsyms_lookup_name helper libbpf: Add typeless ksym support to gen_loader libbpf: Add weak ksym support to gen_loader libbpf: Perform map fd cleanup for gen_loader in case of error bpf: Change bpf_kallsyms_lookup_name size type to ARG_CONST_SIZE_OR_ZERO libbpf: Avoid double stores for success/failure case of ksym relocations libbpf: Avoid reload of imm for weak, unresolved, repeating ksym Lorenz Bauer (2): bpf: Consolidate shared test timing code bpf: Add PROG_TEST_RUN support for sk_lookup programs Martin KaFai Lau (9): bpf: Simplify freeing logic in linfo and jited_linfo bpf: Refactor btf_check_func_arg_match bpf: Support bpf program calling kernel function bpf: Support kernel function call in x86-32 libbpf: Refactor bpf_object__resolve_ksyms_btf_id libbpf: Refactor codes for finding btf id of a kernel symbol libbpf: Rename RELO_EXTERN to RELO_EXTERN_VAR libbpf: Record extern sym relocation first libbpf: Support extern kernel function Martynas Pumputis (1): selftests/bpf: Check inner map deletion Matt Smith (3): libbpf: Change bpf_object_skeleton data field to const pointer bpftool: Provide a helper method for accessing skeleton's embedded ELF data selftests/bpf: Add checks for X__elf_bytes() skeleton helper Mauricio Vásquez (1): libbpf: Fix memory leak in btf__dedup() Michal Suchanek (1): libbpf: Fix pr_warn type warnings on 32bit Pedro Tammela (2): libbpf: Avoid inline hint definition from 'linux/stddef.h' libbpf: Clarify flags in ringbuf helpers Quentin Monnet (17): libbpf: Return non-null error on failures in libbpf_find_prog_btf_id() libbpf: Rename btf__load() as btf__load_into_kernel() libbpf: Rename btf__get_from_id() as btf__load_from_kernel_by_id() tools: Free BTF objects at various locations tools: Replace btf__get_from_id() with btf__load_from_kernel_by_id() libbpf: Add split BTF support for btf__load_from_kernel_by_id() tools: bpftool: Support dumping split BTF by id libbpf: Add LIBBPF_DEPRECATED_SINCE macro for scheduling API deprecations libbpf: Skip re-installing headers file if source is older than target bpftool: Remove unused includes to <bpf/bpf_gen_internal.h> bpftool: Install libbpf headers instead of including the dir tools/resolve_btfids: Install libbpf headers when building tools/runqslower: Install libbpf headers when building bpf: preload: Install libbpf headers when building bpf: iterators: Install libbpf headers when building selftests/bpf: Better clean up for runqslower in test_bpftool_build.sh bpftool: Add install-bin target to install binary only Rafael David Tinoco (1): libbpf: Add bpf object kern_version attribute setter Sedat Dilek (1): tools: Factor Clang, LLC and LLVM utils definitions Shuyi Cheng (2): libbpf: Introduce 'btf_custom_path' to 'bpf_obj_open_opts' libbpf: Add "bool skipped" to struct bpf_map Song Liu (5): bpf: Use separate lockdep class for each hashtab bpf: Avoid hashtab deadlock with map_locked bpftool: Add Makefile target bootstrap perf build: Support build BPF skeletons with perf perf stat: Enable counting events for BPF programs Stanislav Fomichev (2): libbpf: Cap retries in sys_bpf_prog_load libbpf: Skip bpf_object__probe_loading for light skeleton Toke Høiland-Jørgensen (5): bpf: Return target info when a tracing bpf_link is queried libbpf: Restore errno return for functions that were already returning it libbpf: Don't crash on object files with no symbol tables libbpf: Ignore STT_SECTION symbols in 'maps' section libbpf: Properly ignore STT_SECTION symbols in legacy map definitions Wang Hai (1): libbpf: Simplify the return expression of bpf_object__init_maps function Wang Qing (1): bpf, btf: Remove the duplicate btf_ids.h include Wedson Almeida Filho (1): bpf: Refactor check_cfg to use a structured loop. Yauheni Kaliuta (7): selftests/bpf: test_progs/sockopt_sk: Remove version selftests/bpf: test_progs/sockopt_sk: Convert to use BPF skeleton selftests/bpf: Pass page size from userspace in sockopt_sk selftests/bpf: Pass page size from userspace in map_ptr selftests/bpf: mmap: Use runtime page size selftests/bpf: ringbuf: Use runtime page size selftests/bpf: ringbuf_multi: Use runtime page size Yonghong Song (27): bpf: Permit cond_resched for some iterators bpf: Permit size-0 datasec bpf: Refactor BPF_PSEUDO_CALL checking as a helper function bpf: Factor out visit_func_call_insn() in check_cfg() bpf: Factor out verbose_invalid_scalar() bpf: Refactor check_func_call() to allow callback function bpf: Change return value of verifier function add_subprog() bpf: Add bpf_for_each_map_elem() helper libbpf: Move function is_ldimm64() earlier in libbpf.c libbpf: Support subprog address relocation selftests/bpf: Fix test_cpp compilation failure with clang bpftool: Fix a clang compilation warning libbpf: Add support for new llvm bpf relocations bpf: Emit better log message if bpf_iter ctx arg btf_id == 0 btf: Change BTF_KIND_* macros to enums bpf: Support for new btf kind BTF_KIND_TAG libbpf: Rename btf_{hash,equal}_int to btf_{hash,equal}_int_tag libbpf: Add support for BTF_KIND_TAG bpftool: Add support for BTF_KIND_TAG bpf: Add BTF_KIND_DECL_TAG typedef support docs/bpf: Update documentation for BTF_KIND_DECL_TAG typedef support bpf: Rename BTF_KIND_TAG to BTF_KIND_DECL_TAG bpf: Support BTF_KIND_TYPE_TAG for btf_type_tag attributes libbpf: Support BTF_KIND_TYPE_TAG bpftool: Support BTF_KIND_TYPE_TAG docs/bpf: Update documentation for BTF_KIND_TYPE_TAG support libbpf: Fix a couple of missed btf_type_tag handling in btf.c Documentation/ABI/testing/sysfs-kernel-btf | 8 + Documentation/bpf/btf.rst | 40 +- Documentation/networking/filter.rst | 61 +- arch/arm/net/bpf_jit_32.c | 7 +- arch/arm64/net/bpf_jit_comp.c | 16 +- arch/mips/net/ebpf_jit.c | 11 +- arch/powerpc/net/bpf_jit_comp64.c | 25 +- arch/riscv/net/bpf_jit_comp32.c | 20 +- arch/riscv/net/bpf_jit_comp64.c | 16 +- arch/s390/net/bpf_jit_comp.c | 27 +- arch/sparc/net/bpf_jit_comp_64.c | 17 +- arch/x86/net/bpf_jit_comp.c | 408 +- arch/x86/net/bpf_jit_comp32.c | 204 +- drivers/net/ethernet/netronome/nfp/bpf/fw.h | 4 +- drivers/net/ethernet/netronome/nfp/bpf/jit.c | 14 +- drivers/net/ethernet/netronome/nfp/bpf/main.h | 4 +- .../net/ethernet/netronome/nfp/bpf/verifier.c | 15 +- include/linux/bpf.h | 150 +- include/linux/bpf_types.h | 2 + include/linux/bpf_verifier.h | 46 +- include/linux/bpfptr.h | 75 + include/linux/btf.h | 106 +- include/linux/filter.h | 45 +- include/linux/module.h | 4 + include/uapi/linux/bpf.h | 265 +- include/uapi/linux/btf.h | 57 +- kernel/bpf/Makefile | 4 + kernel/bpf/bpf_iter.c | 43 +- kernel/bpf/bpf_struct_ops.c | 6 +- kernel/bpf/btf.c | 1403 ++++- kernel/bpf/core.c | 153 +- kernel/bpf/disasm.c | 56 +- kernel/bpf/hashtab.c | 130 +- kernel/bpf/helpers.c | 326 +- kernel/bpf/preload/Makefile | 25 +- kernel/bpf/preload/iterators/Makefile | 38 +- kernel/bpf/preload/iterators/iterators.bpf.c | 1 - kernel/bpf/syscall.c | 363 +- kernel/bpf/sysfs_btf.c | 2 +- kernel/bpf/task_iter.c | 2 + kernel/bpf/trampoline.c | 77 +- kernel/bpf/verifier.c | 1508 ++++- kernel/module.c | 36 + kernel/trace/bpf_trace.c | 375 +- lib/Kconfig.debug | 9 + lib/test_bpf.c | 21 +- net/bpf/test_run.c | 290 +- net/core/filter.c | 1 + net/ipv4/bpf_tcp_ca.c | 7 +- samples/bpf/bpf_insn.h | 4 +- samples/bpf/cookie_uid_helper_example.c | 8 +- samples/bpf/sock_example.c | 2 +- samples/bpf/test_cgrp2_attach.c | 5 +- samples/bpf/xdp1_user.c | 2 +- samples/bpf/xdp_sample_pkts_user.c | 2 +- scripts/Makefile.modfinal | 25 +- scripts/link-vmlinux.sh | 7 +- .../bpf/bpftool/Documentation/bpftool-gen.rst | 78 +- tools/bpf/bpftool/Makefile | 55 +- tools/bpf/bpftool/bash-completion/bpftool | 17 +- tools/bpf/bpftool/btf.c | 80 +- tools/bpf/bpftool/btf_dumper.c | 6 +- tools/bpf/bpftool/gen.c | 651 +- tools/bpf/bpftool/iter.c | 2 +- tools/bpf/bpftool/main.c | 20 +- tools/bpf/bpftool/main.h | 2 + tools/bpf/bpftool/map.c | 14 +- tools/bpf/bpftool/net.c | 2 +- tools/bpf/bpftool/prog.c | 141 +- tools/bpf/bpftool/xlated_dumper.c | 3 + tools/bpf/resolve_btfids/Makefile | 19 +- tools/bpf/resolve_btfids/main.c | 38 +- tools/bpf/runqslower/Makefile | 71 +- tools/build/Makefile | 8 +- tools/build/Makefile.feature | 4 +- tools/build/feature/Makefile | 4 +- tools/include/linux/filter.h | 24 +- tools/include/uapi/linux/bpf.h | 977 ++- tools/include/uapi/linux/btf.h | 57 +- tools/lib/bpf/.gitignore | 2 - tools/lib/bpf/Build | 2 +- tools/lib/bpf/Makefile | 104 +- tools/lib/bpf/bpf.c | 272 +- tools/lib/bpf/bpf.h | 1 + tools/lib/bpf/bpf_core_read.h | 169 +- tools/lib/bpf/bpf_gen_internal.h | 65 + tools/lib/bpf/bpf_helpers.h | 108 +- tools/lib/bpf/bpf_prog_linfo.c | 18 +- tools/lib/bpf/bpf_tracing.h | 44 +- tools/lib/bpf/btf.c | 2085 ++++--- tools/lib/bpf/btf.h | 99 +- tools/lib/bpf/btf_dump.c | 910 ++- tools/lib/bpf/gen_loader.c | 1126 ++++ tools/lib/bpf/libbpf.c | 5436 +++++++++-------- tools/lib/bpf/libbpf.h | 212 +- tools/lib/bpf/libbpf.map | 54 + tools/lib/bpf/libbpf_common.h | 26 +- tools/lib/bpf/libbpf_errno.c | 7 +- tools/lib/bpf/libbpf_internal.h | 299 +- tools/lib/bpf/libbpf_legacy.h | 60 + tools/lib/bpf/libbpf_version.h | 9 + tools/lib/bpf/linker.c | 2901 +++++++++ tools/lib/bpf/netlink.c | 593 +- tools/lib/bpf/nlattr.h | 48 + tools/lib/bpf/relo_core.c | 1322 ++++ tools/lib/bpf/relo_core.h | 57 + tools/lib/bpf/ringbuf.c | 26 +- tools/lib/bpf/skel_internal.h | 123 + tools/lib/bpf/strset.c | 176 + tools/lib/bpf/strset.h | 21 + tools/lib/bpf/xsk.c | 4 +- tools/perf/Documentation/perf-stat.txt | 18 + tools/perf/Makefile.config | 9 + tools/perf/Makefile.perf | 58 +- tools/perf/builtin-stat.c | 82 +- tools/perf/util/Build | 1 + tools/perf/util/bpf-event.c | 11 +- tools/perf/util/bpf_counter.c | 320 + tools/perf/util/bpf_counter.h | 72 + tools/perf/util/bpf_skel/.gitignore | 3 + .../util/bpf_skel/bpf_prog_profiler.bpf.c | 93 + tools/perf/util/evsel.c | 5 + tools/perf/util/evsel.h | 5 + tools/perf/util/python.c | 21 + tools/perf/util/stat-display.c | 4 +- tools/perf/util/stat.c | 2 +- tools/perf/util/target.c | 34 +- tools/perf/util/target.h | 10 + tools/scripts/Makefile.include | 18 + tools/testing/selftests/bpf/.gitignore | 1 + tools/testing/selftests/bpf/Makefile | 183 +- tools/testing/selftests/bpf/bench.c | 1 + .../selftests/bpf/benchs/bench_rename.c | 2 +- .../selftests/bpf/benchs/bench_ringbufs.c | 6 +- .../selftests/bpf/benchs/bench_trigger.c | 2 +- .../selftests/bpf/bpf_testmod/.gitignore | 6 + .../selftests/bpf/bpf_testmod/Makefile | 20 + .../bpf/bpf_testmod/bpf_testmod-events.h | 36 + .../selftests/bpf/bpf_testmod/bpf_testmod.c | 55 + .../selftests/bpf/bpf_testmod/bpf_testmod.h | 14 + tools/testing/selftests/bpf/btf_helpers.c | 264 + tools/testing/selftests/bpf/btf_helpers.h | 19 + .../selftests/bpf/prog_tests/atomics.c | 246 + .../selftests/bpf/prog_tests/attach_probe.c | 12 +- .../selftests/bpf/prog_tests/bpf_iter.c | 34 +- .../selftests/bpf/prog_tests/bpf_tcp_ca.c | 8 +- tools/testing/selftests/bpf/prog_tests/btf.c | 166 +- .../bpf/prog_tests/btf_dedup_split.c | 325 + .../selftests/bpf/prog_tests/btf_dump.c | 10 +- .../selftests/bpf/prog_tests/btf_endian.c | 4 +- .../selftests/bpf/prog_tests/btf_map_in_map.c | 33 - .../selftests/bpf/prog_tests/btf_split.c | 99 + .../selftests/bpf/prog_tests/btf_write.c | 47 +- .../bpf/prog_tests/cg_storage_multi.c | 84 +- .../bpf/prog_tests/cgroup_attach_multi.c | 6 +- .../selftests/bpf/prog_tests/cgroup_link.c | 16 +- .../bpf/prog_tests/cgroup_skb_sk_lookup.c | 2 +- .../selftests/bpf/prog_tests/core_autosize.c | 2 +- .../bpf/prog_tests/core_read_macros.c | 64 + .../selftests/bpf/prog_tests/core_reloc.c | 105 +- .../selftests/bpf/prog_tests/fexit_bpf2bpf.c | 68 +- .../selftests/bpf/prog_tests/fexit_stress.c | 4 +- .../selftests/bpf/prog_tests/flow_dissector.c | 2 +- .../bpf/prog_tests/flow_dissector_reattach.c | 10 +- .../bpf/prog_tests/get_stack_raw_tp.c | 24 +- .../prog_tests/get_stackid_cannot_attach.c | 9 +- .../selftests/bpf/prog_tests/global_data.c | 11 +- .../bpf/prog_tests/global_data_init.c | 2 +- .../bpf/prog_tests/global_func_args.c | 60 + .../selftests/bpf/prog_tests/hashmap.c | 9 +- .../selftests/bpf/prog_tests/kfree_skb.c | 23 +- .../selftests/bpf/prog_tests/ksyms_btf.c | 34 +- .../selftests/bpf/prog_tests/ksyms_module.c | 31 + .../selftests/bpf/prog_tests/link_pinning.c | 7 +- .../selftests/bpf/prog_tests/map_ptr.c | 15 +- tools/testing/selftests/bpf/prog_tests/mmap.c | 24 +- .../selftests/bpf/prog_tests/module_attach.c | 53 + .../selftests/bpf/prog_tests/obj_name.c | 8 +- .../selftests/bpf/prog_tests/perf_branches.c | 4 +- .../selftests/bpf/prog_tests/perf_buffer.c | 2 +- .../bpf/prog_tests/perf_event_stackmap.c | 3 +- .../selftests/bpf/prog_tests/probe_user.c | 7 +- .../selftests/bpf/prog_tests/prog_run_xattr.c | 2 +- .../bpf/prog_tests/queue_stack_map.c | 12 +- .../bpf/prog_tests/raw_tp_test_run.c | 4 +- .../selftests/bpf/prog_tests/rdonly_maps.c | 9 +- .../selftests/bpf/prog_tests/recursion.c | 41 + .../bpf/prog_tests/reference_tracking.c | 2 +- .../selftests/bpf/prog_tests/resolve_btfids.c | 9 +- .../selftests/bpf/prog_tests/ringbuf.c | 17 +- .../selftests/bpf/prog_tests/ringbuf_multi.c | 23 +- .../bpf/prog_tests/select_reuseport.c | 55 +- .../selftests/bpf/prog_tests/send_signal.c | 5 +- .../selftests/bpf/prog_tests/sk_lookup.c | 2 +- .../selftests/bpf/prog_tests/skeleton.c | 41 +- .../selftests/bpf/prog_tests/snprintf_btf.c | 4 +- .../selftests/bpf/prog_tests/sock_fields.c | 14 +- .../selftests/bpf/prog_tests/sockmap_basic.c | 6 +- .../selftests/bpf/prog_tests/sockmap_ktls.c | 2 +- .../selftests/bpf/prog_tests/sockmap_listen.c | 10 +- .../selftests/bpf/prog_tests/sockopt_sk.c | 66 +- .../bpf/prog_tests/stacktrace_build_id_nmi.c | 3 +- .../selftests/bpf/prog_tests/stacktrace_map.c | 2 +- .../bpf/prog_tests/stacktrace_map_raw_tp.c | 5 +- .../selftests/bpf/prog_tests/static_linked.c | 35 + .../bpf/prog_tests/tcp_hdr_options.c | 15 +- .../selftests/bpf/prog_tests/tcp_rtt.c | 2 +- .../selftests/bpf/prog_tests/test_bpffs.c | 4 +- .../bpf/prog_tests/test_global_funcs.c | 8 + .../selftests/bpf/prog_tests/test_overhead.c | 12 +- .../bpf/prog_tests/trampoline_count.c | 18 +- .../selftests/bpf/prog_tests/udp_limit.c | 7 +- tools/testing/selftests/bpf/prog_tests/xdp.c | 11 +- .../selftests/bpf/prog_tests/xdp_bpf2bpf.c | 8 +- .../selftests/bpf/prog_tests/xdp_link.c | 8 +- tools/testing/selftests/bpf/progs/atomics.c | 154 + tools/testing/selftests/bpf/progs/bpf_cubic.c | 6 +- .../bpf/progs/bpf_iter_bpf_hash_map.c | 1 - .../selftests/bpf/progs/bpf_iter_bpf_map.c | 1 - .../selftests/bpf/progs/bpf_iter_ipv6_route.c | 1 - .../selftests/bpf/progs/bpf_iter_netlink.c | 1 - .../selftests/bpf/progs/bpf_iter_task.c | 1 - .../selftests/bpf/progs/bpf_iter_task_btf.c | 1 - .../selftests/bpf/progs/bpf_iter_task_file.c | 1 - .../selftests/bpf/progs/bpf_iter_task_stack.c | 1 - .../selftests/bpf/progs/bpf_iter_tcp4.c | 1 - .../selftests/bpf/progs/bpf_iter_tcp6.c | 1 - .../selftests/bpf/progs/bpf_iter_test_kern4.c | 4 +- .../selftests/bpf/progs/bpf_iter_udp4.c | 1 - .../selftests/bpf/progs/bpf_iter_udp6.c | 1 - .../selftests/bpf/progs/core_reloc_types.h | 17 + tools/testing/selftests/bpf/progs/kfree_skb.c | 4 +- tools/testing/selftests/bpf/progs/lsm.c | 69 + .../selftests/bpf/progs/map_ptr_kern.c | 4 +- tools/testing/selftests/bpf/progs/recursion.c | 46 + .../testing/selftests/bpf/progs/sockopt_sk.c | 11 +- tools/testing/selftests/bpf/progs/tailcall3.c | 2 +- tools/testing/selftests/bpf/progs/tailcall4.c | 2 +- tools/testing/selftests/bpf/progs/tailcall5.c | 2 +- .../selftests/bpf/progs/tailcall_bpf2bpf2.c | 2 +- .../selftests/bpf/progs/tailcall_bpf2bpf4.c | 2 +- .../selftests/bpf/progs/test_cls_redirect.c | 4 +- .../bpf/progs/test_core_read_macros.c | 50 + .../bpf/progs/test_core_reloc_module.c | 96 + .../selftests/bpf/progs/test_global_func10.c | 29 + .../selftests/bpf/progs/test_global_func11.c | 19 + .../selftests/bpf/progs/test_global_func12.c | 21 + .../selftests/bpf/progs/test_global_func13.c | 24 + .../selftests/bpf/progs/test_global_func14.c | 21 + .../selftests/bpf/progs/test_global_func15.c | 22 + .../selftests/bpf/progs/test_global_func16.c | 22 + .../selftests/bpf/progs/test_global_func9.c | 132 + .../bpf/progs/test_global_func_args.c | 91 + .../selftests/bpf/progs/test_ksyms_module.c | 26 + .../selftests/bpf/progs/test_ksyms_weak.c | 56 + .../bpf/progs/test_map_in_map_invalid.c | 26 + tools/testing/selftests/bpf/progs/test_mmap.c | 2 - .../selftests/bpf/progs/test_module_attach.c | 66 + .../selftests/bpf/progs/test_rdonly_maps.c | 6 +- .../selftests/bpf/progs/test_ringbuf.c | 1 - .../selftests/bpf/progs/test_ringbuf_multi.c | 1 - .../selftests/bpf/progs/test_skeleton.c | 20 +- .../selftests/bpf/progs/test_sockmap_listen.c | 2 +- .../selftests/bpf/progs/test_static_linked1.c | 30 + .../selftests/bpf/progs/test_static_linked2.c | 31 + .../selftests/bpf/progs/test_subprogs.c | 13 + .../selftests/bpf/test_bpftool_build.sh | 4 + tools/testing/selftests/bpf/test_btf.h | 3 + .../selftests/bpf/test_cgroup_storage.c | 2 +- tools/testing/selftests/bpf/test_maps.c | 279 +- tools/testing/selftests/bpf/test_progs.c | 79 +- tools/testing/selftests/bpf/test_progs.h | 72 +- .../selftests/bpf/test_tcpnotify_user.c | 7 +- tools/testing/selftests/bpf/test_verifier.c | 103 +- .../selftests/bpf/verifier/atomic_and.c | 77 + .../selftests/bpf/verifier/atomic_cmpxchg.c | 96 + .../selftests/bpf/verifier/atomic_fetch_add.c | 106 + .../selftests/bpf/verifier/atomic_or.c | 77 + .../selftests/bpf/verifier/atomic_xchg.c | 46 + .../selftests/bpf/verifier/atomic_xor.c | 77 + tools/testing/selftests/bpf/verifier/calls.c | 12 +- tools/testing/selftests/bpf/verifier/ctx.c | 7 +- .../selftests/bpf/verifier/dead_code.c | 10 +- .../bpf/verifier/direct_packet_access.c | 4 +- tools/testing/selftests/bpf/verifier/jit.c | 24 + .../testing/selftests/bpf/verifier/leak_ptr.c | 10 +- .../selftests/bpf/verifier/meta_access.c | 4 +- tools/testing/selftests/bpf/verifier/unpriv.c | 3 +- .../bpf/verifier/value_illegal_alu.c | 2 +- tools/testing/selftests/bpf/verifier/xadd.c | 18 +- tools/testing/selftests/bpf/xdping.c | 2 +- tools/testing/selftests/tc-testing/Makefile | 3 +- 292 files changed, 24645 insertions(+), 6370 deletions(-) create mode 100644 include/linux/bpfptr.h create mode 100644 tools/lib/bpf/bpf_gen_internal.h create mode 100644 tools/lib/bpf/gen_loader.c create mode 100644 tools/lib/bpf/libbpf_legacy.h create mode 100644 tools/lib/bpf/libbpf_version.h create mode 100644 tools/lib/bpf/linker.c create mode 100644 tools/lib/bpf/relo_core.c create mode 100644 tools/lib/bpf/relo_core.h create mode 100644 tools/lib/bpf/skel_internal.h create mode 100644 tools/lib/bpf/strset.c create mode 100644 tools/lib/bpf/strset.h create mode 100644 tools/perf/util/bpf_counter.c create mode 100644 tools/perf/util/bpf_counter.h create mode 100644 tools/perf/util/bpf_skel/.gitignore create mode 100644 tools/perf/util/bpf_skel/bpf_prog_profiler.bpf.c create mode 100644 tools/testing/selftests/bpf/bpf_testmod/.gitignore create mode 100644 tools/testing/selftests/bpf/bpf_testmod/Makefile create mode 100644 tools/testing/selftests/bpf/bpf_testmod/bpf_testmod-events.h create mode 100644 tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.c create mode 100644 tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.h create mode 100644 tools/testing/selftests/bpf/btf_helpers.c create mode 100644 tools/testing/selftests/bpf/btf_helpers.h create mode 100644 tools/testing/selftests/bpf/prog_tests/atomics.c create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_dedup_split.c create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_split.c create mode 100644 tools/testing/selftests/bpf/prog_tests/core_read_macros.c create mode 100644 tools/testing/selftests/bpf/prog_tests/global_func_args.c create mode 100644 tools/testing/selftests/bpf/prog_tests/ksyms_module.c create mode 100644 tools/testing/selftests/bpf/prog_tests/module_attach.c create mode 100644 tools/testing/selftests/bpf/prog_tests/recursion.c create mode 100644 tools/testing/selftests/bpf/prog_tests/static_linked.c create mode 100644 tools/testing/selftests/bpf/progs/atomics.c create mode 100644 tools/testing/selftests/bpf/progs/recursion.c create mode 100644 tools/testing/selftests/bpf/progs/test_core_read_macros.c create mode 100644 tools/testing/selftests/bpf/progs/test_core_reloc_module.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func10.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func11.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func12.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func13.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func14.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func15.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func16.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func9.c create mode 100644 tools/testing/selftests/bpf/progs/test_global_func_args.c create mode 100644 tools/testing/selftests/bpf/progs/test_ksyms_module.c create mode 100644 tools/testing/selftests/bpf/progs/test_ksyms_weak.c create mode 100644 tools/testing/selftests/bpf/progs/test_map_in_map_invalid.c create mode 100644 tools/testing/selftests/bpf/progs/test_module_attach.c create mode 100644 tools/testing/selftests/bpf/progs/test_static_linked1.c create mode 100644 tools/testing/selftests/bpf/progs/test_static_linked2.c create mode 100644 tools/testing/selftests/bpf/verifier/atomic_and.c create mode 100644 tools/testing/selftests/bpf/verifier/atomic_cmpxchg.c create mode 100644 tools/testing/selftests/bpf/verifier/atomic_fetch_add.c create mode 100644 tools/testing/selftests/bpf/verifier/atomic_or.c create mode 100644 tools/testing/selftests/bpf/verifier/atomic_xchg.c create mode 100644 tools/testing/selftests/bpf/verifier/atomic_xor.c -- 2.20.1

1 379

[PATCH openEuler-22.09] samples: bpf: Add sample BMC for Redis
by Zheng Zengkai 12 Aug '22

12 Aug '22

From: Xu Kuohai <xukuohai(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5M05G CVE: NA ------------------------------------------------------- BMC is an in-kernel key-value cache implemented in BPF and proposed by paper [1]. The paper discussed BMC for memcached, obtaining at least 6x performance speedup. This patch implements a sample BMC for Redis. Paper [1] implements BMC in XDP, bypassing the kernel network stack totally. Since Redis is based on TCP protocol, and it's almost impossible to fully process TCP traffic in XDP, so this patch implements BMC in sockmap, which locates at the top of kernel network stack. Since kernel network stack is not bypassed, the speedup is not significant. Any way, this is only a sample implementation, and performance improvements can be continuously optimized. See [2] for details on how to build samples/bpf. Output files: samples/bpf/bmctool samples/bpf/bmc/bpf.o Sample usage: bmctool prog load -p 6379 ./bmc/bpf.o # load bmc bpf prog and attach it # to sockets with listen port 6379 bmctool stat # dump bmc status bmctool prog unload # detach and unload bmc prog [1] https://www.usenix.org/conference/nsdi21/presentation/ghigoff [2] https://www.kernel.org/doc/readme/samples-bpf-README.rst Signed-off-by: Xu Kuohai <xukuohai(a)huawei.com> Reviewed-by: Yang Jihong <yangjihong1(a)huawei.com> --- samples/bpf/Makefile | 3 + samples/bpf/bmc/bpf.c | 144 ++++++++ samples/bpf/bmc/common.h | 21 ++ samples/bpf/bmc/redis.h | 648 ++++++++++++++++++++++++++++++++++ samples/bpf/bmc/tool.c | 733 +++++++++++++++++++++++++++++++++++++++ 5 files changed, 1549 insertions(+) create mode 100644 samples/bpf/bmc/bpf.c create mode 100644 samples/bpf/bmc/common.h create mode 100644 samples/bpf/bmc/redis.h create mode 100644 samples/bpf/bmc/tool.c diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile index aeebf5d12f32..f9bb6bdad6ce 100644 --- a/samples/bpf/Makefile +++ b/samples/bpf/Makefile @@ -54,6 +54,7 @@ tprogs-y += task_fd_query tprogs-y += xdp_sample_pkts tprogs-y += ibumad tprogs-y += hbm +tprogs-y += bmctool # Libbpf dependencies LIBBPF = $(TOOLS_PATH)/lib/bpf/libbpf.a @@ -111,6 +112,7 @@ task_fd_query-objs := bpf_load.o task_fd_query_user.o $(TRACE_HELPERS) xdp_sample_pkts-objs := xdp_sample_pkts_user.o $(TRACE_HELPERS) ibumad-objs := bpf_load.o ibumad_user.o $(TRACE_HELPERS) hbm-objs := bpf_load.o hbm.o $(CGROUP_HELPERS) +bmctool-objs := bmc/tool.o # Tell kbuild to always build the programs always-y := $(tprogs-y) @@ -172,6 +174,7 @@ always-y += ibumad_kern.o always-y += hbm_out_kern.o always-y += hbm_edt_kern.o always-y += xdpsock_kern.o +always-y += bmc/bpf.o ifeq ($(ARCH), arm) # Strip all except -D__LINUX_ARM_ARCH__ option needed to handle linux diff --git a/samples/bpf/bmc/bpf.c b/samples/bpf/bmc/bpf.c new file mode 100644 index 000000000000..127260c611f8 --- /dev/null +++ b/samples/bpf/bmc/bpf.c @@ -0,0 +1,144 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (C) Huawei Technologies Co., Ltd. 2022-2022. All rights reserved. + * + * Description: BPF program to accelerate Redis. The idea is to add a kernel + * cache for Redis data. When new Redis request is received, the kernel cache + * is checked, and if the requested data is found in the cache, a Redis reply + * message is constructed and sent back directly. + */ + +#include <uapi/linux/in.h> +#include <uapi/linux/if_ether.h> +#include <uapi/linux/ip.h> +#include <uapi/linux/tcp.h> +#include <uapi/linux/bpf.h> +#include <uapi/linux/pkt_cls.h> + +#include <bpf/bpf_helpers.h> + +#define debug(fmt, ...) \ +do { \ + char ___fmt[] = fmt; \ + bpf_trace_printk(___fmt, sizeof(___fmt), ##__VA_ARGS__); \ +} while (0) + +struct tcp_key { + __u32 family; + __be32 local_ip4; + __be32 remote_ip4; + __be32 local_port; + __be32 remote_port; +}; + +struct { + __uint(type, BPF_MAP_TYPE_SOCKHASH); + __uint(key_size, sizeof(struct tcp_key)); + __uint(value_size, sizeof(u64)); + __uint(max_entries, 1024); +} bmc_socks SEC(".maps"); + +struct { + __uint(type, BPF_MAP_TYPE_HASH); + __uint(key_size, sizeof(u32)); + __uint(value_size, sizeof(u32)); + __uint(max_entries, 16); +} bmc_ports SEC(".maps"); + +SEC("bmc/sock_parser") +int sock_parser(struct __sk_buff *skb) +{ + return skb->len; +} + +static void init_tcp_key(struct tcp_key *key, struct bpf_sock *sk) +{ + if (sk != NULL) { + key->family = sk->family; + key->local_ip4 = sk->src_ip4; + key->remote_ip4 = sk->dst_ip4; + key->local_port = htonl(sk->src_port); + key->remote_port = htonl((u32)ntohs(sk->dst_port)); + } +} + +static int sock_redirect(struct __sk_buff *skb) +{ + struct tcp_key key; + struct bpf_sock *sk; + + sk = skb->sk; + if (sk == NULL) + return SK_PASS; + + init_tcp_key(&key, sk); + return bpf_sk_redirect_hash(skb, &bmc_socks, &key, 0); +} + +#include "redis.h" + +SEC("bmc/sock_verdict") +int sock_verdict(struct __sk_buff *skb) +{ + return bmc_process(skb); +} + +static bool is_bmc_port(u32 port) +{ + u32 *val = bpf_map_lookup_elem(&bmc_ports, &port); + + return val != NULL && *val != 0; +} + +static void add_bmc_sock(struct bpf_sock_ops *skops, struct bpf_sock *sk) +{ + struct tcp_key key; + + init_tcp_key(&key, sk); + bpf_sock_hash_update(skops, &bmc_socks, &key, BPF_ANY); +} + +static void delete_bmc_sock(struct bpf_sock_ops *skops, struct bpf_sock *sk) +{ + struct tcp_key key; + + init_tcp_key(&key, sk); + bpf_map_delete_elem(&bmc_socks, &key); +} + +SEC("bmc/sock_ops") +int sock_ops(struct bpf_sock_ops *skops) +{ + int op; + u16 local_port; + struct tcp_key key; + struct bpf_sock *sk; + + sk = skops->sk; + if (skops->family != AF_INET || sk == NULL) + return 0; + + local_port = ntohs((u16)sk->src_port); + + switch ((int)skops->op) { + case BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB: + case BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB: + if (is_bmc_port(local_port)) { + bpf_sock_ops_cb_flags_set(skops, BPF_SOCK_OPS_STATE_CB_FLAG); + add_bmc_sock(skops, sk); + } + break; + + case BPF_SOCK_OPS_STATE_CB: + if ((int)skops->args[1] == BPF_TCP_CLOSE) + delete_bmc_sock(skops, sk); + break; + + default: + break; + } + + return 0; +} + +char _license[] SEC("license") = "GPL"; diff --git a/samples/bpf/bmc/common.h b/samples/bpf/bmc/common.h new file mode 100644 index 000000000000..51c8623ab4f8 --- /dev/null +++ b/samples/bpf/bmc/common.h @@ -0,0 +1,21 @@ +/* SPDX-License-Identifier: GPL-2.0 + * + * Copyright (C) Huawei Technologies Co., Ltd. 2022-2022. All rights reserved. + * Description: common header for both user prog and bpf kernel prog + */ +#ifndef __REDIS_BMC_COMMON_H__ +#define __REDIS_BMC_COMMON_H__ + +#define REDIS_GET_PROG_INDEX 0 +#define REDIS_SET_PROG_INDEX 1 + +struct redis_bmc_stat { + __u64 total_get_requests; + __u64 hit_get_requests; + __u64 drop_get_requests; + __u64 total_set_requests; + __u64 hit_set_requests; + __u64 drop_set_requests; +}; + +#endif diff --git a/samples/bpf/bmc/redis.h b/samples/bpf/bmc/redis.h new file mode 100644 index 000000000000..6e739ce3d81a --- /dev/null +++ b/samples/bpf/bmc/redis.h @@ -0,0 +1,648 @@ +/* SPDX-License-Identifier: GPL-2.0 + * + * Copyright (C) Huawei Technologies Co., Ltd. 2022-2022. All rights reserved. + * + * Description: This file parses REDIS commands. When SET command is received, + * the KEY and VALUE fields are extracted from the message and are stored to + * bmc_storage. When GET command is received, we lookup bmc_storage with the + * KEY received, and if success we fill the reply message with the found VALUE + * and send it back to the client. + * + * Here is a sample redis SET and GET session: + * (C: is the client, S: the server) + * + * C: "*3\r\n$3\r\nset\r\n$5\r\nkey01\r\n$5\r\nval01\r\n" + * S: "+OK\r\n" + * C: "*2\r\n$3\r\nget\r\n$5\r\nkey01\r\n" + * S: "$5\r\nval01\r\n" + * + * See [0] for RESP protocol details. + * [0] https://redis.io/docs/reference/protocol-spec/ + */ + +#include "common.h" + +#define BMC_MAX_REDIS_KEY_LEN 448 /* total key size should be less than 512 */ +#define BMC_MAX_REDIS_VALUE_LEN 2048 +#define BMC_MAX_CPUS 512 // NR_CPUS + +struct redis_key { + u32 len; + u8 data[BMC_MAX_REDIS_KEY_LEN]; +}; + +struct redis_value { + u32 len; + u8 data[BMC_MAX_REDIS_VALUE_LEN]; +}; + +struct { + __uint(type, BPF_MAP_TYPE_LRU_HASH); + __uint(key_size, sizeof(struct redis_key)); + __uint(value_size, sizeof(struct redis_value)); + __uint(max_entries, 10000); +} bmc_storage SEC(".maps"); + +struct { + __uint(type, BPF_MAP_TYPE_PROG_ARRAY); + __uint(key_size, sizeof(u32)); + __uint(value_size, sizeof(u32)); + __uint(max_entries, 2); +} bmc_jump_table SEC(".maps"); + +struct redis_ctx { + struct redis_key key; + struct redis_value value; + u32 offset; +}; + +struct { + __uint(type, BPF_MAP_TYPE_ARRAY); + __uint(key_size, sizeof(u32)); + __uint(value_size, sizeof(struct redis_ctx)); + __uint(max_entries, BMC_MAX_CPUS); +} ctxmap SEC(".maps"); + +struct { + __uint(type, BPF_MAP_TYPE_ARRAY); + __uint(key_size, sizeof(u32)); + __uint(value_size, sizeof(struct redis_bmc_stat)); + __uint(max_entries, BMC_MAX_CPUS); +} bmc_stats SEC(".maps"); + +static int bmc_copy_from_skb(void *dst, void *dend, + struct __sk_buff *skb, + u32 skb_off, u32 len) +{ + u32 i; + u32 off = 0; + void *data = (void *)(long)skb->data; + void *data_end = (void *)(long)skb->data_end; + + if (len > 2047) + return -1; + + if (len >= 1024 && dst + off + 1024 < dend && + data + skb_off + off + 1024 < data_end) { + if (bpf_skb_load_bytes(skb, skb_off + off, dst + off, 1024)) + return -1; + off += 1024; + len -= 1024; + } + if (len >= 512 && dst + off + 512 < dend && + data + skb_off + off + 512 < data_end) { + if (bpf_skb_load_bytes(skb, skb_off + off, dst + off, 512)) + return -1; + off += 512; + len -= 512; + } + if (len >= 256 && dst + off + 256 < dend && + data + skb_off + off + 256 < data_end) { + if (bpf_skb_load_bytes(skb, skb_off + off, dst + off, 256)) + return -1; + off += 256; + len -= 256; + } + if (len >= 128 && dst + off + 128 < dend && + data + skb_off + off + 128 < data_end) { + if (bpf_skb_load_bytes(skb, skb_off + off, dst + off, 128)) + return -1; + off += 128; + len -= 128; + } + if (len >= 64 && dst + off + 64 < dend && + data + skb_off + off + 64 < data_end) { + if (bpf_skb_load_bytes(skb, skb_off + off, dst + off, 64)) + return -1; + off += 64; + len -= 64; + } + if (len >= 32 && dst + off + 32 < dend && + data + skb_off + off + 32 < data_end) { + if (bpf_skb_load_bytes(skb, skb_off + off, dst + off, 32)) + return -1; + off += 32; + len -= 32; + } + if (len >= 16 && dst + off + 16 < dend && + data + skb_off + off + 16 < data_end) { + if (bpf_skb_load_bytes(skb, skb_off + off, dst + off, 16)) + return -1; + off += 16; + len -= 16; + } + + if (len >= 8 && dst + off + 8 < dend && + data + skb_off + off + 8 < data_end) { + if (bpf_skb_load_bytes(skb, skb_off + off, dst + off, 8)) + return -1; + off += 8; + len -= 8; + } + + if (len >= 4 && dst + off + 4 < dend && + data + skb_off + off + 4 < data_end) { + if (bpf_skb_load_bytes(skb, skb_off + off, dst + off, 4)) + return -1; + off += 4; + len -= 4; + } + + if (len >= 2 && dst + off + 2 < dend && + data + skb_off + off + 2 < data_end) { + if (bpf_skb_load_bytes(skb, skb_off + off, dst + off, 2)) + return -1; + off += 2; + len -= 2; + } + + if (len >= 1 && dst + off + 1 < dend && + data + skb_off + off + 1 < data_end) { + if (bpf_skb_load_bytes(skb, skb_off + off, dst + off, 1)) + return -1; + off += 1; + len -= 1; + } + + return len == 0 ? 0 : -1; +} + +static int bmc_copy_to_skb(struct __sk_buff *skb, u32 skb_off, + void *dst, void *dend, u32 len) +{ + u32 i; + u32 off = 0; + void *data = (void *)(long)skb->data; + void *data_end = (void *)(long)skb->data_end; + + if (len > 2047) + return -1; + + if (len >= 1024 && dst + off + 1024 < dend && + data + skb_off + off + 1024 < data_end) { + if (bpf_skb_store_bytes(skb, skb_off + off, dst + off, 1024, 0)) + return -1; + off += 1024; + len -= 1024; + } + if (len >= 512 && dst + off + 512 < dend && + data + skb_off + off + 512 < data_end) { + if (bpf_skb_store_bytes(skb, skb_off + off, dst + off, 512, 0)) + return -1; + off += 512; + len -= 512; + } + if (len >= 256 && dst + off + 256 < dend && + data + skb_off + off + 256 < data_end) { + if (bpf_skb_store_bytes(skb, skb_off + off, dst + off, 256, 0)) + return -1; + off += 256; + len -= 256; + } + if (len >= 128 && dst + off + 128 < dend && + data + skb_off + off + 128 < data_end) { + if (bpf_skb_store_bytes(skb, skb_off + off, dst + off, 128, 0)) + return -1; + off += 128; + len -= 128; + } + if (len >= 64 && dst + off + 64 < dend && + data + skb_off + off + 64 < data_end) { + if (bpf_skb_store_bytes(skb, skb_off + off, dst + off, 64, 0)) + return -1; + off += 64; + len -= 64; + } + if (len >= 32 && dst + off + 32 < dend && + data + skb_off + off + 32 < data_end) { + if (bpf_skb_store_bytes(skb, skb_off + off, dst + off, 32, 0)) + return -1; + off += 32; + len -= 32; + } + if (len >= 16 && dst + off + 16 < dend && + data + skb_off + off + 16 < data_end) { + if (bpf_skb_store_bytes(skb, skb_off + off, dst + off, 16, 0)) + return -1; + off += 16; + len -= 16; + } + + if (len >= 8 && dst + off + 8 < dend && + data + skb_off + off + 8 < data_end) { + if (bpf_skb_store_bytes(skb, skb_off + off, dst + off, 8, 0)) + return -1; + off += 8; + len -= 8; + } + + if (len >= 4 && dst + off + 4 < dend && + data + skb_off + off + 4 < data_end) { + if (bpf_skb_store_bytes(skb, skb_off + off, dst + off, 4, 0)) + return -1; + off += 4; + len -= 4; + } + + if (len >= 2 && dst + off + 2 < dend && + data + skb_off + off + 2 < data_end) { + if (bpf_skb_store_bytes(skb, skb_off + off, dst + off, 2, 0)) + return -1; + off += 2; + len -= 2; + } + + if (len >= 1 && dst + off + 1 < dend && + data + skb_off + off + 1 < data_end) { + if (bpf_skb_store_bytes(skb, skb_off + off, dst + off, 1, 0)) + return -1; + off += 1; + len -= 1; + } + + return len == 0 ? 0 : -1; +} + +static inline struct redis_ctx *get_ctx(void) +{ + u32 cpu = bpf_get_smp_processor_id(); + + if (cpu >= BMC_MAX_CPUS) + return NULL; + return bpf_map_lookup_elem(&ctxmap, &cpu); +} + +static inline struct redis_bmc_stat *get_stat(void) +{ + u32 cpu = bpf_get_smp_processor_id(); + + if (cpu >= BMC_MAX_CPUS) + return NULL; + return bpf_map_lookup_elem(&bmc_stats, &cpu); +} + +static int do_redis_get_handler(struct __sk_buff *skb, struct redis_ctx *ctx) +{ + int i; + u32 n; + int err; + char *p; + char *data; + char *data_end; + char buf[5]; + struct redis_value *val; + + ctx = get_ctx(); + if (!ctx) + return BPF_OK; + + val = bpf_map_lookup_elem(&bmc_storage, &ctx->key); + if (val == NULL || val->len == 0 || val->len > sizeof(val->data)) + return BPF_OK; + + n = val->len; + + i = 0; + while (i < 5) { + buf[i] = '0' + n % 10; + n = n / 10; + i++; + if (n == 0) + break; + } + + if (i >= 5) + return BPF_OK; + + /* $ LEN \r \n VALUE \r \n */ + n = 1 + i + 2 + val->len + 2; + + if (n > skb->len) + /* extend head space */ + err = bpf_skb_change_head(skb, n - skb->len, 0); + else if (n < skb->len) + /* shrink head space */ + err = bpf_skb_adjust_room(skb, -(skb->len - n), 0, 0); + + if (err) + return BPF_DROP; + + data = (char *)(long)skb->data; + data_end = (char *)(long)skb->data_end; + p = data; + /* 3 is '$' and "\r\n"*/ + if (p + i + 3 > data_end) + return BPF_DROP; + + *p++ = '$'; + while (p < data_end && --i >= 0) + *p++ = buf[i]; + *p++ = '\r'; + *p++ = '\n'; + + n = val->len; + if (n == 0 || n > sizeof(val->data) || p + n + 2 > data_end) + return BPF_DROP; + + if (bmc_copy_to_skb(skb, p - data, val->data, + val->data + sizeof(val->data), n)) + return BPF_DROP; + + p += n; + char end_mark[] = { '\r', '\n'}; + + bpf_skb_store_bytes(skb, p - data, end_mark, sizeof(end_mark), 0); + + return BPF_REDIRECT; +} + +static int do_redis_set_handler(struct __sk_buff *skb, struct redis_ctx *ctx) +{ + int err; + u32 off = 0; + u32 value_len; + char *data = (char *)(long)skb->data; + char *data_end = (char *)(long)skb->data_end; + + if (data + 1 > data_end || data[0] != '$') + return BPF_OK; + off++; + data++; + + value_len = 0; + if (data < data_end && data[0] >= '0' && data[0] <= '9') { + value_len = value_len * 10 + data[0] - '0'; + off++; + data++; + } + if (data < data_end && data[0] >= '0' && data[0] <= '9') { + value_len = value_len * 10 + data[0] - '0'; + off++; + data++; + } + if (data < data_end && data[0] >= '0' && data[0] <= '9') { + value_len = value_len * 10 + data[0] - '0'; + off++; + data++; + } + if (data < data_end && data[0] >= '0' && data[0] <= '9') { + value_len = value_len * 10 + data[0] - '0'; + off++; + data++; + } + + if (data + 2 > data_end || data[0] != '\r' || data[1] != '\n') + return BPF_OK; + off += 2; + data += 2; + + if (data > data_end) + return BPF_OK; + + /* format error */ + if (value_len <= 0 || value_len > sizeof(ctx->value.data) || + value_len >= data_end - data) { + return BPF_OK; + } + + if (bmc_copy_from_skb(ctx->value.data, + ctx->value.data + sizeof(ctx->value.data), + skb, off, value_len)) + return BPF_OK; + + ctx->value.len = value_len; + + if (bpf_map_update_elem(&bmc_storage, &ctx->key, &ctx->value, BPF_ANY)) { + bpf_map_delete_elem(&bmc_storage, &ctx->key); + return BPF_OK; + } + + char reply[] = { '+', 'O', 'K', '\r', '\n'}; + + if (skb->len < sizeof(reply)) + /* extend head space */ + err = bpf_skb_change_head(skb, sizeof(reply) - skb->len, 0); + else + /* shrink head space */ + err = bpf_skb_adjust_room(skb, -(skb->len - sizeof(reply)), 0, 0); + + if (err) + return BPF_OK; + + bpf_skb_store_bytes(skb, 0, reply, sizeof(reply), 0); + + return BPF_REDIRECT; +} + +SEC("bmc/redis_get_handler") +int redis_get_handler(struct __sk_buff *skb) +{ + int err; + struct redis_bmc_stat *stat; + struct redis_ctx *ctx; + + stat = get_stat(); + if (!stat) + return SK_PASS; + + stat->total_get_requests++; + + ctx = get_ctx(); + if (!ctx) + return SK_PASS; + + err = do_redis_get_handler(skb, ctx); + if (err == BPF_REDIRECT) { + stat->hit_get_requests++; + return sock_redirect(skb); + } + + if (err == BPF_DROP) { + stat->drop_get_requests++; + return SK_DROP; + } + + return SK_PASS; +} + +SEC("bmc/redis_set_handler") +int redis_set_handler(struct __sk_buff *skb) +{ + int err; + struct redis_bmc_stat *stat; + struct redis_ctx *ctx; + + stat = get_stat(); + if (!stat) + return SK_PASS; + + stat->total_set_requests++; + + ctx = get_ctx(); + if (!ctx) + return SK_PASS; + + err = do_redis_set_handler(skb, ctx); + if (err == BPF_REDIRECT) { + stat->hit_set_requests++; + return sock_redirect(skb); + } + + if (err == BPF_DROP) { + stat->drop_set_requests++; + return SK_DROP; + } + + err = bpf_skb_adjust_room(skb, ctx->offset, 0, 0); + if (!err) + return SK_PASS; + + stat->drop_set_requests++; + return SK_DROP; +} + +static inline int bmc_process(struct __sk_buff *skb) +{ + u32 off; + int err; + u32 key_len; + char *data; + char *data_end; + int expect_get = 0; + int is_get = 0; + struct redis_ctx *ctx; + + ctx = get_ctx(); + if (ctx == NULL) + return SK_PASS; + + err = bpf_skb_pull_data(skb, skb->len); + if (err) + return SK_PASS; + + off = 0; + data = (char *)(long)skb->data; + data_end = (char *)(long)skb->data_end; + + /* + * SET message format: + * "*3\r\n" // this is an array with 3 elements + * "$3\r\n" // the first element is a string with 3 characters + * "set\r\n" // the string is "set" + * "$5\r\n" // the second element is a string with 5 characters + * "key01\r\n" // the string is "key01" + * "$5\r\n" // the third element is a string with 5 characters + * "val01\r\n" // the string is "valu01" + * + * GET message format: + * "*2\r\n" // this is an array with 3 elements + * "$3\r\n" // the first element is a string with 3 characters + * "get\r\n" // the string is "get" + * "$5\r\n" // the second element is a string with 5 characters + * "key01\r\n" // the string is "key01" + */ + if (data + 4 > data_end) + return SK_PASS; + + /* Not GET, Not SET */ + if (data[0] != '*' || (data[1] != '2' && data[1] != '3') || + data[2] != '\r' || data[3] != '\n') + return SK_PASS; + + expect_get = (data[1] == '2'); + off += 4; + data += 4; + + if (data + 4 > data_end) + return SK_PASS; + + if (data[0] != '$' || data[1] != '3' || data[2] != '\r' || + data[3] != '\n') + return SK_PASS; + + off += 4; + data += 4; + + if (data + 5 > data_end) + return SK_PASS; + + switch (data[0]) { + case 'g': + is_get = 1; + case 's': + if (data[1] != 'e' || data[2] != 't' || + data[3] != '\r' || data[4] != '\n') + return SK_PASS; + break; + case 'G': + is_get = 1; + case 'S': + if (data[1] != 'E' || data[2] != 'T' || + data[3] != '\r' || data[4] != '\n') + return SK_PASS; + break; + default: + return SK_PASS; + } + off += 5; + data += 5; + + if (expect_get != is_get) + return SK_PASS; + + if (data + 1 > data_end || data[0] != '$') + return SK_PASS; + off++; + data++; + + key_len = 0; + if (data < data_end && data[0] >= '0' && data[0] <= '9') { + key_len = key_len * 10 + data[0] - '0'; + off++; + data++; + } + if (data < data_end && data[0] >= '0' && data[0] <= '9') { + key_len = key_len * 10 + data[0] - '0'; + off++; + data++; + } + if (data < data_end && data[0] >= '0' && data[0] <= '9') { + key_len = key_len * 10 + data[0] - '0'; + off++; + data++; + } + if (data < data_end && data[0] >= '0' && data[0] <= '9') { + key_len = key_len * 10 + data[0] - '0'; + off++; + data++; + } + if (data + 2 > data_end || data[0] != '\r' || data[1] != '\n') + return SK_PASS; + off += 2; + data += 2; + + if (data > data_end) + return SK_PASS; + + if (key_len == 0 || key_len > sizeof(ctx->key.data) || + key_len >= data_end - data) + return SK_PASS; + + ctx->offset = off + key_len + 2; + ctx->key.len = key_len; + + if (bmc_copy_from_skb(ctx->key.data, + ctx->key.data + sizeof(ctx->key.data), + skb, off, key_len)) + return SK_PASS; + + if (is_get) { + bpf_tail_call(skb, &bmc_jump_table, REDIS_GET_PROG_INDEX); + } else { + err = bpf_skb_adjust_room(skb, -ctx->offset, 0, 0); + if (err) + return SK_PASS; + bpf_tail_call(skb, &bmc_jump_table, REDIS_SET_PROG_INDEX); + } + return SK_PASS; +} diff --git a/samples/bpf/bmc/tool.c b/samples/bpf/bmc/tool.c new file mode 100644 index 000000000000..e45be64a2819 --- /dev/null +++ b/samples/bpf/bmc/tool.c @@ -0,0 +1,733 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (C) Huawei Technologies Co., Ltd. 2022-2022. All rights reserved. + */ +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <limits.h> +#include <errno.h> + +#include <unistd.h> +#include <sys/types.h> +#include <sys/stat.h> +#include <sys/select.h> +#include <sys/types.h> +#include <sys/socket.h> +#include <netinet/in.h> +#include <arpa/inet.h> +#include <fcntl.h> + +#include <bpf/bpf.h> +#include <bpf/libbpf.h> + +#include "common.h" + +#define DEFAULT_CGROUP_PATH "/sys/fs/cgroup" +#define DEFAULT_REDIS_PORT 6379 + +#ifndef ARRAY_SIZE +#define ARRAY_SIZE(a) (sizeof(a) / sizeof(a[0])) +#endif + +struct { + char *cgroup_path; + char *bpf_path; + int cgroup_fd; + int map_socks_fd; + int map_ports_fd; + int map_storage_fd; + int map_jump_table_fd; + int map_stats_fd; + int sock_parser_prog_fd; + int sock_verdict_prog_fd; + int sock_ops_prog_fd; + int redis_get_prog_fd; + int redis_set_prog_fd; + uint16_t listen_port; +} bmc; + +struct bmc_prog_info { + const char *sec_name; + enum bpf_prog_type prog_type; + enum bpf_attach_type attach_type; + int *p_prog_fd; + int *p_attach_fd; + unsigned int attach_flags; + const char *pin_path; + struct bpf_program *prog; +}; + +struct bmc_map_info { + const char *map_name; + int *p_map_fd; + char *pin_path; + struct bpf_map *map; + bool is_stat_map; +}; + +static struct bmc_prog_info prog_infos[] = { + { + .sec_name = "bmc/sock_parser", + .prog_type = BPF_PROG_TYPE_SK_SKB, + .attach_type = BPF_SK_SKB_STREAM_PARSER, + .p_prog_fd = &bmc.sock_parser_prog_fd, + .p_attach_fd = &bmc.map_socks_fd, + .attach_flags = 0, + .pin_path = "/sys/fs/bpf/bmc/prog_sock_parser" + }, + { + .sec_name = "bmc/sock_verdict", + .prog_type = BPF_PROG_TYPE_SK_SKB, + .attach_type = BPF_SK_SKB_STREAM_VERDICT, + .p_prog_fd = &bmc.sock_verdict_prog_fd, + .p_attach_fd = &bmc.map_socks_fd, + .attach_flags = 0, + .pin_path = "/sys/fs/bpf/bmc/prog_sock_verdict" + }, + { + .sec_name = "bmc/sock_ops", + .prog_type = BPF_PROG_TYPE_SOCK_OPS, + .attach_type = BPF_CGROUP_SOCK_OPS, + .p_prog_fd = &bmc.sock_ops_prog_fd, + .p_attach_fd = &bmc.cgroup_fd, + .attach_flags = 0, + .pin_path = "/sys/fs/bpf/bmc/prog_sock_ops" + }, + { + .sec_name = "bmc/redis_get_handler", + .prog_type = BPF_PROG_TYPE_SK_SKB, + .p_prog_fd = &bmc.redis_get_prog_fd, + .p_attach_fd = NULL, + .attach_flags = 0, + .pin_path = "/sys/fs/bpf/bmc/prog_redis_get_handler" + + }, + { + .sec_name = "bmc/redis_set_handler", + .prog_type = BPF_PROG_TYPE_SK_SKB, + .p_prog_fd = &bmc.redis_set_prog_fd, + .p_attach_fd = NULL, + .attach_flags = 0, + .pin_path = "/sys/fs/bpf/bmc/prog_redis_set_handler" + + } +}; + +static struct bmc_map_info map_infos[] = { + { + .map_name = "bmc_socks", + .p_map_fd = &bmc.map_socks_fd, + .pin_path = "/sys/fs/bpf/bmc/map_socks" + }, + { + .map_name = "bmc_ports", + .p_map_fd = &bmc.map_ports_fd, + .pin_path = "/sys/fs/bpf/bmc/map_ports" + }, + { + .map_name = "bmc_storage", + .p_map_fd = &bmc.map_storage_fd, + .pin_path = "/sys/fs/bpf/bmc/map_storage" + }, + { + .map_name = "bmc_jump_table", + .p_map_fd = &bmc.map_jump_table_fd, + .pin_path = "/sys/fs/bpf/bmc/map_jump_table" + }, + { + .map_name = "bmc_stats", + .p_map_fd = &bmc.map_stats_fd, + .pin_path = "/sys/fs/bpf/bmc/stats", + .is_stat_map = true, + }, +}; + +static int find_type_by_sec_name(const char *sec_name, + enum bpf_prog_type *p_prog_type, + enum bpf_attach_type *p_attach_type) +{ + int i; + + if (sec_name == NULL) { + fprintf(stderr, "sec_name is NULL\n"); + return -1; + } + + for (i = 0; i < ARRAY_SIZE(prog_infos); i++) { + if (!strcmp(prog_infos[i].sec_name, sec_name)) { + *p_prog_type = prog_infos[i].prog_type; + *p_attach_type = prog_infos[i].attach_type; + return 0; + } + } + + fprintf(stderr, "unknown prog %s\n", sec_name); + + return -1; +} + +static int set_prog_type(struct bpf_object *obj) +{ + const char *sec_name; + struct bpf_program *prog; + enum bpf_prog_type prog_type; + enum bpf_attach_type attach_type; + + bpf_object__for_each_program(prog, obj) { + sec_name = bpf_program__section_name(prog); + if (find_type_by_sec_name(sec_name, &prog_type, &attach_type)) + return -1; + bpf_program__set_type(prog, prog_type); + bpf_program__set_expected_attach_type(prog, attach_type); + } + + return 0; +} + +static struct bpf_object *load_bpf_file(const char *bpf_file) +{ + int err; + char err_buf[256]; + struct bpf_object *obj; + + obj = bpf_object__open(bpf_file); + err = libbpf_get_error(obj); + if (err) { + libbpf_strerror(err, err_buf, sizeof(err_buf)); + fprintf(stderr, "unable to open bpf file %s : %s\n", bpf_file, + err_buf); + return NULL; + } + + if (set_prog_type(obj)) { + bpf_object__close(obj); + return NULL; + } + + err = bpf_object__load(obj); + if (err) { + fprintf(stderr, "load bpf object failed\n"); + bpf_object__close(obj); + return NULL; + } + + return obj; +} + +static int find_prog(struct bpf_object *obj, const char *sec_name, + struct bpf_program **p_prog, int *p_prog_fd) +{ + int fd; + struct bpf_program *prog; + + prog = bpf_object__find_program_by_title(obj, sec_name); + if (!prog) { + fprintf(stderr, "failed to find prog %s\n", sec_name); + return -1; + } + + fd = bpf_program__fd(prog); + if (fd < 0) { + fprintf(stderr, "failed to get fd of prog %s\n", sec_name); + return -1; + } + + + *p_prog = prog; + *p_prog_fd = fd; + + return 0; +} + +static void unpin_progs(int n) +{ + int i; + + for (i = 0; i < n; i++) + bpf_program__unpin(prog_infos[i].prog, prog_infos[i].pin_path); +} + +static int find_progs(struct bpf_object *obj) +{ + int i; + struct bmc_prog_info *info; + + for (i = 0; i < ARRAY_SIZE(prog_infos); i++) { + info = &prog_infos[i]; + + if (find_prog(obj, info->sec_name, &info->prog, info->p_prog_fd)) + goto error_find_prog; + + if (bpf_program__pin(info->prog, info->pin_path)) + goto error_find_prog; + } + + return 0; + +error_find_prog: + unpin_progs(i); + return -1; +} + +static int find_map(struct bpf_object *obj, const char *map_name, + struct bpf_map **p_map, int *p_map_fd) +{ + int fd; + struct bpf_map *map; + + map = bpf_object__find_map_by_name(obj, map_name); + if (!map) { + fprintf(stderr, "failed to find map %s\n", map_name); + return -1; + } + + fd = bpf_map__fd(map); + if (fd < 0) { + fprintf(stderr, "failed to get fd of map %s\n", map_name); + return -1; + } + + + *p_map = map; + *p_map_fd = fd; + + return 0; +} + +static void unpin_maps(int n) +{ + int i; + + for (i = 0; i < n; i++) + bpf_map__unpin(map_infos[i].map, map_infos[i].pin_path); +} + +static int find_maps(struct bpf_object *obj) +{ + int i; + struct bmc_map_info *info; + + for (i = 0; i < ARRAY_SIZE(map_infos); i++) { + info = &map_infos[i]; + + if (find_map(obj, info->map_name, &info->map, info->p_map_fd)) + goto error_find_map; + + if (bpf_map__pin(info->map, info->pin_path)) { + fprintf(stderr, "failed to pin map %s to path %s\n", + info->map_name, info->pin_path); + goto error_find_map; + } + } + + return 0; + +error_find_map: + unpin_maps(i); + return -1; +} + +static void detach_progs(int n) +{ + int i; + struct bmc_prog_info *info; + + for (i = 0; i < n; i++) { + info = &prog_infos[i]; + bpf_prog_detach(*info->p_prog_fd, info->attach_type); + } +} + +static int attach_progs(struct bpf_object *obj) +{ + int i; + int prog_fd; + int attach_fd; + unsigned int flags; + enum bpf_attach_type type; + struct bmc_prog_info *info; + + for (i = 0; i < ARRAY_SIZE(prog_infos); i++) { + info = &prog_infos[i]; + if (!info->p_attach_fd) + continue; + prog_fd = *info->p_prog_fd; + attach_fd = *info->p_attach_fd; + type = info->attach_type; + flags = info->attach_flags; + + if (bpf_prog_attach(prog_fd, attach_fd, type, flags)) { + fprintf(stderr, "attach prog %s failed!\n", + info->sec_name); + goto error_attach_prog; + } + } + + return 0; + +error_attach_prog: + detach_progs(i); + + return -1; +} + +static int add_bmc_port(void) +{ + int ret; + int map_fd = bmc.map_ports_fd; + uint16_t port = htons(bmc.listen_port); + uint32_t key = (uint32_t)port; + uint32_t value = 1; + + ret = bpf_map_update_elem(map_fd, &key, &value, 0); + if (ret) + fprintf(stderr, "failed to add port %u\n", port); + + return ret; +} + +static int add_tail_call(void) +{ + int ret; + int map_fd = bmc.map_jump_table_fd; + __u32 key; + __u32 value; + + key = REDIS_GET_PROG_INDEX; + value = bmc.redis_get_prog_fd; + ret = bpf_map_update_elem(map_fd, &key, &value, 0); + if (ret) { + fprintf(stderr, "failed to add redis get tail call prog\n"); + return -1; + } + + key = REDIS_SET_PROG_INDEX; + value = bmc.redis_set_prog_fd; + ret = bpf_map_update_elem(map_fd, &key, &value, 0); + if (ret) { + fprintf(stderr, "failed to add redis set tail call prog\n"); + key = REDIS_GET_PROG_INDEX; + bpf_map_delete_elem(map_fd, &key); + } + + return ret; +} + +static int setup_bpf(void) +{ + struct bpf_object *obj; + + bmc.cgroup_fd = open(bmc.cgroup_path, O_DIRECTORY, O_RDONLY); + if (bmc.cgroup_fd < 0) { + fprintf(stderr, "failed to open cgroup %s: %s\n", + bmc.cgroup_path, strerror(errno)); + return -1; + } + + obj = load_bpf_file(bmc.bpf_path); + if (!obj) + goto error_load_object; + + if (find_progs(obj)) + goto error_load_object; + + if (find_maps(obj)) + goto error_find_maps; + + if (attach_progs(obj)) + goto error_attach_progs; + + if (add_bmc_port()) + goto error_add_port; + + if (add_tail_call()) + goto error_attach_progs; + + return 0; + +error_add_port: + detach_progs(ARRAY_SIZE(prog_infos)); +error_attach_progs: + unpin_maps(ARRAY_SIZE(map_infos)); +error_find_maps: + unpin_progs(ARRAY_SIZE(prog_infos)); +error_load_object: + bpf_object__close(obj); + close(bmc.cgroup_fd); + return -1; +} + +static int parse_load_args(int argc, char *argv[]) +{ + int opt; + int port; + + bmc.cgroup_path = DEFAULT_CGROUP_PATH; + bmc.listen_port = DEFAULT_REDIS_PORT; + + while ((opt = getopt(argc, argv, "c:p:")) != -1) { + switch (opt) { + case 'c': + bmc.cgroup_path = optarg; + break; + case 'p': + port = atoi(optarg); + if (port <= 0 || port >= USHRT_MAX) { + fprintf(stderr, "invalid port: %s\n", optarg); + return -1; + } + bmc.listen_port = port; + break; + default: + fprintf(stderr, "unknown option %c\n", opt); + return -1; + } + } + + if (optind >= argc) { + fprintf(stderr, "no bpf prog file found\n"); + return -1; + } + + bmc.bpf_path = argv[optind]; + + printf("bpf file: %s\n", bmc.bpf_path); + printf("cgroup path: %s\n", bmc.cgroup_path); + printf("listen port: %d\n", bmc.listen_port); + + return 0; +} + +struct cmd { + const char *name; + int (*func)(int argc, char *argv[]); +}; + +static int do_prog(int argc, char *argv[]); +static int do_stat(int argc, char *argv[]); + +static int do_prog_load(int argc, char *argv[]); +static int do_prog_unload(int argc, char *argv[]); + +static struct cmd main_cmds[] = { + { "prog", do_prog }, + { "stat", do_stat }, +}; + +static struct cmd prog_cmds[] = { + { "load", do_prog_load }, + { "unload", do_prog_unload }, +}; + +static char *elf_name; + +static int dispatch_cmd(struct cmd cmds[], int ncmd, int argc, + char *argv[], void (*help)(void)) +{ + int i; + int ret; + + if (argc <= 0) { + help(); + return -1; + } + + for (i = 0; i < ncmd; i++) { + if (!strcmp(argv[0], cmds[i].name)) { + ret = cmds[i].func(argc - 1, argv + 1); + if (ret == -2) { + help(); + ret = -1; + } + return ret; + } + } + + help(); + + return -1; +} + +static int do_prog_load(int argc, char *argv[]) +{ + if (parse_load_args(argc + 1, argv - 1) < 0) + return -2; + + if (setup_bpf()) + return -1; + + return 0; +} + +static int do_prog_unload(int argc, char *argv[]) +{ + int i; + int prog_fd; + int cgroup_fd; + char *cgroup_path = DEFAULT_CGROUP_PATH; + + if (argc > 1) + cgroup_path = argv[0]; + + cgroup_fd = open(cgroup_path, O_DIRECTORY, O_RDONLY); + if (cgroup_fd < 0) { + fprintf(stderr, "failed to open cgroup path: %s\n", + cgroup_path); + return -1; + } + + for (i = 0; i < ARRAY_SIZE(prog_infos); i++) { + if (prog_infos[i].attach_type == BPF_CGROUP_SOCK_OPS) { + prog_fd = bpf_obj_get(prog_infos[i].pin_path); + if (prog_fd >= 0) + bpf_prog_detach2(prog_fd, cgroup_fd, + BPF_CGROUP_SOCK_OPS); + } + unlink(prog_infos[i].pin_path); + } + + for (i = 0; i < ARRAY_SIZE(map_infos); i++) + unlink(map_infos[i].pin_path); + + return 0; +} + +static void do_prog_help(void) +{ + fprintf(stderr, + "Usage: %s prog load [-c CGROUP_PATH] [-p LISTEN_PORT] {BPF_FILE}\n" + " %s prog unload [CGROUP_PATH]\n", + elf_name, elf_name); +} + +static int do_prog(int argc, char *argv[]) +{ + return dispatch_cmd(prog_cmds, ARRAY_SIZE(prog_cmds), + argc, argv, do_prog_help); +} + +static int do_stat(int argc, char *argv[]) +{ + int i; + int fd; + int err; + int ncpu; + bool found = false; + struct bmc_map_info *info; + struct bpf_map_info map = {}; + struct redis_bmc_stat stat = {}; + __u32 len = sizeof(map); + + ncpu = sysconf(_SC_NPROCESSORS_ONLN); + if (ncpu < 0) { + fprintf(stderr, "sysconf failed: %s\n", strerror(errno)); + return -1; + } + + for (i = 0; i < ARRAY_SIZE(map_infos); i++) { + info = &map_infos[i]; + if (info->is_stat_map) { + found = true; + break; + } + } + + if (!found) { + fprintf(stderr, "no stats map found\n"); + return -1; + } + + fd = bpf_obj_get(info->pin_path); + if (fd < 0) { + fprintf(stderr, "failed to open %s\n", + info->pin_path); + return -1; + } + + err = bpf_obj_get_info_by_fd(fd, &map, &len); + if (err) { + fprintf(stderr, "failed to get map info\n"); + goto error; + } + + if (map.type != BPF_MAP_TYPE_ARRAY) { + fprintf(stderr, "unexpected map type: %d\n", map.type); + goto error; + } + + if (map.key_size != sizeof(__u32)) { + fprintf(stderr, "unexpected map key_size: %u\n", map.key_size); + goto error; + } + + if (map.value_size != sizeof(struct redis_bmc_stat)) { + fprintf(stderr, "unexpected map key_size: %u\n", map.key_size); + goto error; + } + + for (int i = 0; i < ncpu; i++) { + __u32 key = i; + struct redis_bmc_stat value; + + err = bpf_map_lookup_elem(fd, &key, &value); + if (err) { + fprintf(stderr, "lookup cpu stat failed, cpu=%u\n", i); + goto error; + } + stat.total_get_requests += value.total_get_requests; + stat.hit_get_requests += value.hit_get_requests; + stat.drop_get_requests += value.drop_get_requests; + stat.total_set_requests += value.total_set_requests; + stat.hit_set_requests += value.hit_set_requests; + stat.drop_set_requests += value.drop_set_requests; + } + + printf("Total GET Requests: %llu\n", stat.total_get_requests); + printf("Hit GET Requests: %llu (%.2f%%)\n", stat.hit_get_requests, + stat.total_get_requests == 0 ? 0 : + (double)stat.hit_get_requests / + (double)stat.total_get_requests * + 100); + printf("Dropped GET Requests: %llu (%.2lf%%)\n", stat.drop_get_requests, + stat.total_get_requests == 0 ? 0 : + (double)stat.drop_get_requests / + (double)stat.total_get_requests * + 100); + + printf("Total SET Requests: %llu\n", stat.total_set_requests); + printf("Hit SET Requests: %llu (%.2f%%)\n", stat.hit_set_requests, + stat.total_set_requests == 0 ? 0 : + (double)stat.hit_set_requests / + (double)stat.total_set_requests * + 100); + printf("Dropped SET Requests: %llu (%.2lf%%)\n", stat.drop_set_requests, + stat.total_set_requests == 0 ? 0 : + (double)stat.drop_set_requests / + (double)stat.total_set_requests * + 100); + + close(fd); + + return 0; + +error: + close(fd); + return -1; +} + +static void do_main_help(void) +{ + fprintf(stderr, + "Usage: %s OBJECT { COMMAND | help }\n" + " OBJECT := { prog | stat }\n", + elf_name); +} + +int main(int argc, char *argv[]) +{ + elf_name = argv[0]; + + return dispatch_cmd(main_cmds, ARRAY_SIZE(main_cmds), + argc - 1, argv + 1, do_main_help); +} -- 2.20.1

1 0

[PATCH openEuler-1.0-LTS 1/2] mm/slub: add missing TID updates on slab deactivation
by Yongqiang Liu 12 Aug '22

12 Aug '22

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-4.19.252 commit e2b2f0e2e34d71ae6c2a1114fd3c525930e84bc7 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5LJH1 CVE: NA -------------------------------- commit eeaa345e128515135ccb864c04482180c08e3259 upstream. The fastpath in slab_alloc_node() assumes that c->slab is stable as long as the TID stays the same. However, two places in __slab_alloc() currently don't update the TID when deactivating the CPU slab. If multiple operations race the right way, this could lead to an object getting lost; or, in an even more unlikely situation, it could even lead to an object being freed onto the wrong slab's freelist, messing up the `inuse` counter and eventually causing a page to be freed to the page allocator while it still contains slab objects. (I haven't actually tested these cases though, this is just based on looking at the code. Writing testcases for this stuff seems like it'd be a pain...) The race leading to state inconsistency is (all operations on the same CPU and kmem_cache): - task A: begin do_slab_free(): - read TID - read pcpu freelist (==NULL) - check `slab == c->slab` (true) - [PREEMPT A->B] - task B: begin slab_alloc_node(): - fastpath fails (`c->freelist` is NULL) - enter __slab_alloc() - slub_get_cpu_ptr() (disables preemption) - enter ___slab_alloc() - take local_lock_irqsave() - read c->freelist as NULL - get_freelist() returns NULL - write `c->slab = NULL` - drop local_unlock_irqrestore() - goto new_slab - slub_percpu_partial() is NULL - get_partial() returns NULL - slub_put_cpu_ptr() (enables preemption) - [PREEMPT B->A] - task A: finish do_slab_free(): - this_cpu_cmpxchg_double() succeeds() - [CORRUPT STATE: c->slab==NULL, c->freelist!=NULL] From there, the object on c->freelist will get lost if task B is allowed to continue from here: It will proceed to the retry_load_slab label, set c->slab, then jump to load_freelist, which clobbers c->freelist. But if we instead continue as follows, we get worse corruption: - task A: run __slab_free() on object from other struct slab: - CPU_PARTIAL_FREE case (slab was on no list, is now on pcpu partial) - task A: run slab_alloc_node() with NUMA node constraint: - fastpath fails (c->slab is NULL) - call __slab_alloc() - slub_get_cpu_ptr() (disables preemption) - enter ___slab_alloc() - c->slab is NULL: goto new_slab - slub_percpu_partial() is non-NULL - set c->slab to slub_percpu_partial(c) - [CORRUPT STATE: c->slab points to slab-1, c->freelist has objects from slab-2] - goto redo - node_match() fails - goto deactivate_slab - existing c->freelist is passed into deactivate_slab() - inuse count of slab-1 is decremented to account for object from slab-2 At this point, the inuse count of slab-1 is 1 lower than it should be. This means that if we free all allocated objects in slab-1 except for one, SLUB will think that slab-1 is completely unused, and may free its page, leading to use-after-free. Fixes: c17dda40a6a4e ("slub: Separate out kmem_cache_cpu processing from deactivate_slab") Fixes: 03e404af26dc2 ("slub: fast release on full slab") Cc: stable(a)vger.kernel.org Signed-off-by: Jann Horn <jannh(a)google.com> Acked-by: Christoph Lameter <cl(a)linux.com> Acked-by: David Rientjes <rientjes(a)google.com> Reviewed-by: Muchun Song <songmuchun(a)bytedance.com> Tested-by: Hyeonggon Yoo <42.hyeyoo(a)gmail.com> Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz> Link: https://lore.kernel.org/r/20220608182205.2945720-1-jannh@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/slub.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index 7b5630ca9274..4bc29bcd0d5d 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -2168,6 +2168,7 @@ static void deactivate_slab(struct kmem_cache *s, struct page *page, c->page = NULL; c->freelist = NULL; + c->tid = next_tid(c->tid); } /* @@ -2301,8 +2302,6 @@ static inline void flush_slab(struct kmem_cache *s, struct kmem_cache_cpu *c) { stat(s, CPUSLAB_FLUSH); deactivate_slab(s, c->page, c->freelist, c); - - c->tid = next_tid(c->tid); } /* @@ -2589,6 +2588,7 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node, if (!freelist) { c->page = NULL; + c->tid = next_tid(c->tid); stat(s, DEACTIVATE_BYPASS); goto new_slab; } -- 2.25.1

1 1

openEuler Kernel SIG例会
by openEuler conference 11 Aug '22

11 Aug '22

您好！ Kernel SIG 邀请您参加 2022-08-12 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG例会会议内容： 1.英特尔Sapphire Rapids平台PMU新特性介绍 2.基于BPF内核缓存的Redis加速特性评审 3.BPF CO-RE(Compile Once-Run Everywhere)特性评审会议链接：https://us06web.zoom.us/j/89836175849?pwd=ODlUNVhldkdndnN0b21VRUIxNkg0dz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-08-12 14:00, The subject of the conference is openEuler Kernel SIG例会, Summary: 1.英特尔Sapphire Rapids平台PMU新特性介绍 2.基于BPF内核缓存的Redis加速特性评审 3.BPF CO-RE(Compile Once-Run Everywhere)特性评审 You can join the meeting at https://us06web.zoom.us/j/89836175849?pwd=ODlUNVhldkdndnN0b21VRUIxNkg0dz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-5.10-LTS] x86: Clear .brk area at early boot
by Zheng Zengkai 10 Aug '22

10 Aug '22

From: Juergen Gross <jgross(a)suse.com> stable inclusion from stable-v5.10.132 commit 136d7987fcfdeca73ee3c6a29e48f99fdd0f4d87 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5JTYM CVE: CVE-2022-36123 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 38fa5479b41376dc9d7f57e71c83514285a25ca0 ] The .brk section has the same properties as .bss: it is an alloc-only section and should be cleared before being used. Not doing so is especially a problem for Xen PV guests, as the hypervisor will validate page tables (check for writable page tables and hypervisor private bits) before accepting them to be used. Make sure .brk is initially zero by letting clear_bss() clear the brk area, too. Signed-off-by: Juergen Gross <jgross(a)suse.com> Signed-off-by: Borislav Petkov <bp(a)suse.de> Link: https://lore.kernel.org/r/20220630071441.28576-3-jgross@suse.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: GONG, Ruiqi <gongruiqi1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- arch/x86/kernel/head64.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c index 05e117137b45..efe13ab366f4 100644 --- a/arch/x86/kernel/head64.c +++ b/arch/x86/kernel/head64.c @@ -419,6 +419,8 @@ static void __init clear_bss(void) { memset(__bss_start, 0, (unsigned long) __bss_stop - (unsigned long) __bss_start); + memset(__brk_base, 0, + (unsigned long) __brk_limit - (unsigned long) __brk_base); } static unsigned long get_cmd_line_ptr(void) -- 2.20.1

1 0

[PATCH openEuler-5.10 01/15] drivers/perf: hisi: Add driver for HiSilicon PCIe PMU
by Zheng Zengkai 09 Aug '22

09 Aug '22

From: Qi Liu <liuqi115(a)huawei.com> mainline inclusion from mainline-v5.17-rc1 commit 8404b0fbc7fb category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5AZ87 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------------------------------------------------- PCIe PMU Root Complex Integrated End Point(RCiEP) device is supported to sample bandwidth, latency, buffer occupation etc. Each PMU RCiEP device monitors multiple Root Ports, and each RCiEP is registered as a PMU in /sys/bus/event_source/devices, so users can select target PMU, and use filter to do further sets. Filtering options contains: event - select the event. port - select target Root Ports. Information of Root Ports are shown under sysfs. bdf - select requester_id of target EP device. trig_len - set trigger condition for starting event statistics. trig_mode - set trigger mode. 0 means starting to statistic when bigger than trigger condition, and 1 means smaller. thr_len - set threshold for statistics. thr_mode - set threshold mode. 0 means count when bigger than threshold, and 1 means smaller. Acked-by: Krzysztof Wilczyński <kw(a)linux.com> Reviewed-by: John Garry <john.garry(a)huawei.com> Signed-off-by: Qi Liu <liuqi115(a)huawei.com> Reviewed-by: Shaokun Zhang <zhangshaokun(a)hisilicon.com> Link: https://lore.kernel.org/r/20211202080633.2919-3-liuqi115@huawei.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Wangming Shao <shaowangming(a)h-partners.com> Reviewed-by: Junhao He <hejunhao3(a)huawei.com> Reviewed-by: Yang Jihong <yangjihong1(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- MAINTAINERS | 2 + drivers/perf/hisilicon/Kconfig | 9 + drivers/perf/hisilicon/Makefile | 2 + drivers/perf/hisilicon/hisi_pcie_pmu.c | 951 +++++++++++++++++++++++++ include/linux/cpuhotplug.h | 3 + 5 files changed, 967 insertions(+) create mode 100644 drivers/perf/hisilicon/hisi_pcie_pmu.c diff --git a/MAINTAINERS b/MAINTAINERS index 466b1c599848..9908e5442110 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -7976,8 +7976,10 @@ F: Documentation/devicetree/bindings/misc/hisilicon-hikey-usb.yaml HISILICON PMU DRIVER M: Shaokun Zhang <zhangshaokun(a)hisilicon.com> +M: Qi Liu <liuqi115(a)huawei.com> S: Supported W: http://www.hisilicon.com +F: Documentation/admin-guide/perf/hisi-pcie-pmu.rst F: Documentation/admin-guide/perf/hisi-pmu.rst F: drivers/perf/hisilicon diff --git a/drivers/perf/hisilicon/Kconfig b/drivers/perf/hisilicon/Kconfig index c5d1b7019fff..5546218b5598 100644 --- a/drivers/perf/hisilicon/Kconfig +++ b/drivers/perf/hisilicon/Kconfig @@ -5,3 +5,12 @@ config HISI_PMU help Support for HiSilicon SoC L3 Cache performance monitor, Hydra Home Agent performance monitor and DDR Controller performance monitor. + +config HISI_PCIE_PMU + tristate "HiSilicon PCIE PERF PMU" + depends on PCI && ARM64 + help + Provide support for HiSilicon PCIe performance monitoring unit (PMU) + RCiEP devices. + Adds the PCIe PMU into perf events system for monitoring latency, + bandwidth etc. diff --git a/drivers/perf/hisilicon/Makefile b/drivers/perf/hisilicon/Makefile index 22e384cdfd53..ad0e8110f373 100644 --- a/drivers/perf/hisilicon/Makefile +++ b/drivers/perf/hisilicon/Makefile @@ -4,3 +4,5 @@ obj-$(CONFIG_HISI_PMU) += hisi_uncore_pmu.o hisi_uncore_l3c_pmu.o \ hisi_uncore_pa_pmu.o \ hisi_uncore_l3t_pmu.o \ hisi_uncore_lpddrc_pmu.o + +obj-$(CONFIG_HISI_PCIE_PMU) += hisi_pcie_pmu.o diff --git a/drivers/perf/hisilicon/hisi_pcie_pmu.c b/drivers/perf/hisilicon/hisi_pcie_pmu.c new file mode 100644 index 000000000000..2f18838754ec --- /dev/null +++ b/drivers/perf/hisilicon/hisi_pcie_pmu.c @@ -0,0 +1,951 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * This driver adds support for PCIe PMU RCiEP device. Related + * perf events are bandwidth, latency etc. + * + * Copyright (C) 2021 HiSilicon Limited + * Author: Qi Liu <liuqi115(a)huawei.com> + */ +#include <linux/bitfield.h> +#include <linux/bitmap.h> +#include <linux/bug.h> +#include <linux/device.h> +#include <linux/err.h> +#include <linux/interrupt.h> +#include <linux/irq.h> +#include <linux/kernel.h> +#include <linux/list.h> +#include <linux/module.h> +#include <linux/pci.h> +#include <linux/perf_event.h> + +#define DRV_NAME "hisi_pcie_pmu" +/* Define registers */ +#define HISI_PCIE_GLOBAL_CTRL 0x00 +#define HISI_PCIE_EVENT_CTRL 0x010 +#define HISI_PCIE_CNT 0x090 +#define HISI_PCIE_EXT_CNT 0x110 +#define HISI_PCIE_INT_STAT 0x150 +#define HISI_PCIE_INT_MASK 0x154 +#define HISI_PCIE_REG_BDF 0xfe0 +#define HISI_PCIE_REG_VERSION 0xfe4 +#define HISI_PCIE_REG_INFO 0xfe8 + +/* Define command in HISI_PCIE_GLOBAL_CTRL */ +#define HISI_PCIE_GLOBAL_EN 0x01 +#define HISI_PCIE_GLOBAL_NONE 0 + +/* Define command in HISI_PCIE_EVENT_CTRL */ +#define HISI_PCIE_EVENT_EN BIT_ULL(20) +#define HISI_PCIE_RESET_CNT BIT_ULL(22) +#define HISI_PCIE_INIT_SET BIT_ULL(34) +#define HISI_PCIE_THR_EN BIT_ULL(26) +#define HISI_PCIE_TARGET_EN BIT_ULL(32) +#define HISI_PCIE_TRIG_EN BIT_ULL(52) + +/* Define offsets in HISI_PCIE_EVENT_CTRL */ +#define HISI_PCIE_EVENT_M GENMASK_ULL(15, 0) +#define HISI_PCIE_THR_MODE_M GENMASK_ULL(27, 27) +#define HISI_PCIE_THR_M GENMASK_ULL(31, 28) +#define HISI_PCIE_TARGET_M GENMASK_ULL(52, 36) +#define HISI_PCIE_TRIG_MODE_M GENMASK_ULL(53, 53) +#define HISI_PCIE_TRIG_M GENMASK_ULL(59, 56) + +#define HISI_PCIE_MAX_COUNTERS 8 +#define HISI_PCIE_REG_STEP 8 +#define HISI_PCIE_THR_MAX_VAL 10 +#define HISI_PCIE_TRIG_MAX_VAL 10 +#define HISI_PCIE_MAX_PERIOD (GENMASK_ULL(63, 0)) +#define HISI_PCIE_INIT_VAL BIT_ULL(63) + +struct hisi_pcie_pmu { + struct perf_event *hw_events[HISI_PCIE_MAX_COUNTERS]; + struct hlist_node node; + struct pci_dev *pdev; + struct pmu pmu; + void __iomem *base; + int irq; + u32 identifier; + /* Minimum and maximum BDF of root ports monitored by PMU */ + u16 bdf_min; + u16 bdf_max; + int on_cpu; +}; + +struct hisi_pcie_reg_pair { + u16 lo; + u16 hi; +}; + +#define to_pcie_pmu(p) (container_of((p), struct hisi_pcie_pmu, pmu)) +#define GET_PCI_DEVFN(bdf) ((bdf) & 0xff) + +#define HISI_PCIE_PMU_FILTER_ATTR(_name, _config, _hi, _lo) \ + static u64 hisi_pcie_get_##_name(struct perf_event *event) \ + { \ + return FIELD_GET(GENMASK(_hi, _lo), event->attr._config); \ + } \ + +HISI_PCIE_PMU_FILTER_ATTR(event, config, 16, 0); +HISI_PCIE_PMU_FILTER_ATTR(thr_len, config1, 3, 0); +HISI_PCIE_PMU_FILTER_ATTR(thr_mode, config1, 4, 4); +HISI_PCIE_PMU_FILTER_ATTR(trig_len, config1, 8, 5); +HISI_PCIE_PMU_FILTER_ATTR(trig_mode, config1, 9, 9); +HISI_PCIE_PMU_FILTER_ATTR(port, config2, 15, 0); +HISI_PCIE_PMU_FILTER_ATTR(bdf, config2, 31, 16); + +static ssize_t hisi_pcie_format_sysfs_show(struct device *dev, struct device_attribute *attr, + char *buf) +{ + struct dev_ext_attribute *eattr; + + eattr = container_of(attr, struct dev_ext_attribute, attr); + + return sysfs_emit(buf, "%s\n", (char *)eattr->var); +} + +static ssize_t hisi_pcie_event_sysfs_show(struct device *dev, struct device_attribute *attr, + char *buf) +{ + struct perf_pmu_events_attr *pmu_attr = + container_of(attr, struct perf_pmu_events_attr, attr); + + return sysfs_emit(buf, "config=0x%llx\n", pmu_attr->id); +} + +#define HISI_PCIE_PMU_FORMAT_ATTR(_name, _format) \ + (&((struct dev_ext_attribute[]){ \ + { .attr = __ATTR(_name, 0444, hisi_pcie_format_sysfs_show, \ + NULL), \ + .var = (void *)_format } \ + })[0].attr.attr) + +#define HISI_PCIE_PMU_EVENT_ATTR(_name, _id) \ + (&((struct perf_pmu_events_attr[]) { \ + { .attr = __ATTR(_name, 0444, hisi_pcie_event_sysfs_show, NULL), \ + .id = _id, } \ + })[0].attr.attr) + +static ssize_t cpumask_show(struct device *dev, struct device_attribute *attr, char *buf) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(dev_get_drvdata(dev)); + + return cpumap_print_to_pagebuf(true, buf, cpumask_of(pcie_pmu->on_cpu)); +} +static DEVICE_ATTR_RO(cpumask); + +static ssize_t identifier_show(struct device *dev, struct device_attribute *attr, char *buf) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(dev_get_drvdata(dev)); + + return sysfs_emit(buf, "%#x\n", pcie_pmu->identifier); +} +static DEVICE_ATTR_RO(identifier); + +static ssize_t bus_show(struct device *dev, struct device_attribute *attr, char *buf) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(dev_get_drvdata(dev)); + + return sysfs_emit(buf, "%#04x\n", PCI_BUS_NUM(pcie_pmu->bdf_min)); +} +static DEVICE_ATTR_RO(bus); + +static struct hisi_pcie_reg_pair +hisi_pcie_parse_reg_value(struct hisi_pcie_pmu *pcie_pmu, u32 reg_off) +{ + u32 val = readl_relaxed(pcie_pmu->base + reg_off); + struct hisi_pcie_reg_pair regs = { + .lo = val, + .hi = val >> 16, + }; + + return regs; +} + +/* + * Hardware counter and ext_counter work together for bandwidth, latency, bus + * utilization and buffer occupancy events. For example, RX memory write latency + * events(index = 0x0010), counter counts total delay cycles and ext_counter + * counts RX memory write PCIe packets number. + * + * As we don't want PMU driver to process these two data, "delay cycles" can + * be treated as an independent event(index = 0x0010), "RX memory write packets + * number" as another(index = 0x10010). BIT 16 is used to distinguish and 0-15 + * bits are "real" event index, which can be used to set HISI_PCIE_EVENT_CTRL. + */ +#define EXT_COUNTER_IS_USED(idx) ((idx) & BIT(16)) + +static u32 hisi_pcie_get_real_event(struct perf_event *event) +{ + return hisi_pcie_get_event(event) & GENMASK(15, 0); +} + +static u32 hisi_pcie_pmu_get_offset(u32 offset, u32 idx) +{ + return offset + HISI_PCIE_REG_STEP * idx; +} + +static u32 hisi_pcie_pmu_readl(struct hisi_pcie_pmu *pcie_pmu, u32 reg_offset, + u32 idx) +{ + u32 offset = hisi_pcie_pmu_get_offset(reg_offset, idx); + + return readl_relaxed(pcie_pmu->base + offset); +} + +static void hisi_pcie_pmu_writel(struct hisi_pcie_pmu *pcie_pmu, u32 reg_offset, u32 idx, u32 val) +{ + u32 offset = hisi_pcie_pmu_get_offset(reg_offset, idx); + + writel_relaxed(val, pcie_pmu->base + offset); +} + +static u64 hisi_pcie_pmu_readq(struct hisi_pcie_pmu *pcie_pmu, u32 reg_offset, u32 idx) +{ + u32 offset = hisi_pcie_pmu_get_offset(reg_offset, idx); + + return readq_relaxed(pcie_pmu->base + offset); +} + +static void hisi_pcie_pmu_writeq(struct hisi_pcie_pmu *pcie_pmu, u32 reg_offset, u32 idx, u64 val) +{ + u32 offset = hisi_pcie_pmu_get_offset(reg_offset, idx); + + writeq_relaxed(val, pcie_pmu->base + offset); +} + +static void hisi_pcie_pmu_config_filter(struct perf_event *event) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + u64 reg = HISI_PCIE_INIT_SET; + u64 port, trig_len, thr_len; + + /* Config HISI_PCIE_EVENT_CTRL according to event. */ + reg |= FIELD_PREP(HISI_PCIE_EVENT_M, hisi_pcie_get_real_event(event)); + + /* Config HISI_PCIE_EVENT_CTRL according to root port or EP device. */ + port = hisi_pcie_get_port(event); + if (port) + reg |= FIELD_PREP(HISI_PCIE_TARGET_M, port); + else + reg |= HISI_PCIE_TARGET_EN | + FIELD_PREP(HISI_PCIE_TARGET_M, hisi_pcie_get_bdf(event)); + + /* Config HISI_PCIE_EVENT_CTRL according to trigger condition. */ + trig_len = hisi_pcie_get_trig_len(event); + if (trig_len) { + reg |= FIELD_PREP(HISI_PCIE_TRIG_M, trig_len); + reg |= FIELD_PREP(HISI_PCIE_TRIG_MODE_M, hisi_pcie_get_trig_mode(event)); + reg |= HISI_PCIE_TRIG_EN; + } + + /* Config HISI_PCIE_EVENT_CTRL according to threshold condition. */ + thr_len = hisi_pcie_get_thr_len(event); + if (thr_len) { + reg |= FIELD_PREP(HISI_PCIE_THR_M, thr_len); + reg |= FIELD_PREP(HISI_PCIE_THR_MODE_M, hisi_pcie_get_thr_mode(event)); + reg |= HISI_PCIE_THR_EN; + } + + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EVENT_CTRL, hwc->idx, reg); +} + +static void hisi_pcie_pmu_clear_filter(struct perf_event *event) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EVENT_CTRL, hwc->idx, HISI_PCIE_INIT_SET); +} + +static bool hisi_pcie_pmu_valid_requester_id(struct hisi_pcie_pmu *pcie_pmu, u32 bdf) +{ + struct pci_dev *root_port, *pdev; + u16 rp_bdf; + + pdev = pci_get_domain_bus_and_slot(pci_domain_nr(pcie_pmu->pdev->bus), PCI_BUS_NUM(bdf), + GET_PCI_DEVFN(bdf)); + if (!pdev) + return false; + + root_port = pcie_find_root_port(pdev); + if (!root_port) { + pci_dev_put(pdev); + return false; + } + + pci_dev_put(pdev); + rp_bdf = pci_dev_id(root_port); + return rp_bdf >= pcie_pmu->bdf_min && rp_bdf <= pcie_pmu->bdf_max; +} + +static bool hisi_pcie_pmu_valid_filter(struct perf_event *event, + struct hisi_pcie_pmu *pcie_pmu) +{ + u32 requester_id = hisi_pcie_get_bdf(event); + + if (hisi_pcie_get_thr_len(event) > HISI_PCIE_THR_MAX_VAL) + return false; + + if (hisi_pcie_get_trig_len(event) > HISI_PCIE_TRIG_MAX_VAL) + return false; + + if (requester_id) { + if (!hisi_pcie_pmu_valid_requester_id(pcie_pmu, requester_id)) + return false; + } + + return true; +} + +static bool hisi_pcie_pmu_cmp_event(struct perf_event *target, + struct perf_event *event) +{ + return hisi_pcie_get_real_event(target) == hisi_pcie_get_real_event(event); +} + +static bool hisi_pcie_pmu_validate_event_group(struct perf_event *event) +{ + struct perf_event *sibling, *leader = event->group_leader; + struct perf_event *event_group[HISI_PCIE_MAX_COUNTERS]; + int counters = 1; + int num; + + event_group[0] = leader; + if (!is_software_event(leader)) { + if (leader->pmu != event->pmu) + return false; + + if (leader != event && !hisi_pcie_pmu_cmp_event(leader, event)) + event_group[counters++] = event; + } + + for_each_sibling_event(sibling, event->group_leader) { + if (is_software_event(sibling)) + continue; + + if (sibling->pmu != event->pmu) + return false; + + for (num = 0; num < counters; num++) { + if (hisi_pcie_pmu_cmp_event(event_group[num], sibling)) + break; + } + + if (num == counters) + event_group[counters++] = sibling; + } + + return counters <= HISI_PCIE_MAX_COUNTERS; +} + +static int hisi_pcie_pmu_event_init(struct perf_event *event) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + + event->cpu = pcie_pmu->on_cpu; + + if (EXT_COUNTER_IS_USED(hisi_pcie_get_event(event))) + hwc->event_base = HISI_PCIE_EXT_CNT; + else + hwc->event_base = HISI_PCIE_CNT; + + if (event->attr.type != event->pmu->type) + return -ENOENT; + + /* Sampling is not supported. */ + if (is_sampling_event(event) || event->attach_state & PERF_ATTACH_TASK) + return -EOPNOTSUPP; + + if (!hisi_pcie_pmu_valid_filter(event, pcie_pmu)) + return -EINVAL; + + if (!hisi_pcie_pmu_validate_event_group(event)) + return -EINVAL; + + return 0; +} + +static u64 hisi_pcie_pmu_read_counter(struct perf_event *event) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + u32 idx = event->hw.idx; + + return hisi_pcie_pmu_readq(pcie_pmu, event->hw.event_base, idx); +} + +static int hisi_pcie_pmu_find_related_event(struct hisi_pcie_pmu *pcie_pmu, + struct perf_event *event) +{ + struct perf_event *sibling; + int idx; + + for (idx = 0; idx < HISI_PCIE_MAX_COUNTERS; idx++) { + sibling = pcie_pmu->hw_events[idx]; + if (!sibling) + continue; + + if (!hisi_pcie_pmu_cmp_event(sibling, event)) + continue; + + /* Related events must be used in group */ + if (sibling->group_leader == event->group_leader) + return idx; + else + return -EINVAL; + } + + return idx; +} + +static int hisi_pcie_pmu_get_event_idx(struct hisi_pcie_pmu *pcie_pmu) +{ + int idx; + + for (idx = 0; idx < HISI_PCIE_MAX_COUNTERS; idx++) { + if (!pcie_pmu->hw_events[idx]) + return idx; + } + + return -EINVAL; +} + +static void hisi_pcie_pmu_event_update(struct perf_event *event) +{ + struct hw_perf_event *hwc = &event->hw; + u64 new_cnt, prev_cnt, delta; + + do { + prev_cnt = local64_read(&hwc->prev_count); + new_cnt = hisi_pcie_pmu_read_counter(event); + } while (local64_cmpxchg(&hwc->prev_count, prev_cnt, + new_cnt) != prev_cnt); + + delta = (new_cnt - prev_cnt) & HISI_PCIE_MAX_PERIOD; + local64_add(delta, &event->count); +} + +static void hisi_pcie_pmu_read(struct perf_event *event) +{ + hisi_pcie_pmu_event_update(event); +} + +static void hisi_pcie_pmu_set_period(struct perf_event *event) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + int idx = hwc->idx; + + local64_set(&hwc->prev_count, HISI_PCIE_INIT_VAL); + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_CNT, idx, HISI_PCIE_INIT_VAL); + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EXT_CNT, idx, HISI_PCIE_INIT_VAL); +} + +static void hisi_pcie_pmu_enable_counter(struct hisi_pcie_pmu *pcie_pmu, struct hw_perf_event *hwc) +{ + u32 idx = hwc->idx; + u64 val; + + val = hisi_pcie_pmu_readq(pcie_pmu, HISI_PCIE_EVENT_CTRL, idx); + val |= HISI_PCIE_EVENT_EN; + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EVENT_CTRL, idx, val); +} + +static void hisi_pcie_pmu_disable_counter(struct hisi_pcie_pmu *pcie_pmu, struct hw_perf_event *hwc) +{ + u32 idx = hwc->idx; + u64 val; + + val = hisi_pcie_pmu_readq(pcie_pmu, HISI_PCIE_EVENT_CTRL, idx); + val &= ~HISI_PCIE_EVENT_EN; + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EVENT_CTRL, idx, val); +} + +static void hisi_pcie_pmu_enable_int(struct hisi_pcie_pmu *pcie_pmu, struct hw_perf_event *hwc) +{ + u32 idx = hwc->idx; + + hisi_pcie_pmu_writel(pcie_pmu, HISI_PCIE_INT_MASK, idx, 0); +} + +static void hisi_pcie_pmu_disable_int(struct hisi_pcie_pmu *pcie_pmu, struct hw_perf_event *hwc) +{ + u32 idx = hwc->idx; + + hisi_pcie_pmu_writel(pcie_pmu, HISI_PCIE_INT_MASK, idx, 1); +} + +static void hisi_pcie_pmu_reset_counter(struct hisi_pcie_pmu *pcie_pmu, int idx) +{ + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EVENT_CTRL, idx, HISI_PCIE_RESET_CNT); + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EVENT_CTRL, idx, HISI_PCIE_INIT_SET); +} + +static void hisi_pcie_pmu_start(struct perf_event *event, int flags) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + int idx = hwc->idx; + u64 prev_cnt; + + if (WARN_ON_ONCE(!(hwc->state & PERF_HES_STOPPED))) + return; + + WARN_ON_ONCE(!(hwc->state & PERF_HES_UPTODATE)); + hwc->state = 0; + + hisi_pcie_pmu_config_filter(event); + hisi_pcie_pmu_enable_counter(pcie_pmu, hwc); + hisi_pcie_pmu_enable_int(pcie_pmu, hwc); + hisi_pcie_pmu_set_period(event); + + if (flags & PERF_EF_RELOAD) { + prev_cnt = local64_read(&hwc->prev_count); + hisi_pcie_pmu_writeq(pcie_pmu, hwc->event_base, idx, prev_cnt); + } + + perf_event_update_userpage(event); +} + +static void hisi_pcie_pmu_stop(struct perf_event *event, int flags) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + + hisi_pcie_pmu_event_update(event); + hisi_pcie_pmu_disable_int(pcie_pmu, hwc); + hisi_pcie_pmu_disable_counter(pcie_pmu, hwc); + hisi_pcie_pmu_clear_filter(event); + WARN_ON_ONCE(hwc->state & PERF_HES_STOPPED); + hwc->state |= PERF_HES_STOPPED; + + if (hwc->state & PERF_HES_UPTODATE) + return; + + hwc->state |= PERF_HES_UPTODATE; +} + +static int hisi_pcie_pmu_add(struct perf_event *event, int flags) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + int idx; + + hwc->state = PERF_HES_STOPPED | PERF_HES_UPTODATE; + + /* Check all working events to find a related event. */ + idx = hisi_pcie_pmu_find_related_event(pcie_pmu, event); + if (idx < 0) + return idx; + + /* Current event shares an enabled counter with the related event */ + if (idx < HISI_PCIE_MAX_COUNTERS) { + hwc->idx = idx; + goto start_count; + } + + idx = hisi_pcie_pmu_get_event_idx(pcie_pmu); + if (idx < 0) + return idx; + + hwc->idx = idx; + pcie_pmu->hw_events[idx] = event; + /* Reset Counter to avoid previous statistic interference. */ + hisi_pcie_pmu_reset_counter(pcie_pmu, idx); + +start_count: + if (flags & PERF_EF_START) + hisi_pcie_pmu_start(event, PERF_EF_RELOAD); + + return 0; +} + +static void hisi_pcie_pmu_del(struct perf_event *event, int flags) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + + hisi_pcie_pmu_stop(event, PERF_EF_UPDATE); + pcie_pmu->hw_events[hwc->idx] = NULL; + perf_event_update_userpage(event); +} + +static void hisi_pcie_pmu_enable(struct pmu *pmu) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(pmu); + int num; + + for (num = 0; num < HISI_PCIE_MAX_COUNTERS; num++) { + if (pcie_pmu->hw_events[num]) + break; + } + + if (num == HISI_PCIE_MAX_COUNTERS) + return; + + writel(HISI_PCIE_GLOBAL_EN, pcie_pmu->base + HISI_PCIE_GLOBAL_CTRL); +} + +static void hisi_pcie_pmu_disable(struct pmu *pmu) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(pmu); + + writel(HISI_PCIE_GLOBAL_NONE, pcie_pmu->base + HISI_PCIE_GLOBAL_CTRL); +} + +static irqreturn_t hisi_pcie_pmu_irq(int irq, void *data) +{ + struct hisi_pcie_pmu *pcie_pmu = data; + irqreturn_t ret = IRQ_NONE; + struct perf_event *event; + u32 overflown; + int idx; + + for (idx = 0; idx < HISI_PCIE_MAX_COUNTERS; idx++) { + overflown = hisi_pcie_pmu_readl(pcie_pmu, HISI_PCIE_INT_STAT, idx); + if (!overflown) + continue; + + /* Clear status of interrupt. */ + hisi_pcie_pmu_writel(pcie_pmu, HISI_PCIE_INT_STAT, idx, 1); + event = pcie_pmu->hw_events[idx]; + if (!event) + continue; + + hisi_pcie_pmu_event_update(event); + hisi_pcie_pmu_set_period(event); + ret = IRQ_HANDLED; + } + + return ret; +} + +static int hisi_pcie_pmu_irq_register(struct pci_dev *pdev, struct hisi_pcie_pmu *pcie_pmu) +{ + int irq, ret; + + ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_MSI); + if (ret < 0) { + pci_err(pdev, "Failed to enable MSI vectors: %d\n", ret); + return ret; + } + + irq = pci_irq_vector(pdev, 0); + ret = request_irq(irq, hisi_pcie_pmu_irq, IRQF_NOBALANCING | IRQF_NO_THREAD, DRV_NAME, + pcie_pmu); + if (ret) { + pci_err(pdev, "Failed to register IRQ: %d\n", ret); + pci_free_irq_vectors(pdev); + return ret; + } + + pcie_pmu->irq = irq; + + return 0; +} + +static void hisi_pcie_pmu_irq_unregister(struct pci_dev *pdev, struct hisi_pcie_pmu *pcie_pmu) +{ + free_irq(pcie_pmu->irq, pcie_pmu); + pci_free_irq_vectors(pdev); +} + +static int hisi_pcie_pmu_online_cpu(unsigned int cpu, struct hlist_node *node) +{ + struct hisi_pcie_pmu *pcie_pmu = hlist_entry_safe(node, struct hisi_pcie_pmu, node); + + if (pcie_pmu->on_cpu == -1) { + pcie_pmu->on_cpu = cpu; + WARN_ON(irq_set_affinity(pcie_pmu->irq, cpumask_of(cpu))); + } + + return 0; +} + +static int hisi_pcie_pmu_offline_cpu(unsigned int cpu, struct hlist_node *node) +{ + struct hisi_pcie_pmu *pcie_pmu = hlist_entry_safe(node, struct hisi_pcie_pmu, node); + unsigned int target; + + /* Nothing to do if this CPU doesn't own the PMU */ + if (pcie_pmu->on_cpu != cpu) + return 0; + + pcie_pmu->on_cpu = -1; + /* Choose a new CPU from all online cpus. */ + target = cpumask_first(cpu_online_mask); + if (target >= nr_cpu_ids) { + pci_err(pcie_pmu->pdev, "There is no CPU to set\n"); + return 0; + } + + perf_pmu_migrate_context(&pcie_pmu->pmu, cpu, target); + /* Use this CPU for event counting */ + pcie_pmu->on_cpu = target; + WARN_ON(irq_set_affinity(pcie_pmu->irq, cpumask_of(target))); + + return 0; +} + +static struct attribute *hisi_pcie_pmu_events_attr[] = { + HISI_PCIE_PMU_EVENT_ATTR(rx_mwr_latency, 0x0010), + HISI_PCIE_PMU_EVENT_ATTR(rx_mwr_cnt, 0x10010), + HISI_PCIE_PMU_EVENT_ATTR(rx_mrd_latency, 0x0210), + HISI_PCIE_PMU_EVENT_ATTR(rx_mrd_cnt, 0x10210), + HISI_PCIE_PMU_EVENT_ATTR(tx_mrd_latency, 0x0011), + HISI_PCIE_PMU_EVENT_ATTR(tx_mrd_cnt, 0x10011), + HISI_PCIE_PMU_EVENT_ATTR(rx_mrd_flux, 0x1005), + HISI_PCIE_PMU_EVENT_ATTR(rx_mrd_time, 0x11005), + HISI_PCIE_PMU_EVENT_ATTR(tx_mrd_flux, 0x2004), + HISI_PCIE_PMU_EVENT_ATTR(tx_mrd_time, 0x12004), + NULL +}; + +static struct attribute_group hisi_pcie_pmu_events_group = { + .name = "events", + .attrs = hisi_pcie_pmu_events_attr, +}; + +static struct attribute *hisi_pcie_pmu_format_attr[] = { + HISI_PCIE_PMU_FORMAT_ATTR(event, "config:0-16"), + HISI_PCIE_PMU_FORMAT_ATTR(thr_len, "config1:0-3"), + HISI_PCIE_PMU_FORMAT_ATTR(thr_mode, "config1:4"), + HISI_PCIE_PMU_FORMAT_ATTR(trig_len, "config1:5-8"), + HISI_PCIE_PMU_FORMAT_ATTR(trig_mode, "config1:9"), + HISI_PCIE_PMU_FORMAT_ATTR(port, "config2:0-15"), + HISI_PCIE_PMU_FORMAT_ATTR(bdf, "config2:16-31"), + NULL +}; + +static const struct attribute_group hisi_pcie_pmu_format_group = { + .name = "format", + .attrs = hisi_pcie_pmu_format_attr, +}; + +static struct attribute *hisi_pcie_pmu_bus_attrs[] = { + &dev_attr_bus.attr, + NULL +}; + +static const struct attribute_group hisi_pcie_pmu_bus_attr_group = { + .attrs = hisi_pcie_pmu_bus_attrs, +}; + +static struct attribute *hisi_pcie_pmu_cpumask_attrs[] = { + &dev_attr_cpumask.attr, + NULL +}; + +static const struct attribute_group hisi_pcie_pmu_cpumask_attr_group = { + .attrs = hisi_pcie_pmu_cpumask_attrs, +}; + +static struct attribute *hisi_pcie_pmu_identifier_attrs[] = { + &dev_attr_identifier.attr, + NULL +}; + +static const struct attribute_group hisi_pcie_pmu_identifier_attr_group = { + .attrs = hisi_pcie_pmu_identifier_attrs, +}; + +static const struct attribute_group *hisi_pcie_pmu_attr_groups[] = { + &hisi_pcie_pmu_events_group, + &hisi_pcie_pmu_format_group, + &hisi_pcie_pmu_bus_attr_group, + &hisi_pcie_pmu_cpumask_attr_group, + &hisi_pcie_pmu_identifier_attr_group, + NULL +}; + +static int hisi_pcie_alloc_pmu(struct pci_dev *pdev, struct hisi_pcie_pmu *pcie_pmu) +{ + struct hisi_pcie_reg_pair regs; + u16 sicl_id, core_id; + char *name; + + regs = hisi_pcie_parse_reg_value(pcie_pmu, HISI_PCIE_REG_BDF); + pcie_pmu->bdf_min = regs.lo; + pcie_pmu->bdf_max = regs.hi; + + regs = hisi_pcie_parse_reg_value(pcie_pmu, HISI_PCIE_REG_INFO); + sicl_id = regs.hi; + core_id = regs.lo; + + name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "hisi_pcie%u_core%u", sicl_id, core_id); + if (!name) + return -ENOMEM; + + pcie_pmu->pdev = pdev; + pcie_pmu->on_cpu = -1; + pcie_pmu->identifier = readl(pcie_pmu->base + HISI_PCIE_REG_VERSION); + pcie_pmu->pmu = (struct pmu) { + .name = name, + .module = THIS_MODULE, + .event_init = hisi_pcie_pmu_event_init, + .pmu_enable = hisi_pcie_pmu_enable, + .pmu_disable = hisi_pcie_pmu_disable, + .add = hisi_pcie_pmu_add, + .del = hisi_pcie_pmu_del, + .start = hisi_pcie_pmu_start, + .stop = hisi_pcie_pmu_stop, + .read = hisi_pcie_pmu_read, + .task_ctx_nr = perf_invalid_context, + .attr_groups = hisi_pcie_pmu_attr_groups, + .capabilities = PERF_PMU_CAP_NO_EXCLUDE, + }; + + return 0; +} + +static int hisi_pcie_init_pmu(struct pci_dev *pdev, struct hisi_pcie_pmu *pcie_pmu) +{ + int ret; + + pcie_pmu->base = pci_ioremap_bar(pdev, 2); + if (!pcie_pmu->base) { + pci_err(pdev, "Ioremap failed for pcie_pmu resource\n"); + return -ENOMEM; + } + + ret = hisi_pcie_alloc_pmu(pdev, pcie_pmu); + if (ret) + goto err_iounmap; + + ret = hisi_pcie_pmu_irq_register(pdev, pcie_pmu); + if (ret) + goto err_iounmap; + + ret = cpuhp_state_add_instance(CPUHP_AP_PERF_ARM_HISI_PCIE_PMU_ONLINE, &pcie_pmu->node); + if (ret) { + pci_err(pdev, "Failed to register hotplug: %d\n", ret); + goto err_irq_unregister; + } + + ret = perf_pmu_register(&pcie_pmu->pmu, pcie_pmu->pmu.name, -1); + if (ret) { + pci_err(pdev, "Failed to register PCIe PMU: %d\n", ret); + goto err_hotplug_unregister; + } + + return ret; + +err_hotplug_unregister: + cpuhp_state_remove_instance_nocalls( + CPUHP_AP_PERF_ARM_HISI_PCIE_PMU_ONLINE, &pcie_pmu->node); + +err_irq_unregister: + hisi_pcie_pmu_irq_unregister(pdev, pcie_pmu); + +err_iounmap: + iounmap(pcie_pmu->base); + + return ret; +} + +static void hisi_pcie_uninit_pmu(struct pci_dev *pdev) +{ + struct hisi_pcie_pmu *pcie_pmu = pci_get_drvdata(pdev); + + perf_pmu_unregister(&pcie_pmu->pmu); + cpuhp_state_remove_instance_nocalls( + CPUHP_AP_PERF_ARM_HISI_PCIE_PMU_ONLINE, &pcie_pmu->node); + hisi_pcie_pmu_irq_unregister(pdev, pcie_pmu); + iounmap(pcie_pmu->base); +} + +static int hisi_pcie_init_dev(struct pci_dev *pdev) +{ + int ret; + + ret = pcim_enable_device(pdev); + if (ret) { + pci_err(pdev, "Failed to enable PCI device: %d\n", ret); + return ret; + } + + ret = pcim_iomap_regions(pdev, BIT(2), DRV_NAME); + if (ret < 0) { + pci_err(pdev, "Failed to request PCI mem regions: %d\n", ret); + return ret; + } + + pci_set_master(pdev); + + return 0; +} + +static int hisi_pcie_pmu_probe(struct pci_dev *pdev, const struct pci_device_id *id) +{ + struct hisi_pcie_pmu *pcie_pmu; + int ret; + + pcie_pmu = devm_kzalloc(&pdev->dev, sizeof(*pcie_pmu), GFP_KERNEL); + if (!pcie_pmu) + return -ENOMEM; + + ret = hisi_pcie_init_dev(pdev); + if (ret) + return ret; + + ret = hisi_pcie_init_pmu(pdev, pcie_pmu); + if (ret) + return ret; + + pci_set_drvdata(pdev, pcie_pmu); + + return ret; +} + +static void hisi_pcie_pmu_remove(struct pci_dev *pdev) +{ + hisi_pcie_uninit_pmu(pdev); + pci_set_drvdata(pdev, NULL); +} + +static const struct pci_device_id hisi_pcie_pmu_ids[] = { + { PCI_DEVICE(PCI_VENDOR_ID_HUAWEI, 0xa12d) }, + { 0, } +}; +MODULE_DEVICE_TABLE(pci, hisi_pcie_pmu_ids); + +static struct pci_driver hisi_pcie_pmu_driver = { + .name = DRV_NAME, + .id_table = hisi_pcie_pmu_ids, + .probe = hisi_pcie_pmu_probe, + .remove = hisi_pcie_pmu_remove, +}; + +static int __init hisi_pcie_module_init(void) +{ + int ret; + + ret = cpuhp_setup_state_multi(CPUHP_AP_PERF_ARM_HISI_PCIE_PMU_ONLINE, + "AP_PERF_ARM_HISI_PCIE_PMU_ONLINE", + hisi_pcie_pmu_online_cpu, + hisi_pcie_pmu_offline_cpu); + if (ret) { + pr_err("Failed to setup PCIe PMU hotplug: %d\n", ret); + return ret; + } + + ret = pci_register_driver(&hisi_pcie_pmu_driver); + if (ret) + cpuhp_remove_multi_state(CPUHP_AP_PERF_ARM_HISI_PCIE_PMU_ONLINE); + + return ret; +} +module_init(hisi_pcie_module_init); + +static void __exit hisi_pcie_module_exit(void) +{ + pci_unregister_driver(&hisi_pcie_pmu_driver); + cpuhp_remove_multi_state(CPUHP_AP_PERF_ARM_HISI_PCIE_PMU_ONLINE); +} +module_exit(hisi_pcie_module_exit); + +MODULE_DESCRIPTION("HiSilicon PCIe PMU driver"); +MODULE_LICENSE("GPL v2"); +MODULE_AUTHOR("Qi Liu <liuqi115(a)huawei.com>"); diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h index b98b9eb7d5f8..24e7be132046 100644 --- a/include/linux/cpuhotplug.h +++ b/include/linux/cpuhotplug.h @@ -178,6 +178,9 @@ enum cpuhp_state { CPUHP_AP_PERF_ARM_HISI_L3_ONLINE, CPUHP_AP_PERF_ARM_HISI_PA_ONLINE, CPUHP_AP_PERF_ARM_HISI_SLLC_ONLINE, + #ifndef __GENKSYMS__ + CPUHP_AP_PERF_ARM_HISI_PCIE_PMU_ONLINE, + #endif CPUHP_AP_PERF_ARM_L2X0_ONLINE, CPUHP_AP_PERF_ARM_QCOM_L2_ONLINE, CPUHP_AP_PERF_ARM_QCOM_L3_ONLINE, -- 2.20.1

1 14

[PATCH openEuler-5.10-LTS 00/10] Backport 5.10.117 LTS
by Zheng Zengkai 09 Aug '22

09 Aug '22

d1ac096f8869 mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and _mcopy_atomic() c6cbf5431a62 mm: hugetlb: fix missing cache flush in copy_huge_page_from_user() 308ff6a6e768 mm: fix missing cache flush for all tail pages of compound page 185fa5984d7a Bluetooth: Fix the creation of hdev->name 9ff4a6b80642 arm: remove CONFIG_ARCH_HAS_HOLES_MEMORYMODEL dfb55dcf9d39 nfp: bpf: silence bitwise vs. logical OR warning f89f76f4b0e7 drm/amd/display/dc/gpio/gpio_service: Pass around correct dce{version, environment} types efd1429fa99b block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit a71658c7db0b regulator: consumer: Add missing stubs to regulator/consumer.h 7648f42d1a62 MIPS: Use address-of operator on section symbols Total patches: 10 Dmitry Osipenko (1): regulator: consumer: Add missing stubs to regulator/consumer.h Itay Iellin (1): Bluetooth: Fix the creation of hdev->name Lee Jones (2): block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit drm/amd/display/dc/gpio/gpio_service: Pass around correct dce_{version, environment} types Mike Rapoport (1): arm: remove CONFIG_ARCH_HAS_HOLES_MEMORYMODEL Muchun Song (3): mm: fix missing cache flush for all tail pages of compound page mm: hugetlb: fix missing cache flush in copy_huge_page_from_user() mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and __mcopy_atomic() Nathan Chancellor (2): MIPS: Use address-of operator on section symbols nfp: bpf: silence bitwise vs. logical OR warning Documentation/vm/memory-model.rst | 3 +- arch/arm/Kconfig | 8 ++--- arch/arm/mach-bcm/Kconfig | 1 - arch/arm/mach-davinci/Kconfig | 1 - arch/arm/mach-exynos/Kconfig | 1 - arch/arm/mach-highbank/Kconfig | 1 - arch/arm/mach-omap2/Kconfig | 1 - arch/arm/mach-s5pv210/Kconfig | 1 - arch/arm/mach-tango/Kconfig | 1 - arch/mips/bmips/setup.c | 2 +- arch/mips/lantiq/prom.c | 2 +- arch/mips/pic32/pic32mzda/init.c | 2 +- arch/mips/ralink/of.c | 2 +- drivers/block/drbd/drbd_nl.c | 13 +++++--- .../drm/amd/display/dc/gpio/gpio_service.c | 12 +++---- .../display/include/gpio_service_interface.h | 4 +-- drivers/net/ethernet/netronome/nfp/nfp_asm.c | 4 +-- fs/proc/kcore.c | 2 -- include/linux/mmzone.h | 31 ------------------- include/linux/regulator/consumer.h | 30 ++++++++++++++++++ include/net/bluetooth/hci_core.h | 3 ++ mm/memory.c | 2 ++ mm/migrate.c | 7 +++-- mm/mmzone.c | 14 --------- mm/userfaultfd.c | 3 ++ mm/vmstat.c | 4 --- net/bluetooth/hci_core.c | 6 ++-- 27 files changed, 71 insertions(+), 90 deletions(-) -- 2.20.1

1 10

[PATCH openEuler-5.10-LTS 1/6] coresight: etm4x: Workaround CPU hung bug on HiSilicon ETM
by Zheng Zengkai 09 Aug '22

09 Aug '22

From: Junhao He <hejunhao3(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5EZY2 ------------------------------------------------------------------ In FIFO mode, when the state of sink buffer is full, the sink device will continuously backpressures the ETM, so that the ETM cannot switch to the idle state. In this case, the WFx instruction cannot be executed because the CPU detects that the ETM is not in the idle state which that will cause CPU hung. We workaround this issue on HiSilicon ETM by setting bit 13 of TRCAUXCTLR which is used to indicate that the ETM is in the idle state. The call trace is shown below: rcu: INFO: rcu_sched detected stalls on CPUs/tasks: rcu: 10-...0: (1 ticks this GP) idle=5b6/1/0x4000000000000000 softirq=12309/12318 fqs=114196 (detected by 67, t=330041 jiffies, g=309253, q=453663) Task dump for CPU 10: task:ksoftirqd/10 state:R running task stack: 0 pid: 64 ppid: 2 flags:0x0000000a Call trace: __switch_to+0xbc/0xfc irqtime_account_irq+0x58/0xc4 __do_softirq+0x6c/0x358 run_ksoftirqd+0x68/0x90 smpboot_thread_fn+0x15c/0x1a0 kthread+0x108/0x13c ret_from_fork+0x10/0x18 watchdog: BUG: soft lockup - CPU#35 stuck for 22s! [bash:133345] ... Call trace: smp_call_function_single+0x178/0x190 etm4_disable_sysfs+0x74/0xfc [coresight_etm4x] etm4_disable+0x6c/0x70 [coresight_etm4x] coresight_disable_source+0x7c/0xa0 [coresight] coresight_disable+0x6c/0x13c [coresight] enable_source_store+0x88/0xa0 [coresight] dev_attr_store+0x20/0x34 sysfs_kf_write+0x4c/0x5c kernfs_fop_write_iter+0x130/0x1c0 new_sync_write+0xec/0x18c vfs_write+0x214/0x2ac ksys_write+0x70/0xfc __arm64_sys_write+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0x94 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Signed-off-by: Qi Liu <liuqi115(a)huawei.com> Signed-off-by: Junhao He <hejunhao3(a)huawei.com> Reviewed-by: Jay Fang <f.fangjian(a)huawei.com> Acked-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- .../coresight/coresight-etm4x-core.c | 37 +++++++++++++++---- drivers/hwtracing/coresight/coresight-etm4x.h | 1 + 2 files changed, 30 insertions(+), 8 deletions(-) diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c index d4d9c8bb88ca..881da29cbd5a 100644 --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c @@ -116,8 +116,10 @@ struct etm4_enable_arg { #define HISI_HIP08_CORE_COMMIT_LVL_1 0b01 #define HISI_HIP08_CORE_COMMIT_REG sys_reg(3, 1, 15, 2, 5) +#define HISI_HIP08_AUXCTRL_CHICKEN_BIT BIT(13) + struct etm4_arch_features { - void (*arch_callback)(bool enable); + void (*arch_callback)(void *info); }; static bool etm4_hisi_match_pid(unsigned int id) @@ -125,8 +127,9 @@ static bool etm4_hisi_match_pid(unsigned int id) return (id & ETM4_AMBA_MASK) == HISI_HIP08_AMBA_ID; } -static void etm4_hisi_config_core_commit(bool enable) +static void etm4_hisi_config_core_commit(void *info) { + bool enable = *(bool *)info; u8 commit = enable ? HISI_HIP08_CORE_COMMIT_LVL_1 : HISI_HIP08_CORE_COMMIT_FULL; u64 val; @@ -143,48 +146,67 @@ static void etm4_hisi_config_core_commit(bool enable) write_sysreg_s(val, HISI_HIP08_CORE_COMMIT_REG); } +static void etm4_hisi_config_auxctrlr(void *info) +{ + struct etmv4_drvdata *drvdata = info; + + /* Switch the ETM to idle state */ + writel_relaxed(HISI_HIP08_AUXCTRL_CHICKEN_BIT, drvdata->base + TRCAUXCTLR); +} + static struct etm4_arch_features etm4_features[] = { [ETM4_IMPDEF_HISI_CORE_COMMIT] = { .arch_callback = etm4_hisi_config_core_commit, }, + [ETM4_IMPDEF_HISI_SET_AUXCTRLR] = { + .arch_callback = etm4_hisi_config_auxctrlr, + }, {}, }; static void etm4_enable_arch_specific(struct etmv4_drvdata *drvdata) { struct etm4_arch_features *ftr; + bool enable = true; int bit; for_each_set_bit(bit, drvdata->arch_features, ETM4_IMPDEF_FEATURE_MAX) { ftr = &etm4_features[bit]; - if (ftr->arch_callback) - ftr->arch_callback(true); + if (bit == ETM4_IMPDEF_HISI_CORE_COMMIT && ftr->arch_callback) + ftr->arch_callback(&enable); + + if (bit == ETM4_IMPDEF_HISI_SET_AUXCTRLR && ftr->arch_callback) + ftr->arch_callback(drvdata); } } static void etm4_disable_arch_specific(struct etmv4_drvdata *drvdata) { struct etm4_arch_features *ftr; + bool enable = false; int bit; for_each_set_bit(bit, drvdata->arch_features, ETM4_IMPDEF_FEATURE_MAX) { ftr = &etm4_features[bit]; - if (ftr->arch_callback) - ftr->arch_callback(false); + if (bit == ETM4_IMPDEF_HISI_CORE_COMMIT && ftr->arch_callback) + ftr->arch_callback(&enable); } } static void etm4_check_arch_features(struct etmv4_drvdata *drvdata, unsigned int id) { - if (etm4_hisi_match_pid(id)) + if (etm4_hisi_match_pid(id)) { set_bit(ETM4_IMPDEF_HISI_CORE_COMMIT, drvdata->arch_features); + set_bit(ETM4_IMPDEF_HISI_SET_AUXCTRLR, drvdata->arch_features); + } } #else static void etm4_enable_arch_specific(struct etmv4_drvdata *drvdata) { + writel_relaxed(0x0, drvdata->base + TRCAUXCTLR); } static void etm4_disable_arch_specific(struct etmv4_drvdata *drvdata) @@ -223,7 +245,6 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata) writel_relaxed(config->pe_sel, drvdata->base + TRCPROCSELR); writel_relaxed(config->cfg, drvdata->base + TRCCONFIGR); /* nothing specific implemented */ - writel_relaxed(0x0, drvdata->base + TRCAUXCTLR); writel_relaxed(config->eventctrl0, drvdata->base + TRCEVENTCTL0R); writel_relaxed(config->eventctrl1, drvdata->base + TRCEVENTCTL1R); if (drvdata->stallctl) diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h index 3dd3e0633328..ef9d7365c2da 100644 --- a/drivers/hwtracing/coresight/coresight-etm4x.h +++ b/drivers/hwtracing/coresight/coresight-etm4x.h @@ -206,6 +206,7 @@ enum etm_impdef_type { ETM4_IMPDEF_HISI_CORE_COMMIT, + ETM4_IMPDEF_HISI_SET_AUXCTRLR, ETM4_IMPDEF_FEATURE_MAX, }; -- 2.20.1

1 5

[PATCH openEuler-1.0-LTS 1/7] x86/unwind/orc: Change REG_SP_INDIRECT
by Yongqiang Liu 09 Aug '22

09 Aug '22

From: Peter Zijlstra <peterz(a)infradead.org> mainline inclusion from mainline-v5.12-rc1 commit 87ccc826bf1c9e5ab4c2f649b404e02c63e47622 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5LCHG CVE: NA -------------------------------- Currently REG_SP_INDIRECT is unused but means (%rsp + offset), change it to mean (%rsp) + offset. The reason is that we're going to swizzle stack in the middle of a C function with non-trivial stack footprint. This means that when the unwinder finds the ToS, it needs to dereference it (%rsp) and then add the offset to the next frame, resulting in: (%rsp) + offset This is somewhat unfortunate, since REG_BP_INDIRECT is used (by DRAP) and thus needs to retain the current (%rbp + offset). Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Miroslav Benes <mbenes(a)suse.cz> Acked-by: Josh Poimboeuf <jpoimboe(a)redhat.com> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Reviewed-by: Liao Chang <liaochang1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/x86/kernel/unwind_orc.c | 5 ++++- tools/objtool/orc_dump.c | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c index bafe953f5d7f..eea8ec5eca3b 100644 --- a/arch/x86/kernel/unwind_orc.c +++ b/arch/x86/kernel/unwind_orc.c @@ -450,7 +450,7 @@ bool unwind_next_frame(struct unwind_state *state) break; case ORC_REG_SP_INDIRECT: - sp = state->sp + orc->sp_offset; + sp = state->sp; indirect = true; break; @@ -500,6 +500,9 @@ bool unwind_next_frame(struct unwind_state *state) if (indirect) { if (!deref_stack_reg(state, sp, &sp)) goto err; + + if (orc->sp_reg == ORC_REG_SP_INDIRECT) + sp += orc->sp_offset; } /* Find IP, SP and possibly regs: */ diff --git a/tools/objtool/orc_dump.c b/tools/objtool/orc_dump.c index faa444270ee3..ba28830aace2 100644 --- a/tools/objtool/orc_dump.c +++ b/tools/objtool/orc_dump.c @@ -64,7 +64,7 @@ static void print_reg(unsigned int reg, int offset) if (reg == ORC_REG_BP_INDIRECT) printf("(bp%+d)", offset); else if (reg == ORC_REG_SP_INDIRECT) - printf("(sp%+d)", offset); + printf("(sp)%+d", offset); else if (reg == ORC_REG_UNDEFINED) printf("(und)"); else -- 2.25.1

1 6

[PATCH openEuler-1.0-LTS] netfilter: nf_queue: do not allow packet truncation below transport header offset
by Yongqiang Liu 09 Aug '22

09 Aug '22

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v5.19-rc3 commit 99a63d36cb3ed5ca3aa6fcb64cffbeaf3b0fb164 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5J9R4 CVE: CVE-2022-36946 -------------------------------- Domingo Dirutigliano and Nicola Guerrera report kernel panic when sending nf_queue verdict with 1-byte nfta_payload attribute. The IP/IPv6 stack pulls the IP(v6) header from the packet after the input hook. If user truncates the packet below the header size, this skb_pull() will result in a malformed skb (skb->len < 0). Fixes: 7af4cc3fa158 ("[NETFILTER]: Add "nfnetlink_queue" netfilter queue handler over nfnetlink") Reported-by: Domingo Dirutigliano <pwnzer0tt1(a)proton.me> Signed-off-by: Florian Westphal <fw(a)strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/netfilter/nfnetlink_queue.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c index a5aff2834bd6..cd496b074a71 100644 --- a/net/netfilter/nfnetlink_queue.c +++ b/net/netfilter/nfnetlink_queue.c @@ -850,11 +850,16 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum) } static int -nfqnl_mangle(void *data, int data_len, struct nf_queue_entry *e, int diff) +nfqnl_mangle(void *data, unsigned int data_len, struct nf_queue_entry *e, int diff) { struct sk_buff *nskb; if (diff < 0) { + unsigned int min_len = skb_transport_offset(e->skb); + + if (data_len < min_len) + return -EINVAL; + if (pskb_trim(e->skb, data_len)) return -ENOMEM; } else if (diff > 0) { -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] openvswitch: fix OOB access in reserve_sfa_size()
by Yongqiang Liu 08 Aug '22

08 Aug '22

From: Paolo Valerio <pvalerio(a)redhat.com> stable inclusion from stable-v4.19.240 commit bbbf059337f9a74285c1cf088ff85ee92d149e64 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5KKF2 CVE: CVE-2022-2639 ------------------------------------------------- commit cefa91b2332d7009bc0be5d951d6cbbf349f90f8 upstream. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, if next_offset is greater than MAX_ACTIONS_BUFSIZE, the function reserve_sfa_size() does not return -EMSGSIZE as expected, but it allocates MAX_ACTIONS_BUFSIZE bytes increasing actions_len by req_size. This can then lead to an OOB write access, especially when further actions need to be copied. Fix it by rearranging the flow action size check. KASAN splat below: ================================================================== BUG: KASAN: slab-out-of-bounds in reserve_sfa_size+0x1ba/0x380 [openvswitch] Write of size 65360 at addr ffff888147e4001c by task handler15/836 CPU: 1 PID: 836 Comm: handler15 Not tainted 5.18.0-rc1+ #27 ... Call Trace: <TASK> dump_stack_lvl+0x45/0x5a print_report.cold+0x5e/0x5db ? __lock_text_start+0x8/0x8 ? reserve_sfa_size+0x1ba/0x380 [openvswitch] kasan_report+0xb5/0x130 ? reserve_sfa_size+0x1ba/0x380 [openvswitch] kasan_check_range+0xf5/0x1d0 memcpy+0x39/0x60 reserve_sfa_size+0x1ba/0x380 [openvswitch] __add_action+0x24/0x120 [openvswitch] ovs_nla_add_action+0xe/0x20 [openvswitch] ovs_ct_copy_action+0x29d/0x1130 [openvswitch] ? __kernel_text_address+0xe/0x30 ? unwind_get_return_address+0x56/0xa0 ? create_prof_cpu_mask+0x20/0x20 ? ovs_ct_verify+0xf0/0xf0 [openvswitch] ? prep_compound_page+0x198/0x2a0 ? __kasan_check_byte+0x10/0x40 ? kasan_unpoison+0x40/0x70 ? ksize+0x44/0x60 ? reserve_sfa_size+0x75/0x380 [openvswitch] __ovs_nla_copy_actions+0xc26/0x2070 [openvswitch] ? __zone_watermark_ok+0x420/0x420 ? validate_set.constprop.0+0xc90/0xc90 [openvswitch] ? __alloc_pages+0x1a9/0x3e0 ? __alloc_pages_slowpath.constprop.0+0x1da0/0x1da0 ? unwind_next_frame+0x991/0x1e40 ? __mod_node_page_state+0x99/0x120 ? __mod_lruvec_page_state+0x2e3/0x470 ? __kasan_kmalloc_large+0x90/0xe0 ovs_nla_copy_actions+0x1b4/0x2c0 [openvswitch] ovs_flow_cmd_new+0x3cd/0xb10 [openvswitch] ... Cc: stable(a)vger.kernel.org Fixes: f28cd2af22a0 ("openvswitch: fix flow actions reallocation") Signed-off-by: Paolo Valerio <pvalerio(a)redhat.com> Acked-by: Eelco Chaudron <echaudro(a)redhat.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/openvswitch/flow_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c index eab5e8eaddaa..217c64fbc659 100644 --- a/net/openvswitch/flow_netlink.c +++ b/net/openvswitch/flow_netlink.c @@ -2316,7 +2316,7 @@ static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa, new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2); if (new_acts_size > MAX_ACTIONS_BUFSIZE) { - if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size) { + if ((next_offset + req_size) > MAX_ACTIONS_BUFSIZE) { OVS_NLERR(log, "Flow action size exceeds max %u", MAX_ACTIONS_BUFSIZE); return ERR_PTR(-EMSGSIZE); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] dm thin: use refcount_t for thin_c reference counting
by Yongqiang Liu 08 Aug '22

08 Aug '22

From: John Pittman <jpittman(a)redhat.com> mainline inclusion from mainline-v4.20-rc1 commit 22d4c291f58752d14efb8a185b772a3fc3e947d2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5KSEX CVE: NA -------------------------------- The API surrounding refcount_t should be used in place of atomic_t when variables are being used as reference counters. It can potentially prevent reference counter overflows and use-after-free conditions. In the dm thin layer, one such example is tc->refcount. Change this from the atomic_t API to the refcount_t API to prevent mentioned conditions. Signed-off-by: John Pittman <jpittman(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)redhat.com> Signed-off-by: Luo Meng <luomeng12(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/md/dm-thin.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c index 2b6dd7a275eb..e352aa3fdfb0 100644 --- a/drivers/md/dm-thin.c +++ b/drivers/md/dm-thin.c @@ -355,7 +355,7 @@ struct thin_c { * Ensures the thin is not destroyed until the worker has finished * iterating the active_thins list. */ - atomic_t refcount; + refcount_t refcount; struct completion can_destroy; }; @@ -4100,12 +4100,12 @@ static struct target_type pool_target = { *--------------------------------------------------------------*/ static void thin_get(struct thin_c *tc) { - atomic_inc(&tc->refcount); + refcount_inc(&tc->refcount); } static void thin_put(struct thin_c *tc) { - if (atomic_dec_and_test(&tc->refcount)) + if (refcount_dec_and_test(&tc->refcount)) complete(&tc->can_destroy); } @@ -4255,7 +4255,7 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv) r = -EINVAL; goto bad; } - atomic_set(&tc->refcount, 1); + refcount_set(&tc->refcount, 1); init_completion(&tc->can_destroy); list_add_tail_rcu(&tc->list, &tc->pool->active_thins); spin_unlock_irqrestore(&tc->pool->lock, flags); -- 2.25.1

1 0

Kernel SIG 申报议题：英特尔Sapphire Rapids平台PMU新特性
by Jason Zeng 08 Aug '22

08 Aug '22

议题：英特尔Sapphire Rapids平台PMU新特性简介：主要介绍一下英特尔的新一代Sapphire Rapids平台上的PMU新特性，以及Linux的支持情况。

1 0

[PATCH openEuler-1.0-LTS 01/29] ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
by Yongqiang Liu 08 Aug '22

08 Aug '22

From: Sergey Shtylyov <s.shtylyov(a)omp.ru> stable inclusion from stable-4.19.249 commit a810bd5af06977a847d1f202b22d7defd5c62497 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5I4FP CVE: NA -------------------------------- [ Upstream commit bf476fe22aa1851bab4728e0c49025a6a0bea307 ] In an unlikely (and probably wrong?) case that the 'ppi' parameter of ata_host_alloc_pinfo() points to an array starting with a NULL pointer, there's going to be a kernel oops as the 'pi' local variable won't get reassigned from the initial value of NULL. Initialize 'pi' instead to '&ata_dummy_port_info' to fix the possible kernel oops for good... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Signed-off-by: Sergey Shtylyov <s.shtylyov(a)omp.ru> Signed-off-by: Damien Le Moal <damien.lemoal(a)opensource.wdc.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/ata/libata-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c index 290ff99bf1d8..0bcdc5261480 100644 --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -6240,7 +6240,7 @@ struct ata_host *ata_host_alloc_pinfo(struct device *dev, const struct ata_port_info * const * ppi, int n_ports) { - const struct ata_port_info *pi; + const struct ata_port_info *pi = &ata_dummy_port_info; struct ata_host *host; int i, j; @@ -6248,7 +6248,7 @@ struct ata_host *ata_host_alloc_pinfo(struct device *dev, if (!host) return NULL; - for (i = 0, j = 0, pi = NULL; i < host->n_ports; i++) { + for (i = 0, j = 0; i < host->n_ports; i++) { struct ata_port *ap = host->ports[i]; if (ppi[j]) -- 2.25.1

1 28

[PATCH openEuler-1.0-LTS] ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr
by Yongqiang Liu 05 Aug '22

05 Aug '22

From: Ziyang Xuan <william.xuanziyang(a)huawei.com> mainline inclusion from mainline-v5.19 commit 85f0173df35e5462d89947135a6a5599c6c3ef6f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5JW9C CVE: NA ------------------------------- Change net device's MTU to smaller than IPV6_MIN_MTU or unregister device while matching route. That may trigger null-ptr-deref bug for ip6_ptr probability as following. ========================================================= BUG: KASAN: null-ptr-deref in find_match.part.0+0x70/0x134 Read of size 4 at addr 0000000000000308 by task ping6/263 CPU: 2 PID: 263 Comm: ping6 Not tainted 5.19.0-rc7+ #14 Call trace: dump_backtrace+0x1a8/0x230 show_stack+0x20/0x70 dump_stack_lvl+0x68/0x84 print_report+0xc4/0x120 kasan_report+0x84/0x120 __asan_load4+0x94/0xd0 find_match.part.0+0x70/0x134 __find_rr_leaf+0x408/0x470 fib6_table_lookup+0x264/0x540 ip6_pol_route+0xf4/0x260 ip6_pol_route_output+0x58/0x70 fib6_rule_lookup+0x1a8/0x330 ip6_route_output_flags_noref+0xd8/0x1a0 ip6_route_output_flags+0x58/0x160 ip6_dst_lookup_tail+0x5b4/0x85c ip6_dst_lookup_flow+0x98/0x120 rawv6_sendmsg+0x49c/0xc70 inet_sendmsg+0x68/0x94 Reproducer as following: Firstly, prepare conditions: $ip netns add ns1 $ip netns add ns2 $ip link add veth1 type veth peer name veth2 $ip link set veth1 netns ns1 $ip link set veth2 netns ns2 $ip netns exec ns1 ip -6 addr add 2001:0db8:0:f101::1/64 dev veth1 $ip netns exec ns2 ip -6 addr add 2001:0db8:0:f101::2/64 dev veth2 $ip netns exec ns1 ifconfig veth1 up $ip netns exec ns2 ifconfig veth2 up $ip netns exec ns1 ip -6 route add 2000::/64 dev veth1 metric 1 $ip netns exec ns2 ip -6 route add 2001::/64 dev veth2 metric 1 Secondly, execute the following two commands in two ssh windows respectively: $ip netns exec ns1 sh $while true; do ip -6 addr add 2001:0db8:0:f101::1/64 dev veth1; ip -6 route add 2000::/64 dev veth1 metric 1; ping6 2000::2; done $ip netns exec ns1 sh $while true; do ip link set veth1 mtu 1000; ip link set veth1 mtu 1500; sleep 5; done It is because ip6_ptr has been assigned to NULL in addrconf_ifdown() firstly, then ip6_ignore_linkdown() accesses ip6_ptr directly without NULL check. cpu0 cpu1 fib6_table_lookup __find_rr_leaf addrconf_notify [ NETDEV_CHANGEMTU ] addrconf_ifdown RCU_INIT_POINTER(dev->ip6_ptr, NULL) find_match ip6_ignore_linkdown So we can add NULL check for ip6_ptr before using in ip6_ignore_linkdown() to fix the null-ptr-deref bug. Fixes: dcd1f572954f ("net/ipv6: Remove fib6_idev") Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://lore.kernel.org/r/20220728013307.656257-1-william.xuanziyang@huawei… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: include/net/addrconf.h net/ipv6/route.c Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/ipv6/route.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 8efb03cc6f24..31c285d0f8c3 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -655,6 +655,9 @@ static inline bool fib6_ignore_linkdown(const struct fib6_info *f6i) if (dev) { const struct inet6_dev *idev = __in6_dev_get(dev); + if (unlikely(!idev)) + return true; + rc = !!idev->cnf.ignore_routes_with_linkdown; } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] io_uring: add missing item types for various requests
by Yongqiang Liu 05 Aug '22

05 Aug '22

From: Jens Axboe <axboe(a)kernel.dk> stable inclusion from stable-v5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5IM3T CVE: CVE-2022-2327 -------------------------------- Any read/write should grab current->nsproxy, denoted by IO_WQ_WORK_FILES as it refers to current->files as well, and connect and recv/recvmsg, send/sendmsg should grab current->fs which is denoted by IO_WQ_WORK_FS. No upstream commit exists for this issue. Reported-by: Bing-Jhong Billy Jheng <billy(a)starlabs.sg> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: 1. read/write already grab current->nsproxy, thus don't modified read/write related ops. 2. 'work_flags' doesn't exist, io_op_def is using field 'needs_fs' to decide if 'current->fs' should be grabbed. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/io_uring.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/io_uring.c b/fs/io_uring.c index 8a96b7df4112..d4e430b51098 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -816,6 +816,7 @@ static const struct io_op_def io_op_defs[] = { .async_ctx = 1, .needs_mm = 1, .needs_file = 1, + .needs_fs = 1, .unbound_nonreg_file = 1, .pollout = 1, }, @@ -864,12 +865,14 @@ static const struct io_op_def io_op_defs[] = { [IORING_OP_SEND] = { .needs_mm = 1, .needs_file = 1, + .needs_fs = 1, .unbound_nonreg_file = 1, .pollout = 1, }, [IORING_OP_RECV] = { .needs_mm = 1, .needs_file = 1, + .needs_fs = 1, .unbound_nonreg_file = 1, .pollin = 1, .buffer_select = 1, -- 2.25.1

1 0

[PATCH openEuler-22.09 00/20] Add programmable schedule feature for
by Zheng Zengkai 05 Aug '22

05 Aug '22

Add programmable schedule feature for openEuler-22.09. Chen Hui (12): sched: programmable: Add a tag for the task group sched: programmable: Add user interface of task group tag sched: programmable: Add a tag for the task sched: programmable: Add user interface of task tag sched: programmable: add bpf_sched_task_tag_of helper function sched: programmable: Add convenient helper functions to convert sched entity bpf: BPF samples support SCHED program type samples: bpf: Add bpf sched preempt sample program bpf:programmable: Add four helper functions to get cpu stat bpf:programmable: Add cpumask ops collection sched: programmable: Add lib for sched programmable sched: programmable: Add hook for select_task_rq_fair Guan Jing (2): sched: programmable: Add hook for entity_before samples: bpf: Add bpf sched pick task sample Hui Tang (3): bpf:programmable: Add helper func to check cpu share cache bpf:programmable: Add helper func to set cpus_ptr in task samples:bpf: Add samples for cfs select core Ren Zhijie (3): sched: programmable: add bpf_sched_tg_tag_of helper function sched: programmable: Add helpers to set tag of task or task_group sched: programmable: Add helper function for cpu topology. fs/proc/base.c | 65 ++++ include/linux/bpf_topology.h | 46 +++ include/linux/sched.h | 85 ++++++ include/linux/sched_hook_defs.h | 7 +- include/uapi/linux/bpf.h | 112 +++++++ init/init_task.c | 3 + kernel/bpf/helpers.c | 12 + kernel/bpf/verifier.c | 4 +- kernel/sched/Makefile | 3 +- kernel/sched/bpf_sched.c | 409 +++++++++++++++++++++++++ kernel/sched/bpf_topology.c | 99 ++++++ kernel/sched/core.c | 103 +++++++ kernel/sched/fair.c | 58 ++++ kernel/sched/sched.h | 8 + samples/bpf/Makefile | 9 + samples/bpf/bpf_load.c | 8 +- samples/bpf/sched_pick_task_kern.c | 62 ++++ samples/bpf/sched_pick_task_user.c | 92 ++++++ samples/bpf/sched_preempt_kern.c | 151 ++++++++++ samples/bpf/sched_preempt_user.c | 139 +++++++++ samples/bpf/sched_select_core_kern.c | 239 +++++++++++++++ samples/bpf/sched_select_core_user.c | 114 +++++++ scripts/bpf_helpers_doc.py | 20 ++ tools/include/uapi/linux/bpf.h | 112 +++++++ tools/lib/bpf/libbpf_sched.h | 435 +++++++++++++++++++++++++++ 25 files changed, 2389 insertions(+), 6 deletions(-) create mode 100644 include/linux/bpf_topology.h create mode 100644 kernel/sched/bpf_topology.c create mode 100644 samples/bpf/sched_pick_task_kern.c create mode 100644 samples/bpf/sched_pick_task_user.c create mode 100644 samples/bpf/sched_preempt_kern.c create mode 100644 samples/bpf/sched_preempt_user.c create mode 100644 samples/bpf/sched_select_core_kern.c create mode 100644 samples/bpf/sched_select_core_user.c create mode 100644 tools/lib/bpf/libbpf_sched.h -- 2.20.1

1 20

[PATCH openEuler-1.0-LTS 1/3] net: sched: sch_teql: fix null-pointer dereference
by Yongqiang Liu 05 Aug '22

05 Aug '22

From: Pavel Tikhomirov <ptikhomirov(a)virtuozzo.com> stable inclusion from stable-v4.19.187 commit a9a7488979a7d0abfd30bc32f370b8e0c124db33 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5JPWC CVE: NA -------------------------------- commit 1ffbc7ea91606e4abd10eb60de5367f1c86daf5e upstream. Reproduce: modprobe sch_teql tc qdisc add dev teql0 root teql0 This leads to (for instance in Centos 7 VM) OOPS: [ 532.366633] BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8 [ 532.366733] IP: [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql] [ 532.366825] PGD 80000001376d5067 PUD 137e37067 PMD 0 [ 532.366906] Oops: 0000 [#1] SMP [ 532.366987] Modules linked in: sch_teql ... [ 532.367945] CPU: 1 PID: 3026 Comm: tc Kdump: loaded Tainted: G ------------ T 3.10.0-1062.7.1.el7.x86_64 #1 [ 532.368041] Hardware name: Virtuozzo KVM, BIOS 1.11.0-2.vz7.2 04/01/2014 [ 532.368125] task: ffff8b7d37d31070 ti: ffff8b7c9fdbc000 task.ti: ffff8b7c9fdbc000 [ 532.368224] RIP: 0010:[<ffffffffc06124a8>] [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql] [ 532.368320] RSP: 0018:ffff8b7c9fdbf8e0 EFLAGS: 00010286 [ 532.368394] RAX: ffffffffc0612490 RBX: ffff8b7cb1565e00 RCX: ffff8b7d35ba2000 [ 532.368476] RDX: ffff8b7d35ba2000 RSI: 0000000000000000 RDI: ffff8b7cb1565e00 [ 532.368557] RBP: ffff8b7c9fdbf8f8 R08: ffff8b7d3fd1f140 R09: ffff8b7d3b001600 [ 532.368638] R10: ffff8b7d3b001600 R11: ffffffff84c7d65b R12: 00000000ffffffd8 [ 532.368719] R13: 0000000000008000 R14: ffff8b7d35ba2000 R15: ffff8b7c9fdbf9a8 [ 532.368800] FS: 00007f6a4e872740(0000) GS:ffff8b7d3fd00000(0000) knlGS:0000000000000000 [ 532.368885] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 532.368961] CR2: 00000000000000a8 CR3: 00000001396ee000 CR4: 00000000000206e0 [ 532.369046] Call Trace: [ 532.369159] [<ffffffff84c8192e>] qdisc_create+0x36e/0x450 [ 532.369268] [<ffffffff846a9b49>] ? ns_capable+0x29/0x50 [ 532.369366] [<ffffffff849afde2>] ? nla_parse+0x32/0x120 [ 532.369442] [<ffffffff84c81b4c>] tc_modify_qdisc+0x13c/0x610 [ 532.371508] [<ffffffff84c693e7>] rtnetlink_rcv_msg+0xa7/0x260 [ 532.372668] [<ffffffff84907b65>] ? sock_has_perm+0x75/0x90 [ 532.373790] [<ffffffff84c69340>] ? rtnl_newlink+0x890/0x890 [ 532.374914] [<ffffffff84c8da7b>] netlink_rcv_skb+0xab/0xc0 [ 532.376055] [<ffffffff84c63708>] rtnetlink_rcv+0x28/0x30 [ 532.377204] [<ffffffff84c8d400>] netlink_unicast+0x170/0x210 [ 532.378333] [<ffffffff84c8d7a8>] netlink_sendmsg+0x308/0x420 [ 532.379465] [<ffffffff84c2f3a6>] sock_sendmsg+0xb6/0xf0 [ 532.380710] [<ffffffffc034a56e>] ? __xfs_filemap_fault+0x8e/0x1d0 [xfs] [ 532.381868] [<ffffffffc034a75c>] ? xfs_filemap_fault+0x2c/0x30 [xfs] [ 532.383037] [<ffffffff847ec23a>] ? __do_fault.isra.61+0x8a/0x100 [ 532.384144] [<ffffffff84c30269>] ___sys_sendmsg+0x3e9/0x400 [ 532.385268] [<ffffffff847f3fad>] ? handle_mm_fault+0x39d/0x9b0 [ 532.386387] [<ffffffff84d88678>] ? __do_page_fault+0x238/0x500 [ 532.387472] [<ffffffff84c31921>] __sys_sendmsg+0x51/0x90 [ 532.388560] [<ffffffff84c31972>] SyS_sendmsg+0x12/0x20 [ 532.389636] [<ffffffff84d8dede>] system_call_fastpath+0x25/0x2a [ 532.390704] [<ffffffff84d8de21>] ? system_call_after_swapgs+0xae/0x146 [ 532.391753] Code: 00 00 00 00 00 00 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48 89 e5 41 55 41 54 53 48 8b b7 48 01 00 00 48 89 fb <48> 8b 8e a8 00 00 00 48 85 c9 74 43 48 89 ca eb 0f 0f 1f 80 00 [ 532.394036] RIP [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql] [ 532.395127] RSP <ffff8b7c9fdbf8e0> [ 532.396179] CR2: 00000000000000a8 Null pointer dereference happens on master->slaves dereference in teql_destroy() as master is null-pointer. When qdisc_create() calls teql_qdisc_init() it imediately fails after check "if (m->dev == dev)" because both devices are teql0, and it does not set qdisc_priv(sch)->m leaving it zero on error path, then qdisc_create() imediately calls teql_destroy() which does not expect zero master pointer and we get OOPS. Fixes: 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation") Signed-off-by: Pavel Tikhomirov <ptikhomirov(a)virtuozzo.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/sched/sch_teql.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c index 7ed53124069c..163364124691 100644 --- a/net/sched/sch_teql.c +++ b/net/sched/sch_teql.c @@ -138,6 +138,9 @@ teql_destroy(struct Qdisc *sch) struct teql_sched_data *dat = qdisc_priv(sch); struct teql_master *master = dat->m; + if (!master) + return; + prev = master->slaves; if (prev) { do { -- 2.25.1

1 2

[PATCH openEuler-22.09 0/4] add exec hugetlb support
by Zheng Zengkai 05 Aug '22

05 Aug '22

Some applications has large code and data segment, and this causes high TLB miss when page size is 4K. Mapping these apps into hugetlbfs will boost their performance. A userspace tool libhugetlbfs can do this but it seems to stopped development since 2020, and it does not support debugging. Tmpfs supports transparent hugepage, but it will be split into small pages during copy-on-write. Userspace hotpatch will do mprotect on code segment and trigger pmd split, and some users think performance degradation after hotpatch is unacceptable. This patch set implements hugetlb support in exec, and solved the debugging issue. --- v5: mark new Kconfigs default n and add sysctl knob v4: rebase to 5.10.0-107.0.0 v3: add MAP_FILE_HUGETLB v2: fix kabi Liu Zixian (4): hugetlb: support private file map elf: support hugetlb map enable elf huge map by default fs: add sysctl knob for exec_hugetlb arch/arm64/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 2 + fs/Kconfig | 24 ++++++ fs/binfmt_elf.c | 115 +++++++++++++++++++++++++ fs/exec.c | 4 + fs/proc/task_mmu.c | 5 ++ include/linux/elf.h | 4 + include/linux/mm_types.h | 4 + include/uapi/asm-generic/mman-common.h | 1 + include/uapi/linux/elf.h | 1 + kernel/events/core.c | 7 ++ kernel/fork.c | 5 ++ kernel/sysctl.c | 11 +++ mm/hugetlb.c | 25 ++++++ mm/mmap.c | 20 +++++ mm/util.c | 40 +++++++++ 16 files changed, 270 insertions(+) -- 2.20.1

1 4

[PATCH openEuler-5.10 01/20] md: add io accounting for raid0 and raid5
by Zheng Zengkai 04 Aug '22

04 Aug '22

From: Guoqing Jiang <jgq516(a)gmail.com> mainline inclusion from mainline-v5.14-rc1 commit 10764815ff4728d2c57da677cd5d3dd6f446cf5f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I587H6 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------- We introduce a new bioset (io_acct_set) for raid0 and raid5 since they don't own clone infrastructure to accounting io. And the bioset is added to mddev instead of to raid0 and raid5 layer, because with this way, we can put common functions to md.h and reuse them in raid0 and raid5. Also struct md_io_acct is added accordingly which includes io start_time, the origin bio and cloned bio. Then we can call bio_{start,end}_io_acct to get related io status. Signed-off-by: Guoqing Jiang <jiangguoqing(a)kylinos.cn> Signed-off-by: Song Liu <song(a)kernel.org> Conflict: drivers/md/md.c drivers/md/md.h Signed-off-by: Zhang Wensheng <zhangwensheng5(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/md/md.c | 52 ++++++++++++++++++++++++++++++++++++++++++---- drivers/md/md.h | 8 +++++++ drivers/md/raid0.c | 3 +++ drivers/md/raid5.c | 9 ++++++++ 4 files changed, 68 insertions(+), 4 deletions(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index a299fda5b0e9..10d9a8bed604 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -2361,7 +2361,8 @@ int md_integrity_register(struct mddev *mddev) bdev_get_integrity(reference->bdev)); pr_debug("md: data integrity enabled on %s\n", mdname(mddev)); - if (bioset_integrity_create(&mddev->bio_set, BIO_POOL_SIZE)) { + if (bioset_integrity_create(&mddev->bio_set, BIO_POOL_SIZE) || + bioset_integrity_create(&mddev->io_acct_set, BIO_POOL_SIZE)) { pr_err("md: failed to create integrity pool for %s\n", mdname(mddev)); return -EINVAL; @@ -5597,6 +5598,7 @@ static void md_free(struct kobject *ko) bioset_exit(&mddev->bio_set); bioset_exit(&mddev->sync_set); + bioset_exit(&mddev->io_acct_set); kfree(mddev); } @@ -5885,7 +5887,13 @@ int md_run(struct mddev *mddev) if (!bioset_initialized(&mddev->sync_set)) { err = bioset_init(&mddev->sync_set, BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS); if (err) - return err; + goto exit_bio_set; + } + if (!bioset_initialized(&mddev->io_acct_set)) { + err = bioset_init(&mddev->io_acct_set, BIO_POOL_SIZE, + offsetof(struct md_io_acct, bio_clone), 0); + if (err) + goto exit_sync_set; } spin_lock(&pers_lock); @@ -6013,6 +6021,7 @@ int md_run(struct mddev *mddev) blk_queue_flag_set(QUEUE_FLAG_NONROT, mddev->queue); else blk_queue_flag_clear(QUEUE_FLAG_NONROT, mddev->queue); + blk_queue_flag_set(QUEUE_FLAG_IO_STAT, mddev->queue); } if (pers->sync_request) { if (mddev->kobj.sd && @@ -6062,8 +6071,11 @@ int md_run(struct mddev *mddev) module_put(pers->owner); md_bitmap_destroy(mddev); abort: - bioset_exit(&mddev->bio_set); + bioset_exit(&mddev->io_acct_set); +exit_sync_set: bioset_exit(&mddev->sync_set); +exit_bio_set: + bioset_exit(&mddev->bio_set); return err; } EXPORT_SYMBOL_GPL(md_run); @@ -6288,6 +6300,7 @@ void md_stop(struct mddev *mddev) __md_stop(mddev); bioset_exit(&mddev->bio_set); bioset_exit(&mddev->sync_set); + bioset_exit(&mddev->io_acct_set); } EXPORT_SYMBOL_GPL(md_stop); @@ -8571,9 +8584,40 @@ void md_write_end(struct mddev *mddev) roundup(jiffies, mddev->safemode_delay) + mddev->safemode_delay); } - EXPORT_SYMBOL(md_write_end); +static void md_end_io_acct(struct bio *bio) +{ + struct md_io_acct *md_io_acct = bio->bi_private; + struct bio *orig_bio = md_io_acct->orig_bio; + + orig_bio->bi_status = bio->bi_status; + + bio_end_io_acct(orig_bio, md_io_acct->start_time); + bio_put(bio); + bio_endio(orig_bio); +} + +/* used by personalities (raid0 and raid5) to account io stats */ +void md_account_bio(struct mddev *mddev, struct bio **bio) +{ + struct md_io_acct *md_io_acct; + struct bio *clone; + + if (!blk_queue_io_stat((*bio)->bi_disk->queue)) + return; + + clone = bio_clone_fast(*bio, GFP_NOIO, &mddev->io_acct_set); + md_io_acct = container_of(clone, struct md_io_acct, bio_clone); + md_io_acct->orig_bio = *bio; + md_io_acct->start_time = bio_start_io_acct(*bio); + + clone->bi_end_io = md_end_io_acct; + clone->bi_private = md_io_acct; + *bio = clone; +} +EXPORT_SYMBOL_GPL(md_account_bio); + /* md_allow_write(mddev) * Calling this ensures that the array is marked 'active' so that writes * may proceed without blocking. It is important to call this before diff --git a/drivers/md/md.h b/drivers/md/md.h index 85177d068322..20c16cfdd6bb 100644 --- a/drivers/md/md.h +++ b/drivers/md/md.h @@ -491,6 +491,7 @@ struct mddev { struct bio_set sync_set; /* for sync operations like * metadata and bitmap writes */ + struct bio_set io_acct_set; /* for raid0 and raid5 io accounting */ /* Generic flush handling. * The last to finish preflush schedules a worker to submit @@ -687,6 +688,12 @@ struct md_thread { void *private; }; +struct md_io_acct { + struct bio *orig_bio; + unsigned long start_time; + struct bio bio_clone; +}; + #define THREAD_WAKEUP 0 static inline void safe_put_page(struct page *p) @@ -716,6 +723,7 @@ extern void md_write_end(struct mddev *mddev); extern void md_done_sync(struct mddev *mddev, int blocks, int ok); extern void md_error(struct mddev *mddev, struct md_rdev *rdev); extern void md_finish_reshape(struct mddev *mddev); +void md_account_bio(struct mddev *mddev, struct bio **bio); extern bool __must_check md_flush_request(struct mddev *mddev, struct bio *bio); extern void md_super_write(struct mddev *mddev, struct md_rdev *rdev, diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c index 35843df15b5e..0312b192106a 100644 --- a/drivers/md/raid0.c +++ b/drivers/md/raid0.c @@ -556,6 +556,9 @@ static bool raid0_make_request(struct mddev *mddev, struct bio *bio) bio = split; } + if (bio->bi_pool != &mddev->bio_set) + md_account_bio(mddev, &bio); + orig_sector = sector; zone = find_zone(mddev->private, &sector); switch (conf->layout) { diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c index c82953a3299e..35dacc6e754f 100644 --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c @@ -5487,6 +5487,7 @@ static struct bio *chunk_aligned_read(struct mddev *mddev, struct bio *raid_bio) sector_t sector = raid_bio->bi_iter.bi_sector; unsigned chunk_sects = mddev->chunk_sectors; unsigned sectors = chunk_sects - (sector & (chunk_sects-1)); + struct r5conf *conf = mddev->private; if (sectors < bio_sectors(raid_bio)) { struct r5conf *conf = mddev->private; @@ -5496,6 +5497,9 @@ static struct bio *chunk_aligned_read(struct mddev *mddev, struct bio *raid_bio) raid_bio = split; } + if (raid_bio->bi_pool != &conf->bio_split) + md_account_bio(mddev, &raid_bio); + if (!raid5_read_one_chunk(mddev, raid_bio)) return raid_bio; @@ -5775,6 +5779,7 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) DEFINE_WAIT(w); bool do_prepare; bool do_flush = false; + bool do_clone = false; if (unlikely(bi->bi_opf & REQ_PREFLUSH)) { int ret = log_handle_flush_request(conf, bi); @@ -5803,6 +5808,7 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) if (rw == READ && mddev->degraded == 0 && mddev->reshape_position == MaxSector) { bi = chunk_aligned_read(mddev, bi); + do_clone = true; if (!bi) return true; } @@ -5817,6 +5823,9 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) last_sector = bio_end_sector(bi); bi->bi_next = NULL; + if (!do_clone) + md_account_bio(mddev, &bi); + prepare_to_wait(&conf->wait_for_overlap, &w, TASK_UNINTERRUPTIBLE); for (; logical_sector < last_sector; logical_sector += RAID5_STRIPE_SECTORS(conf)) { int previous; -- 2.20.1

1 19

[PATCH openEuler-5.10 00/64] Backport 5.10.115 LTS
by Zheng Zengkai 04 Aug '22

04 Aug '22

Backport 5.10.115 LTS patches from upstream. git cherry-pick v5.10.114..v5.10.115~1 -s Complicts: Already merged(4): 8a9e7c64f4a0 nfc: replace improper check device_is_registered() in netlink related functions 1961c5a688ed nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs 879b075a9a36 NFC: netlink: fix sleep in atomic bug when firmware download timeout a439819f4797 block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern Rejected(2): hinic driver drops related file in the patch: 475237e807a2 hinic: fix bug of wq out of bound access build failed due to reject of patch "845f44ce3d9f1 net/sched: flower: fix parsing of ethertype following VLAN header": d8338a7a0957 net/mlx5e: Don't match double-vlan packets if cvlan is not set Total patches: 70 - 4 - 2 = 64 Andreas Larsson (2): can: grcan: grcan_probe(): fix broken system id check for errata workaround needs can: grcan: only use the NAPI poll budget for RX Andrei Lalaev (1): gpiolib: of: fix bounds check for 'gpio-reserved-ranges' Armin Wolf (1): hwmon: (adt7470) Fix warning on module removal Aya Levin (1): net/mlx5: Fix slab-out-of-bounds while reading resource dump menu Brian Norris (1): mmc: core: Set HS clock speed before sending HS CMD13 Cheng Xu (1): RDMA/siw: Fix a condition race issue in MPA request processing Chengfeng Ye (1): firewire: fix potential uaf in outbound_phy_packet_callback() Codrin Ciubotariu (1): ASoC: dmaengine: Restore NULL prepare_slave_config() callback Daniel Hellstrom (1): can: grcan: use ofdev->dev when allocating DMA memory David Stevens (1): iommu/vt-d: Calculate mask for non-aligned flushes Duoming Zhou (1): can: grcan: grcan_close(): fix deadlock Eric Dumazet (1): net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter() Filipe Manana (1): btrfs: always log symlinks in full mode Frederic Weisbecker (2): rcu: Fix callbacks processing time limit retaining cond_resched() rcu: Apply callbacks processing time limit only on softirq Harry Wentland (1): drm/amd/display: Avoid reading audio pattern past AUDIO_CHANNELS_COUNT Helge Deller (1): parisc: Merge model and model name into one line in /proc/cpuinfo Ido Schimmel (1): selftests: mirror_gre_bridge_1q: Avoid changing PVID while interface is operational Jakob Koschel (1): firewire: remove check of list iterator against head past the loop body Jan Höppner (2): s390/dasd: Fix read for ESE with blksize < 4k s390/dasd: Fix read inconsistency for ESE DASD devices Jann Horn (1): selftests/seccomp: Don't call read() on TTY from background pgrp Kyle Huey (1): KVM: x86/svm: Account for family 17h event renumberings in amd_pmc_perf_hw_id Maciej W. Rozycki (1): MIPS: Fix CP0 counter erratum detection for R4k CPUs Mark Brown (5): ASoC: da7219: Fix change notifications for tone generator frequency ASoC: wm8958: Fix change notifications for DSP controls ASoC: meson: Fix event generation for AUI ACODEC mux ASoC: meson: Fix event generation for G12A tohdmi mux ASoC: meson: Fix event generation for AUI CODEC mux Mark Zhang (1): net/mlx5e: Fix the calling of update_buffer_lossy() API Michael Chan (1): bnxt_en: Fix unnecessary dropping of RX packets Mike Snitzer (1): dm: interlock pending dm_io and dm_wait_for_bios_completion Moshe Shemesh (1): net/mlx5: Avoid double clear or set of sync reset requested Moshe Tal (1): net/mlx5e: Fix trust state reset in reload Niels Dossche (1): firewire: core: extend card->lock in fw_core_handle_bus_reset Oliver Hartkopp (1): can: isotp: remove re-binding of bound socket Pali Rohár (2): PCI: aardvark: Clear all MSIs at setup PCI: aardvark: Fix reading MSI interrupt number Paolo Bonzini (2): KVM: x86: Do not change ICR on write to APIC_SELF_IPI KVM: x86/mmu: avoid NULL-pointer dereference on page freeing bugs Paul Blakey (1): net/mlx5e: CT: Fix queued up restore put() executing after relevant ft release Puyou Lu (1): gpio: pca953x: fix irq_stat not updated when irq is disabled (irq_mask not set) Ricky WU (1): mmc: rtsx: add 74 Clocks in power on flow Sandipan Das (1): kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU Sergey Shtylyov (1): smsc911x: allow using IRQ0 Shaik Sajida Bhanu (1): mmc: sdhci-msm: Reset GCC_SDCC_BCR register for SDHC Shravya Kumbham (1): net: emaclite: Add error handling for of_address_to_resource() Somnath Kotur (1): bnxt_en: Fix possible bnxt_open() failure caused by wrong RFS flag Stefan Haberland (2): s390/dasd: fix data corruption for ESE devices s390/dasd: prevent double format of tracks for ESE devices Takashi Sakamoto (1): ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes Tan Tee Min (1): net: stmmac: disable Split Header (SPH) for Intel platforms Thomas Pfaff (1): genirq: Synchronize interrupt thread startup Trond Myklebust (2): Revert "SUNRPC: attempt AF_LOCAL connect on setup" NFSv4: Don't invalidate inode attributes on delegation return Vladimir Oltean (1): selftests: ocelot: tc_flower_chains: specify conform-exceed action for policer Wanpeng Li (2): x86/kvm: Preserve BSP MSR_KVM_POLL_CONTROL across suspend/resume KVM: LAPIC: Enable timer posted-interrupt only when mwait/hlt is advertised Yang Yingliang (4): net: ethernet: mediatek: add missing of_node_put() in mtk_sgmii_init() net: dsa: mt7530: add missing of_node_put() in mt7530_setup() net: stmmac: dwmac-sun8i: add missing of_node_put() in sun8i_dwmac_register_mdio_mux() net: cpsw: add missing of_node_put() in cpsw_probe_dt() Zihao Wang (1): ALSA: hda/realtek: Add quirk for Yoga Duet 7 13ITL6 speakers arch/mips/include/asm/timex.h | 8 ++-- arch/mips/kernel/time.c | 11 ++--- arch/parisc/kernel/processor.c | 3 +- arch/x86/kernel/kvm.c | 13 ++++++ arch/x86/kvm/cpuid.c | 5 ++ arch/x86/kvm/lapic.c | 10 ++-- arch/x86/kvm/mmu/mmu.c | 2 + arch/x86/kvm/svm/pmu.c | 28 +++++++++-- drivers/firewire/core-card.c | 3 ++ drivers/firewire/core-cdev.c | 4 +- drivers/firewire/core-topology.c | 9 ++-- drivers/firewire/core-transaction.c | 30 ++++++------ drivers/firewire/sbp2.c | 13 +++--- drivers/gpio/gpio-pca953x.c | 4 +- drivers/gpio/gpiolib-of.c | 2 +- .../gpu/drm/amd/display/dc/core/dc_link_dp.c | 2 +- drivers/hwmon/adt7470.c | 4 +- drivers/infiniband/sw/siw/siw_cm.c | 7 +-- drivers/iommu/intel/iommu.c | 27 +++++++++-- drivers/md/dm.c | 8 +++- drivers/mmc/core/mmc.c | 23 ++++++++-- drivers/mmc/host/rtsx_pci_sdmmc.c | 31 +++++++++---- drivers/mmc/host/sdhci-msm.c | 42 +++++++++++++++++ drivers/net/can/grcan.c | 46 ++++++++++--------- drivers/net/dsa/mt7530.c | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 13 ++++-- drivers/net/ethernet/mediatek/mtk_sgmii.c | 1 + .../mellanox/mlx5/core/diag/rsc_dump.c | 31 ++++++++++--- .../mellanox/mlx5/core/en/port_buffer.c | 4 +- .../ethernet/mellanox/mlx5/core/en/tc_ct.c | 4 ++ .../ethernet/mellanox/mlx5/core/en_dcbnl.c | 10 ++++ .../ethernet/mellanox/mlx5/core/fw_reset.c | 28 +++++++---- drivers/net/ethernet/smsc/smsc911x.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac-intel.c | 1 + .../net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 1 + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- drivers/net/ethernet/ti/cpsw_new.c | 5 +- drivers/net/ethernet/xilinx/xilinx_emaclite.c | 15 ++++-- drivers/pci/controller/pci-aardvark.c | 16 +++---- drivers/s390/block/dasd.c | 18 ++++++-- drivers/s390/block/dasd_eckd.c | 28 ++++++++--- drivers/s390/block/dasd_int.h | 14 ++++++ fs/btrfs/tree-log.c | 14 +++++- fs/nfs/nfs4proc.c | 12 ++++- include/linux/stmmac.h | 1 + kernel/irq/internals.h | 2 + kernel/irq/irqdesc.c | 2 + kernel/irq/manage.c | 39 ++++++++++++---- kernel/rcu/tree.c | 32 +++++++------ net/can/isotp.c | 22 ++------- net/ipv4/igmp.c | 9 ++-- net/sunrpc/xprtsock.c | 3 -- sound/firewire/fireworks/fireworks_hwdep.c | 1 + sound/pci/hda/patch_realtek.c | 1 + sound/soc/codecs/da7219.c | 14 ++++-- sound/soc/codecs/wm8958-dsp2.c | 8 ++-- sound/soc/meson/aiu-acodec-ctrl.c | 2 +- sound/soc/meson/aiu-codec-ctrl.c | 2 +- sound/soc/meson/g12a-tohdmitx.c | 2 +- sound/soc/soc-generic-dmaengine-pcm.c | 6 +-- .../drivers/net/ocelot/tc_flower_chains.sh | 2 +- .../net/forwarding/mirror_gre_bridge_1q.sh | 3 ++ tools/testing/selftests/seccomp/seccomp_bpf.c | 10 ++-- 63 files changed, 501 insertions(+), 215 deletions(-) -- 2.20.1

1 64

[PATCH openEuler-5.10 000/120] Backport 5.10.114 LTS
by Zheng Zengkai 04 Aug '22

04 Aug '22

Backport 5.10.114 LTS patches from upstream. git cherry-pick v5.10.113..v5.10.114~1 -s Complicts: Already merged(5): 54c028cfc496 floppy: disable FDRAWCMD by default e3ec78d82d48 net: hns3: modify the return code of hclge_get_ring_chain_from_mbx 929c30c02de4 net: hns3: add validity check for message data length 9eb25e00f59b net: hns3: add return value for mailbox handling in PF 1781beb87935 tls: Skip tls_append_frag on zero copy size Implementation changed(already merged, use mainline version b98535d09179, 1): 585ef03c9e79 ext4: fix bug_on in start_this_handle during umount filesystem Defered(3, kabi changed): 3c464db03c12 tcp: ensure to use the most recently sent skb when filling the rate sample 6f2bf9c5ddfe mtd: fix 'part' field data corruption in mtd_info 616d354fb9e8 hex2bin: make the function hex_to_bin constant-time Total patches: 129 - 5 - 1 - 3 = 120 Adam Ford (2): ARM: dts: am3517-evm: Fix misc pinmuxing ARM: dts: logicpd-som-lv: Fix wrong pinmuxing on OMAP35 Alexey Kardashevskiy (1): powerpc/perf: Fix 32bit compile Baruch Siach (1): net: phy: marvell10g: fix return value on error Borislav Petkov (1): x86/cpu: Load microcode during restore_processor_state() Bruno Thomsen (1): USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader Chao Song (1): ASoC: Intel: soc-acpi: correct device endpoints for max98373 Christian Hewitt (2): arm64: dts: meson: remove CPU opps below 1GHz for G12B boards arm64: dts: meson: remove CPU opps below 1GHz for SM1 boards Christophe JAILLET (1): bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create() Chuanhong Guo (1): mtd: rawnand: fix ecc parameters for mt7622 Claudiu Beznea (1): ARM: dts: at91: sama5d4_xplained: fix pinctrl phandle name Damien Le Moal (2): zonefs: Fix management of open zones zonefs: Clear inode information flags on inode creation Dan Vacura (1): usb: gadget: uvc: Fix crash when encoding data for usb request Daniel Starke (13): tty: n_gsm: fix restart handling via CLD command tty: n_gsm: fix decoupled mux resource tty: n_gsm: fix mux cleanup after unregister tty device tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2 tty: n_gsm: fix malformed counter for out of frame data tty: n_gsm: fix insufficient txframe size tty: n_gsm: fix wrong DLCI release order tty: n_gsm: fix missing explicit ldisc flush tty: n_gsm: fix wrong command retry handling tty: n_gsm: fix wrong command frame length field encoding tty: n_gsm: fix reset fifo race condition tty: n_gsm: fix incorrect UA handling tty: n_gsm: fix software flow control handling Daniele Palmas (1): USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions Dany Madden (1): Revert "ibmvnic: Add ethtool private flag for driver-defined queue limits" David Yat Sin (1): drm/amdkfd: Fix GWS queue count Dinh Nguyen (1): net: ethernet: stmmac: fix write to sgmii_adapter_base Duoming Zhou (1): drivers: net: hippi: Fix deadlock in rr_close() Eric Dumazet (2): tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT tcp: make sure treq->af_specific is initialized Evan Green (1): xhci: Enable runtime PM on second Alderlake controller Eyal Birger (1): bpf, lwt: Fix crash when using bpf_skb_set_tunnel_key() from bpf_xmit lwt hook Fabio Estevam (2): ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue arm64: dts: imx8mn-ddr4-evk: Describe the 32.768 kHz PMIC clock Fawzi Khaber (1): iio: imu: inv_icm42600: Fix I2C init possible nack Florian Westphal (1): netfilter: nft_socket: only do sk lookups when indev is available Francesco Ruggeri (1): tcp: md5: incorrect tcp_header_len for incoming connections Geert Uytterhoeven (1): memory: renesas-rpc-if: Fix HF/OSPI data transfer in Manual Mode Greg Kroah-Hartman (1): lightnvm: disable the subsystem Guo Ren (1): riscv: patch_text: Fixup last cpu should be master H. Nikolaus Schaller (1): ARM: dts: Fix mmc order for omap3-gta04 Hangyu Hua (1): usb: misc: fix improper handling of refcount in uss720_probe() Heikki Krogerus (2): usb: typec: ucsi: Fix reuse of completion structure usb: typec: ucsi: Fix role swapping Henry Lin (1): xhci: stop polling roothubs after shutdown Imre Deak (1): drm/i915: Fix SEL_FETCH_PLANE_*(PIPE_B+) register addresses Johan Hovold (1): serial: imx: fix overrun interrupts in DMA mode Jonathan Lemon (1): net: bcmgenet: hide status block before TX timestamping Kees Cook (2): USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS thermal: int340x: Fix attr.show callback prototype Krzysztof Kozlowski (2): pinctrl: samsung: fix missing GPIOLIB on ARM64 Exynos config phy: samsung: exynos5250-sata: fix missing device put in probe error paths Leon Romanovsky (1): ixgbe: ensure IPsec VF<->PF compatibility Lijun Pan (1): ibmvnic: fix miscellaneous checks Luca Ceresoli (1): pinctrl: rockchip: fix RK3308 pinmux bits Lv Ruyi (1): pinctrl: pistachio: fix use of irq_of_parse_and_map() Maciej W. Rozycki (2): serial: 8250: Also set sticky MCR bits in console restoration serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device Macpaul Lin (1): usb: mtu3: fix USB 3.0 dual-role-switch from device to host Manish Chopra (1): bnx2x: fix napi API usage sequence Marek Vasut (2): pinctrl: stm32: Do not call stm32_gpio_get() for edge triggered IRQs in EOI pinctrl: stm32: Keep pinctrl block clock enabled when LEVEL IRQ requested Mark Brown (1): ARM: dts: at91: Map MCLK for wm8731 on at91sam9g20ek Martin Blumenstingl (1): net: dsa: lantiq_gswip: Don't set GSWIP_MII_CFG_RMII_CLK Mathias Nyman (1): xhci: increase usb U3 -> U0 link resume timeout from 100ms to 500ms Max Krummenacher (1): ARM: dts: imx6ull-colibri: fix vqmmc regulator Miaoqian Lin (8): phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe ARM: OMAP2+: Fix refcount leak in omap_gic_of_init phy: ti: omap-usb2: Fix error handling in omap_usb2_enable_clocks phy: mapphone-mdm6600: Fix PM error handling in phy_mdm6600_probe phy: ti: Add missing pm_runtime_disable() in serdes_am654_probe mtd: rawnand: Fix return value check of wait_for_completion_timeout net: dsa: Add missing of_node_put() in dsa_port_link_register_of drm/amd/display: Fix memory leak in dcn21_clock_source_create Michael Hennerich (1): iio: dac: ad5446: Fix read_raw not returning set value Mikulas Patocka (2): hex2bin: fix access beyond string end x86: __memcpy_flushcache: fix wrong alignment if size > 2^32 Namhyung Kim (3): perf symbol: Pass is_kallsyms to symbols__fixup_end() perf symbol: Update symbols__fixup_end() perf symbol: Remove arch__symbols__fixup_end() Nikolay Aleksandrov (1): wireguard: device: check for metadata_dst with skb_valid_dst() Oliver Neukum (2): USB: quirks: add a Realtek card reader USB: quirks: add STRING quirk for VCOM device Pablo Neira Ayuso (1): netfilter: nft_set_rbtree: overlap detection with element re-addition after deletion Pavel Skripkin (1): video: fbdev: udlfb: properly check endpoint type Pawel Laszczak (1): usb: cdns3: Fix issue for clear halt endpoint Peilin Ye (3): ip_gre: Make o_seqno start from 0 in native mode ip6_gre: Make o_seqno start from 0 in native mode ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode Pengcheng Yang (2): ipvs: correctly print the memory size of ip_vs_conn_tab tcp: fix F-RTO may not work correctly when receiving DSACK Ronnie Sahlberg (1): cifs: destage any unwritten data to the server before calling copychunk_write Sean Anderson (1): usb: phy: generic: Get the vbus supply Slark Xiao (1): USB: serial: option: add support for Cinterion MV32-WA/MV32-WB Sven Peter (1): usb: dwc3: Try usb-role-switch first in dwc3_drd_init Tejun Heo (1): iocost: don't reset the inuse weight of under-weighted debtors Thinh Nguyen (3): usb: dwc3: core: Fix tx/rx threshold settings usb: dwc3: core: Only handle soft-reset in DCTL usb: dwc3: gadget: Return proper request status Thomas Gleixner (1): x86/pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests Tong Zhang (1): iio:imu:bmi160: disable regulator in error path Tony Lindgren (1): bus: ti-sysc: Make omap3 gpt12 quirk handling SoC specific Vijayavardhan Vennapusa (1): usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind() Wang Qing (1): arch_topology: Do not set llc_sibling if llc_id is invalid Weitao Wang (1): USB: Fix xhci event ring dequeue pointer ERDP update issue Xiaobing Luo (1): cpufreq: fix memory leak in sun50i_cpufreq_nvmem_probe Xin Long (1): sctp: check asoc strreset_chunk in sctp_generate_reconf_event Yang Yingliang (2): clk: sunxi: sun9i-mmc: check return value after calling platform_get_resource() net: fec: add missing of_node_put() in fec_enet_init_stop_mode() YueHaibing (1): pinctrl: mediatek: moore: Fix build error Zheyu Ma (2): iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on() ASoC: wm8731: Disable the regulator when probing fails Zizhuang Deng (1): iio: dac: ad5592r: Fix the missing return value. Zqiang (1): kasan: prevent cpu_quarantine corruption when CPU offline and cache shrink occur at same time liuyacan (1): net/smc: sync err code when tcp connection was refused arch/arm/boot/dts/am3517-evm.dts | 45 +++- arch/arm/boot/dts/am3517-som.dtsi | 9 + arch/arm/boot/dts/at91-sama5d4_xplained.dts | 4 +- arch/arm/boot/dts/at91sam9g20ek_common.dtsi | 6 + arch/arm/boot/dts/imx6qdl-apalis.dtsi | 10 +- arch/arm/boot/dts/imx6ull-colibri.dtsi | 2 +- .../boot/dts/logicpd-som-lv-35xx-devkit.dts | 15 ++ .../boot/dts/logicpd-som-lv-37xx-devkit.dts | 15 ++ arch/arm/boot/dts/logicpd-som-lv.dtsi | 15 -- arch/arm/boot/dts/omap3-gta04.dtsi | 2 + arch/arm/mach-exynos/Kconfig | 1 - arch/arm/mach-omap2/omap4-common.c | 2 + .../boot/dts/amlogic/meson-g12b-a311d.dtsi | 40 ---- .../boot/dts/amlogic/meson-g12b-s922x.dtsi | 40 ---- arch/arm64/boot/dts/amlogic/meson-sm1.dtsi | 20 -- .../boot/dts/freescale/imx8mn-ddr4-evk.dts | 4 + arch/powerpc/perf/Makefile | 4 +- arch/riscv/kernel/patch.c | 2 +- arch/x86/include/asm/microcode.h | 2 + arch/x86/kernel/cpu/microcode/core.c | 6 +- arch/x86/lib/usercopy_64.c | 2 +- arch/x86/pci/xen.c | 6 +- arch/x86/power/cpu.c | 10 +- block/blk-iocost.c | 12 +- drivers/base/arch_topology.c | 2 +- drivers/bus/sunxi-rsb.c | 2 + drivers/bus/ti-sysc.c | 16 +- drivers/clk/sunxi/clk-sun9i-mmc.c | 2 + drivers/cpufreq/sun50i-cpufreq-nvmem.c | 4 +- .../drm/amd/amdkfd/kfd_device_queue_manager.c | 83 ++++---- .../drm/amd/display/dc/dcn21/dcn21_resource.c | 1 + drivers/gpu/drm/i915/i915_reg.h | 2 +- drivers/iio/dac/ad5446.c | 2 +- drivers/iio/dac/ad5592r-base.c | 2 +- drivers/iio/imu/bmi160/bmi160_core.c | 20 +- .../iio/imu/inv_icm42600/inv_icm42600_i2c.c | 15 +- drivers/iio/magnetometer/ak8975.c | 1 + drivers/lightnvm/Kconfig | 2 +- drivers/memory/renesas-rpc-if.c | 60 ++++-- drivers/mtd/nand/raw/mtk_ecc.c | 12 +- drivers/mtd/nand/raw/sh_flctl.c | 14 +- drivers/net/dsa/lantiq_gswip.c | 3 - .../net/ethernet/broadcom/bnx2x/bnx2x_main.c | 9 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 7 + drivers/net/ethernet/freescale/fec_main.c | 2 +- drivers/net/ethernet/ibm/ibmvnic.c | 144 ++++--------- drivers/net/ethernet/ibm/ibmvnic.h | 6 - .../net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 3 +- .../ethernet/stmicro/stmmac/dwmac-socfpga.c | 12 +- drivers/net/hippi/rrunner.c | 2 + drivers/net/phy/marvell10g.c | 2 +- drivers/net/wireguard/device.c | 3 +- drivers/phy/motorola/phy-mapphone-mdm6600.c | 3 +- drivers/phy/samsung/phy-exynos5250-sata.c | 21 +- drivers/phy/ti/phy-am654-serdes.c | 2 +- drivers/phy/ti/phy-omap-usb2.c | 2 +- drivers/pinctrl/mediatek/Kconfig | 1 + drivers/pinctrl/pinctrl-pistachio.c | 6 +- drivers/pinctrl/pinctrl-rockchip.c | 45 ++-- drivers/pinctrl/samsung/Kconfig | 11 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 23 ++- .../intel/int340x_thermal/int3400_thermal.c | 4 +- drivers/tty/n_gsm.c | 194 ++++++++++-------- drivers/tty/serial/8250/8250_pci.c | 8 +- drivers/tty/serial/8250/8250_port.c | 2 +- drivers/tty/serial/imx.c | 2 +- drivers/usb/cdns3/gadget.c | 7 +- drivers/usb/core/quirks.c | 6 + drivers/usb/dwc3/core.c | 11 +- drivers/usb/dwc3/drd.c | 11 +- drivers/usb/dwc3/gadget.c | 31 ++- drivers/usb/gadget/configfs.c | 2 + drivers/usb/gadget/function/uvc_queue.c | 2 + drivers/usb/host/xhci-hub.c | 2 +- drivers/usb/host/xhci-pci.c | 4 +- drivers/usb/host/xhci-ring.c | 2 + drivers/usb/host/xhci.c | 11 + drivers/usb/misc/uss720.c | 3 +- drivers/usb/mtu3/mtu3_dr.c | 6 +- drivers/usb/phy/phy-generic.c | 7 + drivers/usb/serial/cp210x.c | 2 + drivers/usb/serial/option.c | 12 ++ drivers/usb/serial/whiteheat.c | 5 +- drivers/usb/typec/ucsi/ucsi.c | 24 ++- drivers/video/fbdev/udlfb.c | 14 +- fs/cifs/smb2ops.c | 8 + fs/zonefs/super.c | 46 ++++- include/memory/renesas-rpc-if.h | 1 + include/net/ip6_tunnel.h | 2 +- include/net/ip_tunnels.h | 2 +- include/net/tcp.h | 2 + lib/hexdump.c | 9 +- mm/kasan/quarantine.c | 7 + net/core/lwt_bpf.c | 7 +- net/dsa/port.c | 2 + net/ipv4/ip_gre.c | 12 +- net/ipv4/syncookies.c | 8 +- net/ipv4/tcp_input.c | 15 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 1 + net/ipv6/ip6_gre.c | 16 +- net/ipv6/syncookies.c | 3 +- net/netfilter/ipvs/ip_vs_conn.c | 2 +- net/netfilter/nft_set_rbtree.c | 6 +- net/netfilter/nft_socket.c | 52 +++-- net/sctp/sm_sideeffect.c | 4 + net/smc/af_smc.c | 2 + sound/soc/codecs/wm8731.c | 19 +- .../intel/common/soc-acpi-intel-tgl-match.c | 4 +- tools/perf/arch/arm64/util/Build | 1 - tools/perf/arch/arm64/util/machine.c | 27 --- tools/perf/arch/s390/util/machine.c | 16 -- tools/perf/util/symbol-elf.c | 2 +- tools/perf/util/symbol.c | 37 +++- tools/perf/util/symbol.h | 3 +- 115 files changed, 879 insertions(+), 632 deletions(-) delete mode 100644 tools/perf/arch/arm64/util/machine.c -- 2.20.1

1 120

[PATCH openEuler-1.0-LTS] rcu: Set a maximum limit for back-to-back callback invocation
by Yongqiang Liu 04 Aug '22

04 Aug '22

From: "Paul E. McKenney" <paulmck(a)linux.ibm.com> mainline inclusion from mainline-v5.3-rc1 commit d5a9a8c3bc8068f2e5dfba30150ac09b596b461a category: bugfix bugzilla: 187356, https://gitee.com/openeuler/kernel/issues/I5KOZ5 CVE: NA --------------------------- Currently, if a CPU has more than 10,000 callbacks pending, it will increase rdp->blimit to LONG_MAX. If you are lucky, LONG_MAX is only about two billion, but this is still a bit too many callbacks to invoke back-to-back while otherwise ignoring the world. This commit therefore sets a maximum limit of DEFAULT_MAX_RCU_BLIMIT, which is set to 10,000, for rdp->blimit. Reported-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Signed-off-by: Paul E. McKenney <paulmck(a)linux.ibm.com> Conflicts: kernel/rcu/tree.c Signed-off-by: Zhen Lei <thunder.leizhen(a)huawei.com> Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/rcu/tree.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c index ea05c59096a2..a0dc5385bcbc 100644 --- a/kernel/rcu/tree.c +++ b/kernel/rcu/tree.c @@ -490,7 +490,8 @@ void rcu_all_qs(void) } EXPORT_SYMBOL_GPL(rcu_all_qs); -#define DEFAULT_RCU_BLIMIT 10 /* Maximum callbacks per rcu_do_batch. */ +#define DEFAULT_RCU_BLIMIT 10 /* Maximum callbacks per rcu_do_batch ... */ +#define DEFAULT_MAX_RCU_BLIMIT 10000 /* ... even during callback flood. */ static long blimit = DEFAULT_RCU_BLIMIT; #define DEFAULT_RCU_QHIMARK 10000 /* If this many pending, ignore blimit. */ static long qhimark = DEFAULT_RCU_QHIMARK; @@ -2604,7 +2605,7 @@ static void rcu_do_batch(struct rcu_state *rsp, struct rcu_data *rdp) /* Reinstate batch limit if we have worked down the excess. */ count = rcu_segcblist_n_cbs(&rdp->cblist); - if (rdp->blimit == LONG_MAX && count <= qlowmark) + if (rdp->blimit >= DEFAULT_MAX_RCU_BLIMIT && count <= qlowmark) rdp->blimit = blimit; /* Reset ->qlen_last_fqs_check trigger if enough CBs have drained. */ @@ -2940,7 +2941,7 @@ static void __call_rcu_core(struct rcu_state *rsp, struct rcu_data *rdp, rcu_accelerate_cbs_unlocked(rsp, rdp->mynode, rdp); } else { /* Give the grace period a kick. */ - rdp->blimit = LONG_MAX; + rdp->blimit = DEFAULT_MAX_RCU_BLIMIT; if (rsp->n_force_qs == rdp->n_force_qs_snap && rcu_segcblist_first_pend_cb(&rdp->cblist) != head) force_quiescent_state(rsp); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] mm: Fix page counter mismatch in shmem_mfill_atomic_pte
by Yongqiang Liu 04 Aug '22

04 Aug '22

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5JT6V CVE: NA -------------------------------- shmem_mfill_atomic_pte() wrongly called mem_cgroup_cancel_charge() in "success" path, it should mem_cgroup_uncharge() to dec memory counter instead. mem_cgroup_cancel_charge() should only be used if this transaction is unsuccessful and mem_cgroup_uncharge() is used to do this if this transaction succeed. This will lead to page->memcg not null and will uncharge one more in put_page(). The page counter will underflow to maximum value and trigger oom to kill all process include sshd and leave system unaccessible. page->memcg is set in the following path: mem_cgroup_commit_charge commit_charge page->mem_cgroup = memcg; extra uncharge will be done in the following path: put_page __put_page __put_single_page mem_cgroup_uncharge if (!page->mem_cgroup) <-- should return return uncharge_page uncharge_batch To fix this, call mem_cgroup_commit_charge() at the end of this transaction to make sure this transaction is really finished. Fixes: 4c27fe4c4c84 ("userfaultfd: shmem: add shmem_mcopy_atomic_pte for userfaultfd support") Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/shmem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mm/shmem.c b/mm/shmem.c index 34981c7aad14..e300395fe308 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -2464,8 +2464,6 @@ static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm, if (ret) goto out_release_uncharge; - mem_cgroup_commit_charge(page, memcg, false, false); - _dst_pte = mk_pte(page, dst_vma->vm_page_prot); if (dst_vma->vm_flags & VM_WRITE) _dst_pte = pte_mkwrite(pte_mkdirty(_dst_pte)); @@ -2491,6 +2489,8 @@ static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm, if (!pte_none(*dst_pte)) goto out_release_uncharge_unlock; + mem_cgroup_commit_charge(page, memcg, false, false); + lru_cache_add_anon(page); spin_lock_irq(&info->lock); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] scsi: mpt3sas: Fix unlock imbalance
by Yongqiang Liu 04 Aug '22

04 Aug '22

From: Damien Le Moal <damien.lemoal(a)wdc.com> mainline inclusion from mainline-v5.8-rc5 commit cb551b8dc079d2ef189145782627c99cb68c0255 category: bugfix bugzilla: 187287, https://gitee.com/openeuler/kernel/issues/I5JQML CVE: NA -------------------------------- In BRM_status_show(), if the condition "!ioc->is_warpdrive" tested on entry to the function is true, a "goto out" is called. This results in unlocking ioc->pci_access_mutex without this mutex lock being taken. This generates the following splat: [ 1148.539883] mpt3sas_cm2: BRM_status_show: BRM attribute is only for warpdrive [ 1148.547184] [ 1148.548708] ===================================== [ 1148.553501] WARNING: bad unlock balance detected! [ 1148.558277] 5.8.0-rc3+ #827 Not tainted [ 1148.562183] ------------------------------------- [ 1148.566959] cat/5008 is trying to release lock (&ioc->pci_access_mutex) at: [ 1148.574035] [<ffffffffc070b7a3>] BRM_status_show+0xd3/0x100 [mpt3sas] [ 1148.580574] but there are no more locks to release! [ 1148.585524] [ 1148.585524] other info that might help us debug this: [ 1148.599624] 3 locks held by cat/5008: [ 1148.607085] #0: ffff92aea3e392c0 (&p->lock){+.+.}-{3:3}, at: seq_read+0x34/0x480 [ 1148.618509] #1: ffff922ef14c4888 (&of->mutex){+.+.}-{3:3}, at: kernfs_seq_start+0x2a/0xb0 [ 1148.630729] #2: ffff92aedb5d7310 (kn->active#224){.+.+}-{0:0}, at: kernfs_seq_start+0x32/0xb0 [ 1148.643347] [ 1148.643347] stack backtrace: [ 1148.655259] CPU: 73 PID: 5008 Comm: cat Not tainted 5.8.0-rc3+ #827 [ 1148.665309] Hardware name: HGST H4060-S/S2600STB, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [ 1148.678394] Call Trace: [ 1148.684750] dump_stack+0x78/0xa0 [ 1148.691802] lock_release.cold+0x45/0x4a [ 1148.699451] __mutex_unlock_slowpath+0x35/0x270 [ 1148.707675] BRM_status_show+0xd3/0x100 [mpt3sas] [ 1148.716092] dev_attr_show+0x19/0x40 [ 1148.723664] sysfs_kf_seq_show+0x87/0x100 [ 1148.731193] seq_read+0xbc/0x480 [ 1148.737882] vfs_read+0xa0/0x160 [ 1148.744514] ksys_read+0x58/0xd0 [ 1148.751129] do_syscall_64+0x4c/0xa0 [ 1148.757941] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1148.766240] RIP: 0033:0x7f1230566542 [ 1148.772957] Code: Bad RIP value. [ 1148.779206] RSP: 002b:00007ffeac1bcac8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1148.790063] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f1230566542 [ 1148.800284] RDX: 0000000000020000 RSI: 00007f1223460000 RDI: 0000000000000003 [ 1148.810474] RBP: 00007f1223460000 R08: 00007f122345f010 R09: 0000000000000000 [ 1148.820641] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000000000 [ 1148.830728] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000 Fix this by returning immediately instead of jumping to the out label. Link: https://lore.kernel.org/r/20200701085254.51740-1-damien.lemoal@wdc.com Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Acked-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Signed-off-by: Damien Le Moal <damien.lemoal(a)wdc.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Conflict: drivers/scsi/mpt3sas/mpt3sas_ctl.c Signed-off-by: Zhang Wensheng <zhangwensheng5(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/scsi/mpt3sas/mpt3sas_ctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_ctl.c b/drivers/scsi/mpt3sas/mpt3sas_ctl.c index 772d78d92d44..90060af097cc 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_ctl.c +++ b/drivers/scsi/mpt3sas/mpt3sas_ctl.c @@ -2965,7 +2965,7 @@ _ctl_BRM_status_show(struct device *cdev, struct device_attribute *attr, if (!ioc->is_warpdrive) { pr_err(MPT3SAS_FMT "%s: BRM attribute is only for" " warpdrive\n", ioc->name, __func__); - goto out; + return 0; } /* pci_access_mutex lock acquired by sysfs show path */ mutex_lock(&ioc->pci_access_mutex); -- 2.25.1

1 0

openEuler kernel SIG例会
by openEuler conference 04 Aug '22

04 Aug '22

您好！ Kernel SIG 邀请您参加 2022-08-05 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler kernel SIG例会会议内容： 1、arm64:support SME（Scalable Matrix Extension）特性回合评审 2、rust for openEuler特性回合评审会议链接：https://us06web.zoom.us/j/89651338599?pwd=RUMzN1B6WStiMXVwcEdZZVYxTWRmdz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-08-05 14:00, The subject of the conference is openEuler kernel SIG例会, Summary: 1、arm64:support SME（Scalable Matrix Extension）特性回合评审 2、rust for openEuler特性回合评审 You can join the meeting at https://us06web.zoom.us/j/89651338599?pwd=RUMzN1B6WStiMXVwcEdZZVYxTWRmdz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] io-wq: Switch io_wqe_worker's fs before releasing request
by Yongqiang Liu 04 Aug '22

04 Aug '22

From: Zhihao Cheng <chengzhihao1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187369, https://gitee.com/openeuler/kernel/issues/I5K66O CVE: NA -------------------------------- Following process triggers an use-after-free problem while iterating every process's fs: main fd = setup_iouring fork => main' // task->fs->users = 1 submit(fd, STATX, async) id->fs = current->fs req->work.identity = id io_submit_sqes ... io_grab_identity id = req->work.identity id->fs->users++ // fs->users = 2 io_wqe_worker current->fs = work->identity->fs io_req_clean_work fs = req->work.identity->fs --fs->users // fs->user = 1 main' exit exit_fs --fs->users // fs->user = 0 free_fs_struct(fs) // FREE fs pivot_root chroot_fs_refs do_each_thread(g, p) { fs = p->fs // io_wqe_worker->fs if (fs) spin_lock(&fs->lock) // UAF! } io_wqe_worker io_worker_exit __io_worker_unuse if (current->fs != worker->restore_fs) current->fs = worker->restore_fs Task's fs_struct is used in do_work() and destroyed in free_work(), this problem can be fixed by switching io_wqe_worker's fs before releasing request. Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/io-wq.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/io-wq.c b/fs/io-wq.c index b6e311e57b47..67d157bcf2fb 100644 --- a/fs/io-wq.c +++ b/fs/io-wq.c @@ -534,6 +534,8 @@ static void io_worker_handle_work(struct io_worker *worker) linked = NULL; } io_assign_current_work(worker, work); + if (current->fs != worker->restore_fs) + current->fs = worker->restore_fs; wq->free_work(old_work); if (linked) -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
by Yongqiang Liu 03 Aug '22

03 Aug '22

From: Pavel Skripkin <paskripkin(a)gmail.com> mainline inclusion from linux-next commit 0ac4827f78c7ffe8eef074bc010e7e34bc22f533 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I58DFB CVE: CVE-2022-1679 -------------------------------- Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The problem was in incorrect htc_handle->drv_priv initialization. Probable call trace which can trigger use-after-free: ath9k_htc_probe_device() /* htc_handle->drv_priv = priv; */ ath9k_htc_wait_for_target() <--- Failed ieee80211_free_hw() <--- priv pointer is freed <IRQ> ... ath9k_hif_usb_rx_cb() ath9k_hif_usb_rx_stream() RX_STAT_INC() <--- htc_handle->drv_priv access In order to not add fancy protection for drv_priv we can move htc_handle->drv_priv initialization at the end of the ath9k_htc_probe_device() and add helper macro to make all *_STAT_* macros NULL safe, since syzbot has reported related NULL deref in that macros [1] Link: https://syzkaller.appspot.com/bug?id=6ead44e37afb6866ac0c7dd121b4ce07cb665f… [0] Link: https://syzkaller.appspot.com/bug?id=b8101ffcec107c0567a0cd8acbbacec91e9ee8… [1] Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") Reported-and-tested-by: syzbot+03110230a11411024147(a)syzkaller.appspotmail.com Reported-and-tested-by: syzbot+c6dde1f690b60e0b9fbe(a)syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Acked-by: Toke Høiland-Jørgensen <toke(a)toke.dk> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://lore.kernel.org/r/d57bbedc857950659bfacac0ab48790c1eda00c8.16551457… Signed-off-by: Xu Jia <xujia39(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/wireless/ath/ath9k/htc.h | 10 +++++----- drivers/net/wireless/ath/ath9k/htc_drv_init.c | 3 ++- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h index 9f64e32381f9..81107100e368 100644 --- a/drivers/net/wireless/ath/ath9k/htc.h +++ b/drivers/net/wireless/ath/ath9k/htc.h @@ -325,11 +325,11 @@ static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(struct sk_buff *skb) } #ifdef CONFIG_ATH9K_HTC_DEBUGFS - -#define TX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c++) -#define TX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a) -#define RX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++) -#define RX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a) +#define __STAT_SAFE(expr) (hif_dev->htc_handle->drv_priv ? (expr) : 0) +#define TX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c++) +#define TX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a) +#define RX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++) +#define RX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a) #define CAB_STAT_INC priv->debug.tx_stats.cab_queued++ #define TX_QSTAT_INC(q) (priv->debug.tx_stats.queue_stats[q]++) diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c index 214c68269a69..e3a6f48dbd8c 100644 --- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c +++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c @@ -945,7 +945,6 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev, priv->hw = hw; priv->htc = htc_handle; priv->dev = dev; - htc_handle->drv_priv = priv; SET_IEEE80211_DEV(hw, priv->dev); ret = ath9k_htc_wait_for_target(priv); @@ -966,6 +965,8 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev, if (ret) goto err_init; + htc_handle->drv_priv = priv; + return 0; err_init: -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] Revert "iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()"
by Yongqiang Liu 03 Aug '22

03 Aug '22

From: Zhang Zekun <zhangzekun11(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187358, https://gitee.com/openeuler/kernel/issues/I5KD2A CVE: NA --------------------------------- This reverts commit 75624b5bc0485778aef9f46ebbf5e5df3c0d054c. This patch could cause double-free problem, when 'irqdomain' is failed to add, in which case, irq_domain_free_fwnode(fn) will be called twice. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/iommu/intel_irq_remapping.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c index 276005451914..967450bd421a 100644 --- a/drivers/iommu/intel_irq_remapping.c +++ b/drivers/iommu/intel_irq_remapping.c @@ -539,7 +539,7 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu) irq_domain_free_fwnode(fn); if (!iommu->ir_domain) { pr_err("IR%d: failed to allocate irqdomain\n", iommu->seq_id); - goto out_free_fwnode; + goto out_free_bitmap; } iommu->ir_msi_domain = arch_create_remap_msi_irq_domain(iommu->ir_domain, @@ -563,7 +563,7 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu) if (dmar_enable_qi(iommu)) { pr_err("Failed to enable queued invalidation\n"); - goto out_free_ir_domain; + goto out_free_bitmap; } } @@ -587,14 +587,6 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu) return 0; -out_free_ir_domain: - if (iommu->ir_msi_domain) - irq_domain_remove(iommu->ir_msi_domain); - iommu->ir_msi_domain = NULL; - irq_domain_remove(iommu->ir_domain); - iommu->ir_domain = NULL; -out_free_fwnode: - irq_domain_free_fwnode(fn); out_free_bitmap: kfree(bitmap); out_free_pages: -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS 01/20] md: add io accounting for raid0 and raid5
by Zheng Zengkai 02 Aug '22

02 Aug '22

From: Guoqing Jiang <jgq516(a)gmail.com> mainline inclusion from mainline-v5.14-rc1 commit 10764815ff4728d2c57da677cd5d3dd6f446cf5f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I587H6 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------- We introduce a new bioset (io_acct_set) for raid0 and raid5 since they don't own clone infrastructure to accounting io. And the bioset is added to mddev instead of to raid0 and raid5 layer, because with this way, we can put common functions to md.h and reuse them in raid0 and raid5. Also struct md_io_acct is added accordingly which includes io start_time, the origin bio and cloned bio. Then we can call bio_{start,end}_io_acct to get related io status. Signed-off-by: Guoqing Jiang <jiangguoqing(a)kylinos.cn> Signed-off-by: Song Liu <song(a)kernel.org> Conflict: drivers/md/md.c drivers/md/md.h Signed-off-by: Zhang Wensheng <zhangwensheng5(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/md/md.c | 52 ++++++++++++++++++++++++++++++++++++++++++---- drivers/md/md.h | 8 +++++++ drivers/md/raid0.c | 3 +++ drivers/md/raid5.c | 9 ++++++++ 4 files changed, 68 insertions(+), 4 deletions(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index a299fda5b0e9..10d9a8bed604 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -2361,7 +2361,8 @@ int md_integrity_register(struct mddev *mddev) bdev_get_integrity(reference->bdev)); pr_debug("md: data integrity enabled on %s\n", mdname(mddev)); - if (bioset_integrity_create(&mddev->bio_set, BIO_POOL_SIZE)) { + if (bioset_integrity_create(&mddev->bio_set, BIO_POOL_SIZE) || + bioset_integrity_create(&mddev->io_acct_set, BIO_POOL_SIZE)) { pr_err("md: failed to create integrity pool for %s\n", mdname(mddev)); return -EINVAL; @@ -5597,6 +5598,7 @@ static void md_free(struct kobject *ko) bioset_exit(&mddev->bio_set); bioset_exit(&mddev->sync_set); + bioset_exit(&mddev->io_acct_set); kfree(mddev); } @@ -5885,7 +5887,13 @@ int md_run(struct mddev *mddev) if (!bioset_initialized(&mddev->sync_set)) { err = bioset_init(&mddev->sync_set, BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS); if (err) - return err; + goto exit_bio_set; + } + if (!bioset_initialized(&mddev->io_acct_set)) { + err = bioset_init(&mddev->io_acct_set, BIO_POOL_SIZE, + offsetof(struct md_io_acct, bio_clone), 0); + if (err) + goto exit_sync_set; } spin_lock(&pers_lock); @@ -6013,6 +6021,7 @@ int md_run(struct mddev *mddev) blk_queue_flag_set(QUEUE_FLAG_NONROT, mddev->queue); else blk_queue_flag_clear(QUEUE_FLAG_NONROT, mddev->queue); + blk_queue_flag_set(QUEUE_FLAG_IO_STAT, mddev->queue); } if (pers->sync_request) { if (mddev->kobj.sd && @@ -6062,8 +6071,11 @@ int md_run(struct mddev *mddev) module_put(pers->owner); md_bitmap_destroy(mddev); abort: - bioset_exit(&mddev->bio_set); + bioset_exit(&mddev->io_acct_set); +exit_sync_set: bioset_exit(&mddev->sync_set); +exit_bio_set: + bioset_exit(&mddev->bio_set); return err; } EXPORT_SYMBOL_GPL(md_run); @@ -6288,6 +6300,7 @@ void md_stop(struct mddev *mddev) __md_stop(mddev); bioset_exit(&mddev->bio_set); bioset_exit(&mddev->sync_set); + bioset_exit(&mddev->io_acct_set); } EXPORT_SYMBOL_GPL(md_stop); @@ -8571,9 +8584,40 @@ void md_write_end(struct mddev *mddev) roundup(jiffies, mddev->safemode_delay) + mddev->safemode_delay); } - EXPORT_SYMBOL(md_write_end); +static void md_end_io_acct(struct bio *bio) +{ + struct md_io_acct *md_io_acct = bio->bi_private; + struct bio *orig_bio = md_io_acct->orig_bio; + + orig_bio->bi_status = bio->bi_status; + + bio_end_io_acct(orig_bio, md_io_acct->start_time); + bio_put(bio); + bio_endio(orig_bio); +} + +/* used by personalities (raid0 and raid5) to account io stats */ +void md_account_bio(struct mddev *mddev, struct bio **bio) +{ + struct md_io_acct *md_io_acct; + struct bio *clone; + + if (!blk_queue_io_stat((*bio)->bi_disk->queue)) + return; + + clone = bio_clone_fast(*bio, GFP_NOIO, &mddev->io_acct_set); + md_io_acct = container_of(clone, struct md_io_acct, bio_clone); + md_io_acct->orig_bio = *bio; + md_io_acct->start_time = bio_start_io_acct(*bio); + + clone->bi_end_io = md_end_io_acct; + clone->bi_private = md_io_acct; + *bio = clone; +} +EXPORT_SYMBOL_GPL(md_account_bio); + /* md_allow_write(mddev) * Calling this ensures that the array is marked 'active' so that writes * may proceed without blocking. It is important to call this before diff --git a/drivers/md/md.h b/drivers/md/md.h index 85177d068322..20c16cfdd6bb 100644 --- a/drivers/md/md.h +++ b/drivers/md/md.h @@ -491,6 +491,7 @@ struct mddev { struct bio_set sync_set; /* for sync operations like * metadata and bitmap writes */ + struct bio_set io_acct_set; /* for raid0 and raid5 io accounting */ /* Generic flush handling. * The last to finish preflush schedules a worker to submit @@ -687,6 +688,12 @@ struct md_thread { void *private; }; +struct md_io_acct { + struct bio *orig_bio; + unsigned long start_time; + struct bio bio_clone; +}; + #define THREAD_WAKEUP 0 static inline void safe_put_page(struct page *p) @@ -716,6 +723,7 @@ extern void md_write_end(struct mddev *mddev); extern void md_done_sync(struct mddev *mddev, int blocks, int ok); extern void md_error(struct mddev *mddev, struct md_rdev *rdev); extern void md_finish_reshape(struct mddev *mddev); +void md_account_bio(struct mddev *mddev, struct bio **bio); extern bool __must_check md_flush_request(struct mddev *mddev, struct bio *bio); extern void md_super_write(struct mddev *mddev, struct md_rdev *rdev, diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c index 35843df15b5e..0312b192106a 100644 --- a/drivers/md/raid0.c +++ b/drivers/md/raid0.c @@ -556,6 +556,9 @@ static bool raid0_make_request(struct mddev *mddev, struct bio *bio) bio = split; } + if (bio->bi_pool != &mddev->bio_set) + md_account_bio(mddev, &bio); + orig_sector = sector; zone = find_zone(mddev->private, &sector); switch (conf->layout) { diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c index c82953a3299e..35dacc6e754f 100644 --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c @@ -5487,6 +5487,7 @@ static struct bio *chunk_aligned_read(struct mddev *mddev, struct bio *raid_bio) sector_t sector = raid_bio->bi_iter.bi_sector; unsigned chunk_sects = mddev->chunk_sectors; unsigned sectors = chunk_sects - (sector & (chunk_sects-1)); + struct r5conf *conf = mddev->private; if (sectors < bio_sectors(raid_bio)) { struct r5conf *conf = mddev->private; @@ -5496,6 +5497,9 @@ static struct bio *chunk_aligned_read(struct mddev *mddev, struct bio *raid_bio) raid_bio = split; } + if (raid_bio->bi_pool != &conf->bio_split) + md_account_bio(mddev, &raid_bio); + if (!raid5_read_one_chunk(mddev, raid_bio)) return raid_bio; @@ -5775,6 +5779,7 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) DEFINE_WAIT(w); bool do_prepare; bool do_flush = false; + bool do_clone = false; if (unlikely(bi->bi_opf & REQ_PREFLUSH)) { int ret = log_handle_flush_request(conf, bi); @@ -5803,6 +5808,7 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) if (rw == READ && mddev->degraded == 0 && mddev->reshape_position == MaxSector) { bi = chunk_aligned_read(mddev, bi); + do_clone = true; if (!bi) return true; } @@ -5817,6 +5823,9 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) last_sector = bio_end_sector(bi); bi->bi_next = NULL; + if (!do_clone) + md_account_bio(mddev, &bi); + prepare_to_wait(&conf->wait_for_overlap, &w, TASK_UNINTERRUPTIBLE); for (; logical_sector < last_sector; logical_sector += RAID5_STRIPE_SECTORS(conf)) { int previous; -- 2.20.1

1 19

[PATCH openEuler-5.10-LTS 00/64] Backport 5.10.115 LTS
by Zheng Zengkai 02 Aug '22

02 Aug '22

Backport 5.10.115 LTS patches from upstream. git cherry-pick v5.10.114..v5.10.115~1 -s Complicts: Already merged(4): 8a9e7c64f4a0 nfc: replace improper check device_is_registered() in netlink related functions 1961c5a688ed nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs 879b075a9a36 NFC: netlink: fix sleep in atomic bug when firmware download timeout a439819f4797 block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern Rejected(2): hinic driver drops related file in the patch: 475237e807a2 hinic: fix bug of wq out of bound access build failed due to reject of patch "845f44ce3d9f1 net/sched: flower: fix parsing of ethertype following VLAN header": d8338a7a0957 net/mlx5e: Don't match double-vlan packets if cvlan is not set Total patches: 70 - 4 - 2 = 64 Andreas Larsson (2): can: grcan: grcan_probe(): fix broken system id check for errata workaround needs can: grcan: only use the NAPI poll budget for RX Andrei Lalaev (1): gpiolib: of: fix bounds check for 'gpio-reserved-ranges' Armin Wolf (1): hwmon: (adt7470) Fix warning on module removal Aya Levin (1): net/mlx5: Fix slab-out-of-bounds while reading resource dump menu Brian Norris (1): mmc: core: Set HS clock speed before sending HS CMD13 Cheng Xu (1): RDMA/siw: Fix a condition race issue in MPA request processing Chengfeng Ye (1): firewire: fix potential uaf in outbound_phy_packet_callback() Codrin Ciubotariu (1): ASoC: dmaengine: Restore NULL prepare_slave_config() callback Daniel Hellstrom (1): can: grcan: use ofdev->dev when allocating DMA memory David Stevens (1): iommu/vt-d: Calculate mask for non-aligned flushes Duoming Zhou (1): can: grcan: grcan_close(): fix deadlock Eric Dumazet (1): net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter() Filipe Manana (1): btrfs: always log symlinks in full mode Frederic Weisbecker (2): rcu: Fix callbacks processing time limit retaining cond_resched() rcu: Apply callbacks processing time limit only on softirq Harry Wentland (1): drm/amd/display: Avoid reading audio pattern past AUDIO_CHANNELS_COUNT Helge Deller (1): parisc: Merge model and model name into one line in /proc/cpuinfo Ido Schimmel (1): selftests: mirror_gre_bridge_1q: Avoid changing PVID while interface is operational Jakob Koschel (1): firewire: remove check of list iterator against head past the loop body Jan Höppner (2): s390/dasd: Fix read for ESE with blksize < 4k s390/dasd: Fix read inconsistency for ESE DASD devices Jann Horn (1): selftests/seccomp: Don't call read() on TTY from background pgrp Kyle Huey (1): KVM: x86/svm: Account for family 17h event renumberings in amd_pmc_perf_hw_id Maciej W. Rozycki (1): MIPS: Fix CP0 counter erratum detection for R4k CPUs Mark Brown (5): ASoC: da7219: Fix change notifications for tone generator frequency ASoC: wm8958: Fix change notifications for DSP controls ASoC: meson: Fix event generation for AUI ACODEC mux ASoC: meson: Fix event generation for G12A tohdmi mux ASoC: meson: Fix event generation for AUI CODEC mux Mark Zhang (1): net/mlx5e: Fix the calling of update_buffer_lossy() API Michael Chan (1): bnxt_en: Fix unnecessary dropping of RX packets Mike Snitzer (1): dm: interlock pending dm_io and dm_wait_for_bios_completion Moshe Shemesh (1): net/mlx5: Avoid double clear or set of sync reset requested Moshe Tal (1): net/mlx5e: Fix trust state reset in reload Niels Dossche (1): firewire: core: extend card->lock in fw_core_handle_bus_reset Oliver Hartkopp (1): can: isotp: remove re-binding of bound socket Pali Rohár (2): PCI: aardvark: Clear all MSIs at setup PCI: aardvark: Fix reading MSI interrupt number Paolo Bonzini (2): KVM: x86: Do not change ICR on write to APIC_SELF_IPI KVM: x86/mmu: avoid NULL-pointer dereference on page freeing bugs Paul Blakey (1): net/mlx5e: CT: Fix queued up restore put() executing after relevant ft release Puyou Lu (1): gpio: pca953x: fix irq_stat not updated when irq is disabled (irq_mask not set) Ricky WU (1): mmc: rtsx: add 74 Clocks in power on flow Sandipan Das (1): kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU Sergey Shtylyov (1): smsc911x: allow using IRQ0 Shaik Sajida Bhanu (1): mmc: sdhci-msm: Reset GCC_SDCC_BCR register for SDHC Shravya Kumbham (1): net: emaclite: Add error handling for of_address_to_resource() Somnath Kotur (1): bnxt_en: Fix possible bnxt_open() failure caused by wrong RFS flag Stefan Haberland (2): s390/dasd: fix data corruption for ESE devices s390/dasd: prevent double format of tracks for ESE devices Takashi Sakamoto (1): ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes Tan Tee Min (1): net: stmmac: disable Split Header (SPH) for Intel platforms Thomas Pfaff (1): genirq: Synchronize interrupt thread startup Trond Myklebust (2): Revert "SUNRPC: attempt AF_LOCAL connect on setup" NFSv4: Don't invalidate inode attributes on delegation return Vladimir Oltean (1): selftests: ocelot: tc_flower_chains: specify conform-exceed action for policer Wanpeng Li (2): x86/kvm: Preserve BSP MSR_KVM_POLL_CONTROL across suspend/resume KVM: LAPIC: Enable timer posted-interrupt only when mwait/hlt is advertised Yang Yingliang (4): net: ethernet: mediatek: add missing of_node_put() in mtk_sgmii_init() net: dsa: mt7530: add missing of_node_put() in mt7530_setup() net: stmmac: dwmac-sun8i: add missing of_node_put() in sun8i_dwmac_register_mdio_mux() net: cpsw: add missing of_node_put() in cpsw_probe_dt() Zihao Wang (1): ALSA: hda/realtek: Add quirk for Yoga Duet 7 13ITL6 speakers arch/mips/include/asm/timex.h | 8 ++-- arch/mips/kernel/time.c | 11 ++--- arch/parisc/kernel/processor.c | 3 +- arch/x86/kernel/kvm.c | 13 ++++++ arch/x86/kvm/cpuid.c | 5 ++ arch/x86/kvm/lapic.c | 10 ++-- arch/x86/kvm/mmu/mmu.c | 2 + arch/x86/kvm/svm/pmu.c | 28 +++++++++-- drivers/firewire/core-card.c | 3 ++ drivers/firewire/core-cdev.c | 4 +- drivers/firewire/core-topology.c | 9 ++-- drivers/firewire/core-transaction.c | 30 ++++++------ drivers/firewire/sbp2.c | 13 +++--- drivers/gpio/gpio-pca953x.c | 4 +- drivers/gpio/gpiolib-of.c | 2 +- .../gpu/drm/amd/display/dc/core/dc_link_dp.c | 2 +- drivers/hwmon/adt7470.c | 4 +- drivers/infiniband/sw/siw/siw_cm.c | 7 +-- drivers/iommu/intel/iommu.c | 27 +++++++++-- drivers/md/dm.c | 8 +++- drivers/mmc/core/mmc.c | 23 ++++++++-- drivers/mmc/host/rtsx_pci_sdmmc.c | 31 +++++++++---- drivers/mmc/host/sdhci-msm.c | 42 +++++++++++++++++ drivers/net/can/grcan.c | 46 ++++++++++--------- drivers/net/dsa/mt7530.c | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 13 ++++-- drivers/net/ethernet/mediatek/mtk_sgmii.c | 1 + .../mellanox/mlx5/core/diag/rsc_dump.c | 31 ++++++++++--- .../mellanox/mlx5/core/en/port_buffer.c | 4 +- .../ethernet/mellanox/mlx5/core/en/tc_ct.c | 4 ++ .../ethernet/mellanox/mlx5/core/en_dcbnl.c | 10 ++++ .../ethernet/mellanox/mlx5/core/fw_reset.c | 28 +++++++---- drivers/net/ethernet/smsc/smsc911x.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac-intel.c | 1 + .../net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 1 + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- drivers/net/ethernet/ti/cpsw_new.c | 5 +- drivers/net/ethernet/xilinx/xilinx_emaclite.c | 15 ++++-- drivers/pci/controller/pci-aardvark.c | 16 +++---- drivers/s390/block/dasd.c | 18 ++++++-- drivers/s390/block/dasd_eckd.c | 28 ++++++++--- drivers/s390/block/dasd_int.h | 14 ++++++ fs/btrfs/tree-log.c | 14 +++++- fs/nfs/nfs4proc.c | 12 ++++- include/linux/stmmac.h | 1 + kernel/irq/internals.h | 2 + kernel/irq/irqdesc.c | 2 + kernel/irq/manage.c | 39 ++++++++++++---- kernel/rcu/tree.c | 32 +++++++------ net/can/isotp.c | 22 ++------- net/ipv4/igmp.c | 9 ++-- net/sunrpc/xprtsock.c | 3 -- sound/firewire/fireworks/fireworks_hwdep.c | 1 + sound/pci/hda/patch_realtek.c | 1 + sound/soc/codecs/da7219.c | 14 ++++-- sound/soc/codecs/wm8958-dsp2.c | 8 ++-- sound/soc/meson/aiu-acodec-ctrl.c | 2 +- sound/soc/meson/aiu-codec-ctrl.c | 2 +- sound/soc/meson/g12a-tohdmitx.c | 2 +- sound/soc/soc-generic-dmaengine-pcm.c | 6 +-- .../drivers/net/ocelot/tc_flower_chains.sh | 2 +- .../net/forwarding/mirror_gre_bridge_1q.sh | 3 ++ tools/testing/selftests/seccomp/seccomp_bpf.c | 10 ++-- 63 files changed, 501 insertions(+), 215 deletions(-) -- 2.20.1

1 64

[PATCH openEuler-5.10-LTS 000/121] Backport 5.10.114 LTS
by Zheng Zengkai 02 Aug '22

02 Aug '22

Backport 5.10.114 LTS patches from upstream. git cherry-pick v5.10.113..v5.10.114~1 -s Complicts: Already merged(4): 54c028cfc496 floppy: disable FDRAWCMD by default e3ec78d82d48 net: hns3: modify the return code of hclge_get_ring_chain_from_mbx 929c30c02de4 net: hns3: add validity check for message data length 9eb25e00f59b net: hns3: add return value for mailbox handling in PF Implementation changed(already merged, use mainline version b98535d09179, 1): 585ef03c9e79 ext4: fix bug_on in start_this_handle during umount filesystem Defered(3, kabi changed): 3c464db03c12 tcp: ensure to use the most recently sent skb when filling the rate sample 6f2bf9c5ddfe mtd: fix 'part' field data corruption in mtd_info 616d354fb9e8 hex2bin: make the function hex_to_bin constant-time Total patches: 129 - 4 - 1 - 3 = 121 Adam Ford (2): ARM: dts: am3517-evm: Fix misc pinmuxing ARM: dts: logicpd-som-lv: Fix wrong pinmuxing on OMAP35 Alexey Kardashevskiy (1): powerpc/perf: Fix 32bit compile Baruch Siach (1): net: phy: marvell10g: fix return value on error Borislav Petkov (1): x86/cpu: Load microcode during restore_processor_state() Bruno Thomsen (1): USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader Chao Song (1): ASoC: Intel: soc-acpi: correct device endpoints for max98373 Christian Hewitt (2): arm64: dts: meson: remove CPU opps below 1GHz for G12B boards arm64: dts: meson: remove CPU opps below 1GHz for SM1 boards Christophe JAILLET (1): bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create() Chuanhong Guo (1): mtd: rawnand: fix ecc parameters for mt7622 Claudiu Beznea (1): ARM: dts: at91: sama5d4_xplained: fix pinctrl phandle name Damien Le Moal (2): zonefs: Fix management of open zones zonefs: Clear inode information flags on inode creation Dan Vacura (1): usb: gadget: uvc: Fix crash when encoding data for usb request Daniel Starke (13): tty: n_gsm: fix restart handling via CLD command tty: n_gsm: fix decoupled mux resource tty: n_gsm: fix mux cleanup after unregister tty device tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2 tty: n_gsm: fix malformed counter for out of frame data tty: n_gsm: fix insufficient txframe size tty: n_gsm: fix wrong DLCI release order tty: n_gsm: fix missing explicit ldisc flush tty: n_gsm: fix wrong command retry handling tty: n_gsm: fix wrong command frame length field encoding tty: n_gsm: fix reset fifo race condition tty: n_gsm: fix incorrect UA handling tty: n_gsm: fix software flow control handling Daniele Palmas (1): USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions Dany Madden (1): Revert "ibmvnic: Add ethtool private flag for driver-defined queue limits" David Yat Sin (1): drm/amdkfd: Fix GWS queue count Dinh Nguyen (1): net: ethernet: stmmac: fix write to sgmii_adapter_base Duoming Zhou (1): drivers: net: hippi: Fix deadlock in rr_close() Eric Dumazet (2): tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT tcp: make sure treq->af_specific is initialized Evan Green (1): xhci: Enable runtime PM on second Alderlake controller Eyal Birger (1): bpf, lwt: Fix crash when using bpf_skb_set_tunnel_key() from bpf_xmit lwt hook Fabio Estevam (2): ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue arm64: dts: imx8mn-ddr4-evk: Describe the 32.768 kHz PMIC clock Fawzi Khaber (1): iio: imu: inv_icm42600: Fix I2C init possible nack Florian Westphal (1): netfilter: nft_socket: only do sk lookups when indev is available Francesco Ruggeri (1): tcp: md5: incorrect tcp_header_len for incoming connections Geert Uytterhoeven (1): memory: renesas-rpc-if: Fix HF/OSPI data transfer in Manual Mode Greg Kroah-Hartman (1): lightnvm: disable the subsystem Guo Ren (1): riscv: patch_text: Fixup last cpu should be master H. Nikolaus Schaller (1): ARM: dts: Fix mmc order for omap3-gta04 Hangyu Hua (1): usb: misc: fix improper handling of refcount in uss720_probe() Heikki Krogerus (2): usb: typec: ucsi: Fix reuse of completion structure usb: typec: ucsi: Fix role swapping Henry Lin (1): xhci: stop polling roothubs after shutdown Imre Deak (1): drm/i915: Fix SEL_FETCH_PLANE_*(PIPE_B+) register addresses Johan Hovold (1): serial: imx: fix overrun interrupts in DMA mode Jonathan Lemon (1): net: bcmgenet: hide status block before TX timestamping Kees Cook (2): USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS thermal: int340x: Fix attr.show callback prototype Krzysztof Kozlowski (2): pinctrl: samsung: fix missing GPIOLIB on ARM64 Exynos config phy: samsung: exynos5250-sata: fix missing device put in probe error paths Leon Romanovsky (1): ixgbe: ensure IPsec VF<->PF compatibility Lijun Pan (1): ibmvnic: fix miscellaneous checks Luca Ceresoli (1): pinctrl: rockchip: fix RK3308 pinmux bits Lv Ruyi (1): pinctrl: pistachio: fix use of irq_of_parse_and_map() Maciej W. Rozycki (2): serial: 8250: Also set sticky MCR bits in console restoration serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device Macpaul Lin (1): usb: mtu3: fix USB 3.0 dual-role-switch from device to host Manish Chopra (1): bnx2x: fix napi API usage sequence Marek Vasut (2): pinctrl: stm32: Do not call stm32_gpio_get() for edge triggered IRQs in EOI pinctrl: stm32: Keep pinctrl block clock enabled when LEVEL IRQ requested Mark Brown (1): ARM: dts: at91: Map MCLK for wm8731 on at91sam9g20ek Martin Blumenstingl (1): net: dsa: lantiq_gswip: Don't set GSWIP_MII_CFG_RMII_CLK Mathias Nyman (1): xhci: increase usb U3 -> U0 link resume timeout from 100ms to 500ms Max Krummenacher (1): ARM: dts: imx6ull-colibri: fix vqmmc regulator Maxim Mikityanskiy (1): tls: Skip tls_append_frag on zero copy size Miaoqian Lin (8): phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe ARM: OMAP2+: Fix refcount leak in omap_gic_of_init phy: ti: omap-usb2: Fix error handling in omap_usb2_enable_clocks phy: mapphone-mdm6600: Fix PM error handling in phy_mdm6600_probe phy: ti: Add missing pm_runtime_disable() in serdes_am654_probe mtd: rawnand: Fix return value check of wait_for_completion_timeout net: dsa: Add missing of_node_put() in dsa_port_link_register_of drm/amd/display: Fix memory leak in dcn21_clock_source_create Michael Hennerich (1): iio: dac: ad5446: Fix read_raw not returning set value Mikulas Patocka (2): hex2bin: fix access beyond string end x86: __memcpy_flushcache: fix wrong alignment if size > 2^32 Namhyung Kim (3): perf symbol: Pass is_kallsyms to symbols__fixup_end() perf symbol: Update symbols__fixup_end() perf symbol: Remove arch__symbols__fixup_end() Nikolay Aleksandrov (1): wireguard: device: check for metadata_dst with skb_valid_dst() Oliver Neukum (2): USB: quirks: add a Realtek card reader USB: quirks: add STRING quirk for VCOM device Pablo Neira Ayuso (1): netfilter: nft_set_rbtree: overlap detection with element re-addition after deletion Pavel Skripkin (1): video: fbdev: udlfb: properly check endpoint type Pawel Laszczak (1): usb: cdns3: Fix issue for clear halt endpoint Peilin Ye (3): ip_gre: Make o_seqno start from 0 in native mode ip6_gre: Make o_seqno start from 0 in native mode ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode Pengcheng Yang (2): ipvs: correctly print the memory size of ip_vs_conn_tab tcp: fix F-RTO may not work correctly when receiving DSACK Ronnie Sahlberg (1): cifs: destage any unwritten data to the server before calling copychunk_write Sean Anderson (1): usb: phy: generic: Get the vbus supply Slark Xiao (1): USB: serial: option: add support for Cinterion MV32-WA/MV32-WB Sven Peter (1): usb: dwc3: Try usb-role-switch first in dwc3_drd_init Tejun Heo (1): iocost: don't reset the inuse weight of under-weighted debtors Thinh Nguyen (3): usb: dwc3: core: Fix tx/rx threshold settings usb: dwc3: core: Only handle soft-reset in DCTL usb: dwc3: gadget: Return proper request status Thomas Gleixner (1): x86/pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests Tong Zhang (1): iio:imu:bmi160: disable regulator in error path Tony Lindgren (1): bus: ti-sysc: Make omap3 gpt12 quirk handling SoC specific Vijayavardhan Vennapusa (1): usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind() Wang Qing (1): arch_topology: Do not set llc_sibling if llc_id is invalid Weitao Wang (1): USB: Fix xhci event ring dequeue pointer ERDP update issue Xiaobing Luo (1): cpufreq: fix memory leak in sun50i_cpufreq_nvmem_probe Xin Long (1): sctp: check asoc strreset_chunk in sctp_generate_reconf_event Yang Yingliang (2): clk: sunxi: sun9i-mmc: check return value after calling platform_get_resource() net: fec: add missing of_node_put() in fec_enet_init_stop_mode() YueHaibing (1): pinctrl: mediatek: moore: Fix build error Zheyu Ma (2): iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on() ASoC: wm8731: Disable the regulator when probing fails Zizhuang Deng (1): iio: dac: ad5592r: Fix the missing return value. Zqiang (1): kasan: prevent cpu_quarantine corruption when CPU offline and cache shrink occur at same time liuyacan (1): net/smc: sync err code when tcp connection was refused arch/arm/boot/dts/am3517-evm.dts | 45 +++- arch/arm/boot/dts/am3517-som.dtsi | 9 + arch/arm/boot/dts/at91-sama5d4_xplained.dts | 4 +- arch/arm/boot/dts/at91sam9g20ek_common.dtsi | 6 + arch/arm/boot/dts/imx6qdl-apalis.dtsi | 10 +- arch/arm/boot/dts/imx6ull-colibri.dtsi | 2 +- .../boot/dts/logicpd-som-lv-35xx-devkit.dts | 15 ++ .../boot/dts/logicpd-som-lv-37xx-devkit.dts | 15 ++ arch/arm/boot/dts/logicpd-som-lv.dtsi | 15 -- arch/arm/boot/dts/omap3-gta04.dtsi | 2 + arch/arm/mach-exynos/Kconfig | 1 - arch/arm/mach-omap2/omap4-common.c | 2 + .../boot/dts/amlogic/meson-g12b-a311d.dtsi | 40 ---- .../boot/dts/amlogic/meson-g12b-s922x.dtsi | 40 ---- arch/arm64/boot/dts/amlogic/meson-sm1.dtsi | 20 -- .../boot/dts/freescale/imx8mn-ddr4-evk.dts | 4 + arch/powerpc/perf/Makefile | 4 +- arch/riscv/kernel/patch.c | 2 +- arch/x86/include/asm/microcode.h | 2 + arch/x86/kernel/cpu/microcode/core.c | 6 +- arch/x86/lib/usercopy_64.c | 2 +- arch/x86/pci/xen.c | 6 +- arch/x86/power/cpu.c | 10 +- block/blk-iocost.c | 12 +- drivers/base/arch_topology.c | 2 +- drivers/bus/sunxi-rsb.c | 2 + drivers/bus/ti-sysc.c | 16 +- drivers/clk/sunxi/clk-sun9i-mmc.c | 2 + drivers/cpufreq/sun50i-cpufreq-nvmem.c | 4 +- .../drm/amd/amdkfd/kfd_device_queue_manager.c | 83 ++++---- .../drm/amd/display/dc/dcn21/dcn21_resource.c | 1 + drivers/gpu/drm/i915/i915_reg.h | 2 +- drivers/iio/dac/ad5446.c | 2 +- drivers/iio/dac/ad5592r-base.c | 2 +- drivers/iio/imu/bmi160/bmi160_core.c | 20 +- .../iio/imu/inv_icm42600/inv_icm42600_i2c.c | 15 +- drivers/iio/magnetometer/ak8975.c | 1 + drivers/lightnvm/Kconfig | 2 +- drivers/memory/renesas-rpc-if.c | 60 ++++-- drivers/mtd/nand/raw/mtk_ecc.c | 12 +- drivers/mtd/nand/raw/sh_flctl.c | 14 +- drivers/net/dsa/lantiq_gswip.c | 3 - .../net/ethernet/broadcom/bnx2x/bnx2x_main.c | 9 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 7 + drivers/net/ethernet/freescale/fec_main.c | 2 +- drivers/net/ethernet/ibm/ibmvnic.c | 144 ++++--------- drivers/net/ethernet/ibm/ibmvnic.h | 6 - .../net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 3 +- .../ethernet/stmicro/stmmac/dwmac-socfpga.c | 12 +- drivers/net/hippi/rrunner.c | 2 + drivers/net/phy/marvell10g.c | 2 +- drivers/net/wireguard/device.c | 3 +- drivers/phy/motorola/phy-mapphone-mdm6600.c | 3 +- drivers/phy/samsung/phy-exynos5250-sata.c | 21 +- drivers/phy/ti/phy-am654-serdes.c | 2 +- drivers/phy/ti/phy-omap-usb2.c | 2 +- drivers/pinctrl/mediatek/Kconfig | 1 + drivers/pinctrl/pinctrl-pistachio.c | 6 +- drivers/pinctrl/pinctrl-rockchip.c | 45 ++-- drivers/pinctrl/samsung/Kconfig | 11 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 23 ++- .../intel/int340x_thermal/int3400_thermal.c | 4 +- drivers/tty/n_gsm.c | 194 ++++++++++-------- drivers/tty/serial/8250/8250_pci.c | 8 +- drivers/tty/serial/8250/8250_port.c | 2 +- drivers/tty/serial/imx.c | 2 +- drivers/usb/cdns3/gadget.c | 7 +- drivers/usb/core/quirks.c | 6 + drivers/usb/dwc3/core.c | 11 +- drivers/usb/dwc3/drd.c | 11 +- drivers/usb/dwc3/gadget.c | 31 ++- drivers/usb/gadget/configfs.c | 2 + drivers/usb/gadget/function/uvc_queue.c | 2 + drivers/usb/host/xhci-hub.c | 2 +- drivers/usb/host/xhci-pci.c | 4 +- drivers/usb/host/xhci-ring.c | 2 + drivers/usb/host/xhci.c | 11 + drivers/usb/misc/uss720.c | 3 +- drivers/usb/mtu3/mtu3_dr.c | 6 +- drivers/usb/phy/phy-generic.c | 7 + drivers/usb/serial/cp210x.c | 2 + drivers/usb/serial/option.c | 12 ++ drivers/usb/serial/whiteheat.c | 5 +- drivers/usb/typec/ucsi/ucsi.c | 24 ++- drivers/video/fbdev/udlfb.c | 14 +- fs/cifs/smb2ops.c | 8 + fs/zonefs/super.c | 46 ++++- include/memory/renesas-rpc-if.h | 1 + include/net/ip6_tunnel.h | 2 +- include/net/ip_tunnels.h | 2 +- include/net/tcp.h | 2 + lib/hexdump.c | 9 +- mm/kasan/quarantine.c | 7 + net/core/lwt_bpf.c | 7 +- net/dsa/port.c | 2 + net/ipv4/ip_gre.c | 12 +- net/ipv4/syncookies.c | 8 +- net/ipv4/tcp_input.c | 15 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 1 + net/ipv6/ip6_gre.c | 16 +- net/ipv6/syncookies.c | 3 +- net/netfilter/ipvs/ip_vs_conn.c | 2 +- net/netfilter/nft_set_rbtree.c | 6 +- net/netfilter/nft_socket.c | 52 +++-- net/sctp/sm_sideeffect.c | 4 + net/smc/af_smc.c | 2 + net/tls/tls_device.c | 12 +- sound/soc/codecs/wm8731.c | 19 +- .../intel/common/soc-acpi-intel-tgl-match.c | 4 +- tools/perf/arch/arm64/util/Build | 1 - tools/perf/arch/arm64/util/machine.c | 27 --- tools/perf/arch/s390/util/machine.c | 16 -- tools/perf/util/symbol-elf.c | 2 +- tools/perf/util/symbol.c | 37 +++- tools/perf/util/symbol.h | 3 +- 116 files changed, 886 insertions(+), 637 deletions(-) delete mode 100644 tools/perf/arch/arm64/util/machine.c -- 2.20.1

1 121

【会议通知】 SPR: Add core PMU support for SPR KABI问题讨论，时间：2022-08-02 15:30-17:00(UTC+08:00)，
by Meeting Book 02 Aug '22

02 Aug '22

会议主题 Subject Intel SPR: Add core PMU support for SPR KABI问题讨论会议时间 Time 2022-08-02 15:30-17:00 (UTC+08:00)Beijing 会议地点 Location Welink视频会议 Welink Video Meeting 加入会议(External)<https://meeting.huaweicloud.com:36443/#/j/98677767> 会议ID Meeting ID 98677767 召集人 Convener 郑增凯提示 Tips 请点击会议链接加入会议,首次使用请在入会界面根据提示下载并安装客户端后输入ID入会。 Click the meeting link to join the meeting. For the first time, download and install the client as prompted and enter the ID to join the meeting

1 0

[PATCH openEuler-22.09] openeuler_defconfig: enable CONFIG_BPF_SCHED for x86
by Zheng Zengkai 02 Aug '22

02 Aug '22

From: Ren Zhijie <renzhijie2(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5F6X6 CVE: NA -------------------------------- Enable CONFIG_BPF_SCHED for x86 by default. Signed-off-by: Ren Zhijie <renzhijie2(a)huawei.com> --- arch/x86/configs/openeuler_defconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index f013c7b95881..bc9d7ee3812c 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -235,6 +235,7 @@ CONFIG_KALLSYMS_ALL=y CONFIG_KALLSYMS_ABSOLUTE_PERCPU=y CONFIG_KALLSYMS_BASE_RELATIVE=y # CONFIG_BPF_LSM is not set +CONFIG_BPF_SCHED=y CONFIG_BPF_SYSCALL=y CONFIG_ARCH_WANT_DEFAULT_BPF_JIT=y CONFIG_BPF_JIT_ALWAYS_ON=y -- 2.20.1

1 0

[PATCH openEuler-1.0-LTS 1/3] fbmem: Check virtual screen sizes in fb_set_var()
by Yongqiang Liu 01 Aug '22

01 Aug '22

From: Helge Deller <deller(a)gmx.de> mainline inclusion from mainline-v5.19-rc6 commit 6c11df58fd1ac0aefcb3b227f72769272b939e56 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5IQ4M CVE: CVE-2021-33655 -------------------------------- Verify that the fbdev or drm driver correctly adjusted the virtual screen sizes. On failure report the failing driver and reject the screen size change. Signed-off-by: Helge Deller <deller(a)gmx.de> Reviewed-by: Geert Uytterhoeven <geert(a)linux-m68k.org> Cc: stable(a)vger.kernel.org # v5.4+ Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Conflicts: drivers/video/fbdev/core/fbmem.c Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/video/fbdev/core/fbmem.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c index c48f083d522a..43a446416843 100644 --- a/drivers/video/fbdev/core/fbmem.c +++ b/drivers/video/fbdev/core/fbmem.c @@ -996,6 +996,16 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var) if (ret) goto done; + /* verify that virtual resolution >= physical resolution */ + if (var->xres_virtual < var->xres || + var->yres_virtual < var->yres) { + pr_warn("WARNING: fbcon: Driver '%s' missed to adjust virtual screen size (%ux%u vs. %ux%u)\n", + info->fix.id, + var->xres_virtual, var->yres_virtual, + var->xres, var->yres); + return -EINVAL; + } + if ((var->activate & FB_ACTIVATE_MASK) == FB_ACTIVATE_NOW) { struct fb_var_screeninfo old_var; struct fb_videomode mode; -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS] xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup()
by Yongqiang Liu 01 Aug '22

01 Aug '22

From: Hangyu Hua <hbh25y(a)gmail.com> stable inclusion from stable-v4.19.254 commit fdb4fba1ba8512fa579a9d091dcb6c410f82f96a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5JMHA CVE: CVE-2022-36879 -------------------------------- [ Upstream commit f85daf0e725358be78dfd208dea5fd665d8cb901 ] xfrm_policy_lookup() will call xfrm_pol_hold_rcu() to get a refcount of pols[0]. This refcount can be dropped in xfrm_expand_policies() when xfrm_expand_policies() return error. pols[0]'s refcount is balanced in here. But xfrm_bundle_lookup() will also call xfrm_pols_put() with num_pols == 1 to drop this refcount when xfrm_expand_policies() return error. This patch also fix an illegal address access. pols[0] will save a error point when xfrm_policy_lookup fails. This lead to xfrm_pols_put to resolve an illegal address in xfrm_bundle_lookup's error path. Fix these by setting num_pols = 0 in xfrm_expand_policies()'s error path. Fixes: 80c802f3073e ("xfrm: cache bundles instead of policies for outgoing flows") Signed-off-by: Hangyu Hua <hbh25y(a)gmail.com> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/xfrm/xfrm_policy.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index e9aea82f370d..408e3f34d16c 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -1703,8 +1703,10 @@ static int xfrm_expand_policies(const struct flowi *fl, u16 family, *num_xfrms = 0; return 0; } - if (IS_ERR(pols[0])) + if (IS_ERR(pols[0])) { + *num_pols = 0; return PTR_ERR(pols[0]); + } *num_xfrms = pols[0]->xfrm_nr; @@ -1719,6 +1721,7 @@ static int xfrm_expand_policies(const struct flowi *fl, u16 family, if (pols[1]) { if (IS_ERR(pols[1])) { xfrm_pols_put(pols, *num_pols); + *num_pols = 0; return PTR_ERR(pols[1]); } (*num_pols)++; -- 2.25.1

1 0

[PATCH openEuler-22.03-LTS] xfs: fix comment for start time value of inode with bigtime enabled
by Xiaole He 01 Aug '22

01 Aug '22

From: Xiaole He <hexiaole1994(a)126.com> mainline inclusion from mainline-for-next commit fdbae121b4369fe49eb5f8efbd23604ab4c50116 category: doc -------------------------------- The 'ctime', 'mtime', and 'atime' for inode is the type of 'xfs_timestamp_t', which is a 64-bit type: /* fs/xfs/libxfs/xfs_format.h begin */ typedef __be64 xfs_timestamp_t; /* fs/xfs/libxfs/xfs_format.h end */ When the 'bigtime' feature is disabled, this 64-bit type is splitted into two parts of 32-bit, one part is encoded for seconds since 1970-01-01 00:00:00 UTC, the other part is encoded for nanoseconds above the seconds, this two parts are the type of 'xfs_legacy_timestamp' and the min and max time value of this type are defined as macros 'XFS_LEGACY_TIME_MIN' and 'XFS_LEGACY_TIME_MAX': /* fs/xfs/libxfs/xfs_format.h begin */ struct xfs_legacy_timestamp { __be32 t_sec; /* timestamp seconds */ __be32 t_nsec; /* timestamp nanoseconds */ }; #define XFS_LEGACY_TIME_MIN ((int64_t)S32_MIN) #define XFS_LEGACY_TIME_MAX ((int64_t)S32_MAX) /* fs/xfs/libxfs/xfs_format.h end */ /* include/linux/limits.h begin */ #define U32_MAX ((u32)~0U) #define S32_MAX ((s32)(U32_MAX >> 1)) #define S32_MIN ((s32)(-S32_MAX - 1)) /* include/linux/limits.h end */ 'XFS_LEGACY_TIME_MIN' is the min time value of the 'xfs_legacy_timestamp', that is -(2^31) seconds relative to the 1970-01-01 00:00:00 UTC, it can be converted to human-friendly time value by 'date' command: /* command begin */ [root@~]# date --utc -d '@0' +'%Y-%m-%d %H:%M:%S' 1970-01-01 00:00:00 [root@~]# date --utc -d "@`echo '-(2^31)'|bc`" +'%Y-%m-%d %H:%M:%S' 1901-12-13 20:45:52 [root@~]# /* command end */ When 'bigtime' feature is enabled, this 64-bit type becomes a 64-bit nanoseconds counter, with the start time value is the min time value of 'xfs_legacy_timestamp'(start time means the value of 64-bit nanoseconds counter is 0). We have already caculated the min time value of 'xfs_legacy_timestamp', that is 1901-12-13 20:45:52 UTC, but the comment for the start time value of inode with 'bigtime' feature enabled writes the value is 1901-12-31 20:45:52 UTC: /* fs/xfs/libxfs/xfs_format.h begin */ /* * XFS Timestamps * ============== * When the bigtime feature is enabled, ondisk inode timestamps become an * unsigned 64-bit nanoseconds counter. This means that the bigtime inode * timestamp epoch is the start of the classic timestamp range, which is * Dec 31 20:45:52 UTC 1901. ... ... */ /* fs/xfs/libxfs/xfs_format.h end */ That is a typo, and this patch corrects the typo, from 'Dec 31' to 'Dec 13'. Suggested-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Xiaole He <hexiaole(a)kylinos.cn> Reviewed-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Darrick J. Wong <djwong(a)kernel.org> --- fs/xfs/libxfs/xfs_format.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/xfs/libxfs/xfs_format.h b/fs/xfs/libxfs/xfs_format.h index dd764da08f6f..8faa2a6069e6 100644 --- a/fs/xfs/libxfs/xfs_format.h +++ b/fs/xfs/libxfs/xfs_format.h @@ -870,7 +870,7 @@ struct xfs_agfl { * When the bigtime feature is enabled, ondisk inode timestamps become an * unsigned 64-bit nanoseconds counter. This means that the bigtime inode * timestamp epoch is the start of the classic timestamp range, which is - * Dec 31 20:45:52 UTC 1901. Because the epochs are not the same, callers + * Dec 13 20:45:52 UTC 1901. Because the epochs are not the same, callers * /must/ use the bigtime conversion functions when encoding and decoding raw * timestamps. */ -- 2.27.0

1 0

[PATCH openEuler-1.0-LTS 1/2] block: prevent lockdep false positive warning about 'bd_mutex'
by Yongqiang Liu 30 Jul '22

30 Jul '22

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187246, https://gitee.com/openeuler/kernel/issues/I5JQL4 CVE: NA -------------------------------- Commit faf2662e328c ("block: fix that part scan is disabled in device_add_disk()") confuse lockdep to produce following warning: ===================================================== WARNING: possible circular locking dependency detected 4.18.0+ #2 Tainted: G ---------r- - ------------------------------------------------------ syz-executor.0/4652 is trying to acquire lock: 00000000ad5f5a19 (&mddev->open_mutex){+.+.}, at: md_open+0x13a/0x260 home/install/linux-rh-3-10/drivers/md/md.c:7626 but task is already holding lock: 000000005c3a3fea (&bdev->bd_mutex){+.+.}, at: __blkdev_get+0x156/0x1490 home/install/linux-rh-3-10/fs/block_dev.c:1583 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&bdev->bd_mutex){+.+.}: __mutex_lock_common home/install/linux-rh-3-10/kernel/locking/mutex.c:925 [inline] __mutex_lock+0x105/0x1270 home/install/linux-rh-3-10/kernel/locking/mutex.c:1072 __blkdev_get+0x156/0x1490 home/install/linux-rh-3-10/fs/block_dev.c:1583 blkdev_get+0x33c/0xac0 home/install/linux-rh-3-10/fs/block_dev.c:1735 disk_init_partition home/install/linux-rh-3-10/block/blk-sysfs.c:972 [inline] blk_register_queue+0x5ed/0x6c0 home/install/linux-rh-3-10/block/blk-sysfs.c:1055 __device_add_disk+0xab5/0xd70 home/install/linux-rh-3-10/block/genhd.c:729 sd_probe_async+0x447/0x852 home/install/linux-rh-3-10/drivers/scsi/sd.c:3249 async_run_entry_fn+0xe1/0x700 home/install/linux-rh-3-10/kernel/async.c:127 process_one_work+0x9cf/0x1940 home/install/linux-rh-3-10/kernel/workqueue.c:2175 worker_thread+0x91/0xc50 home/install/linux-rh-3-10/kernel/workqueue.c:2321 kthread+0x33a/0x400 home/install/linux-rh-3-10/kernel/kthread.c:257 ret_from_fork+0x3a/0x50 home/install/linux-rh-3-10/arch/x86/entry/entry_64.S:355 -> #1 (&q->sysfs_dir_lock){+.+.}: __mutex_lock_common home/install/linux-rh-3-10/kernel/locking/mutex.c:925 [inline] __mutex_lock+0x105/0x1270 home/install/linux-rh-3-10/kernel/locking/mutex.c:1072 blk_register_queue+0x143/0x6c0 home/install/linux-rh-3-10/block/blk-sysfs.c:1010 __device_add_disk+0xab5/0xd70 home/install/linux-rh-3-10/block/genhd.c:729 add_disk home/install/linux-rh-3-10/./include/linux/genhd.h:447 [inline] md_alloc+0xb06/0x10d0 home/install/linux-rh-3-10/drivers/md/md.c:5525 md_probe+0x32/0x60 home/install/linux-rh-3-10/drivers/md/md.c:5554 kobj_lookup+0x2d2/0x450 home/install/linux-rh-3-10/drivers/base/map.c:152 get_gendisk+0x3b/0x360 home/install/linux-rh-3-10/block/genhd.c:860 bdev_get_gendisk home/install/linux-rh-3-10/fs/block_dev.c:1181 [inline] __blkdev_get+0x3b6/0x1490 home/install/linux-rh-3-10/fs/block_dev.c:1578 blkdev_get+0x33c/0xac0 home/install/linux-rh-3-10/fs/block_dev.c:1735 blkdev_open+0x1c2/0x250 home/install/linux-rh-3-10/fs/block_dev.c:1923 do_dentry_open+0x686/0xf50 home/install/linux-rh-3-10/fs/open.c:777 do_last home/install/linux-rh-3-10/fs/namei.c:3449 [inline] path_openat+0x92f/0x28c0 home/install/linux-rh-3-10/fs/namei.c:3578 do_filp_open+0x1aa/0x2b0 home/install/linux-rh-3-10/fs/namei.c:3613 do_sys_open+0x307/0x490 home/install/linux-rh-3-10/fs/open.c:1075 do_syscall_64+0xca/0x5c0 home/install/linux-rh-3-10/arch/x86/entry/common.c:298 entry_SYSCALL_64_after_hwframe+0x6a/0xdf -> #0 (&mddev->open_mutex){+.+.}: lock_acquire+0x10b/0x3a0 home/install/linux-rh-3-10/kernel/locking/lockdep.c:3868 __mutex_lock_common home/install/linux-rh-3-10/kernel/locking/mutex.c:925 [inline] __mutex_lock+0x105/0x1270 home/install/linux-rh-3-10/kernel/locking/mutex.c:1072 md_open+0x13a/0x260 home/install/linux-rh-3-10/drivers/md/md.c:7626 __blkdev_get+0x2dc/0x1490 home/install/linux-rh-3-10/fs/block_dev.c:1599 blkdev_get+0x33c/0xac0 home/install/linux-rh-3-10/fs/block_dev.c:1735 blkdev_open+0x1c2/0x250 home/install/linux-rh-3-10/fs/block_dev.c:1923 do_dentry_open+0x686/0xf50 home/install/linux-rh-3-10/fs/open.c:777 do_last home/install/linux-rh-3-10/fs/namei.c:3449 [inline] path_openat+0x92f/0x28c0 home/install/linux-rh-3-10/fs/namei.c:3578 do_filp_open+0x1aa/0x2b0 home/install/linux-rh-3-10/fs/namei.c:3613 do_sys_open+0x307/0x490 home/install/linux-rh-3-10/fs/open.c:1075 do_syscall_64+0xca/0x5c0 home/install/linux-rh-3-10/arch/x86/entry/common.c:298 entry_SYSCALL_64_after_hwframe+0x6a/0xdf other info that might help us debug this: Chain exists of: &mddev->open_mutex --> &q->sysfs_dir_lock --> &bdev->bd_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&bdev->bd_mutex); lock(&q->sysfs_dir_lock); lock(&bdev->bd_mutex); lock(&mddev->open_mutex); *** DEADLOCK *** Since 'bd_mutex' and 'sysfs_dir_lock' is different is for each device, deadlock between md_open() and sd_probe_async() is impossible. However, lockdep is treating 'bd_mutex' and 'sysfs_dir_lock' from different devices the same, and commit faf2662e328c ("block: fix that part scan is disabled in device_add_disk()") is holding 'bd_mutex' inside 'sysfs_dir_lock', which causes the false positive warning. Fix the false positive warning by don't grab 'bd_mutex' inside 'sysfs_dir_lock'. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- block/blk-sysfs.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index ee963759ae10..530f1bf36c87 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -977,10 +977,16 @@ int blk_register_queue(struct gendisk *disk) * before it's registration is done. */ disk->flags |= GENHD_FL_UP; - disk_init_partition(disk); ret = 0; unlock: mutex_unlock(&q->sysfs_lock); + /* + * Init partitions after releasing 'sysfs_lock', otherwise lockdep + * will be confused because it will treat 'bd_mutex' from different + * devices as the same lock. + */ + if (!ret) + disk_init_partition(disk); /* * SCSI probing may synchronously create and destroy a lot of -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/3] dm verity: add root hash pkcs#7 signature verification
by Yongqiang Liu 30 Jul '22

30 Jul '22

From: Jaskaran Khurana <jaskarankhurana(a)linux.microsoft.com> mainline inclusion from mainline-v5.4-rc1 commit 88cd3e6cfac915f50f7aa7b699bdf053afec866e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5CES3 CVE: NA -------------------------------- The verification is to support cases where the root hash is not secured by Trusted Boot, UEFI Secureboot or similar technologies. One of the use cases for this is for dm-verity volumes mounted after boot, the root hash provided during the creation of the dm-verity volume has to be secure and thus in-kernel validation implemented here will be used before we trust the root hash and allow the block device to be created. The signature being provided for verification must verify the root hash and must be trusted by the builtin keyring for verification to succeed. The hash is added as a key of type "user" and the description is passed to the kernel so it can look it up and use it for verification. Adds CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG which can be turned on if root hash verification is needed. Kernel commandline dm_verity module parameter 'require_signatures' will indicate whether to force root hash signature verification (for all dm verity volumes). Signed-off-by: Jaskaran Khurana <jaskarankhurana(a)linux.microsoft.com> Tested-and-Reviewed-by: Milan Broz <gmazyland(a)gmail.com> Signed-off-by: Mike Snitzer <snitzer(a)redhat.com> Conflicts: Documentation/admin-guide/device-mapper/verity.rst drivers/md/dm-verity-target.c Signed-off-by: Luo Meng <luomeng12(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/md/Kconfig | 12 +++ drivers/md/Makefile | 4 + drivers/md/dm-verity-target.c | 43 ++++++++-- drivers/md/dm-verity-verify-sig.c | 133 ++++++++++++++++++++++++++++++ drivers/md/dm-verity-verify-sig.h | 60 ++++++++++++++ drivers/md/dm-verity.h | 2 + 6 files changed, 249 insertions(+), 5 deletions(-) create mode 100644 drivers/md/dm-verity-verify-sig.c create mode 100644 drivers/md/dm-verity-verify-sig.h diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig index 8b8c123cae66..6d052c11d66d 100644 --- a/drivers/md/Kconfig +++ b/drivers/md/Kconfig @@ -479,6 +479,18 @@ config DM_VERITY If unsure, say N. +config DM_VERITY_VERIFY_ROOTHASH_SIG + def_bool n + bool "Verity data device root hash signature verification support" + depends on DM_VERITY + select SYSTEM_DATA_VERIFICATION + help + Add ability for dm-verity device to be validated if the + pre-generated tree of cryptographic checksums passed has a pkcs#7 + signature file that can validate the roothash of the tree. + + If unsure, say N. + config DM_VERITY_FEC bool "Verity forward error correction support" depends on DM_VERITY diff --git a/drivers/md/Makefile b/drivers/md/Makefile index 822f4e8753bc..32d6d6e4a756 100644 --- a/drivers/md/Makefile +++ b/drivers/md/Makefile @@ -76,3 +76,7 @@ endif ifeq ($(CONFIG_DM_VERITY_FEC),y) dm-verity-objs += dm-verity-fec.o endif + +ifeq ($(CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG),y) +dm-verity-objs += dm-verity-verify-sig.o +endif diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c index ca6acc1b20ae..246593cd8fd2 100644 --- a/drivers/md/dm-verity-target.c +++ b/drivers/md/dm-verity-target.c @@ -16,7 +16,7 @@ #include "dm-verity.h" #include "dm-verity-fec.h" - +#include "dm-verity-verify-sig.h" #include <linux/module.h> #include <linux/reboot.h> @@ -34,7 +34,8 @@ #define DM_VERITY_OPT_IGN_ZEROES "ignore_zero_blocks" #define DM_VERITY_OPT_AT_MOST_ONCE "check_at_most_once" -#define DM_VERITY_OPTS_MAX (3 + DM_VERITY_OPTS_FEC) +#define DM_VERITY_OPTS_MAX (3 + DM_VERITY_OPTS_FEC + \ + DM_VERITY_ROOT_HASH_VERIFICATION_OPTS) static unsigned dm_verity_prefetch_cluster = DM_VERITY_DEFAULT_PREFETCH_SIZE; @@ -738,6 +739,8 @@ static void verity_status(struct dm_target *ti, status_type_t type, args++; if (v->validated_blocks) args++; + if (v->signature_key_desc) + args += DM_VERITY_ROOT_HASH_VERIFICATION_OPTS; if (!args) return; DMEMIT(" %u", args); @@ -759,6 +762,9 @@ static void verity_status(struct dm_target *ti, status_type_t type, if (v->validated_blocks) DMEMIT(" " DM_VERITY_OPT_AT_MOST_ONCE); sz = verity_fec_status_table(v, sz, result, maxlen); + if (v->signature_key_desc) + DMEMIT(" " DM_VERITY_ROOT_HASH_VERIFICATION_OPT_SIG_KEY + " %s", v->signature_key_desc); break; } } @@ -824,6 +830,8 @@ static void verity_dtr(struct dm_target *ti) verity_fec_dtr(v); + kfree(v->signature_key_desc); + kfree(v); } @@ -879,7 +887,8 @@ static int verity_alloc_zero_digest(struct dm_verity *v) return r; } -static int verity_parse_opt_args(struct dm_arg_set *as, struct dm_verity *v) +static int verity_parse_opt_args(struct dm_arg_set *as, struct dm_verity *v, + struct dm_verity_sig_opts *verify_args) { int r; unsigned argc; @@ -928,6 +937,14 @@ static int verity_parse_opt_args(struct dm_arg_set *as, struct dm_verity *v) if (r) return r; continue; + } else if (verity_verify_is_sig_opt_arg(arg_name)) { + r = verity_verify_sig_parse_opt_args(as, v, + verify_args, + &argc, arg_name); + if (r) + return r; + continue; + } ti->error = "Unrecognized verity feature request"; @@ -954,6 +971,7 @@ static int verity_parse_opt_args(struct dm_arg_set *as, struct dm_verity *v) static int verity_ctr(struct dm_target *ti, unsigned argc, char **argv) { struct dm_verity *v; + struct dm_verity_sig_opts verify_args = {0}; struct dm_arg_set as; unsigned int num; unsigned long long num_ll; @@ -961,6 +979,7 @@ static int verity_ctr(struct dm_target *ti, unsigned argc, char **argv) int i; sector_t hash_position; char dummy; + char *root_hash_digest_to_validate; v = kzalloc(sizeof(struct dm_verity), GFP_KERNEL); if (!v) { @@ -1085,6 +1104,7 @@ static int verity_ctr(struct dm_target *ti, unsigned argc, char **argv) r = -EINVAL; goto bad; } + root_hash_digest_to_validate = argv[8]; if (strcmp(argv[9], "-")) { v->salt_size = strlen(argv[9]) / 2; @@ -1110,11 +1130,20 @@ static int verity_ctr(struct dm_target *ti, unsigned argc, char **argv) as.argc = argc; as.argv = argv; - r = verity_parse_opt_args(&as, v); + r = verity_parse_opt_args(&as, v, &verify_args); if (r < 0) goto bad; } + /* Root hash signature is a optional parameter*/ + r = verity_verify_root_hash(root_hash_digest_to_validate, + strlen(root_hash_digest_to_validate), + verify_args.sig, + verify_args.sig_size); + if (r < 0) { + ti->error = "Root hash verification failed"; + goto bad; + } v->hash_per_block_bits = __fls((1 << v->hash_dev_block_bits) / v->digest_size); @@ -1180,9 +1209,13 @@ static int verity_ctr(struct dm_target *ti, unsigned argc, char **argv) ti->per_io_data_size = roundup(ti->per_io_data_size, __alignof__(struct dm_verity_io)); + verity_verify_sig_opts_cleanup(&verify_args); + return 0; bad: + + verity_verify_sig_opts_cleanup(&verify_args); verity_dtr(ti); return r; @@ -1190,7 +1223,7 @@ static int verity_ctr(struct dm_target *ti, unsigned argc, char **argv) static struct target_type verity_target = { .name = "verity", - .version = {1, 4, 0}, + .version = {1, 5, 0}, .module = THIS_MODULE, .ctr = verity_ctr, .dtr = verity_dtr, diff --git a/drivers/md/dm-verity-verify-sig.c b/drivers/md/dm-verity-verify-sig.c new file mode 100644 index 000000000000..614e43db93aa --- /dev/null +++ b/drivers/md/dm-verity-verify-sig.c @@ -0,0 +1,133 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (C) 2019 Microsoft Corporation. + * + * Author: Jaskaran Singh Khurana <jaskarankhurana(a)linux.microsoft.com> + * + */ +#include <linux/device-mapper.h> +#include <linux/verification.h> +#include <keys/user-type.h> +#include <linux/module.h> +#include "dm-verity.h" +#include "dm-verity-verify-sig.h" + +#define DM_VERITY_VERIFY_ERR(s) DM_VERITY_ROOT_HASH_VERIFICATION " " s + +static bool require_signatures; +module_param(require_signatures, bool, false); +MODULE_PARM_DESC(require_signatures, + "Verify the roothash of dm-verity hash tree"); + +#define DM_VERITY_IS_SIG_FORCE_ENABLED() \ + (require_signatures != false) + +bool verity_verify_is_sig_opt_arg(const char *arg_name) +{ + return (!strcasecmp(arg_name, + DM_VERITY_ROOT_HASH_VERIFICATION_OPT_SIG_KEY)); +} + +static int verity_verify_get_sig_from_key(const char *key_desc, + struct dm_verity_sig_opts *sig_opts) +{ + struct key *key; + const struct user_key_payload *ukp; + int ret = 0; + + key = request_key(&key_type_user, + key_desc, NULL); + if (IS_ERR(key)) + return PTR_ERR(key); + + down_read(&key->sem); + + ukp = user_key_payload_locked(key); + if (!ukp) { + ret = -EKEYREVOKED; + goto end; + } + + sig_opts->sig = kmalloc(ukp->datalen, GFP_KERNEL); + if (!sig_opts->sig) { + ret = -ENOMEM; + goto end; + } + sig_opts->sig_size = ukp->datalen; + + memcpy(sig_opts->sig, ukp->data, sig_opts->sig_size); + +end: + up_read(&key->sem); + key_put(key); + + return ret; +} + +int verity_verify_sig_parse_opt_args(struct dm_arg_set *as, + struct dm_verity *v, + struct dm_verity_sig_opts *sig_opts, + unsigned int *argc, + const char *arg_name) +{ + struct dm_target *ti = v->ti; + int ret = 0; + const char *sig_key = NULL; + + if (!*argc) { + ti->error = DM_VERITY_VERIFY_ERR("Signature key not specified"); + return -EINVAL; + } + + sig_key = dm_shift_arg(as); + (*argc)--; + + ret = verity_verify_get_sig_from_key(sig_key, sig_opts); + if (ret < 0) + ti->error = DM_VERITY_VERIFY_ERR("Invalid key specified"); + + v->signature_key_desc = kstrdup(sig_key, GFP_KERNEL); + if (!v->signature_key_desc) + return -ENOMEM; + + return ret; +} + +/* + * verify_verify_roothash - Verify the root hash of the verity hash device + * using builtin trusted keys. + * + * @root_hash: For verity, the roothash/data to be verified. + * @root_hash_len: Size of the roothash/data to be verified. + * @sig_data: The trusted signature that verifies the roothash/data. + * @sig_len: Size of the signature. + * + */ +int verity_verify_root_hash(const void *root_hash, size_t root_hash_len, + const void *sig_data, size_t sig_len) +{ + int ret; + + if (!root_hash || root_hash_len == 0) + return -EINVAL; + + if (!sig_data || sig_len == 0) { + if (DM_VERITY_IS_SIG_FORCE_ENABLED()) + return -ENOKEY; + else + return 0; + } + + ret = verify_pkcs7_signature(root_hash, root_hash_len, sig_data, + sig_len, NULL, VERIFYING_UNSPECIFIED_SIGNATURE, + NULL, NULL); + + return ret; +} + +void verity_verify_sig_opts_cleanup(struct dm_verity_sig_opts *sig_opts) +{ + kfree(sig_opts->sig); + sig_opts->sig = NULL; + sig_opts->sig_size = 0; +} diff --git a/drivers/md/dm-verity-verify-sig.h b/drivers/md/dm-verity-verify-sig.h new file mode 100644 index 000000000000..19b1547aa741 --- /dev/null +++ b/drivers/md/dm-verity-verify-sig.h @@ -0,0 +1,60 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (C) 2019 Microsoft Corporation. + * + * Author: Jaskaran Singh Khurana <jaskarankhurana(a)linux.microsoft.com> + * + */ +#ifndef DM_VERITY_SIG_VERIFICATION_H +#define DM_VERITY_SIG_VERIFICATION_H + +#define DM_VERITY_ROOT_HASH_VERIFICATION "DM Verity Sig Verification" +#define DM_VERITY_ROOT_HASH_VERIFICATION_OPT_SIG_KEY "root_hash_sig_key_desc" + +struct dm_verity_sig_opts { + unsigned int sig_size; + u8 *sig; +}; + +#ifdef CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG + +#define DM_VERITY_ROOT_HASH_VERIFICATION_OPTS 2 + +int verity_verify_root_hash(const void *data, size_t data_len, + const void *sig_data, size_t sig_len); +bool verity_verify_is_sig_opt_arg(const char *arg_name); + +int verity_verify_sig_parse_opt_args(struct dm_arg_set *as, struct dm_verity *v, + struct dm_verity_sig_opts *sig_opts, + unsigned int *argc, const char *arg_name); + +void verity_verify_sig_opts_cleanup(struct dm_verity_sig_opts *sig_opts); + +#else + +#define DM_VERITY_ROOT_HASH_VERIFICATION_OPTS 0 + +int verity_verify_root_hash(const void *data, size_t data_len, + const void *sig_data, size_t sig_len) +{ + return 0; +} + +bool verity_verify_is_sig_opt_arg(const char *arg_name) +{ + return false; +} + +int verity_verify_sig_parse_opt_args(struct dm_arg_set *as, struct dm_verity *v, + struct dm_verity_sig_opts *sig_opts, + unsigned int *argc, const char *arg_name) +{ + return -EINVAL; +} + +void verity_verify_sig_opts_cleanup(struct dm_verity_sig_opts *sig_opts) +{ +} + +#endif /* CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG */ +#endif /* DM_VERITY_SIG_VERIFICATION_H */ diff --git a/drivers/md/dm-verity.h b/drivers/md/dm-verity.h index 3441c10b840c..42183a3903ae 100644 --- a/drivers/md/dm-verity.h +++ b/drivers/md/dm-verity.h @@ -64,6 +64,8 @@ struct dm_verity { struct dm_verity_fec *fec; /* forward error correction */ unsigned long *validated_blocks; /* bitset blocks validated */ + + char *signature_key_desc; /* signature keyring reference */ }; struct dm_verity_io { -- 2.25.1

1 2

[PATCH openEuler-22.09 00/67] backport from mainline
by Zheng Zengkai 29 Jul '22

29 Jul '22

v2: 1. full test in this branch. 2. correct implict declare function in arch/arm64/kvm/hyp/include/hyp/switch.h. v1: backport from mainline Alexandru Elisei (1): arm64: Do not trap PMSNEVFR_EL1 Marc Zyngier (10): KVM: arm64: Let vcpu_sve_pffr() handle HYP VAs KVM: arm64: Provide KVM's own save/restore SVE primitives KVM: arm64: Use {read,write}_sysreg_el1 to access ZCR_EL1 KVM: arm64: Introduce vcpu_sve_vq() helper arm64: sve: Provide a conditional update accessor for ZCR_ELx KVM: arm64: Map SVE context at EL2 when available KVM: arm64: Rework SVE host-save/guest-restore KVM: arm64: Save guest's ZCR_EL1 before saving the FPSIMD state KVM: arm64: Save/restore SVE state for nVHE KVM: arm64: Always start with clearing SME flag on load Mark Brown (54): arm64/sve: Remove redundant system_supports_sve() tests arm64/sve: Add compile time checks for SVE hooks in generic functions arm64/sve: Rework SVE access trap to convert state in registers arm64/sve: Split _sve_flush macro into separate Z and predicate flushes arm64/sve: Skip flushing Z registers with 128 bit vectors arm64/sve: Use the sve_flush macros in sve_load_from_fpsimd_state() arm64/sve: Remove sve_load_from_fpsimd_state() arm64/sve: Better handle failure to allocate SVE register storage arm64/fp: Reindent fpsimd_save() arm64/sve: Make access to FFR optional arm64/sve: Rename find_supported_vector_length() arm64/sve: Use accessor functions for vector lengths in thread_struct arm64/sve: Put system wide vector length information into structs arm64/sve: Explicitly load vector length when restoring SVE state arm64/sve: Track vector lengths for tasks in an array arm64/sve: Make sysctl interface for SVE reusable by SME arm64/sve: Generalise vector length configuration prctl() for SME arm64/sve: Minor clarification of ABI documentation arm64: cpufeature: Always specify and use a field width for capabilities arm64/sme: Provide ABI documentation for SME arm64/sme: System register and exception syndrome definitions arm64/sme: Manually encode SME instructions arm64: Disable fine grained traps on boot arm64/sme: Early CPU setup for SME arm64/sme: Basic enumeration support arm64/sme: Identify supported SME vector lengths at boot arm64/sme: Implement sysctl to set the default vector length arm64/sme: Implement vector length configuration prctl()s arm64/sme: Implement support for TPIDR2 arm64/sme: Implement SVCR context switching arm64/sme: Implement streaming SVE context switching arm64/sme: Implement ZA context switching arm64/sme: Implement traps and syscall handling for SME arm64/sme: Disable ZA and streaming mode when handling signals arm64/sme: Implement streaming SVE signal handling arm64/sme: Implement ZA signal handling arm64/sme: Implement ptrace support for streaming mode SVE registers arm64/sme: Add ptrace support for ZA arm64/sme: Disable streaming mode and ZA when flushing CPU state arm64/sme: Save and restore streaming mode over EFI runtime calls arm64/sme: Provide Kconfig for SME arm64/sme: Add ID_AA64SMFR0_EL1 to __read_sysreg_by_encoding() arm64/sme: More sensibly define the size for the ZA register set KVM: arm64: Hide SME system registers from guests KVM: arm64: Trap SME usage in guest KVM: arm64: Handle SME host state when running guests arm64/fp: Make SVE and SME length register definition match architecture arm64/fp: Rename SVE and SME LEN field name to _WIDTH arm64/sme: Drop SYS_ from SMIDR_EL1 defines arm64/sme: Standardise bitfield names for SVCR arm64/sme: Remove _EL0 from name of SVCR - FIXME sysreg.h arm64/sme: Fix tests for 0b1111 value ID registers arm64/sme: Fix SVE/SME typo in ABI documentation arm64/sme: Fix EFI save/restore Wan Jiabing (1): arm64/sme: Fix NULL check after kzalloc Xiaofei Tan (1): arm64: sve: Provide sve_cond_update_zcr_vq fallback when !ARM64_SVE Documentation/arm64/elf_hwcaps.rst | 34 + Documentation/arm64/index.rst | 1 + Documentation/arm64/sme.rst | 428 ++++++++++ Documentation/arm64/sve.rst | 72 +- arch/arm64/Kconfig | 11 + arch/arm64/include/asm/cpu.h | 4 + arch/arm64/include/asm/cpucaps.h | 2 + arch/arm64/include/asm/cpufeature.h | 25 + arch/arm64/include/asm/esr.h | 13 +- arch/arm64/include/asm/exception.h | 1 + arch/arm64/include/asm/fpsimd.h | 262 ++++++- arch/arm64/include/asm/fpsimdmacros.h | 108 ++- arch/arm64/include/asm/hwcap.h | 8 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_host.h | 12 +- arch/arm64/include/asm/kvm_hyp.h | 2 + arch/arm64/include/asm/processor.h | 78 +- arch/arm64/include/asm/signal_common.h | 19 +- arch/arm64/include/asm/sysreg.h | 78 +- arch/arm64/include/asm/thread_info.h | 4 +- arch/arm64/include/uapi/asm/hwcap.h | 8 + arch/arm64/include/uapi/asm/ptrace.h | 69 +- arch/arm64/include/uapi/asm/sigcontext.h | 55 +- arch/arm64/kernel/cpufeature.c | 280 +++++-- arch/arm64/kernel/cpuinfo.c | 13 + arch/arm64/kernel/entry-common.c | 11 + arch/arm64/kernel/entry-fpsimd.S | 72 +- arch/arm64/kernel/fpsimd.c | 944 ++++++++++++++++++----- arch/arm64/kernel/head.S | 87 +++ arch/arm64/kernel/process.c | 45 +- arch/arm64/kernel/ptrace.c | 373 +++++++-- arch/arm64/kernel/signal.c | 175 ++++- arch/arm64/kernel/syscall.c | 29 +- arch/arm64/kernel/traps.c | 1 + arch/arm64/kvm/fpsimd.c | 70 +- arch/arm64/kvm/guest.c | 6 +- arch/arm64/kvm/hyp/fpsimd.S | 12 + arch/arm64/kvm/hyp/include/hyp/switch.h | 75 +- arch/arm64/kvm/hyp/nvhe/switch.c | 38 +- arch/arm64/kvm/hyp/vhe/switch.c | 10 +- arch/arm64/kvm/reset.c | 14 +- arch/arm64/kvm/sys_regs.c | 8 +- include/uapi/linux/elf.h | 2 + include/uapi/linux/prctl.h | 9 + kernel/sys.c | 12 + 45 files changed, 3123 insertions(+), 458 deletions(-) create mode 100644 Documentation/arm64/sme.rst -- 2.20.1

1 67

[PATCH openEuler-1.0-LTS] jbd2: Fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
by Yongqiang Liu 28 Jul '22

28 Jul '22

From: Zhihao Cheng <chengzhihao1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187185, https://gitee.com/openeuler/kernel/issues/I5JAOC CVE: NA -------------------------------- Following process will fail assertion 'jh->b_frozen_data == NULL' in jbd2_journal_dirty_metadata(): jbd2_journal_commit_transaction unlink(dir/a) jh->b_transaction = trans1 jh->b_jlist = BJ_Metadata journal->j_running_transaction = NULL trans1->t_state = T_COMMIT unlink(dir/b) handle->h_trans = trans2 do_get_write_access jh->b_modified = 0 jh->b_frozen_data = frozen_buffer jh->b_next_transaction = trans2 jbd2_journal_dirty_metadata is_handle_aborted is_journal_aborted // return false --> jbd2 abort <-- while (commit_transaction->t_buffers) if (is_journal_aborted) jbd2_journal_refile_buffer __jbd2_journal_refile_buffer WRITE_ONCE(jh->b_transaction, jh->b_next_transaction) WRITE_ONCE(jh->b_next_transaction, NULL) __jbd2_journal_file_buffer(jh, BJ_Reserved) J_ASSERT_JH(jh, jh->b_frozen_data == NULL) // assertion failure ! The reproducer (See detail in [Link]) reports: ------------[ cut here ]------------ kernel BUG at fs/jbd2/transaction.c:1629! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 2 PID: 584 Comm: unlink Tainted: G W 5.19.0-rc6-00115-g4a57a8400075-dirty #697 RIP: 0010:jbd2_journal_dirty_metadata+0x3c5/0x470 RSP: 0018:ffffc90000be7ce0 EFLAGS: 00010202 Call Trace: <TASK> __ext4_handle_dirty_metadata+0xa0/0x290 ext4_handle_dirty_dirblock+0x10c/0x1d0 ext4_delete_entry+0x104/0x200 __ext4_unlink+0x22b/0x360 ext4_unlink+0x275/0x390 vfs_unlink+0x20b/0x4c0 do_unlinkat+0x42f/0x4c0 __x64_sys_unlink+0x37/0x50 do_syscall_64+0x35/0x80 After journal aborting, __jbd2_journal_refile_buffer() is executed with holding @jh->b_state_lock, we can fix it by moving 'is_handle_aborted()' into the area protected by @jh->b_state_lock. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216251 Fixes: 470decc613ab20 ("[PATCH] jbd2: initial copy of files from jbd") Conflicts: fs/jbd2/transaction.c [ 464170647b56("jbd2: Make state lock a spinlock") is not applied. ] Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/jbd2/transaction.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c index f56be34564e7..3b31bd1f7b77 100644 --- a/fs/jbd2/transaction.c +++ b/fs/jbd2/transaction.c @@ -1410,8 +1410,6 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) struct journal_head *jh; int ret = 0; - if (is_handle_aborted(handle)) - return -EROFS; if (!buffer_jbd(bh)) return -EUCLEAN; @@ -1458,6 +1456,18 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) journal = transaction->t_journal; jbd_lock_bh_state(bh); + if (is_handle_aborted(handle)) { + /* + * Check journal aborting with @jh->b_state_lock locked, + * since 'jh->b_transaction' could be replaced with + * 'jh->b_next_transaction' during old transaction + * committing if journal aborted, which may fail + * assertion on 'jh->b_frozen_data == NULL'. + */ + ret = -EROFS; + goto out_unlock_bh; + } + if (jh->b_modified == 0) { /* * This buffer's got modified and becoming part -- 2.25.1

1 0

[PATCH openEuler-5.10 01/32] bpf: Don't redirect packets with invalid pkt_len
by Zheng Zengkai 28 Jul '22

28 Jul '22

From: Zhengchao Shao <shaozhengchao(a)huawei.com> mainline inclusion from mainline-v5.19-rc6 commit fd1894224407c484f652ad456e1ce423e89bb3eb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5HWKR CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id… -------------------------------- Syzbot found an issue [1]: fq_codel_drop() try to drop a flow whitout any skbs, that is, the flow->head is null. The root cause, as the [2] says, is because that bpf_prog_test_run_skb() run a bpf prog which redirects empty skbs. So we should determine whether the length of the packet modified by bpf prog or others like bpf_prog_test is valid before forwarding it directly. LINK: [1] https://syzkaller.appspot.com/bug?id=0b84da80c2917757915afa89f7738a9d16ec96… LINK: [2] https://www.spinics.net/lists/netdev/msg777503.html Reported-by: syzbot+7a12909485b94426aceb(a)syzkaller.appspotmail.com Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Stanislav Fomichev <sdf(a)google.com> Link: https://lore.kernel.org/r/20220715115559.139691-1-shaozhengchao@huawei.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/skbuff.h | 8 ++++++++ net/bpf/test_run.c | 3 +++ net/core/dev.c | 1 + 3 files changed, 12 insertions(+) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 68efccc15a87..72cfb047fd2c 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -2251,6 +2251,14 @@ static inline void skb_set_tail_pointer(struct sk_buff *skb, const int offset) #endif /* NET_SKBUFF_DATA_USES_OFFSET */ +static inline void skb_assert_len(struct sk_buff *skb) +{ +#ifdef CONFIG_DEBUG_NET + if (WARN_ONCE(!skb->len, "%s\n", __func__)) + DO_ONCE_LITE(skb_dump, KERN_ERR, skb, false); +#endif /* CONFIG_DEBUG_NET */ +} + /* * Add data to an sk_buff */ diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c index 99712d35e535..f266a9453c8e 100644 --- a/net/bpf/test_run.c +++ b/net/bpf/test_run.c @@ -398,6 +398,9 @@ static int convert___skb_to_skb(struct sk_buff *skb, struct __sk_buff *__skb) { struct qdisc_skb_cb *cb = (struct qdisc_skb_cb *)skb->cb; + if (!skb->len) + return -EINVAL; + if (!__skb) return 0; diff --git a/net/core/dev.c b/net/core/dev.c index 12089c484b30..8e4de36eede8 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -4094,6 +4094,7 @@ static int __dev_queue_xmit(struct sk_buff *skb, struct net_device *sb_dev) bool again = false; skb_reset_mac_header(skb); + skb_assert_len(skb); if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_SCHED_TSTAMP)) __skb_tstamp_tx(skb, NULL, skb->sk, SCM_TSTAMP_SCHED); -- 2.20.1

1 31

[PATCH openEuler-1.0-LTS 1/2] dm btree spine: remove paranoid node_check call in node_prep_for_write()
by Yongqiang Liu 28 Jul '22

28 Jul '22

From: Joe Thornber <ejt(a)redhat.com> mainline inclusion from mainline-v5.13-rc1 commit f73e2e70ec48c9a9d45494c4866230a5059062ad category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5JCAH CVE: NA -------------------------------- Remove this extra BUG_ON() that calls node_check() -- which avoids extra crc checking. Signed-off-by: Joe Thornber <ejt(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)redhat.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/md/persistent-data/dm-btree-spine.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/md/persistent-data/dm-btree-spine.c b/drivers/md/persistent-data/dm-btree-spine.c index b27b8091a1ca..52f11a7bad92 100644 --- a/drivers/md/persistent-data/dm-btree-spine.c +++ b/drivers/md/persistent-data/dm-btree-spine.c @@ -30,8 +30,6 @@ static void node_prepare_for_write(struct dm_block_validator *v, h->csum = cpu_to_le32(dm_bm_checksum(&h->flags, block_size - sizeof(__le32), BTREE_CSUM_XOR)); - - BUG_ON(node_check(v, b, 4096)); } static int node_check(struct dm_block_validator *v, -- 2.25.1

1 1

[PATCH] scripts: Add checkformat script for openEuler kernel
by Zheng Zengkai 28 Jul '22

28 Jul '22

Add script for check patch header, including inclusion, commit, category, bugzilla sections. Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- pr_checkformat.py | 166 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 166 insertions(+) create mode 100644 pr_checkformat.py diff --git a/pr_checkformat.py b/pr_checkformat.py new file mode 100644 index 000000000000..9a799fe290d9 --- /dev/null +++ b/pr_checkformat.py @@ -0,0 +1,166 @@ +#!/usr/bin/python3 + +import os +import re +import sys +import subprocess +import shlex + +def exec_shell(cmd, workdir = None): + p = subprocess.Popen(shlex.split(cmd), stdin = subprocess.PIPE, stdout = subprocess.PIPE, + stderr = subprocess.PIPE, cwd = workdir) + output, err = p.communicate(timeout = 180) + return p.returncode, str(output, 'utf-8'), str(err, 'utf-8') + +commit_format = { + "[Backport]": + [ + [ + [r'mainline inclusion\n' ,r''], + [r'from mainline(-v\d*\.\d*-rc\d*)?\n' ,r'miss "from mainline"'], + [r'commit [a-f0-9]{40}\n' ,r'miss commit or commit-id not 40char'], + [r'(category: .*\n)?' ,r''], + [r'bugzilla: .*\n' ,r'miss bugzilla'], + [r'(CVE: CVE-\d{4}-\d+\n)?' ,r''], + [r'\n' ,r'miss \n'], + [r'(Reference: .*\n)+' ,r'miss Reference'], + [r'\n' ,r'miss \n'], + [r'-{16,80}\n' ,r'miss parting line 16~80 "-"'], + [r'\n' ,r'miss \n'], + ], + [ + [r'stable inclusion\n' ,r''], + [r'from stable-v\d*\.\d*\.\d*\n' ,r'miss "from stable"'], + [r'commit [a-f0-9]{40}\n' ,r'miss commit or commit-id not 40char'], + [r'(category: .*\n)?' ,r''], + [r'bugzilla: .*\n' ,r'miss bugzilla'], + [r'(CVE: CVE-\d{4}-\d+\n)?' ,r''], + [r'\n' ,r'miss \n'], + [r'(Reference: .*\n)+' ,r'miss Reference'], + [r'\n' ,r'miss \n'], + [r'-{16,80}\n' ,r'miss parting line 16~80 "-"'], + [r'\n' ,r'miss \n'], + ], + [ + [r'.* inclusion\n' ,r'miss inclusion'], + [r'(category: .*\n)?' ,r''], + [r'bugzilla: .*\n' ,r'miss bugzilla'], + [r'(CVE: CVE-\d{4}-\d+\n)?' ,r''], + [r'\n' ,r'miss \n'], + [r'(Reference: .*\n)+' ,r'miss Reference'], + [r'\n' ,r'miss \n'], + [r'-{16,80}\n' ,r'miss parting line 16~80 "-"'], + [r'\n' ,r'miss \n'], + ], + + ], + } + +def check_employee_id(body): + m = re.findall(r'Signed-off-by.*\n', body) + if len(m) == 0: + return False, "miss Signed-off-by\n" + else: + for sig in m: + __m = re.findall(r'Signed-off-by.*[a-zA-Z][0-9]{8}.*(a)huawei.com', sig) + if __m: + return False, "incorrect Signed-off-by: %s\n"%(__m); + + m = re.findall(r'Reviewed-by.*\n', body) + for rew in m: + __m = re.findall(r'Reviewed-by.*[a-zA-Z][0-9]{8}.*(a)huawei.com', rew) + if __m: + return False, "incorrect Reviewed-by: %s\n"%(__m); + + m = re.findall(r'Author:.*\n', body) + for author in m: + __m = re.findall(r'Author.*[a-zA-Z][0-9]{8}.*(a)huawei.com', author) + if __m: + return False, "incorrect author: %s\n"%(__m); + + return True, "" + +def format_print(__format, line): + description = "" + for i in range(0, len(__format)): + __line = __format[i][0].replace("\\n","") + if i == line: + __line += "\t<------" + __format[i][1] + description += __line + "\n" + return description + +def match_format(__format, body): + regex = r'' + match = False + + for i in range(0, len(__format)): + regex = regex + __format[i][0] + m = re.match(regex, body) + if not m: + return match, format_print(__format, i) + match = True + + return True, "" + +def error_description(description): + return description + +def do_checkformat(patch, workdir = None): + commit = patch.split(" ")[0] + + description = "" + + #check subject begin with hw + subject = exec_shell('git log --pretty=%s -n 1 %s'%('%s', commit), workdir)[1] + subject_type = subject.split(" ")[0] + if not subject_type in commit_format: + description = "subject should be begin with " + for __subject_type in commit_format: + description = description + __subject_type + "," + return False, error_description(description) + + #check Sig/Review/Author has Job number + body = exec_shell('git log -n 1 %s'%(commit), workdir)[1] + ret, description = check_employee_id(body) + if ret == False: + return False, error_description(description) + + #check commit message header + body = exec_shell('git log --pretty=%s -n 1 %s'%('%b', commit), workdir)[1] + for __format in commit_format[subject_type]: + match, description = match_format(__format, body) + if match == True: + if description == "": + return True, "checkformat success" + else: + return False, error_description(description) + + #not match any template + description = "do not match any template!\n" + for __subject_type in commit_format: + description = description + __subject_type + for __format in commit_format[__subject_type]: + description += "^^^^^^^^^^\n" + description += format_print(__format, -1) + description = description + "^^^^^^^^^^\n" + return False, error_description(description) + +def main(): + ForT = True + tag=sys.argv[1] + patches = os.popen("git log --oneline " + tag + "..HEAD").readlines() + for patch in patches: + ret, description = do_checkformat(patch) + if ret == False: + print("check " + patch + " failed") + print(description) + ForT = False + if ForT == False: + return False + + print("check " + str(len(patches)) + " patch(es) success") + return True + +if __name__ == "__main__": + # execute only if run as a script + main() -- 2.20.1

1 0

[PATCH v3 openEuler-22.09 00/24] Rust for openEuler
by Xie XiuQi 27 Jul '22

27 Jul '22

From: Zheng Zengkai <zhengzengkai(a)huawei.com> Rust for openEuler Boqun Feng (1): kallsyms: avoid hardcoding the buffer size Gary Guo (2): rust: add `build_error` crate vsprintf: add new `%pA` format specifier Miguel Ojeda (17): kallsyms: support "big" kernel symbols kallsyms: increase maximum kernel symbol length to 512 rust: add C helpers rust: add `compiler_builtins` crate rust: import upstream `alloc` crate rust: adapt `alloc` crate to the kernel rust: add `macros` crate rust: export generated symbols scripts: checkpatch: diagnose uses of `%pA` in the C side scripts: checkpatch: enable language-independent checks for Rust scripts: add `rustdoc_test_{builder,gen}.py` scripts scripts: add `generate_rust_analyzer.py` scripts scripts: decode_stacktrace: demangle Rust symbols docs: add Rust documentation Kbuild: add Rust support samples: add Rust examples MAINTAINERS: Rust Wedson Almeida Filho (3): rust: add `kernel` crate's `sync` module rust: add `kernel` crate drivers: gpio: PrimeCell PL061 in Rust Weilong Chen (1): Adaptation of rust for openEuler .gitignore | 5 + .rustfmt.toml | 12 + Documentation/core-api/printk-formats.rst | 10 + Documentation/doc-guide/kernel-doc.rst | 3 + Documentation/index.rst | 1 + Documentation/kbuild/kbuild.rst | 17 + Documentation/kbuild/makefiles.rst | 50 +- Documentation/process/changes.rst | 41 + Documentation/rust/arch-support.rst | 25 + Documentation/rust/coding-guidelines.rst | 216 ++ Documentation/rust/general-information.rst | 79 + Documentation/rust/index.rst | 22 + Documentation/rust/quick-start.rst | 232 ++ MAINTAINERS | 15 + Makefile | 176 +- arch/Kconfig | 6 + arch/arm/Kconfig | 1 + arch/arm64/Kconfig | 1 + arch/powerpc/Kconfig | 1 + arch/riscv/Kconfig | 1 + arch/riscv/Makefile | 5 + arch/um/Kconfig | 1 + arch/x86/Kconfig | 1 + arch/x86/Makefile | 13 + drivers/gpio/Kconfig | 8 + drivers/gpio/Makefile | 1 + drivers/gpio/gpio_pl061_rust.rs | 370 ++ include/linux/kallsyms.h | 2 +- include/linux/spinlock.h | 25 +- init/Kconfig | 42 + kernel/kallsyms.c | 26 +- kernel/livepatch/core.c | 4 +- lib/Kconfig.debug | 155 + lib/vsprintf.c | 13 + rust/.gitignore | 10 + rust/Makefile | 398 +++ rust/alloc/README.md | 33 + rust/alloc/alloc.rs | 440 +++ rust/alloc/borrow.rs | 498 +++ rust/alloc/boxed.rs | 2026 +++++++++++ rust/alloc/boxed/thin.rs | 217 ++ rust/alloc/collections/mod.rs | 156 + rust/alloc/fmt.rs | 614 ++++ rust/alloc/lib.rs | 239 ++ rust/alloc/macros.rs | 128 + rust/alloc/raw_vec.rs | 567 +++ rust/alloc/slice.rs | 1295 +++++++ rust/alloc/str.rs | 641 ++++ rust/alloc/string.rs | 2944 +++++++++++++++ rust/alloc/vec/drain.rs | 186 + rust/alloc/vec/drain_filter.rs | 145 + rust/alloc/vec/into_iter.rs | 356 ++ rust/alloc/vec/is_zero.rs | 106 + rust/alloc/vec/mod.rs | 3362 ++++++++++++++++++ rust/alloc/vec/partial_eq.rs | 49 + rust/alloc/vec/set_len_on_drop.rs | 30 + rust/alloc/vec/spec_extend.rs | 174 + rust/bindgen_parameters | 17 + rust/build_error.rs | 29 + rust/compiler_builtins.rs | 79 + rust/exports.c | 20 + rust/helpers.c | 644 ++++ rust/kernel/allocator.rs | 65 + rust/kernel/amba.rs | 258 ++ rust/kernel/bindings.rs | 47 + rust/kernel/bindings_helper.h | 46 + rust/kernel/build_assert.rs | 82 + rust/kernel/c_types.rs | 119 + rust/kernel/chrdev.rs | 207 ++ rust/kernel/clk.rs | 79 + rust/kernel/cred.rs | 46 + rust/kernel/device.rs | 546 +++ rust/kernel/driver.rs | 442 +++ rust/kernel/error.rs | 565 +++ rust/kernel/file.rs | 864 +++++ rust/kernel/gpio.rs | 478 +++ rust/kernel/hwrng.rs | 242 ++ rust/kernel/io_buffer.rs | 153 + rust/kernel/io_mem.rs | 275 ++ rust/kernel/iov_iter.rs | 81 + rust/kernel/irq.rs | 411 +++ rust/kernel/kasync.rs | 6 + rust/kernel/kasync/net.rs | 322 ++ rust/kernel/kunit.rs | 91 + rust/kernel/lib.rs | 261 ++ rust/kernel/linked_list.rs | 247 ++ rust/kernel/miscdev.rs | 291 ++ rust/kernel/mm.rs | 149 + rust/kernel/module_param.rs | 498 +++ rust/kernel/net.rs | 391 ++ rust/kernel/net/filter.rs | 447 +++ rust/kernel/of.rs | 63 + rust/kernel/pages.rs | 144 + rust/kernel/platform.rs | 223 ++ rust/kernel/power.rs | 118 + rust/kernel/prelude.rs | 36 + rust/kernel/print.rs | 405 +++ rust/kernel/random.rs | 42 + rust/kernel/raw_list.rs | 361 ++ rust/kernel/rbtree.rs | 563 +++ rust/kernel/revocable.rs | 161 + rust/kernel/security.rs | 38 + rust/kernel/static_assert.rs | 38 + rust/kernel/std_vendor.rs | 160 + rust/kernel/str.rs | 597 ++++ rust/kernel/sync.rs | 161 + rust/kernel/sync/arc.rs | 503 +++ rust/kernel/sync/condvar.rs | 138 + rust/kernel/sync/guard.rs | 169 + rust/kernel/sync/locked_by.rs | 111 + rust/kernel/sync/mutex.rs | 153 + rust/kernel/sync/nowait.rs | 188 + rust/kernel/sync/revocable.rs | 250 ++ rust/kernel/sync/rwsem.rs | 197 + rust/kernel/sync/seqlock.rs | 202 ++ rust/kernel/sync/smutex.rs | 295 ++ rust/kernel/sync/spinlock.rs | 360 ++ rust/kernel/sysctl.rs | 199 ++ rust/kernel/task.rs | 175 + rust/kernel/types.rs | 679 ++++ rust/kernel/user_ptr.rs | 175 + rust/macros/helpers.rs | 79 + rust/macros/lib.rs | 94 + rust/macros/module.rs | 631 ++++ samples/Kconfig | 2 + samples/Makefile | 1 + samples/rust/Kconfig | 140 + samples/rust/Makefile | 15 + samples/rust/hostprogs/.gitignore | 3 + samples/rust/hostprogs/Makefile | 5 + samples/rust/hostprogs/a.rs | 7 + samples/rust/hostprogs/b.rs | 5 + samples/rust/hostprogs/single.rs | 12 + samples/rust/rust_chrdev.rs | 50 + samples/rust/rust_minimal.rs | 35 + samples/rust/rust_miscdev.rs | 143 + samples/rust/rust_module_parameters.rs | 69 + samples/rust/rust_netfilter.rs | 54 + samples/rust/rust_platform.rs | 22 + samples/rust/rust_print.rs | 54 + samples/rust/rust_random.rs | 60 + samples/rust/rust_semaphore.rs | 171 + samples/rust/rust_semaphore_c.c | 212 ++ samples/rust/rust_stack_probing.rs | 36 + samples/rust/rust_sync.rs | 93 + scripts/Kconfig.include | 2 +- scripts/Makefile | 3 + scripts/Makefile.build | 60 + scripts/Makefile.host | 34 +- scripts/Makefile.lib | 12 + scripts/cc-version.sh | 72 + scripts/checkpatch.pl | 8 +- scripts/decode_stacktrace.sh | 14 + scripts/generate_rust_analyzer.py | 134 + scripts/generate_rust_target.rs | 227 ++ scripts/is_rust_module.sh | 13 + scripts/kallsyms.c | 47 +- scripts/kconfig/confdata.c | 156 +- scripts/min-tool-version.sh | 43 + scripts/rust-is-available-bindgen-libclang.h | 2 + scripts/rust-is-available.sh | 158 + scripts/rustdoc_test_builder.py | 59 + scripts/rustdoc_test_gen.py | 164 + tools/include/linux/kallsyms.h | 2 +- tools/lib/perf/include/perf/event.h | 2 +- tools/lib/symbol/kallsyms.h | 2 +- 166 files changed, 34760 insertions(+), 43 deletions(-) create mode 100644 .rustfmt.toml create mode 100644 Documentation/rust/arch-support.rst create mode 100644 Documentation/rust/coding-guidelines.rst create mode 100644 Documentation/rust/general-information.rst create mode 100644 Documentation/rust/index.rst create mode 100644 Documentation/rust/quick-start.rst create mode 100644 drivers/gpio/gpio_pl061_rust.rs create mode 100644 rust/.gitignore create mode 100644 rust/Makefile create mode 100644 rust/alloc/README.md create mode 100644 rust/alloc/alloc.rs create mode 100644 rust/alloc/borrow.rs create mode 100644 rust/alloc/boxed.rs create mode 100644 rust/alloc/boxed/thin.rs create mode 100644 rust/alloc/collections/mod.rs create mode 100644 rust/alloc/fmt.rs create mode 100644 rust/alloc/lib.rs create mode 100644 rust/alloc/macros.rs create mode 100644 rust/alloc/raw_vec.rs create mode 100644 rust/alloc/slice.rs create mode 100644 rust/alloc/str.rs create mode 100644 rust/alloc/string.rs create mode 100644 rust/alloc/vec/drain.rs create mode 100644 rust/alloc/vec/drain_filter.rs create mode 100644 rust/alloc/vec/into_iter.rs create mode 100644 rust/alloc/vec/is_zero.rs create mode 100644 rust/alloc/vec/mod.rs create mode 100644 rust/alloc/vec/partial_eq.rs create mode 100644 rust/alloc/vec/set_len_on_drop.rs create mode 100644 rust/alloc/vec/spec_extend.rs create mode 100644 rust/bindgen_parameters create mode 100644 rust/build_error.rs create mode 100644 rust/compiler_builtins.rs create mode 100644 rust/exports.c create mode 100644 rust/helpers.c create mode 100644 rust/kernel/allocator.rs create mode 100644 rust/kernel/amba.rs create mode 100644 rust/kernel/bindings.rs create mode 100644 rust/kernel/bindings_helper.h create mode 100644 rust/kernel/build_assert.rs create mode 100644 rust/kernel/c_types.rs create mode 100644 rust/kernel/chrdev.rs create mode 100644 rust/kernel/clk.rs create mode 100644 rust/kernel/cred.rs create mode 100644 rust/kernel/device.rs create mode 100644 rust/kernel/driver.rs create mode 100644 rust/kernel/error.rs create mode 100644 rust/kernel/file.rs create mode 100644 rust/kernel/gpio.rs create mode 100644 rust/kernel/hwrng.rs create mode 100644 rust/kernel/io_buffer.rs create mode 100644 rust/kernel/io_mem.rs create mode 100644 rust/kernel/iov_iter.rs create mode 100644 rust/kernel/irq.rs create mode 100644 rust/kernel/kasync.rs create mode 100644 rust/kernel/kasync/net.rs create mode 100644 rust/kernel/kunit.rs create mode 100644 rust/kernel/lib.rs create mode 100644 rust/kernel/linked_list.rs create mode 100644 rust/kernel/miscdev.rs create mode 100644 rust/kernel/mm.rs create mode 100644 rust/kernel/module_param.rs create mode 100644 rust/kernel/net.rs create mode 100644 rust/kernel/net/filter.rs create mode 100644 rust/kernel/of.rs create mode 100644 rust/kernel/pages.rs create mode 100644 rust/kernel/platform.rs create mode 100644 rust/kernel/power.rs create mode 100644 rust/kernel/prelude.rs create mode 100644 rust/kernel/print.rs create mode 100644 rust/kernel/random.rs create mode 100644 rust/kernel/raw_list.rs create mode 100644 rust/kernel/rbtree.rs create mode 100644 rust/kernel/revocable.rs create mode 100644 rust/kernel/security.rs create mode 100644 rust/kernel/static_assert.rs create mode 100644 rust/kernel/std_vendor.rs create mode 100644 rust/kernel/str.rs create mode 100644 rust/kernel/sync.rs create mode 100644 rust/kernel/sync/arc.rs create mode 100644 rust/kernel/sync/condvar.rs create mode 100644 rust/kernel/sync/guard.rs create mode 100644 rust/kernel/sync/locked_by.rs create mode 100644 rust/kernel/sync/mutex.rs create mode 100644 rust/kernel/sync/nowait.rs create mode 100644 rust/kernel/sync/revocable.rs create mode 100644 rust/kernel/sync/rwsem.rs create mode 100644 rust/kernel/sync/seqlock.rs create mode 100644 rust/kernel/sync/smutex.rs create mode 100644 rust/kernel/sync/spinlock.rs create mode 100644 rust/kernel/sysctl.rs create mode 100644 rust/kernel/task.rs create mode 100644 rust/kernel/types.rs create mode 100644 rust/kernel/user_ptr.rs create mode 100644 rust/macros/helpers.rs create mode 100644 rust/macros/lib.rs create mode 100644 rust/macros/module.rs create mode 100644 samples/rust/Kconfig create mode 100644 samples/rust/Makefile create mode 100644 samples/rust/hostprogs/.gitignore create mode 100644 samples/rust/hostprogs/Makefile create mode 100644 samples/rust/hostprogs/a.rs create mode 100644 samples/rust/hostprogs/b.rs create mode 100644 samples/rust/hostprogs/single.rs create mode 100644 samples/rust/rust_chrdev.rs create mode 100644 samples/rust/rust_minimal.rs create mode 100644 samples/rust/rust_miscdev.rs create mode 100644 samples/rust/rust_module_parameters.rs create mode 100644 samples/rust/rust_netfilter.rs create mode 100644 samples/rust/rust_platform.rs create mode 100644 samples/rust/rust_print.rs create mode 100644 samples/rust/rust_random.rs create mode 100644 samples/rust/rust_semaphore.rs create mode 100644 samples/rust/rust_semaphore_c.c create mode 100644 samples/rust/rust_stack_probing.rs create mode 100644 samples/rust/rust_sync.rs create mode 100755 scripts/cc-version.sh create mode 100755 scripts/generate_rust_analyzer.py create mode 100644 scripts/generate_rust_target.rs create mode 100755 scripts/is_rust_module.sh create mode 100755 scripts/min-tool-version.sh create mode 100644 scripts/rust-is-available-bindgen-libclang.h create mode 100755 scripts/rust-is-available.sh create mode 100755 scripts/rustdoc_test_builder.py create mode 100755 scripts/rustdoc_test_gen.py -- 2.20.1

1 24

[PATCH v2 openEuler-22.09 00/24] Rust for openEuler
by Xie XiuQi 27 Jul '22

27 Jul '22

From: Zheng Zengkai <zhengzengkai(a)huawei.com> Rust for openEuler Boqun Feng (1): kallsyms: avoid hardcoding the buffer size Gary Guo (2): rust: add `build_error` crate vsprintf: add new `%pA` format specifier Miguel Ojeda (17): kallsyms: support "big" kernel symbols kallsyms: increase maximum kernel symbol length to 512 rust: add C helpers rust: add `compiler_builtins` crate rust: import upstream `alloc` crate rust: adapt `alloc` crate to the kernel rust: add `macros` crate rust: export generated symbols scripts: checkpatch: diagnose uses of `%pA` in the C side scripts: checkpatch: enable language-independent checks for Rust scripts: add `rustdoc_test_{builder,gen}.py` scripts scripts: add `generate_rust_analyzer.py` scripts scripts: decode_stacktrace: demangle Rust symbols docs: add Rust documentation Kbuild: add Rust support samples: add Rust examples MAINTAINERS: Rust Wedson Almeida Filho (3): rust: add `kernel` crate's `sync` module rust: add `kernel` crate drivers: gpio: PrimeCell PL061 in Rust Weilong Chen (1): Adaptation of rust for openEuler .gitignore | 5 + .rustfmt.toml | 12 + Documentation/core-api/printk-formats.rst | 10 + Documentation/doc-guide/kernel-doc.rst | 3 + Documentation/index.rst | 1 + Documentation/kbuild/kbuild.rst | 17 + Documentation/kbuild/makefiles.rst | 50 +- Documentation/process/changes.rst | 41 + Documentation/rust/arch-support.rst | 25 + Documentation/rust/coding-guidelines.rst | 216 ++ Documentation/rust/general-information.rst | 79 + Documentation/rust/index.rst | 22 + Documentation/rust/quick-start.rst | 232 ++ MAINTAINERS | 15 + Makefile | 176 +- arch/Kconfig | 6 + arch/arm/Kconfig | 1 + arch/arm64/Kconfig | 1 + arch/powerpc/Kconfig | 1 + arch/riscv/Kconfig | 1 + arch/riscv/Makefile | 5 + arch/um/Kconfig | 1 + arch/x86/Kconfig | 1 + arch/x86/Makefile | 13 + drivers/gpio/Kconfig | 8 + drivers/gpio/Makefile | 1 + drivers/gpio/gpio_pl061_rust.rs | 370 ++ include/linux/kallsyms.h | 2 +- include/linux/spinlock.h | 25 +- init/Kconfig | 42 + kernel/kallsyms.c | 26 +- kernel/livepatch/core.c | 4 +- lib/Kconfig.debug | 155 + lib/vsprintf.c | 13 + rust/.gitignore | 10 + rust/Makefile | 398 +++ rust/alloc/README.md | 33 + rust/alloc/alloc.rs | 440 +++ rust/alloc/borrow.rs | 498 +++ rust/alloc/boxed.rs | 2026 +++++++++++ rust/alloc/boxed/thin.rs | 217 ++ rust/alloc/collections/mod.rs | 156 + rust/alloc/fmt.rs | 614 ++++ rust/alloc/lib.rs | 239 ++ rust/alloc/macros.rs | 128 + rust/alloc/raw_vec.rs | 567 +++ rust/alloc/slice.rs | 1295 +++++++ rust/alloc/str.rs | 641 ++++ rust/alloc/string.rs | 2944 +++++++++++++++ rust/alloc/vec/drain.rs | 186 + rust/alloc/vec/drain_filter.rs | 145 + rust/alloc/vec/into_iter.rs | 356 ++ rust/alloc/vec/is_zero.rs | 106 + rust/alloc/vec/mod.rs | 3362 ++++++++++++++++++ rust/alloc/vec/partial_eq.rs | 49 + rust/alloc/vec/set_len_on_drop.rs | 30 + rust/alloc/vec/spec_extend.rs | 174 + rust/bindgen_parameters | 17 + rust/build_error.rs | 29 + rust/compiler_builtins.rs | 79 + rust/exports.c | 20 + rust/helpers.c | 644 ++++ rust/kernel/allocator.rs | 65 + rust/kernel/amba.rs | 258 ++ rust/kernel/bindings.rs | 47 + rust/kernel/bindings_helper.h | 46 + rust/kernel/build_assert.rs | 82 + rust/kernel/c_types.rs | 119 + rust/kernel/chrdev.rs | 207 ++ rust/kernel/clk.rs | 79 + rust/kernel/cred.rs | 46 + rust/kernel/device.rs | 546 +++ rust/kernel/driver.rs | 442 +++ rust/kernel/error.rs | 565 +++ rust/kernel/file.rs | 864 +++++ rust/kernel/gpio.rs | 478 +++ rust/kernel/hwrng.rs | 242 ++ rust/kernel/io_buffer.rs | 153 + rust/kernel/io_mem.rs | 275 ++ rust/kernel/iov_iter.rs | 81 + rust/kernel/irq.rs | 411 +++ rust/kernel/kasync.rs | 6 + rust/kernel/kasync/net.rs | 322 ++ rust/kernel/kunit.rs | 91 + rust/kernel/lib.rs | 261 ++ rust/kernel/linked_list.rs | 247 ++ rust/kernel/miscdev.rs | 291 ++ rust/kernel/mm.rs | 149 + rust/kernel/module_param.rs | 498 +++ rust/kernel/net.rs | 391 ++ rust/kernel/net/filter.rs | 447 +++ rust/kernel/of.rs | 63 + rust/kernel/pages.rs | 144 + rust/kernel/platform.rs | 223 ++ rust/kernel/power.rs | 118 + rust/kernel/prelude.rs | 36 + rust/kernel/print.rs | 405 +++ rust/kernel/random.rs | 42 + rust/kernel/raw_list.rs | 361 ++ rust/kernel/rbtree.rs | 563 +++ rust/kernel/revocable.rs | 161 + rust/kernel/security.rs | 38 + rust/kernel/static_assert.rs | 38 + rust/kernel/std_vendor.rs | 160 + rust/kernel/str.rs | 597 ++++ rust/kernel/sync.rs | 161 + rust/kernel/sync/arc.rs | 503 +++ rust/kernel/sync/condvar.rs | 138 + rust/kernel/sync/guard.rs | 169 + rust/kernel/sync/locked_by.rs | 111 + rust/kernel/sync/mutex.rs | 153 + rust/kernel/sync/nowait.rs | 188 + rust/kernel/sync/revocable.rs | 250 ++ rust/kernel/sync/rwsem.rs | 197 + rust/kernel/sync/seqlock.rs | 202 ++ rust/kernel/sync/smutex.rs | 295 ++ rust/kernel/sync/spinlock.rs | 360 ++ rust/kernel/sysctl.rs | 199 ++ rust/kernel/task.rs | 175 + rust/kernel/types.rs | 679 ++++ rust/kernel/user_ptr.rs | 175 + rust/macros/helpers.rs | 79 + rust/macros/lib.rs | 94 + rust/macros/module.rs | 631 ++++ samples/Kconfig | 2 + samples/Makefile | 1 + samples/rust/Kconfig | 140 + samples/rust/Makefile | 15 + samples/rust/hostprogs/.gitignore | 3 + samples/rust/hostprogs/Makefile | 5 + samples/rust/hostprogs/a.rs | 7 + samples/rust/hostprogs/b.rs | 5 + samples/rust/hostprogs/single.rs | 12 + samples/rust/rust_chrdev.rs | 50 + samples/rust/rust_minimal.rs | 35 + samples/rust/rust_miscdev.rs | 143 + samples/rust/rust_module_parameters.rs | 69 + samples/rust/rust_netfilter.rs | 54 + samples/rust/rust_platform.rs | 22 + samples/rust/rust_print.rs | 54 + samples/rust/rust_random.rs | 60 + samples/rust/rust_semaphore.rs | 171 + samples/rust/rust_semaphore_c.c | 212 ++ samples/rust/rust_stack_probing.rs | 36 + samples/rust/rust_sync.rs | 93 + scripts/Kconfig.include | 2 +- scripts/Makefile | 3 + scripts/Makefile.build | 60 + scripts/Makefile.host | 34 +- scripts/Makefile.lib | 12 + scripts/cc-version.sh | 72 + scripts/checkpatch.pl | 8 +- scripts/decode_stacktrace.sh | 14 + scripts/generate_rust_analyzer.py | 134 + scripts/generate_rust_target.rs | 227 ++ scripts/is_rust_module.sh | 13 + scripts/kallsyms.c | 47 +- scripts/kconfig/confdata.c | 156 +- scripts/min-tool-version.sh | 43 + scripts/rust-is-available-bindgen-libclang.h | 2 + scripts/rust-is-available.sh | 158 + scripts/rustdoc_test_builder.py | 59 + scripts/rustdoc_test_gen.py | 164 + tools/include/linux/kallsyms.h | 2 +- tools/lib/perf/include/perf/event.h | 2 +- tools/lib/symbol/kallsyms.h | 2 +- 166 files changed, 34760 insertions(+), 43 deletions(-) create mode 100644 .rustfmt.toml create mode 100644 Documentation/rust/arch-support.rst create mode 100644 Documentation/rust/coding-guidelines.rst create mode 100644 Documentation/rust/general-information.rst create mode 100644 Documentation/rust/index.rst create mode 100644 Documentation/rust/quick-start.rst create mode 100644 drivers/gpio/gpio_pl061_rust.rs create mode 100644 rust/.gitignore create mode 100644 rust/Makefile create mode 100644 rust/alloc/README.md create mode 100644 rust/alloc/alloc.rs create mode 100644 rust/alloc/borrow.rs create mode 100644 rust/alloc/boxed.rs create mode 100644 rust/alloc/boxed/thin.rs create mode 100644 rust/alloc/collections/mod.rs create mode 100644 rust/alloc/fmt.rs create mode 100644 rust/alloc/lib.rs create mode 100644 rust/alloc/macros.rs create mode 100644 rust/alloc/raw_vec.rs create mode 100644 rust/alloc/slice.rs create mode 100644 rust/alloc/str.rs create mode 100644 rust/alloc/string.rs create mode 100644 rust/alloc/vec/drain.rs create mode 100644 rust/alloc/vec/drain_filter.rs create mode 100644 rust/alloc/vec/into_iter.rs create mode 100644 rust/alloc/vec/is_zero.rs create mode 100644 rust/alloc/vec/mod.rs create mode 100644 rust/alloc/vec/partial_eq.rs create mode 100644 rust/alloc/vec/set_len_on_drop.rs create mode 100644 rust/alloc/vec/spec_extend.rs create mode 100644 rust/bindgen_parameters create mode 100644 rust/build_error.rs create mode 100644 rust/compiler_builtins.rs create mode 100644 rust/exports.c create mode 100644 rust/helpers.c create mode 100644 rust/kernel/allocator.rs create mode 100644 rust/kernel/amba.rs create mode 100644 rust/kernel/bindings.rs create mode 100644 rust/kernel/bindings_helper.h create mode 100644 rust/kernel/build_assert.rs create mode 100644 rust/kernel/c_types.rs create mode 100644 rust/kernel/chrdev.rs create mode 100644 rust/kernel/clk.rs create mode 100644 rust/kernel/cred.rs create mode 100644 rust/kernel/device.rs create mode 100644 rust/kernel/driver.rs create mode 100644 rust/kernel/error.rs create mode 100644 rust/kernel/file.rs create mode 100644 rust/kernel/gpio.rs create mode 100644 rust/kernel/hwrng.rs create mode 100644 rust/kernel/io_buffer.rs create mode 100644 rust/kernel/io_mem.rs create mode 100644 rust/kernel/iov_iter.rs create mode 100644 rust/kernel/irq.rs create mode 100644 rust/kernel/kasync.rs create mode 100644 rust/kernel/kasync/net.rs create mode 100644 rust/kernel/kunit.rs create mode 100644 rust/kernel/lib.rs create mode 100644 rust/kernel/linked_list.rs create mode 100644 rust/kernel/miscdev.rs create mode 100644 rust/kernel/mm.rs create mode 100644 rust/kernel/module_param.rs create mode 100644 rust/kernel/net.rs create mode 100644 rust/kernel/net/filter.rs create mode 100644 rust/kernel/of.rs create mode 100644 rust/kernel/pages.rs create mode 100644 rust/kernel/platform.rs create mode 100644 rust/kernel/power.rs create mode 100644 rust/kernel/prelude.rs create mode 100644 rust/kernel/print.rs create mode 100644 rust/kernel/random.rs create mode 100644 rust/kernel/raw_list.rs create mode 100644 rust/kernel/rbtree.rs create mode 100644 rust/kernel/revocable.rs create mode 100644 rust/kernel/security.rs create mode 100644 rust/kernel/static_assert.rs create mode 100644 rust/kernel/std_vendor.rs create mode 100644 rust/kernel/str.rs create mode 100644 rust/kernel/sync.rs create mode 100644 rust/kernel/sync/arc.rs create mode 100644 rust/kernel/sync/condvar.rs create mode 100644 rust/kernel/sync/guard.rs create mode 100644 rust/kernel/sync/locked_by.rs create mode 100644 rust/kernel/sync/mutex.rs create mode 100644 rust/kernel/sync/nowait.rs create mode 100644 rust/kernel/sync/revocable.rs create mode 100644 rust/kernel/sync/rwsem.rs create mode 100644 rust/kernel/sync/seqlock.rs create mode 100644 rust/kernel/sync/smutex.rs create mode 100644 rust/kernel/sync/spinlock.rs create mode 100644 rust/kernel/sysctl.rs create mode 100644 rust/kernel/task.rs create mode 100644 rust/kernel/types.rs create mode 100644 rust/kernel/user_ptr.rs create mode 100644 rust/macros/helpers.rs create mode 100644 rust/macros/lib.rs create mode 100644 rust/macros/module.rs create mode 100644 samples/rust/Kconfig create mode 100644 samples/rust/Makefile create mode 100644 samples/rust/hostprogs/.gitignore create mode 100644 samples/rust/hostprogs/Makefile create mode 100644 samples/rust/hostprogs/a.rs create mode 100644 samples/rust/hostprogs/b.rs create mode 100644 samples/rust/hostprogs/single.rs create mode 100644 samples/rust/rust_chrdev.rs create mode 100644 samples/rust/rust_minimal.rs create mode 100644 samples/rust/rust_miscdev.rs create mode 100644 samples/rust/rust_module_parameters.rs create mode 100644 samples/rust/rust_netfilter.rs create mode 100644 samples/rust/rust_platform.rs create mode 100644 samples/rust/rust_print.rs create mode 100644 samples/rust/rust_random.rs create mode 100644 samples/rust/rust_semaphore.rs create mode 100644 samples/rust/rust_semaphore_c.c create mode 100644 samples/rust/rust_stack_probing.rs create mode 100644 samples/rust/rust_sync.rs create mode 100755 scripts/cc-version.sh create mode 100755 scripts/generate_rust_analyzer.py create mode 100644 scripts/generate_rust_target.rs create mode 100755 scripts/is_rust_module.sh create mode 100755 scripts/min-tool-version.sh create mode 100644 scripts/rust-is-available-bindgen-libclang.h create mode 100755 scripts/rust-is-available.sh create mode 100755 scripts/rustdoc_test_builder.py create mode 100755 scripts/rustdoc_test_gen.py -- 2.20.1

1 24

[PATCH openEuler-22.09 00/24] Rust for openEuler
by Xie XiuQi 27 Jul '22

27 Jul '22

From: Zheng Zengkai <zhengzengkai(a)huawei.com> Rust for openEuler Boqun Feng (1): kallsyms: avoid hardcoding the buffer size Gary Guo (2): rust: add `build_error` crate vsprintf: add new `%pA` format specifier Miguel Ojeda (17): kallsyms: support "big" kernel symbols kallsyms: increase maximum kernel symbol length to 512 rust: add C helpers rust: add `compiler_builtins` crate rust: import upstream `alloc` crate rust: adapt `alloc` crate to the kernel rust: add `macros` crate rust: export generated symbols scripts: checkpatch: diagnose uses of `%pA` in the C side scripts: checkpatch: enable language-independent checks for Rust scripts: add `rustdoc_test_{builder,gen}.py` scripts scripts: add `generate_rust_analyzer.py` scripts scripts: decode_stacktrace: demangle Rust symbols docs: add Rust documentation Kbuild: add Rust support samples: add Rust examples MAINTAINERS: Rust Wedson Almeida Filho (3): rust: add `kernel` crate's `sync` module rust: add `kernel` crate drivers: gpio: PrimeCell PL061 in Rust Weilong Chen (1): Adaptation of rust for openEuler .gitignore | 5 + .rustfmt.toml | 12 + Documentation/core-api/printk-formats.rst | 10 + Documentation/doc-guide/kernel-doc.rst | 3 + Documentation/index.rst | 1 + Documentation/kbuild/kbuild.rst | 17 + Documentation/kbuild/makefiles.rst | 50 +- Documentation/process/changes.rst | 41 + Documentation/rust/arch-support.rst | 25 + Documentation/rust/coding-guidelines.rst | 216 ++ Documentation/rust/general-information.rst | 79 + Documentation/rust/index.rst | 22 + Documentation/rust/quick-start.rst | 232 ++ MAINTAINERS | 15 + Makefile | 176 +- arch/Kconfig | 6 + arch/arm/Kconfig | 1 + arch/arm64/Kconfig | 1 + arch/powerpc/Kconfig | 1 + arch/riscv/Kconfig | 1 + arch/riscv/Makefile | 5 + arch/um/Kconfig | 1 + arch/x86/Kconfig | 1 + arch/x86/Makefile | 13 + drivers/gpio/Kconfig | 8 + drivers/gpio/Makefile | 1 + drivers/gpio/gpio_pl061_rust.rs | 370 ++ include/linux/kallsyms.h | 2 +- include/linux/spinlock.h | 25 +- init/Kconfig | 42 + kernel/kallsyms.c | 26 +- kernel/livepatch/core.c | 4 +- lib/Kconfig.debug | 155 + lib/vsprintf.c | 13 + rust/.gitignore | 10 + rust/Makefile | 398 +++ rust/alloc/README.md | 33 + rust/alloc/alloc.rs | 440 +++ rust/alloc/borrow.rs | 498 +++ rust/alloc/boxed.rs | 2026 +++++++++++ rust/alloc/boxed/thin.rs | 217 ++ rust/alloc/collections/mod.rs | 156 + rust/alloc/fmt.rs | 614 ++++ rust/alloc/lib.rs | 239 ++ rust/alloc/macros.rs | 128 + rust/alloc/raw_vec.rs | 567 +++ rust/alloc/slice.rs | 1295 +++++++ rust/alloc/str.rs | 641 ++++ rust/alloc/string.rs | 2944 +++++++++++++++ rust/alloc/vec/drain.rs | 186 + rust/alloc/vec/drain_filter.rs | 145 + rust/alloc/vec/into_iter.rs | 356 ++ rust/alloc/vec/is_zero.rs | 106 + rust/alloc/vec/mod.rs | 3362 ++++++++++++++++++ rust/alloc/vec/partial_eq.rs | 49 + rust/alloc/vec/set_len_on_drop.rs | 30 + rust/alloc/vec/spec_extend.rs | 174 + rust/bindgen_parameters | 17 + rust/build_error.rs | 29 + rust/compiler_builtins.rs | 79 + rust/exports.c | 20 + rust/helpers.c | 644 ++++ rust/kernel/allocator.rs | 65 + rust/kernel/amba.rs | 258 ++ rust/kernel/bindings.rs | 47 + rust/kernel/bindings_helper.h | 46 + rust/kernel/build_assert.rs | 82 + rust/kernel/c_types.rs | 119 + rust/kernel/chrdev.rs | 207 ++ rust/kernel/clk.rs | 79 + rust/kernel/cred.rs | 46 + rust/kernel/device.rs | 546 +++ rust/kernel/driver.rs | 442 +++ rust/kernel/error.rs | 565 +++ rust/kernel/file.rs | 864 +++++ rust/kernel/gpio.rs | 478 +++ rust/kernel/hwrng.rs | 242 ++ rust/kernel/io_buffer.rs | 153 + rust/kernel/io_mem.rs | 275 ++ rust/kernel/iov_iter.rs | 81 + rust/kernel/irq.rs | 411 +++ rust/kernel/kasync.rs | 6 + rust/kernel/kasync/net.rs | 322 ++ rust/kernel/kunit.rs | 91 + rust/kernel/lib.rs | 261 ++ rust/kernel/linked_list.rs | 247 ++ rust/kernel/miscdev.rs | 291 ++ rust/kernel/mm.rs | 149 + rust/kernel/module_param.rs | 498 +++ rust/kernel/net.rs | 391 ++ rust/kernel/net/filter.rs | 447 +++ rust/kernel/of.rs | 63 + rust/kernel/pages.rs | 144 + rust/kernel/platform.rs | 223 ++ rust/kernel/power.rs | 118 + rust/kernel/prelude.rs | 36 + rust/kernel/print.rs | 405 +++ rust/kernel/random.rs | 42 + rust/kernel/raw_list.rs | 361 ++ rust/kernel/rbtree.rs | 563 +++ rust/kernel/revocable.rs | 161 + rust/kernel/security.rs | 38 + rust/kernel/static_assert.rs | 38 + rust/kernel/std_vendor.rs | 160 + rust/kernel/str.rs | 597 ++++ rust/kernel/sync.rs | 161 + rust/kernel/sync/arc.rs | 503 +++ rust/kernel/sync/condvar.rs | 138 + rust/kernel/sync/guard.rs | 169 + rust/kernel/sync/locked_by.rs | 111 + rust/kernel/sync/mutex.rs | 153 + rust/kernel/sync/nowait.rs | 188 + rust/kernel/sync/revocable.rs | 250 ++ rust/kernel/sync/rwsem.rs | 197 + rust/kernel/sync/seqlock.rs | 202 ++ rust/kernel/sync/smutex.rs | 295 ++ rust/kernel/sync/spinlock.rs | 360 ++ rust/kernel/sysctl.rs | 199 ++ rust/kernel/task.rs | 175 + rust/kernel/types.rs | 679 ++++ rust/kernel/user_ptr.rs | 175 + rust/macros/helpers.rs | 79 + rust/macros/lib.rs | 94 + rust/macros/module.rs | 631 ++++ samples/Kconfig | 2 + samples/Makefile | 1 + samples/rust/Kconfig | 140 + samples/rust/Makefile | 15 + samples/rust/hostprogs/.gitignore | 3 + samples/rust/hostprogs/Makefile | 5 + samples/rust/hostprogs/a.rs | 7 + samples/rust/hostprogs/b.rs | 5 + samples/rust/hostprogs/single.rs | 12 + samples/rust/rust_chrdev.rs | 50 + samples/rust/rust_minimal.rs | 35 + samples/rust/rust_miscdev.rs | 143 + samples/rust/rust_module_parameters.rs | 69 + samples/rust/rust_netfilter.rs | 54 + samples/rust/rust_platform.rs | 22 + samples/rust/rust_print.rs | 54 + samples/rust/rust_random.rs | 60 + samples/rust/rust_semaphore.rs | 171 + samples/rust/rust_semaphore_c.c | 212 ++ samples/rust/rust_stack_probing.rs | 36 + samples/rust/rust_sync.rs | 93 + scripts/Kconfig.include | 2 +- scripts/Makefile | 3 + scripts/Makefile.build | 60 + scripts/Makefile.host | 34 +- scripts/Makefile.lib | 12 + scripts/cc-version.sh | 72 + scripts/checkpatch.pl | 8 +- scripts/decode_stacktrace.sh | 14 + scripts/generate_rust_analyzer.py | 134 + scripts/generate_rust_target.rs | 227 ++ scripts/is_rust_module.sh | 13 + scripts/kallsyms.c | 47 +- scripts/kconfig/confdata.c | 156 +- scripts/min-tool-version.sh | 43 + scripts/rust-is-available-bindgen-libclang.h | 2 + scripts/rust-is-available.sh | 158 + scripts/rustdoc_test_builder.py | 59 + scripts/rustdoc_test_gen.py | 164 + tools/include/linux/kallsyms.h | 2 +- tools/lib/perf/include/perf/event.h | 2 +- tools/lib/symbol/kallsyms.h | 2 +- 166 files changed, 34760 insertions(+), 43 deletions(-) create mode 100644 .rustfmt.toml create mode 100644 Documentation/rust/arch-support.rst create mode 100644 Documentation/rust/coding-guidelines.rst create mode 100644 Documentation/rust/general-information.rst create mode 100644 Documentation/rust/index.rst create mode 100644 Documentation/rust/quick-start.rst create mode 100644 drivers/gpio/gpio_pl061_rust.rs create mode 100644 rust/.gitignore create mode 100644 rust/Makefile create mode 100644 rust/alloc/README.md create mode 100644 rust/alloc/alloc.rs create mode 100644 rust/alloc/borrow.rs create mode 100644 rust/alloc/boxed.rs create mode 100644 rust/alloc/boxed/thin.rs create mode 100644 rust/alloc/collections/mod.rs create mode 100644 rust/alloc/fmt.rs create mode 100644 rust/alloc/lib.rs create mode 100644 rust/alloc/macros.rs create mode 100644 rust/alloc/raw_vec.rs create mode 100644 rust/alloc/slice.rs create mode 100644 rust/alloc/str.rs create mode 100644 rust/alloc/string.rs create mode 100644 rust/alloc/vec/drain.rs create mode 100644 rust/alloc/vec/drain_filter.rs create mode 100644 rust/alloc/vec/into_iter.rs create mode 100644 rust/alloc/vec/is_zero.rs create mode 100644 rust/alloc/vec/mod.rs create mode 100644 rust/alloc/vec/partial_eq.rs create mode 100644 rust/alloc/vec/set_len_on_drop.rs create mode 100644 rust/alloc/vec/spec_extend.rs create mode 100644 rust/bindgen_parameters create mode 100644 rust/build_error.rs create mode 100644 rust/compiler_builtins.rs create mode 100644 rust/exports.c create mode 100644 rust/helpers.c create mode 100644 rust/kernel/allocator.rs create mode 100644 rust/kernel/amba.rs create mode 100644 rust/kernel/bindings.rs create mode 100644 rust/kernel/bindings_helper.h create mode 100644 rust/kernel/build_assert.rs create mode 100644 rust/kernel/c_types.rs create mode 100644 rust/kernel/chrdev.rs create mode 100644 rust/kernel/clk.rs create mode 100644 rust/kernel/cred.rs create mode 100644 rust/kernel/device.rs create mode 100644 rust/kernel/driver.rs create mode 100644 rust/kernel/error.rs create mode 100644 rust/kernel/file.rs create mode 100644 rust/kernel/gpio.rs create mode 100644 rust/kernel/hwrng.rs create mode 100644 rust/kernel/io_buffer.rs create mode 100644 rust/kernel/io_mem.rs create mode 100644 rust/kernel/iov_iter.rs create mode 100644 rust/kernel/irq.rs create mode 100644 rust/kernel/kasync.rs create mode 100644 rust/kernel/kasync/net.rs create mode 100644 rust/kernel/kunit.rs create mode 100644 rust/kernel/lib.rs create mode 100644 rust/kernel/linked_list.rs create mode 100644 rust/kernel/miscdev.rs create mode 100644 rust/kernel/mm.rs create mode 100644 rust/kernel/module_param.rs create mode 100644 rust/kernel/net.rs create mode 100644 rust/kernel/net/filter.rs create mode 100644 rust/kernel/of.rs create mode 100644 rust/kernel/pages.rs create mode 100644 rust/kernel/platform.rs create mode 100644 rust/kernel/power.rs create mode 100644 rust/kernel/prelude.rs create mode 100644 rust/kernel/print.rs create mode 100644 rust/kernel/random.rs create mode 100644 rust/kernel/raw_list.rs create mode 100644 rust/kernel/rbtree.rs create mode 100644 rust/kernel/revocable.rs create mode 100644 rust/kernel/security.rs create mode 100644 rust/kernel/static_assert.rs create mode 100644 rust/kernel/std_vendor.rs create mode 100644 rust/kernel/str.rs create mode 100644 rust/kernel/sync.rs create mode 100644 rust/kernel/sync/arc.rs create mode 100644 rust/kernel/sync/condvar.rs create mode 100644 rust/kernel/sync/guard.rs create mode 100644 rust/kernel/sync/locked_by.rs create mode 100644 rust/kernel/sync/mutex.rs create mode 100644 rust/kernel/sync/nowait.rs create mode 100644 rust/kernel/sync/revocable.rs create mode 100644 rust/kernel/sync/rwsem.rs create mode 100644 rust/kernel/sync/seqlock.rs create mode 100644 rust/kernel/sync/smutex.rs create mode 100644 rust/kernel/sync/spinlock.rs create mode 100644 rust/kernel/sysctl.rs create mode 100644 rust/kernel/task.rs create mode 100644 rust/kernel/types.rs create mode 100644 rust/kernel/user_ptr.rs create mode 100644 rust/macros/helpers.rs create mode 100644 rust/macros/lib.rs create mode 100644 rust/macros/module.rs create mode 100644 samples/rust/Kconfig create mode 100644 samples/rust/Makefile create mode 100644 samples/rust/hostprogs/.gitignore create mode 100644 samples/rust/hostprogs/Makefile create mode 100644 samples/rust/hostprogs/a.rs create mode 100644 samples/rust/hostprogs/b.rs create mode 100644 samples/rust/hostprogs/single.rs create mode 100644 samples/rust/rust_chrdev.rs create mode 100644 samples/rust/rust_minimal.rs create mode 100644 samples/rust/rust_miscdev.rs create mode 100644 samples/rust/rust_module_parameters.rs create mode 100644 samples/rust/rust_netfilter.rs create mode 100644 samples/rust/rust_platform.rs create mode 100644 samples/rust/rust_print.rs create mode 100644 samples/rust/rust_random.rs create mode 100644 samples/rust/rust_semaphore.rs create mode 100644 samples/rust/rust_semaphore_c.c create mode 100644 samples/rust/rust_stack_probing.rs create mode 100644 samples/rust/rust_sync.rs create mode 100755 scripts/cc-version.sh create mode 100755 scripts/generate_rust_analyzer.py create mode 100644 scripts/generate_rust_target.rs create mode 100755 scripts/is_rust_module.sh create mode 100755 scripts/min-tool-version.sh create mode 100644 scripts/rust-is-available-bindgen-libclang.h create mode 100755 scripts/rust-is-available.sh create mode 100755 scripts/rustdoc_test_builder.py create mode 100755 scripts/rustdoc_test_gen.py -- 2.20.1

1 24

[PATCH openEuler-1.0-LTS 1/5] mbcache: Don't reclaim used entries
by Yongqiang Liu 27 Jul '22

27 Jul '22

From: Jan Kara <jack(a)suse.cz> hulk inclusion category: bugfix bugzilla: 186975, https://gitee.com/openeuler/kernel/issues/I5HT6F CVE: NA Reference: https://patchwork.ozlabs.org/project/linux-ext4/list/?series=309169 -------------------------------- Do not reclaim entries that are currently used by somebody from a shrinker. Firstly, these entries are likely useful. Secondly, we will need to keep such entries to protect pending increment of xattr block refcount. CC: stable(a)vger.kernel.org Fixes: 82939d7999df ("ext4: convert to mbcache2") Signed-off-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/mbcache.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/fs/mbcache.c b/fs/mbcache.c index 081ccf0caee3..12203e5a91e7 100644 --- a/fs/mbcache.c +++ b/fs/mbcache.c @@ -287,7 +287,7 @@ static unsigned long mb_cache_shrink(struct mb_cache *cache, while (nr_to_scan-- && !list_empty(&cache->c_list)) { entry = list_first_entry(&cache->c_list, struct mb_cache_entry, e_list); - if (entry->e_referenced) { + if (entry->e_referenced || atomic_read(&entry->e_refcnt) > 2) { entry->e_referenced = 0; list_move_tail(&entry->e_list, &cache->c_list); continue; @@ -301,6 +301,14 @@ static unsigned long mb_cache_shrink(struct mb_cache *cache, spin_unlock(&cache->c_list_lock); head = mb_cache_entry_head(cache, entry->e_key); hlist_bl_lock(head); + /* Now a reliable check if the entry didn't get used... */ + if (atomic_read(&entry->e_refcnt) > 2) { + hlist_bl_unlock(head); + spin_lock(&cache->c_list_lock); + list_add_tail(&entry->e_list, &cache->c_list); + cache->c_entry_count++; + continue; + } if (!hlist_bl_unhashed(&entry->e_hash_list)) { hlist_bl_del_init(&entry->e_hash_list); atomic_dec(&entry->e_refcnt); -- 2.25.1

1 4

[PATCH openEuler-22.09 00/24] Rust for openEuler
by Yongqiang Liu 27 Jul '22

27 Jul '22

From: Zheng Zengkai <zhengzengkai(a)huawei.com> Rust for openEuler Boqun Feng (1): kallsyms: avoid hardcoding the buffer size Gary Guo (2): rust: add `build_error` crate vsprintf: add new `%pA` format specifier Miguel Ojeda (17): kallsyms: support "big" kernel symbols kallsyms: increase maximum kernel symbol length to 512 rust: add C helpers rust: add `compiler_builtins` crate rust: import upstream `alloc` crate rust: adapt `alloc` crate to the kernel rust: add `macros` crate rust: export generated symbols scripts: checkpatch: diagnose uses of `%pA` in the C side scripts: checkpatch: enable language-independent checks for Rust scripts: add `rustdoc_test_{builder,gen}.py` scripts scripts: add `generate_rust_analyzer.py` scripts scripts: decode_stacktrace: demangle Rust symbols docs: add Rust documentation Kbuild: add Rust support samples: add Rust examples MAINTAINERS: Rust Wedson Almeida Filho (3): rust: add `kernel` crate's `sync` module rust: add `kernel` crate drivers: gpio: PrimeCell PL061 in Rust Weilong Chen (1): Adaptation of rust for openEuler .gitignore | 5 + .rustfmt.toml | 12 + Documentation/core-api/printk-formats.rst | 10 + Documentation/doc-guide/kernel-doc.rst | 3 + Documentation/index.rst | 1 + Documentation/kbuild/kbuild.rst | 17 + Documentation/kbuild/makefiles.rst | 50 +- Documentation/process/changes.rst | 41 + Documentation/rust/arch-support.rst | 25 + Documentation/rust/coding-guidelines.rst | 216 ++ Documentation/rust/general-information.rst | 79 + Documentation/rust/index.rst | 22 + Documentation/rust/quick-start.rst | 232 ++ MAINTAINERS | 15 + Makefile | 176 +- arch/Kconfig | 6 + arch/arm/Kconfig | 1 + arch/arm64/Kconfig | 1 + arch/powerpc/Kconfig | 1 + arch/riscv/Kconfig | 1 + arch/riscv/Makefile | 5 + arch/um/Kconfig | 1 + arch/x86/Kconfig | 1 + arch/x86/Makefile | 13 + drivers/gpio/Kconfig | 8 + drivers/gpio/Makefile | 1 + drivers/gpio/gpio_pl061_rust.rs | 370 ++ include/linux/kallsyms.h | 2 +- include/linux/spinlock.h | 25 +- init/Kconfig | 42 + kernel/kallsyms.c | 26 +- kernel/livepatch/core.c | 4 +- lib/Kconfig.debug | 155 + lib/vsprintf.c | 13 + rust/.gitignore | 10 + rust/Makefile | 398 +++ rust/alloc/README.md | 33 + rust/alloc/alloc.rs | 440 +++ rust/alloc/borrow.rs | 498 +++ rust/alloc/boxed.rs | 2026 +++++++++++ rust/alloc/boxed/thin.rs | 217 ++ rust/alloc/collections/mod.rs | 156 + rust/alloc/fmt.rs | 614 ++++ rust/alloc/lib.rs | 239 ++ rust/alloc/macros.rs | 128 + rust/alloc/raw_vec.rs | 567 +++ rust/alloc/slice.rs | 1295 +++++++ rust/alloc/str.rs | 641 ++++ rust/alloc/string.rs | 2944 +++++++++++++++ rust/alloc/vec/drain.rs | 186 + rust/alloc/vec/drain_filter.rs | 145 + rust/alloc/vec/into_iter.rs | 356 ++ rust/alloc/vec/is_zero.rs | 106 + rust/alloc/vec/mod.rs | 3362 ++++++++++++++++++ rust/alloc/vec/partial_eq.rs | 49 + rust/alloc/vec/set_len_on_drop.rs | 30 + rust/alloc/vec/spec_extend.rs | 174 + rust/bindgen_parameters | 17 + rust/build_error.rs | 29 + rust/compiler_builtins.rs | 79 + rust/exports.c | 20 + rust/helpers.c | 644 ++++ rust/kernel/allocator.rs | 65 + rust/kernel/amba.rs | 258 ++ rust/kernel/bindings.rs | 47 + rust/kernel/bindings_helper.h | 46 + rust/kernel/build_assert.rs | 82 + rust/kernel/c_types.rs | 119 + rust/kernel/chrdev.rs | 207 ++ rust/kernel/clk.rs | 79 + rust/kernel/cred.rs | 46 + rust/kernel/device.rs | 546 +++ rust/kernel/driver.rs | 442 +++ rust/kernel/error.rs | 565 +++ rust/kernel/file.rs | 864 +++++ rust/kernel/gpio.rs | 478 +++ rust/kernel/hwrng.rs | 242 ++ rust/kernel/io_buffer.rs | 153 + rust/kernel/io_mem.rs | 275 ++ rust/kernel/iov_iter.rs | 81 + rust/kernel/irq.rs | 411 +++ rust/kernel/kasync.rs | 6 + rust/kernel/kasync/net.rs | 322 ++ rust/kernel/kunit.rs | 91 + rust/kernel/lib.rs | 261 ++ rust/kernel/linked_list.rs | 247 ++ rust/kernel/miscdev.rs | 291 ++ rust/kernel/mm.rs | 149 + rust/kernel/module_param.rs | 498 +++ rust/kernel/net.rs | 391 ++ rust/kernel/net/filter.rs | 447 +++ rust/kernel/of.rs | 63 + rust/kernel/pages.rs | 144 + rust/kernel/platform.rs | 223 ++ rust/kernel/power.rs | 118 + rust/kernel/prelude.rs | 36 + rust/kernel/print.rs | 405 +++ rust/kernel/random.rs | 42 + rust/kernel/raw_list.rs | 361 ++ rust/kernel/rbtree.rs | 563 +++ rust/kernel/revocable.rs | 161 + rust/kernel/security.rs | 38 + rust/kernel/static_assert.rs | 38 + rust/kernel/std_vendor.rs | 160 + rust/kernel/str.rs | 597 ++++ rust/kernel/sync.rs | 161 + rust/kernel/sync/arc.rs | 503 +++ rust/kernel/sync/condvar.rs | 138 + rust/kernel/sync/guard.rs | 169 + rust/kernel/sync/locked_by.rs | 111 + rust/kernel/sync/mutex.rs | 153 + rust/kernel/sync/nowait.rs | 188 + rust/kernel/sync/revocable.rs | 250 ++ rust/kernel/sync/rwsem.rs | 197 + rust/kernel/sync/seqlock.rs | 202 ++ rust/kernel/sync/smutex.rs | 295 ++ rust/kernel/sync/spinlock.rs | 360 ++ rust/kernel/sysctl.rs | 199 ++ rust/kernel/task.rs | 175 + rust/kernel/types.rs | 679 ++++ rust/kernel/user_ptr.rs | 175 + rust/macros/helpers.rs | 79 + rust/macros/lib.rs | 94 + rust/macros/module.rs | 631 ++++ samples/Kconfig | 2 + samples/Makefile | 1 + samples/rust/Kconfig | 140 + samples/rust/Makefile | 15 + samples/rust/hostprogs/.gitignore | 3 + samples/rust/hostprogs/Makefile | 5 + samples/rust/hostprogs/a.rs | 7 + samples/rust/hostprogs/b.rs | 5 + samples/rust/hostprogs/single.rs | 12 + samples/rust/rust_chrdev.rs | 50 + samples/rust/rust_minimal.rs | 35 + samples/rust/rust_miscdev.rs | 143 + samples/rust/rust_module_parameters.rs | 69 + samples/rust/rust_netfilter.rs | 54 + samples/rust/rust_platform.rs | 22 + samples/rust/rust_print.rs | 54 + samples/rust/rust_random.rs | 60 + samples/rust/rust_semaphore.rs | 171 + samples/rust/rust_semaphore_c.c | 212 ++ samples/rust/rust_stack_probing.rs | 36 + samples/rust/rust_sync.rs | 93 + scripts/Kconfig.include | 2 +- scripts/Makefile | 3 + scripts/Makefile.build | 60 + scripts/Makefile.host | 34 +- scripts/Makefile.lib | 12 + scripts/cc-version.sh | 72 + scripts/checkpatch.pl | 8 +- scripts/decode_stacktrace.sh | 14 + scripts/generate_rust_analyzer.py | 134 + scripts/generate_rust_target.rs | 227 ++ scripts/is_rust_module.sh | 13 + scripts/kallsyms.c | 47 +- scripts/kconfig/confdata.c | 156 +- scripts/min-tool-version.sh | 43 + scripts/rust-is-available-bindgen-libclang.h | 2 + scripts/rust-is-available.sh | 158 + scripts/rustdoc_test_builder.py | 59 + scripts/rustdoc_test_gen.py | 164 + tools/include/linux/kallsyms.h | 2 +- tools/lib/perf/include/perf/event.h | 2 +- tools/lib/symbol/kallsyms.h | 2 +- 166 files changed, 34760 insertions(+), 43 deletions(-) create mode 100644 .rustfmt.toml create mode 100644 Documentation/rust/arch-support.rst create mode 100644 Documentation/rust/coding-guidelines.rst create mode 100644 Documentation/rust/general-information.rst create mode 100644 Documentation/rust/index.rst create mode 100644 Documentation/rust/quick-start.rst create mode 100644 drivers/gpio/gpio_pl061_rust.rs create mode 100644 rust/.gitignore create mode 100644 rust/Makefile create mode 100644 rust/alloc/README.md create mode 100644 rust/alloc/alloc.rs create mode 100644 rust/alloc/borrow.rs create mode 100644 rust/alloc/boxed.rs create mode 100644 rust/alloc/boxed/thin.rs create mode 100644 rust/alloc/collections/mod.rs create mode 100644 rust/alloc/fmt.rs create mode 100644 rust/alloc/lib.rs create mode 100644 rust/alloc/macros.rs create mode 100644 rust/alloc/raw_vec.rs create mode 100644 rust/alloc/slice.rs create mode 100644 rust/alloc/str.rs create mode 100644 rust/alloc/string.rs create mode 100644 rust/alloc/vec/drain.rs create mode 100644 rust/alloc/vec/drain_filter.rs create mode 100644 rust/alloc/vec/into_iter.rs create mode 100644 rust/alloc/vec/is_zero.rs create mode 100644 rust/alloc/vec/mod.rs create mode 100644 rust/alloc/vec/partial_eq.rs create mode 100644 rust/alloc/vec/set_len_on_drop.rs create mode 100644 rust/alloc/vec/spec_extend.rs create mode 100644 rust/bindgen_parameters create mode 100644 rust/build_error.rs create mode 100644 rust/compiler_builtins.rs create mode 100644 rust/exports.c create mode 100644 rust/helpers.c create mode 100644 rust/kernel/allocator.rs create mode 100644 rust/kernel/amba.rs create mode 100644 rust/kernel/bindings.rs create mode 100644 rust/kernel/bindings_helper.h create mode 100644 rust/kernel/build_assert.rs create mode 100644 rust/kernel/c_types.rs create mode 100644 rust/kernel/chrdev.rs create mode 100644 rust/kernel/clk.rs create mode 100644 rust/kernel/cred.rs create mode 100644 rust/kernel/device.rs create mode 100644 rust/kernel/driver.rs create mode 100644 rust/kernel/error.rs create mode 100644 rust/kernel/file.rs create mode 100644 rust/kernel/gpio.rs create mode 100644 rust/kernel/hwrng.rs create mode 100644 rust/kernel/io_buffer.rs create mode 100644 rust/kernel/io_mem.rs create mode 100644 rust/kernel/iov_iter.rs create mode 100644 rust/kernel/irq.rs create mode 100644 rust/kernel/kasync.rs create mode 100644 rust/kernel/kasync/net.rs create mode 100644 rust/kernel/kunit.rs create mode 100644 rust/kernel/lib.rs create mode 100644 rust/kernel/linked_list.rs create mode 100644 rust/kernel/miscdev.rs create mode 100644 rust/kernel/mm.rs create mode 100644 rust/kernel/module_param.rs create mode 100644 rust/kernel/net.rs create mode 100644 rust/kernel/net/filter.rs create mode 100644 rust/kernel/of.rs create mode 100644 rust/kernel/pages.rs create mode 100644 rust/kernel/platform.rs create mode 100644 rust/kernel/power.rs create mode 100644 rust/kernel/prelude.rs create mode 100644 rust/kernel/print.rs create mode 100644 rust/kernel/random.rs create mode 100644 rust/kernel/raw_list.rs create mode 100644 rust/kernel/rbtree.rs create mode 100644 rust/kernel/revocable.rs create mode 100644 rust/kernel/security.rs create mode 100644 rust/kernel/static_assert.rs create mode 100644 rust/kernel/std_vendor.rs create mode 100644 rust/kernel/str.rs create mode 100644 rust/kernel/sync.rs create mode 100644 rust/kernel/sync/arc.rs create mode 100644 rust/kernel/sync/condvar.rs create mode 100644 rust/kernel/sync/guard.rs create mode 100644 rust/kernel/sync/locked_by.rs create mode 100644 rust/kernel/sync/mutex.rs create mode 100644 rust/kernel/sync/nowait.rs create mode 100644 rust/kernel/sync/revocable.rs create mode 100644 rust/kernel/sync/rwsem.rs create mode 100644 rust/kernel/sync/seqlock.rs create mode 100644 rust/kernel/sync/smutex.rs create mode 100644 rust/kernel/sync/spinlock.rs create mode 100644 rust/kernel/sysctl.rs create mode 100644 rust/kernel/task.rs create mode 100644 rust/kernel/types.rs create mode 100644 rust/kernel/user_ptr.rs create mode 100644 rust/macros/helpers.rs create mode 100644 rust/macros/lib.rs create mode 100644 rust/macros/module.rs create mode 100644 samples/rust/Kconfig create mode 100644 samples/rust/Makefile create mode 100644 samples/rust/hostprogs/.gitignore create mode 100644 samples/rust/hostprogs/Makefile create mode 100644 samples/rust/hostprogs/a.rs create mode 100644 samples/rust/hostprogs/b.rs create mode 100644 samples/rust/hostprogs/single.rs create mode 100644 samples/rust/rust_chrdev.rs create mode 100644 samples/rust/rust_minimal.rs create mode 100644 samples/rust/rust_miscdev.rs create mode 100644 samples/rust/rust_module_parameters.rs create mode 100644 samples/rust/rust_netfilter.rs create mode 100644 samples/rust/rust_platform.rs create mode 100644 samples/rust/rust_print.rs create mode 100644 samples/rust/rust_random.rs create mode 100644 samples/rust/rust_semaphore.rs create mode 100644 samples/rust/rust_semaphore_c.c create mode 100644 samples/rust/rust_stack_probing.rs create mode 100644 samples/rust/rust_sync.rs create mode 100755 scripts/cc-version.sh create mode 100755 scripts/generate_rust_analyzer.py create mode 100644 scripts/generate_rust_target.rs create mode 100755 scripts/is_rust_module.sh create mode 100755 scripts/min-tool-version.sh create mode 100644 scripts/rust-is-available-bindgen-libclang.h create mode 100755 scripts/rust-is-available.sh create mode 100755 scripts/rustdoc_test_builder.py create mode 100755 scripts/rustdoc_test_gen.py -- 2.20.1

1 24

[PATCH openEuler-22.09 v3 0/8] bpf: sched: Introduce Scheduler BPF
by Yongqiang Liu 27 Jul '22

27 Jul '22

From: Zheng Zengkai <zhengzengkai(a)huawei.com> This patchset aims to start a discussion about potential applications of BPF to the scheduler. It also aims to land some very basic BPF infrastructure necessary to add new BPF hooks to the scheduler, a minimal set of useful helpers, corresponding libbpf changes, etc. [Testing] kernel options: CONFIG_BPF_SCHED=y CONFIG_BPF_SYSCALL=y CONFIG_BPF_EVENTS=y Test passed with below step: 1.cd tools/testing/selftests/bpf & make 2.run cmd: ./test_progs -t test_sched 3.it will show like this: # ./test_progs -t test_sched #113/1 sched_tgidpid_mode:OK #113/2 sched_cgid_mode:OK #113 test_sched:OK Summary: 1/2 PASSED, 0 SKIPPED, 0 FAILED Chen Hui (1): sched: Move some definitions to sched.h Ren Zhijie (1): bpf: sched: add selftests for BPF_PROG_TYPE_SCHED Roman Gushchin (6): bpf: sched: basic infrastructure for scheduler bpf bpf: sched: add convenient helpers to identify sched entities bpf: sched: introduce bpf_sched_enable() sched: cfs: add bpf hooks to control wakeup and tick preemption libbpf: add support for scheduler bpf programs bpftool: recognize scheduler programs include/linux/bpf_sched.h | 50 ++++++ include/linux/bpf_types.h | 4 + include/linux/sched_hook_defs.h | 5 + include/uapi/linux/bpf.h | 25 +++ init/Kconfig | 10 ++ kernel/bpf/btf.c | 1 + kernel/bpf/syscall.c | 20 +++ kernel/bpf/trampoline.c | 1 + kernel/bpf/verifier.c | 11 +- kernel/sched/Makefile | 1 + kernel/sched/bpf_sched.c | 138 +++++++++++++++ kernel/sched/fair.c | 79 ++++----- kernel/sched/sched.h | 52 ++++++ scripts/bpf_helpers_doc.py | 2 + tools/bpf/bpftool/common.c | 1 + tools/bpf/bpftool/prog.c | 1 + tools/include/uapi/linux/bpf.h | 25 +++ tools/lib/bpf/bpf.c | 3 +- tools/lib/bpf/libbpf.c | 33 +++- tools/lib/bpf/libbpf.h | 4 + tools/lib/bpf/libbpf.map | 3 + .../selftests/bpf/prog_tests/test_sched.c | 161 +++++++++++++++++ tools/testing/selftests/bpf/progs/sched.c | 165 ++++++++++++++++++ 23 files changed, 743 insertions(+), 52 deletions(-) create mode 100644 include/linux/bpf_sched.h create mode 100644 include/linux/sched_hook_defs.h create mode 100644 kernel/sched/bpf_sched.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_sched.c create mode 100644 tools/testing/selftests/bpf/progs/sched.c -- 2.20.1

1 8

[PATCH openEuler-5.10-LTS 01/10] bpf: Don't redirect packets with invalid pkt_len
by Zheng Zengkai 26 Jul '22

26 Jul '22

From: Zhengchao Shao <shaozhengchao(a)huawei.com> mainline inclusion from mainline-v5.19-rc6 commit fd1894224407c484f652ad456e1ce423e89bb3eb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5HWKR CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id… -------------------------------- Syzbot found an issue [1]: fq_codel_drop() try to drop a flow whitout any skbs, that is, the flow->head is null. The root cause, as the [2] says, is because that bpf_prog_test_run_skb() run a bpf prog which redirects empty skbs. So we should determine whether the length of the packet modified by bpf prog or others like bpf_prog_test is valid before forwarding it directly. LINK: [1] https://syzkaller.appspot.com/bug?id=0b84da80c2917757915afa89f7738a9d16ec96… LINK: [2] https://www.spinics.net/lists/netdev/msg777503.html Reported-by: syzbot+7a12909485b94426aceb(a)syzkaller.appspotmail.com Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Stanislav Fomichev <sdf(a)google.com> Link: https://lore.kernel.org/r/20220715115559.139691-1-shaozhengchao@huawei.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/skbuff.h | 8 ++++++++ net/bpf/test_run.c | 3 +++ net/core/dev.c | 1 + 3 files changed, 12 insertions(+) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index e5f61bdd42a8..6dae09f22c5a 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -2251,6 +2251,14 @@ static inline void skb_set_tail_pointer(struct sk_buff *skb, const int offset) #endif /* NET_SKBUFF_DATA_USES_OFFSET */ +static inline void skb_assert_len(struct sk_buff *skb) +{ +#ifdef CONFIG_DEBUG_NET + if (WARN_ONCE(!skb->len, "%s\n", __func__)) + DO_ONCE_LITE(skb_dump, KERN_ERR, skb, false); +#endif /* CONFIG_DEBUG_NET */ +} + /* * Add data to an sk_buff */ diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c index 99712d35e535..f266a9453c8e 100644 --- a/net/bpf/test_run.c +++ b/net/bpf/test_run.c @@ -398,6 +398,9 @@ static int convert___skb_to_skb(struct sk_buff *skb, struct __sk_buff *__skb) { struct qdisc_skb_cb *cb = (struct qdisc_skb_cb *)skb->cb; + if (!skb->len) + return -EINVAL; + if (!__skb) return 0; diff --git a/net/core/dev.c b/net/core/dev.c index 12089c484b30..8e4de36eede8 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -4094,6 +4094,7 @@ static int __dev_queue_xmit(struct sk_buff *skb, struct net_device *sb_dev) bool again = false; skb_reset_mac_header(skb); + skb_assert_len(skb); if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_SCHED_TSTAMP)) __skb_tstamp_tx(skb, NULL, skb->sk, SCM_TSTAMP_SCHED); -- 2.20.1

1 9

[PATCH openEuler-5.10-LTS 00/81] Backport 5.10.113 LTS
by Zheng Zengkai 26 Jul '22

26 Jul '22

Backport 5.10.113 LTS patches from upstream. git cherry-pick v5.10.112..v5.10.113~1 -s Complicts: Already merged(-5): 43ce33a68e2b net/sched: cls_u32: fix netns refcount changes in u32_change() d29c78d3f9c5 dm: fix mempool NULL pointer race when completing IO a46b3d849864 ext4: fix symlink file size not match to file content 75ac724684b7 ext4: fix use-after-free in ext4_search_dir 572761645b88 jbd2: fix a potential race while discarding reserved buffers after an abort Context conflict(2): 49516e6ed914 ipv6: make ip6_rt_gc_expire an atomic_t 6b932920b96f mm, hugetlb: allow for "high" userspace addresses Implement changed(1, cherry-picked from mainline): ce33c845b030c tracing: Dump stacktrace trigger to the corresponding instance Defered(-1, kabi changed): ed5d4efb4df1 oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup kabi fixed(+1): ipv6: fix kabi for ip6_rt_gc_expire in struct netns_ipv6 Total patches: 86 - 5 - 1 + 1 = 81 Adrian Hunter (1): perf tools: Fix segfault accessing sample_id xyarray Alexey Kardashevskiy (1): KVM: PPC: Fix TCE handling for VFIO Alistair Popple (1): mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() Allen-KH Cheng (1): spi: spi-mtk-nor: initialize spi controller after resume Anshuman Khandual (1): arm64/mm: Remove [PUD|PMD]_TABLE_BIT from [pud|pmd]_bad() Athira Rajeev (1): powerpc/perf: Fix power9 event alternatives Bob Peterson (1): gfs2: assign rgrp glock before compute_bitstructs Borislav Petkov (3): ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant mt76: Fix undefined behavior due to shift overflowing the constant brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant Christoph Hellwig (2): nvme: add a quirk to disable namespace identifiers nvme-pci: disable namespace identifiers for Qemu controllers Christophe Leroy (1): mm, hugetlb: allow for "high" userspace addresses Daniel Bristot de Oliveira (1): tracing: Dump stacktrace trigger to the corresponding instance Darrick J. Wong (1): ext4: fix fallocate to use file_modified to update permissions consistently Dave Jiang (2): dmaengine: idxd: add RO check for wq max_batch_size write dmaengine: idxd: add RO check for wq max_transfer_size write Dave Stevenson (2): drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not initialised drm/panel/raspberrypi-touchscreen: Initialise the bridge in prepare David Ahern (1): l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu David Howells (2): rxrpc: Restore removed timer deletion cifs: Check the IOCB_DIRECT flag, not O_DIRECT Eric Dumazet (3): net/sched: cls_u32: fix possible leak in u32_init_knode() ipv6: make ip6_rt_gc_expire an atomic_t netlink: reset network and mac headers in netlink_dump() Guo Ren (1): xtensa: patch_text: Fixup last cpu should be master Hangbin Liu (1): net/packet: fix packet_sock xmit return value checking Hongbin Wang (1): vxlan: fix error return code in vxlan_fdb_append Ido Schimmel (1): selftests: mlxsw: vxlan_flooding: Prevent flooding of unwanted packets Jiapeng Chong (1): platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative Kai-Heng Feng (1): net: atlantic: Avoid out-of-bounds indexing Kees Cook (2): etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead ARM: vexpress/spc: Avoid negative array index when !SMP Kevin Hao (1): net: stmmac: Use readl_poll_timeout_atomic() in atomic state Khazhismel Kumykov (1): block/compat_ioctl: fix range check in BLKGETSIZE Lee Jones (1): staging: ion: Prevent incorrect reference counting behavour Leo Yan (1): perf report: Set PERF_SAMPLE_DATA_SRC bit for Arm SPE event Lv Ruyi (1): dpaa_eth: Fix missing of_node_put in dpaa_get_ts_info() Manuel Ullmann (1): net: atlantic: invert deep par in pm functions, preventing null derefs Marek Vasut (1): Revert "net: micrel: fix KS8851_MLL Kconfig" Mario Limonciello (1): gpio: Request interrupts after IRQ is initialized Mark Brown (1): ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek Max Filippov (1): xtensa: fix a7 clobbering in coprocessor context load/store Miaoqian Lin (3): ASoC: msm8916-wcd-digital: Check failure for devm_snd_soc_register_component dmaengine: imx-sdma: Fix error checking in sdma_event_remap drm/vc4: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage Mike Christie (1): scsi: qedi: Fix failed disconnect handling Mikulas Patocka (1): stat: fix inconsistency between struct stat and struct compat_stat Muchun Song (1): arm64: mm: fix p?d_leaf() Oliver Hartkopp (1): can: isotp: stop timeout monitoring when no first frame was sent Paolo Valerio (1): openvswitch: fix OOB access in reserve_sfa_size() Peilin Ye (2): ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit() ip6_gre: Fix skb_under_panic in __gre6_xmit() Rob Herring (2): arm64: dts: imx: Fix imx8*-var-som touchscreen property sizes arm_pmu: Validate single/group leader events Sabrina Dubroca (1): esp: limit skb_page_frag_refill use to a single page Sameer Pujar (1): reset: tegra-bpmp: Restore Handle errors in BPMP response Sasha Neftin (3): igc: Fix infinite loop in release_swfw_sync igc: Fix BUG: scheduling while atomic e1000e: Fix possible overflow in LTR decoding Sergey Matyukevich (1): ARC: entry: fix syscall_trace_exit argument Shubhrajyoti Datta (1): EDAC/synopsys: Read the error count from the correct register Srinivas Kandagatla (1): ASoC: codecs: wcd934x: do not switch off SIDO Buck when codec is in use Tadeusz Struk (1): ext4: limit length to bitmap_maxbytes - blocksize in punch_hole Takashi Iwai (1): ALSA: usb-audio: Clear MIDI port active flag after draining Theodore Ts'o (2): ext4: fix overhead calculation to account for the reserved gdt blocks ext4: force overhead calculation if the s_overhead_cluster makes no sense Tim Crawford (1): ALSA: hda/realtek: Add quirk for Clevo NP70PNP Tomas Melin (1): net: macb: Restart tx only if queue pointer is lagging Tony Lu (1): net/smc: Fix sock leak when release after smc_shutdown() Tudor Ambarus (1): spi: atmel-quadspi: Fix the buswidth adjustment between spi-mem and controller Xiaoke Wang (1): drm/msm/mdp5: check the return of kzalloc() Xiaomeng Tong (2): dma: at_xdmac: fix a missing check on list iterator ASoC: soc-dapm: fix two incorrect uses of list iterator Xiongwei Song (1): mm: page_alloc: fix building error on -Werror=array-compare Xu Jia (1): ipv6: fix kabi for ip6_rt_gc_expire in struct netns_ipv6 Zheyu Ma (1): ata: pata_marvell: Check the 'bmdma_addr' beforing reading Zhipeng Xie (1): perf/core: Fix perf_mmap fail when CONFIG_PERF_USE_VMALLOC enabled kuyo chang (1): sched/pelt: Fix attach_entity_load_avg() corner case wangjianjian (C) (1): ext4, doc: fix incorrect h_reserved size zhangqilong (1): dmaengine: mediatek:Fix PM usage reference leak of mtk_uart_apdma_alloc_chan_resources Documentation/filesystems/ext4/attributes.rst | 2 +- arch/arc/kernel/entry.S | 1 + arch/arm/mach-vexpress/spc.c | 2 +- .../boot/dts/freescale/imx8mm-var-som.dtsi | 8 +-- .../boot/dts/freescale/imx8mn-var-som.dtsi | 8 +-- arch/arm64/include/asm/pgtable.h | 9 ++- arch/powerpc/kvm/book3s_64_vio.c | 45 ++++++------ arch/powerpc/kvm/book3s_64_vio_hv.c | 44 ++++++------ arch/powerpc/perf/power9-pmu.c | 8 +-- arch/x86/include/asm/compat.h | 6 +- arch/xtensa/kernel/coprocessor.S | 4 +- arch/xtensa/kernel/jump_label.c | 2 +- block/ioctl.c | 2 +- drivers/ata/pata_marvell.c | 2 + drivers/dma/at_xdmac.c | 12 ++-- drivers/dma/idxd/sysfs.c | 6 ++ drivers/dma/imx-sdma.c | 4 +- drivers/dma/mediatek/mtk-uart-apdma.c | 9 ++- drivers/edac/synopsys_edac.c | 16 +++-- drivers/gpio/gpiolib.c | 4 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 3 + .../drm/panel/panel-raspberrypi-touchscreen.c | 13 +++- drivers/gpu/drm/vc4/vc4_dsi.c | 2 +- .../net/ethernet/aquantia/atlantic/aq_nic.c | 8 +-- .../ethernet/aquantia/atlantic/aq_pci_func.c | 8 +-- .../net/ethernet/aquantia/atlantic/aq_vec.c | 24 +++---- drivers/net/ethernet/cadence/macb_main.c | 8 +++ .../ethernet/freescale/dpaa/dpaa_ethtool.c | 8 ++- drivers/net/ethernet/intel/e1000e/ich8lan.c | 4 +- drivers/net/ethernet/intel/igc/igc_i225.c | 11 ++- drivers/net/ethernet/intel/igc/igc_phy.c | 4 +- drivers/net/ethernet/micrel/Kconfig | 1 - .../ethernet/stmicro/stmmac/stmmac_hwtstamp.c | 4 +- drivers/net/vxlan.c | 4 +- .../broadcom/brcm80211/brcmfmac/sdio.c | 2 +- .../net/wireless/mediatek/mt76/mt76x2/pci.c | 2 +- drivers/nvme/host/core.c | 24 +++++-- drivers/nvme/host/nvme.h | 5 ++ drivers/nvme/host/pci.c | 5 +- drivers/perf/arm_pmu.c | 10 ++- drivers/platform/x86/samsung-laptop.c | 2 - drivers/reset/tegra/reset-bpmp.c | 9 ++- drivers/scsi/qedi/qedi_iscsi.c | 69 +++++++++---------- drivers/spi/atmel-quadspi.c | 3 + drivers/spi/spi-mtk-nor.c | 12 +++- drivers/staging/android/ion/ion.c | 3 + fs/cifs/cifsfs.c | 2 +- fs/ext4/ext4.h | 2 +- fs/ext4/extents.c | 32 +++++++-- fs/ext4/inode.c | 18 ++++- fs/ext4/super.c | 19 +++-- fs/gfs2/rgrp.c | 9 +-- fs/hugetlbfs/inode.c | 9 +-- fs/stat.c | 19 ++--- include/linux/etherdevice.h | 5 +- include/linux/sched/mm.h | 8 +++ include/net/esp.h | 2 - include/net/netns/ipv6.h | 4 +- kernel/events/core.c | 2 +- kernel/events/internal.h | 5 ++ kernel/events/ring_buffer.c | 5 -- kernel/sched/fair.c | 10 +-- kernel/trace/trace_events_trigger.c | 7 +- mm/mmap.c | 8 --- mm/mmu_notifier.c | 14 +++- mm/page_alloc.c | 2 +- net/can/isotp.c | 10 ++- net/ipv4/esp4.c | 5 +- net/ipv6/esp6.c | 5 +- net/ipv6/ip6_gre.c | 14 ++-- net/ipv6/route.c | 11 +-- net/l3mdev/l3mdev.c | 2 +- net/netlink/af_netlink.c | 7 ++ net/openvswitch/flow_netlink.c | 2 +- net/packet/af_packet.c | 13 ++-- net/rxrpc/net_ns.c | 2 + net/sched/cls_u32.c | 8 +-- net/smc/af_smc.c | 4 +- sound/pci/hda/patch_realtek.c | 1 + sound/soc/atmel/sam9g20_wm8731.c | 61 ---------------- sound/soc/codecs/msm8916-wcd-digital.c | 9 ++- sound/soc/codecs/wcd934x.c | 26 +------ sound/soc/soc-dapm.c | 6 +- sound/usb/midi.c | 1 + sound/usb/usbaudio.h | 2 +- tools/lib/perf/evlist.c | 3 +- tools/perf/builtin-report.c | 14 ++++ .../drivers/net/mlxsw/vxlan_flooding.sh | 17 +++++ 88 files changed, 485 insertions(+), 362 deletions(-) -- 2.20.1

1 81

[PATCH openEuler-1.0-LTS] perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()
by Yongqiang Liu 26 Jul '22

26 Jul '22

From: Yang Jihong <yangjihong1(a)huawei.com> mainline inclusion from mainline-v5.19-rc7 commit 68e3c69803dada336893640110cb87221bb01dcf category: bugfix bugzilla: 187299, https://gitee.com/src-openeuler/kernel/issues/I5ISXP CVE: NA -------------------------------- Yang Jihing reported a race between perf_event_set_output() and perf_mmap_close(): CPU1 CPU2 perf_mmap_close(e2) if (atomic_dec_and_test(&e2->rb->mmap_count)) // 1 - > 0 detach_rest = true ioctl(e1, IOC_SET_OUTPUT, e2) perf_event_set_output(e1, e2) ... list_for_each_entry_rcu(e, &e2->rb->event_list, rb_entry) ring_buffer_attach(e, NULL); // e1 isn't yet added and // therefore not detached ring_buffer_attach(e1, e2->rb) list_add_rcu(&e1->rb_entry, &e2->rb->event_list) After this; e1 is attached to an unmapped rb and a subsequent perf_mmap() will loop forever more: again: mutex_lock(&e->mmap_mutex); if (event->rb) { ... if (!atomic_inc_not_zero(&e->rb->mmap_count)) { ... mutex_unlock(&e->mmap_mutex); goto again; } } The loop in perf_mmap_close() holds e2->mmap_mutex, while the attach in perf_event_set_output() holds e1->mmap_mutex. As such there is no serialization to avoid this race. Change perf_event_set_output() to take both e1->mmap_mutex and e2->mmap_mutex to alleviate that problem. Additionally, have the loop in perf_mmap() detach the rb directly, this avoids having to wait for the concurrent perf_mmap_close() to get around to doing it to make progress. Fixes: 9bb5d40cd93c ("perf: Fix mmap() accounting hole") Reported-by: Yang Jihong <yangjihong1(a)huawei.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Tested-by: Yang Jihong <yangjihong1(a)huawei.com> Link: https://lkml.kernel.org/r/YsQ3jm2GR38SW7uD@worktop.programming.kicks-ass.net Signed-off-by: Yang Jihong <yangjihong1(a)huawei.com> Reviewed-by: Kuohai Xu <xukuohai(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/events/core.c | 45 ++++++++++++++++++++++++++++++-------------- 1 file changed, 31 insertions(+), 14 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 98d12fc3976a..616cccf9c835 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -5727,10 +5727,10 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) if (!atomic_inc_not_zero(&event->rb->mmap_count)) { /* - * Raced against perf_mmap_close() through - * perf_event_set_output(). Try again, hope for better - * luck. + * Raced against perf_mmap_close(); remove the + * event and try again. */ + ring_buffer_attach(event, NULL); mutex_unlock(&event->mmap_mutex); goto again; } @@ -10453,14 +10453,25 @@ static int perf_copy_attr(struct perf_event_attr __user *uattr, goto out; } +static void mutex_lock_double(struct mutex *a, struct mutex *b) +{ + if (b < a) + swap(a, b); + + mutex_lock(a); + mutex_lock_nested(b, SINGLE_DEPTH_NESTING); +} + static int perf_event_set_output(struct perf_event *event, struct perf_event *output_event) { struct ring_buffer *rb = NULL; int ret = -EINVAL; - if (!output_event) + if (!output_event) { + mutex_lock(&event->mmap_mutex); goto set; + } /* don't allow circular references */ if (event == output_event) @@ -10498,8 +10509,15 @@ perf_event_set_output(struct perf_event *event, struct perf_event *output_event) event->pmu != output_event->pmu) goto out; + /* + * Hold both mmap_mutex to serialize against perf_mmap_close(). Since + * output_event is already on rb->event_list, and the list iteration + * restarts after every removal, it is guaranteed this new event is + * observed *OR* if output_event is already removed, it's guaranteed we + * observe !rb->mmap_count. + */ + mutex_lock_double(&event->mmap_mutex, &output_event->mmap_mutex); set: - mutex_lock(&event->mmap_mutex); /* Can't redirect output if we've got an active mmap() */ if (atomic_read(&event->mmap_count)) goto unlock; @@ -10509,6 +10527,12 @@ perf_event_set_output(struct perf_event *event, struct perf_event *output_event) rb = ring_buffer_get(output_event); if (!rb) goto unlock; + + /* did we race against perf_mmap_close() */ + if (!atomic_read(&rb->mmap_count)) { + ring_buffer_put(rb); + goto unlock; + } } ring_buffer_attach(event, rb); @@ -10516,20 +10540,13 @@ perf_event_set_output(struct perf_event *event, struct perf_event *output_event) ret = 0; unlock: mutex_unlock(&event->mmap_mutex); + if (output_event) + mutex_unlock(&output_event->mmap_mutex); out: return ret; } -static void mutex_lock_double(struct mutex *a, struct mutex *b) -{ - if (b < a) - swap(a, b); - - mutex_lock(a); - mutex_lock_nested(b, SINGLE_DEPTH_NESTING); -} - static int perf_event_set_clock(struct perf_event *event, clockid_t clk_id) { bool nmi_safe = false; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] inotify: show inotify mask flags in proc fdinfo
by Laibin Qiu 25 Jul '22

25 Jul '22

From: Amir Goldstein <amir73il(a)gmail.com> mainline inclusion from mainline-v5.19-rc1 commit a32e697cda27679a0327ae2cafdad8c7170f548f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5IGXM CVE: NA -------------------------------- The inotify mask flags IN_ONESHOT and IN_EXCL_UNLINK are not "internal to kernel" and should be exposed in procfs fdinfo so CRIU can restore them. Fixes: 6933599697c9 ("inotify: hide internal kernel bits from fdinfo") Link: https://lore.kernel.org/r/20220422120327.3459282-2-amir73il@gmail.com Signed-off-by: Amir Goldstein <amir73il(a)gmail.com> Signed-off-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Li Nan <linan122(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- fs/notify/fdinfo.c | 11 ++--------- fs/notify/inotify/inotify.h | 12 ++++++++++++ fs/notify/inotify/inotify_user.c | 2 +- 3 files changed, 15 insertions(+), 10 deletions(-) diff --git a/fs/notify/fdinfo.c b/fs/notify/fdinfo.c index c4f18a8a8161..a67483ce2ee1 100644 --- a/fs/notify/fdinfo.c +++ b/fs/notify/fdinfo.c @@ -84,16 +84,9 @@ static void inotify_fdinfo(struct seq_file *m, struct fsnotify_mark *mark) inode_mark = container_of(mark, struct inotify_inode_mark, fsn_mark); inode = igrab(fsnotify_conn_inode(mark->connector)); if (inode) { - /* - * IN_ALL_EVENTS represents all of the mask bits - * that we expose to userspace. There is at - * least one bit (FS_EVENT_ON_CHILD) which is - * used only internally to the kernel. - */ - u32 mask = mark->mask & IN_ALL_EVENTS; - seq_printf(m, "inotify wd:%x ino:%lx sdev:%x mask:%x ignored_mask:%x ", + seq_printf(m, "inotify wd:%x ino:%lx sdev:%x mask:%x ignored_mask:0 ", inode_mark->wd, inode->i_ino, inode->i_sb->s_dev, - mask, mark->ignored_mask); + inotify_mark_user_mask(mark)); show_mark_fhandle(m, inode); seq_putc(m, '\n'); iput(inode); diff --git a/fs/notify/inotify/inotify.h b/fs/notify/inotify/inotify.h index 7e4578d35b61..5d94c00b1233 100644 --- a/fs/notify/inotify/inotify.h +++ b/fs/notify/inotify/inotify.h @@ -21,6 +21,18 @@ static inline struct inotify_event_info *INOTIFY_E(struct fsnotify_event *fse) return container_of(fse, struct inotify_event_info, fse); } +/* + * INOTIFY_USER_FLAGS represents all of the mask bits that we expose to + * userspace. There is at least one bit (FS_EVENT_ON_CHILD) which is + * used only internally to the kernel. + */ +#define INOTIFY_USER_MASK (IN_ALL_EVENTS | IN_ONESHOT | IN_EXCL_UNLINK) + +static inline __u32 inotify_mark_user_mask(struct fsnotify_mark *fsn_mark) +{ + return fsn_mark->mask & INOTIFY_USER_MASK; +} + extern void inotify_ignored_and_remove_idr(struct fsnotify_mark *fsn_mark, struct fsnotify_group *group); extern int inotify_handle_event(struct fsnotify_group *group, diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c index 73b47cb533f2..156faf3d1288 100644 --- a/fs/notify/inotify/inotify_user.c +++ b/fs/notify/inotify/inotify_user.c @@ -96,7 +96,7 @@ static inline __u32 inotify_arg_to_mask(u32 arg) mask = (FS_IN_IGNORED | FS_EVENT_ON_CHILD | FS_UNMOUNT); /* mask off the flags used to open the fd */ - mask |= (arg & (IN_ALL_EVENTS | IN_ONESHOT | IN_EXCL_UNLINK)); + mask |= (arg & INOTIFY_USER_MASK); return mask; } -- 2.25.1

1 0

openEuler 22.09 Alpha版本release公告
by chenyaqiang 25 Jul '22

25 Jul '22

Dear all， openEuler 22.09创新版本Alpha版本在经过社区各SIG组协作开发，CI/CD SIG规模构建，及QA SIG Alpha版本质量评估，满足alpha版本发布质量标准，现正式发布该alpha版本，社区各SIG组及所有爱好者均可以下载并试用alpha ，Alpha 版本包含 openEuler 22.09 版本的几乎全量组件（少量持续编译/构建失败包清单详见邮件正文编译构建章节），版本测试能力/策略由 openEuler QA SIG团队指导，社区各个SIG组自主开展组件自验证，社区一起协作支撑openEuler 22.09创新版本issue发现和定位修复，您发现和定位修复每一个issue不仅可以解决您使用openEuler创新版本的问题点，更可以支撑社区一起持续优化提升百万级openEuler用户的体验！ Alpha版本作为beta版本的前置自验证版本，经过社区联合协作自验证和issue修复后，下一个版本里程碑点（预计在2022/08/01）将会提供 Beta 版本。 openEuler 22.09版本release plan公示链接： https://gitee.com/openeuler/release-management/blob/master/openEuler-22.09/… openEuler 22.09 Alpha版本下载链接： http://121.36.84.172/dailybuild/openEuler-22.09/openeuler-2022-07-25-10-43-… openEuler 22.09 Alpha版本发布质量评估规范公示链接： https://gitee.com/openeuler/QA/blob/master/Test_Checklist/%E7%A4%BE%E5%8C%B… openEuler 22.09 Alpha版本自验证进展与质量结果同步方式：建议各sig组及社区用户均可以在QA-sig下以ISSUE方式同步自验证进展和自验证结果，您的自验证结果将是Alpha版本质量评估的充分信息依据；社区QA 版本测试提单规范 https://gitee.com/openeuler/QA/blob/839f952696f271f83c018ccf3218cf493b92d65… 社区QA 测试平台 radiates https://radiatest.openeuler.org<https://radiatest.openeuler.org/> openEuler 22.09 Alpha版本已知待修复单包构建失败问题清单：里程碑地址：https://e.gitee.com/open_euler/milestones/170898/issues/table 里程碑任务ID 任务标题任务状态关联仓库 Sig openEuler-22.09-Dailybuild I5HVUZ ima-evm-utils build problem in openEuler:22.09 待办的 ima-evm-utils Base-service openEuler-22.09-Dailybuild I5HVVF mysql5 build problem in openEuler:22.09 待办的 mysql5 DB openEuler-22.09-Dailybuild I5HZVX folks build problem in openEuler:22.09 待办的 folks GNOME openEuler-22.09-Dailybuild I5HZW3 subunit build problem in openEuler:22.09 待办的 subunit Programming-language openEuler-22.09-Dailybuild I5I1ZZ ceph build problem in openEuler:22.09 待办的 ceph sig-SDS openEuler-22.09-Dailybuild I5I6MO libgit2 build problem in openEuler:22.09 待办的 libgit2 Base-service openEuler-22.09-Dailybuild I5IH5G gpgme build problem in openEuler:22.09 待办的 gpgme Base-service openEuler-22.09-Dailybuild I5IH69 iotop build problem in openEuler:22.09 待办的 iotop Storage openEuler-22.09-Dailybuild I5IH6M libpwquality build problem in openEuler:22.09 待办的 libpwquality sig-security-facility openEuler-22.09-Dailybuild I5IH6T nftables build problem in openEuler:22.09 待办的 nftables Networking openEuler-22.09-Dailybuild I5ILK7 bamf build problem in openEuler:22.09:Epol 待办的 bamf sig-UKUI openEuler-22.09-Dailybuild I5ILK8 vdsm-jsonrpc-java build problem in openEuler:22.09:Epol 待办的 vdsm-jsonrpc-java oVirt openEuler-22.09-Dailybuild I5ILKA python-crypto build problem in openEuler:22.09 待办的 python-crypto Base-service openEuler-22.09-Dailybuild I5ILKE sssd build problem in openEuler:22.09 待办的 sssd Base-service openEuler-22.09-Dailybuild I5IQZF highlight build problem in openEuler:22.09:Epol 待办的 highlight oVirt openEuler 22.09 Alpha版本已知待修复单包安装失败软件包清单：安装校验项架构 jenkins任务地址 ISO二进制范围 x86_64 https://openeulerjenkins.osinfra.cn/job/openEuler-OS-build/job/check_rpm_in… Epol二进制范围 x86_64 https://openeulerjenkins.osinfra.cn/job/openEuler-OS-build/job/check_rpm_in… ISO二进制范围 aarch64 https://openeulerjenkins.osinfra.cn/job/openEuler-OS-build/job/check_rpm_in… Epol二进制范围 aarch64 https://openeulerjenkins.osinfra.cn/job/openEuler-OS-build/job/check_rpm_in… 二进制包名源码包名 Sig python3-jupyter python-jupyter #N/A python3-nni python-nni A-Tune setroubleshoot-plugins setroubleshoot-plugins Base-service backupninja backupninja Application blueman blueman sig-UKUI cinnamon cinnamon sig-cinnamon cinnamon-devel-doc cinnamon sig-cinnamon claws-mail-plugins claws-mail sig-UKUI claws-mail-plugins-bsfilter claws-mail sig-UKUI claws-mail-plugins-bogofilter claws-mail sig-UKUI cockpit-ovirt-dashboard cockpit-ovirt oVirt ovirt-hosted-engine-setup ovirt-hosted-engine-setup oVirt ovirt-host ovirt-host oVirt dde dde sig-DDE dde-control-center dde-control-center sig-DDE startdde startdde sig-DDE dde-daemon dde-daemon sig-DDE dde-session-ui dde-session-ui sig-DDE dde-desktop dde-file-manager sig-DDE dde-launcher dde-launcher sig-DDE dde-file-manager dde-file-manager sig-DDE libdde-file-manager dde-file-manager sig-DDE dde-disk-mount-plugin dde-file-manager sig-DDE dde-file-manager-devel dde-file-manager sig-DDE dde-launcher-devel dde-launcher sig-DDE deepin-compressor deepin-compressor sig-DDE deepin-font-manager deepin-font-manager sig-DDE libdeepin-font-manager deepin-font-manager sig-DDE deepin-screen-recorder deepin-screen-recorder sig-DDE kwin kwin sig-KDE kwin-common kwin sig-KDE kwin-devel kwin sig-KDE kwin-doc kwin sig-KDE kwin-wayland kwin sig-KDE kwin-x11 kwin sig-KDE lastpass-cli lastpass-cli Application openstack-dashboard openstack-dashboard #N/A python3-horizon openstack-dashboard #N/A ovirt-engine ovirt-engine oVirt ovirt-engine-setup-plugin-ovirt-engine ovirt-engine oVirt ovirt-provider-ovn ovirt-provider-ovn oVirt ovirt-engine-backend ovirt-engine oVirt ovirt-engine-dbscripts ovirt-engine oVirt ovirt-engine-dwh ovirt-engine-dwh oVirt ovirt-engine-dwh-grafana-integration-setup ovirt-engine-dwh oVirt ovirt-engine-dwh-setup ovirt-engine-dwh oVirt ovirt-engine-restapi ovirt-engine oVirt ovirt-engine-setup ovirt-engine oVirt ovirt-engine-setup-plugin-cinderlib ovirt-engine oVirt ovirt-engine-setup-plugin-imageio ovirt-engine oVirt ovirt-engine-setup-plugin-vmconsole-proxy-helper ovirt-engine oVirt ovirt-engine-tools ovirt-engine oVirt ovirt-engine-webadmin-portal ovirt-engine oVirt ovirt-engine-ui-extensions ovirt-engine-ui-extensions oVirt ovirt-engine-vmconsole-proxy-helper ovirt-engine oVirt ovirt-provider-ovn-driver ovirt-provider-ovn oVirt python3-graphviz python-graphviz sig-python-modules python3-ironic-ui python-ironic-ui sig-openstack python3-mitmproxy python-mitmproxy sig-python-modules python3-muranoclient python-muranoclient sig-openstack python3-neutron-tempest-plugin python-neutron-tempest-plugin sig-openstack python3-os-xenapi-tests python-os-xenapi sig-openstack python3-pep517 python-pep517 sig-python-modules python3-pip-api python-pip-api sig-openstack python3-requirementslib python-requirementslib sig-openstack python3-senlinclient python-senlinclient sig-openstack python3-trove-tempest-plugin python-trove-tempest-plugin sig-openstack ukui ukui-desktop-environment sig-UKUI ukui-desktop-environment ukui-desktop-environment sig-UKUI ukui-desktop-environment-core ukui-desktop-environment sig-UKUI kylin-music kylin-music sig-UKUI ------ BR 陈亚强（openEuler release management sig）

1 0

[PATCH openEuler-1.0-LTS] io_uring: always grab file table for deferred statx
by Yongqiang Liu 22 Jul '22

22 Jul '22

From: Jens Axboe <axboe(a)kernel.dk> stable inclusion from stable-v5.10.118 commit 3c48558be571e01f67e65edcf03193484eeb2b79 category: bugfix bugzilla: 187134, https://gitee.com/openeuler/kernel/issues/I5HEXY CVE: NA -------------------------------- Lee reports that there's a use-after-free of the process file table. There's an assumption that we don't need the file table for some variants of statx invocation, but that turns out to be false and we end up with not grabbing a reference for the request even if the deferred execution uses it. Get rid of the REQ_F_NO_FILE_TABLE optimization for statx, and always grab that reference. This issues doesn't exist upstream since the native workers got introduced with 5.12. Link: https://lore.kernel.org/io-uring/YoOJ%2FT4QRKC+fAZE@google.com/ Reported-by: Lee Jones <lee.jones(a)linaro.org> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/io_uring.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 7ae8ba98e73b..8a96b7df4112 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -3836,12 +3836,8 @@ static int io_statx(struct io_kiocb *req, bool force_nonblock) struct io_statx *ctx = &req->statx; int ret; - if (force_nonblock) { - /* only need file table for an actual valid fd */ - if (ctx->dfd == -1 || ctx->dfd == AT_FDCWD) - req->flags |= REQ_F_NO_FILE_TABLE; + if (force_nonblock) return -EAGAIN; - } ret = do_statx(ctx->dfd, ctx->filename, ctx->flags, ctx->mask, ctx->buffer); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] bpf: Don't redirect packets with invalid pkt_len
by Yongqiang Liu 22 Jul '22

22 Jul '22

From: Zhengchao Shao <shaozhengchao(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5HWKR CVE: NA -------------------------------- Syzbot found an issue [1]: fq_codel_drop() try to drop a flow whitout any skbs, that is, the flow->head is null. The root cause, as the [2] says, is because that bpf_prog_test_run_skb() run a bpf prog which redirects empty skbs. So we should determine whether the length of the packet modified by bpf prog or others like bpf_prog_test is valid before forwarding it directly. LINK: [1] https://syzkaller.appspot.com/bug?id=0b84da80c2917757915afa89f7738a9d16ec96… LINK: [2] https://www.spinics.net/lists/netdev/msg777503.html Reported-by: syzbot+7a12909485b94426aceb(a)syzkaller.appspotmail.com Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Conflict: net/bpf/test_run.c Reviewed-by: Stanislav Fomichev <sdf(a)google.com> Link: https://lore.kernel.org/r/20220715115559.139691-1-shaozhengchao@huawei.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- include/linux/skbuff.h | 8 ++++++++ net/bpf/test_run.c | 6 ++++++ net/core/dev.c | 1 + 3 files changed, 15 insertions(+) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index e9f100bd73d9..dbdb03ac557f 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -2077,6 +2077,14 @@ static inline void skb_set_tail_pointer(struct sk_buff *skb, const int offset) #endif /* NET_SKBUFF_DATA_USES_OFFSET */ +static inline void skb_assert_len(struct sk_buff *skb) +{ +#ifdef CONFIG_DEBUG_NET + if (WARN_ONCE(!skb->len, "%s\n", __func__)) + DO_ONCE_LITE(skb_dump, KERN_ERR, skb, false); +#endif /* CONFIG_DEBUG_NET */ +} + /* * Add data to an sk_buff */ diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c index f4078830ea50..fba139c995aa 100644 --- a/net/bpf/test_run.c +++ b/net/bpf/test_run.c @@ -144,6 +144,12 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr, __skb_push(skb, hh_len); if (is_direct_pkt_access) bpf_compute_data_pointers(skb); + + if (!skb->len) { + kfree_skb(skb); + return -EINVAL; + } + retval = bpf_test_run(prog, skb, repeat, &duration); if (!is_l2) { if (skb_headroom(skb) < hh_len) { diff --git a/net/core/dev.c b/net/core/dev.c index 5bc0e56216c9..078e8a231616 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -3775,6 +3775,7 @@ static int __dev_queue_xmit(struct sk_buff *skb, struct net_device *sb_dev) bool again = false; skb_reset_mac_header(skb); + skb_assert_len(skb); if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_SCHED_TSTAMP)) __skb_tstamp_tx(skb, NULL, skb->sk, SCM_TSTAMP_SCHED); -- 2.25.1

1 0

[PATCH openEuler-22.09 v2 0/8] bpf: sched: Introduce Schduler BPF
by Zheng Zengkai 22 Jul '22

22 Jul '22

This patchset aims to start a discussion about potential applications of BPF to the scheduler. It also aims to land some very basic BPF infrastructure necessary to add new BPF hooks to the scheduler, a minimal set of useful helpers, corresponding libbpf changes, etc. [Testing] kernel options: CONFIG_BPF_SCHED=y CONFIG_BPF_SYSCALL=y CONFIG_BPF_EVENTS=y Test passed with below step: 1.cd tools/testing/selftests/bpf & make 2.run cmd: ./test_progs -t test_sched 3.it will show like this: # ./test_progs -t test_sched #113/1 sched_tgidpid_mode:OK #113/2 sched_cgid_mode:OK #113 test_sched:OK Summary: 1/2 PASSED, 0 SKIPPED, 0 FAILED Chen Hui (1): sched: Move some definition to sched.h Ren Zhijie (1): bpf: sched: add selftests for BPF_PROG_TYPE_SCHED Roman Gushchin (6): bpf: sched: basic infrastructure for scheduler bpf bpf: sched: add convenient helpers to identify sched entities bpf: sched: introduce bpf_sched_enable() sched: cfs: add bpf hooks to control wakeup and tick preemption libbpf: add support for scheduler bpf programs bpftool: recognize scheduler programs include/linux/bpf_sched.h | 50 +++++ include/linux/bpf_types.h | 4 + include/linux/sched_hook_defs.h | 5 + include/uapi/linux/bpf.h | 25 +++ init/Kconfig | 10 + kernel/bpf/btf.c | 1 + kernel/bpf/syscall.c | 20 ++ kernel/bpf/trampoline.c | 1 + kernel/bpf/verifier.c | 11 +- kernel/sched/Makefile | 1 + kernel/sched/bpf_sched.c | 138 ++++++++++++ kernel/sched/fair.c | 79 +++---- kernel/sched/sched.h | 52 +++++ scripts/bpf_helpers_doc.py | 2 + tools/bpf/bpftool/common.c | 1 + tools/bpf/bpftool/prog.c | 1 + tools/include/uapi/linux/bpf.h | 25 +++ tools/lib/bpf/bpf.c | 3 +- tools/lib/bpf/libbpf.c | 33 ++- tools/lib/bpf/libbpf.h | 4 + tools/lib/bpf/libbpf.map | 3 + .../selftests/bpf/prog_tests/test_sched.c | 160 ++++++++++++++ tools/testing/selftests/bpf/progs/sched.c | 203 ++++++++++++++++++ 23 files changed, 780 insertions(+), 52 deletions(-) create mode 100644 include/linux/bpf_sched.h create mode 100644 include/linux/sched_hook_defs.h create mode 100644 kernel/sched/bpf_sched.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_sched.c create mode 100644 tools/testing/selftests/bpf/progs/sched.c -- 2.20.1

1 0

[PATCH openEuler-22.09 v2 1/8] bpf: sched: basic infrastructure for scheduler bpf
by Zheng Zengkai 22 Jul '22

22 Jul '22

From: Roman Gushchin <guro(a)fb.com> maillist inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5F6X6 CVE: NA Reference: https://lore.kernel.org/all/20210916162451.709260-1-guro@fb.com/ ------------------- This commit introduces basic definitions and infrastructure for scheduler bpf programs. It defines the BPF_PROG_TYPE_SCHED program type and the BPF_SCHED attachment type. The implementation is inspired by lsm bpf programs and is based on kretprobes. This will allow to add new hooks with a minimal changes to the kernel code and without any changes to libbpf/bpftool. It's very convenient as I anticipate a large number of private patches being used for a long time before (or if at all) reaching upstream. Sched programs are expected to return an int, which meaning will be context defined. This patch doesn't add any real scheduler hooks (only a stub), it will be done by following patches in the series. Scheduler bpf programs as now are very restricted in what they can do: only the bpf_printk() helper is available. The scheduler context can impose significant restrictions on what's safe and what's not. So let's extend their abilities on case by case basis when a need arise. Signed-off-by: Roman Gushchin <guro(a)fb.com> Signed-off-by: Chen Hui <judy.chenhui(a)huawei.com> Signed-off-by: Ren Zhijie <renzhijie2(a)huawei.com> --- include/linux/bpf_sched.h | 26 ++++++++++++++ include/linux/bpf_types.h | 4 +++ include/linux/sched_hook_defs.h | 2 ++ include/uapi/linux/bpf.h | 2 ++ init/Kconfig | 10 ++++++ kernel/bpf/btf.c | 1 + kernel/bpf/syscall.c | 9 +++++ kernel/bpf/trampoline.c | 1 + kernel/bpf/verifier.c | 11 +++++- kernel/sched/Makefile | 1 + kernel/sched/bpf_sched.c | 62 +++++++++++++++++++++++++++++++++ tools/include/uapi/linux/bpf.h | 2 ++ 12 files changed, 130 insertions(+), 1 deletion(-) create mode 100644 include/linux/bpf_sched.h create mode 100644 include/linux/sched_hook_defs.h create mode 100644 kernel/sched/bpf_sched.c diff --git a/include/linux/bpf_sched.h b/include/linux/bpf_sched.h new file mode 100644 index 000000000000..874393e6a6aa --- /dev/null +++ b/include/linux/bpf_sched.h @@ -0,0 +1,26 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _LINUX_BPF_SCHED_H +#define _LINUX_BPF_SCHED_H + +#include <linux/bpf.h> + +#ifdef CONFIG_BPF_SCHED + +#define BPF_SCHED_HOOK(RET, DEFAULT, NAME, ...) \ + RET bpf_sched_##NAME(__VA_ARGS__); +#include <linux/sched_hook_defs.h> +#undef BPF_SCHED_HOOK + +int bpf_sched_verify_prog(struct bpf_verifier_log *vlog, + const struct bpf_prog *prog); + +#else /* !CONFIG_BPF_SCHED */ + +static inline int bpf_sched_verify_prog(struct bpf_verifier_log *vlog, + const struct bpf_prog *prog) +{ + return -EOPNOTSUPP; +} + +#endif /* CONFIG_BPF_SCHED */ +#endif /* _LINUX_BPF_SCHED_H */ diff --git a/include/linux/bpf_types.h b/include/linux/bpf_types.h index a8137bb6dd3c..5732b485c539 100644 --- a/include/linux/bpf_types.h +++ b/include/linux/bpf_types.h @@ -77,6 +77,10 @@ BPF_PROG_TYPE(BPF_PROG_TYPE_LSM, lsm, void *, void *) #endif /* CONFIG_BPF_LSM */ #endif +#ifdef CONFIG_BPF_SCHED +BPF_PROG_TYPE(BPF_PROG_TYPE_SCHED, bpf_sched, + void *, void *) +#endif /* CONFIG_BPF_SCHED */ BPF_MAP_TYPE(BPF_MAP_TYPE_ARRAY, array_map_ops) BPF_MAP_TYPE(BPF_MAP_TYPE_PERCPU_ARRAY, percpu_array_map_ops) diff --git a/include/linux/sched_hook_defs.h b/include/linux/sched_hook_defs.h new file mode 100644 index 000000000000..14344004e335 --- /dev/null +++ b/include/linux/sched_hook_defs.h @@ -0,0 +1,2 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +BPF_SCHED_HOOK(int, 0, dummy, void) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 8fae845d80e2..4f8f3f2113a7 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -199,6 +199,7 @@ enum bpf_prog_type { BPF_PROG_TYPE_EXT, BPF_PROG_TYPE_LSM, BPF_PROG_TYPE_SK_LOOKUP, + BPF_PROG_TYPE_SCHED, }; enum bpf_attach_type { @@ -240,6 +241,7 @@ enum bpf_attach_type { BPF_XDP_CPUMAP, BPF_SK_LOOKUP, BPF_XDP, + BPF_SCHED, __MAX_BPF_ATTACH_TYPE }; diff --git a/init/Kconfig b/init/Kconfig index 27c5ed16fef1..c3fa3240d87d 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1749,6 +1749,16 @@ config BPF_LSM If you are unsure how to answer this question, answer N. +config BPF_SCHED + bool "SCHED Instrumentation with BPF" + depends on BPF_EVENTS + depends on BPF_SYSCALL + help + Enables instrumentation of the sched hooks with eBPF programs for + implementing dynamic scheduling Policies. + + If you are unsure how to answer this question, answer N. + config BPF_SYSCALL bool "Enable bpf() system call" select BPF diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index fba28f17e61a..9a0a9895ec62 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -4479,6 +4479,7 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type, return true; t = btf_type_by_id(btf, t->type); break; + case BPF_SCHED: case BPF_MODIFY_RETURN: /* For now the BPF_MODIFY_RETURN can only be attached to * functions that return an int. diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 419dbc3d060e..ff65862ae5ce 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -1997,6 +1997,7 @@ bpf_prog_load_check_attach(enum bpf_prog_type prog_type, case BPF_PROG_TYPE_LSM: case BPF_PROG_TYPE_STRUCT_OPS: case BPF_PROG_TYPE_EXT: + case BPF_PROG_TYPE_SCHED: break; default: return -EINVAL; @@ -2108,6 +2109,7 @@ static bool is_perfmon_prog_type(enum bpf_prog_type prog_type) case BPF_PROG_TYPE_LSM: case BPF_PROG_TYPE_STRUCT_OPS: /* has access to struct sock */ case BPF_PROG_TYPE_EXT: /* extends any prog */ + case BPF_PROG_TYPE_SCHED: return true; default: return false; @@ -2608,6 +2610,12 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog, goto out_put_prog; } break; + case BPF_PROG_TYPE_SCHED: + if (prog->expected_attach_type != BPF_SCHED) { + err = -EINVAL; + goto out_put_prog; + } + break; default: err = -EINVAL; goto out_put_prog; @@ -2838,6 +2846,7 @@ static int bpf_raw_tracepoint_open(const union bpf_attr *attr) case BPF_PROG_TYPE_TRACING: case BPF_PROG_TYPE_EXT: case BPF_PROG_TYPE_LSM: + case BPF_PROG_TYPE_SCHED: if (attr->raw_tracepoint.name) { /* The attach point for this category of programs * should be specified via btf_id during program load. diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c index 986dabc3d11f..cc6ba35a1d14 100644 --- a/kernel/bpf/trampoline.c +++ b/kernel/bpf/trampoline.c @@ -357,6 +357,7 @@ static enum bpf_tramp_prog_type bpf_attach_type_to_tramp(struct bpf_prog *prog) switch (prog->expected_attach_type) { case BPF_TRACE_FENTRY: return BPF_TRAMP_FENTRY; + case BPF_SCHED: case BPF_MODIFY_RETURN: return BPF_TRAMP_MODIFY_RETURN; case BPF_TRACE_FEXIT: diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 6423f1714a2f..d26104b258ba 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -22,6 +22,7 @@ #include <linux/error-injection.h> #include <linux/bpf_lsm.h> #include <linux/btf_ids.h> +#include <linux/bpf_sched.h> #include "disasm.h" @@ -12178,6 +12179,7 @@ int bpf_check_attach_target(struct bpf_verifier_log *log, case BPF_LSM_MAC: case BPF_TRACE_FENTRY: case BPF_TRACE_FEXIT: + case BPF_SCHED: if (!btf_type_is_func(t)) { bpf_log(log, "attach_btf_id %u is not a function\n", btf_id); @@ -12283,7 +12285,8 @@ static int check_attach_btf_id(struct bpf_verifier_env *env) if (prog->type != BPF_PROG_TYPE_TRACING && prog->type != BPF_PROG_TYPE_LSM && - prog->type != BPF_PROG_TYPE_EXT) + prog->type != BPF_PROG_TYPE_EXT && + prog->type != BPF_PROG_TYPE_SCHED) return 0; ret = bpf_check_attach_target(&env->log, prog, tgt_prog, btf_id, &tgt_info); @@ -12323,6 +12326,12 @@ static int check_attach_btf_id(struct bpf_verifier_env *env) return ret; } + if (prog->type == BPF_PROG_TYPE_SCHED) { + ret = bpf_sched_verify_prog(&env->log, prog); + if (ret < 0) + return ret; + } + key = bpf_trampoline_compute_key(tgt_prog, btf_id); tr = bpf_trampoline_get(key, &tgt_info); if (!tr) diff --git a/kernel/sched/Makefile b/kernel/sched/Makefile index 5fc9c9b70862..8ae9e39eb83a 100644 --- a/kernel/sched/Makefile +++ b/kernel/sched/Makefile @@ -36,3 +36,4 @@ obj-$(CONFIG_CPU_FREQ_GOV_SCHEDUTIL) += cpufreq_schedutil.o obj-$(CONFIG_MEMBARRIER) += membarrier.o obj-$(CONFIG_CPU_ISOLATION) += isolation.o obj-$(CONFIG_PSI) += psi.o +obj-$(CONFIG_BPF_SCHED) += bpf_sched.o \ No newline at end of file diff --git a/kernel/sched/bpf_sched.c b/kernel/sched/bpf_sched.c new file mode 100644 index 000000000000..2f05c186cfd0 --- /dev/null +++ b/kernel/sched/bpf_sched.c @@ -0,0 +1,62 @@ +// SPDX-License-Identifier: GPL-2.0 +#include <linux/bpf.h> +#include <linux/cgroup.h> +#include <linux/bpf_verifier.h> +#include <linux/bpf_sched.h> +#include <linux/btf_ids.h> +#include "sched.h" + +/* + * For every hook declare a nop function where a BPF program can be attached. + */ +#define BPF_SCHED_HOOK(RET, DEFAULT, NAME, ...) \ +noinline RET bpf_sched_##NAME(__VA_ARGS__) \ +{ \ + return DEFAULT; \ +} + +#include <linux/sched_hook_defs.h> +#undef BPF_SCHED_HOOK + +#define BPF_SCHED_HOOK(RET, DEFAULT, NAME, ...) BTF_ID(func, bpf_sched_##NAME) +BTF_SET_START(bpf_sched_hooks) +#include <linux/sched_hook_defs.h> +#undef BPF_SCHED_HOOK +BTF_SET_END(bpf_sched_hooks) + +int bpf_sched_verify_prog(struct bpf_verifier_log *vlog, + const struct bpf_prog *prog) +{ + if (!prog->gpl_compatible) { + bpf_log(vlog, + "sched programs must have a GPL compatible license\n"); + return -EINVAL; + } + + if (!btf_id_set_contains(&bpf_sched_hooks, prog->aux->attach_btf_id)) { + bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n", + prog->aux->attach_btf_id, prog->aux->attach_func_name); + return -EINVAL; + } + + return 0; +} + +static const struct bpf_func_proto * +bpf_sched_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) +{ + switch (func_id) { + case BPF_FUNC_trace_printk: + return bpf_get_trace_printk_proto(); + default: + return NULL; + } +} + +const struct bpf_prog_ops bpf_sched_prog_ops = { +}; + +const struct bpf_verifier_ops bpf_sched_verifier_ops = { + .get_func_proto = bpf_sched_func_proto, + .is_valid_access = btf_ctx_access, +}; diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index a44cb5155825..7d7c04f698ec 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -199,6 +199,7 @@ enum bpf_prog_type { BPF_PROG_TYPE_EXT, BPF_PROG_TYPE_LSM, BPF_PROG_TYPE_SK_LOOKUP, + BPF_PROG_TYPE_SCHED, }; enum bpf_attach_type { @@ -240,6 +241,7 @@ enum bpf_attach_type { BPF_XDP_CPUMAP, BPF_SK_LOOKUP, BPF_XDP, + BPF_SCHED, __MAX_BPF_ATTACH_TYPE }; -- 2.20.1

1 7

[PATCH openEuler-22.09 1/7] bpf: sched: basic infrastructure for scheduler bpf
by Zheng Zengkai 22 Jul '22

22 Jul '22

From: Roman Gushchin <guro(a)fb.com> maillist inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5F6X6 CVE: NA Reference: https://lore.kernel.org/all/20210916162451.709260-1-guro@fb.com/ ------------------- This commit introduces basic definitions and infrastructure for scheduler bpf programs. It defines the BPF_PROG_TYPE_SCHED program type and the BPF_SCHED attachment type. The implementation is inspired by lsm bpf programs and is based on kretprobes. This will allow to add new hooks with a minimal changes to the kernel code and without any changes to libbpf/bpftool. It's very convenient as I anticipate a large number of private patches being used for a long time before (or if at all) reaching upstream. Sched programs are expected to return an int, which meaning will be context defined. This patch doesn't add any real scheduler hooks (only a stub), it will be done by following patches in the series. Scheduler bpf programs as now are very restricted in what they can do: only the bpf_printk() helper is available. The scheduler context can impose significant restrictions on what's safe and what's not. So let's extend their abilities on case by case basis when a need arise. Signed-off-by: Roman Gushchin <guro(a)fb.com> Signed-off-by: Chen Hui <judy.chenhui(a)huawei.com> Signed-off-by: Ren Zhijie <renzhijie2(a)huawei.com> --- include/linux/bpf_sched.h | 26 ++++++++++++++ include/linux/bpf_types.h | 4 +++ include/linux/sched_hook_defs.h | 2 ++ include/uapi/linux/bpf.h | 2 ++ init/Kconfig | 10 ++++++ kernel/bpf/btf.c | 1 + kernel/bpf/syscall.c | 9 +++++ kernel/bpf/trampoline.c | 1 + kernel/bpf/verifier.c | 11 +++++- kernel/sched/Makefile | 1 + kernel/sched/bpf_sched.c | 62 +++++++++++++++++++++++++++++++++ tools/include/uapi/linux/bpf.h | 2 ++ 12 files changed, 130 insertions(+), 1 deletion(-) create mode 100644 include/linux/bpf_sched.h create mode 100644 include/linux/sched_hook_defs.h create mode 100644 kernel/sched/bpf_sched.c diff --git a/include/linux/bpf_sched.h b/include/linux/bpf_sched.h new file mode 100644 index 000000000000..874393e6a6aa --- /dev/null +++ b/include/linux/bpf_sched.h @@ -0,0 +1,26 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _LINUX_BPF_SCHED_H +#define _LINUX_BPF_SCHED_H + +#include <linux/bpf.h> + +#ifdef CONFIG_BPF_SCHED + +#define BPF_SCHED_HOOK(RET, DEFAULT, NAME, ...) \ + RET bpf_sched_##NAME(__VA_ARGS__); +#include <linux/sched_hook_defs.h> +#undef BPF_SCHED_HOOK + +int bpf_sched_verify_prog(struct bpf_verifier_log *vlog, + const struct bpf_prog *prog); + +#else /* !CONFIG_BPF_SCHED */ + +static inline int bpf_sched_verify_prog(struct bpf_verifier_log *vlog, + const struct bpf_prog *prog) +{ + return -EOPNOTSUPP; +} + +#endif /* CONFIG_BPF_SCHED */ +#endif /* _LINUX_BPF_SCHED_H */ diff --git a/include/linux/bpf_types.h b/include/linux/bpf_types.h index a8137bb6dd3c..5732b485c539 100644 --- a/include/linux/bpf_types.h +++ b/include/linux/bpf_types.h @@ -77,6 +77,10 @@ BPF_PROG_TYPE(BPF_PROG_TYPE_LSM, lsm, void *, void *) #endif /* CONFIG_BPF_LSM */ #endif +#ifdef CONFIG_BPF_SCHED +BPF_PROG_TYPE(BPF_PROG_TYPE_SCHED, bpf_sched, + void *, void *) +#endif /* CONFIG_BPF_SCHED */ BPF_MAP_TYPE(BPF_MAP_TYPE_ARRAY, array_map_ops) BPF_MAP_TYPE(BPF_MAP_TYPE_PERCPU_ARRAY, percpu_array_map_ops) diff --git a/include/linux/sched_hook_defs.h b/include/linux/sched_hook_defs.h new file mode 100644 index 000000000000..14344004e335 --- /dev/null +++ b/include/linux/sched_hook_defs.h @@ -0,0 +1,2 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +BPF_SCHED_HOOK(int, 0, dummy, void) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 8fae845d80e2..4f8f3f2113a7 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -199,6 +199,7 @@ enum bpf_prog_type { BPF_PROG_TYPE_EXT, BPF_PROG_TYPE_LSM, BPF_PROG_TYPE_SK_LOOKUP, + BPF_PROG_TYPE_SCHED, }; enum bpf_attach_type { @@ -240,6 +241,7 @@ enum bpf_attach_type { BPF_XDP_CPUMAP, BPF_SK_LOOKUP, BPF_XDP, + BPF_SCHED, __MAX_BPF_ATTACH_TYPE }; diff --git a/init/Kconfig b/init/Kconfig index 27c5ed16fef1..c3fa3240d87d 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1749,6 +1749,16 @@ config BPF_LSM If you are unsure how to answer this question, answer N. +config BPF_SCHED + bool "SCHED Instrumentation with BPF" + depends on BPF_EVENTS + depends on BPF_SYSCALL + help + Enables instrumentation of the sched hooks with eBPF programs for + implementing dynamic scheduling Policies. + + If you are unsure how to answer this question, answer N. + config BPF_SYSCALL bool "Enable bpf() system call" select BPF diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index fba28f17e61a..9a0a9895ec62 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -4479,6 +4479,7 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type, return true; t = btf_type_by_id(btf, t->type); break; + case BPF_SCHED: case BPF_MODIFY_RETURN: /* For now the BPF_MODIFY_RETURN can only be attached to * functions that return an int. diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 419dbc3d060e..ff65862ae5ce 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -1997,6 +1997,7 @@ bpf_prog_load_check_attach(enum bpf_prog_type prog_type, case BPF_PROG_TYPE_LSM: case BPF_PROG_TYPE_STRUCT_OPS: case BPF_PROG_TYPE_EXT: + case BPF_PROG_TYPE_SCHED: break; default: return -EINVAL; @@ -2108,6 +2109,7 @@ static bool is_perfmon_prog_type(enum bpf_prog_type prog_type) case BPF_PROG_TYPE_LSM: case BPF_PROG_TYPE_STRUCT_OPS: /* has access to struct sock */ case BPF_PROG_TYPE_EXT: /* extends any prog */ + case BPF_PROG_TYPE_SCHED: return true; default: return false; @@ -2608,6 +2610,12 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog, goto out_put_prog; } break; + case BPF_PROG_TYPE_SCHED: + if (prog->expected_attach_type != BPF_SCHED) { + err = -EINVAL; + goto out_put_prog; + } + break; default: err = -EINVAL; goto out_put_prog; @@ -2838,6 +2846,7 @@ static int bpf_raw_tracepoint_open(const union bpf_attr *attr) case BPF_PROG_TYPE_TRACING: case BPF_PROG_TYPE_EXT: case BPF_PROG_TYPE_LSM: + case BPF_PROG_TYPE_SCHED: if (attr->raw_tracepoint.name) { /* The attach point for this category of programs * should be specified via btf_id during program load. diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c index 986dabc3d11f..cc6ba35a1d14 100644 --- a/kernel/bpf/trampoline.c +++ b/kernel/bpf/trampoline.c @@ -357,6 +357,7 @@ static enum bpf_tramp_prog_type bpf_attach_type_to_tramp(struct bpf_prog *prog) switch (prog->expected_attach_type) { case BPF_TRACE_FENTRY: return BPF_TRAMP_FENTRY; + case BPF_SCHED: case BPF_MODIFY_RETURN: return BPF_TRAMP_MODIFY_RETURN; case BPF_TRACE_FEXIT: diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 6423f1714a2f..d26104b258ba 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -22,6 +22,7 @@ #include <linux/error-injection.h> #include <linux/bpf_lsm.h> #include <linux/btf_ids.h> +#include <linux/bpf_sched.h> #include "disasm.h" @@ -12178,6 +12179,7 @@ int bpf_check_attach_target(struct bpf_verifier_log *log, case BPF_LSM_MAC: case BPF_TRACE_FENTRY: case BPF_TRACE_FEXIT: + case BPF_SCHED: if (!btf_type_is_func(t)) { bpf_log(log, "attach_btf_id %u is not a function\n", btf_id); @@ -12283,7 +12285,8 @@ static int check_attach_btf_id(struct bpf_verifier_env *env) if (prog->type != BPF_PROG_TYPE_TRACING && prog->type != BPF_PROG_TYPE_LSM && - prog->type != BPF_PROG_TYPE_EXT) + prog->type != BPF_PROG_TYPE_EXT && + prog->type != BPF_PROG_TYPE_SCHED) return 0; ret = bpf_check_attach_target(&env->log, prog, tgt_prog, btf_id, &tgt_info); @@ -12323,6 +12326,12 @@ static int check_attach_btf_id(struct bpf_verifier_env *env) return ret; } + if (prog->type == BPF_PROG_TYPE_SCHED) { + ret = bpf_sched_verify_prog(&env->log, prog); + if (ret < 0) + return ret; + } + key = bpf_trampoline_compute_key(tgt_prog, btf_id); tr = bpf_trampoline_get(key, &tgt_info); if (!tr) diff --git a/kernel/sched/Makefile b/kernel/sched/Makefile index 5fc9c9b70862..8ae9e39eb83a 100644 --- a/kernel/sched/Makefile +++ b/kernel/sched/Makefile @@ -36,3 +36,4 @@ obj-$(CONFIG_CPU_FREQ_GOV_SCHEDUTIL) += cpufreq_schedutil.o obj-$(CONFIG_MEMBARRIER) += membarrier.o obj-$(CONFIG_CPU_ISOLATION) += isolation.o obj-$(CONFIG_PSI) += psi.o +obj-$(CONFIG_BPF_SCHED) += bpf_sched.o \ No newline at end of file diff --git a/kernel/sched/bpf_sched.c b/kernel/sched/bpf_sched.c new file mode 100644 index 000000000000..2f05c186cfd0 --- /dev/null +++ b/kernel/sched/bpf_sched.c @@ -0,0 +1,62 @@ +// SPDX-License-Identifier: GPL-2.0 +#include <linux/bpf.h> +#include <linux/cgroup.h> +#include <linux/bpf_verifier.h> +#include <linux/bpf_sched.h> +#include <linux/btf_ids.h> +#include "sched.h" + +/* + * For every hook declare a nop function where a BPF program can be attached. + */ +#define BPF_SCHED_HOOK(RET, DEFAULT, NAME, ...) \ +noinline RET bpf_sched_##NAME(__VA_ARGS__) \ +{ \ + return DEFAULT; \ +} + +#include <linux/sched_hook_defs.h> +#undef BPF_SCHED_HOOK + +#define BPF_SCHED_HOOK(RET, DEFAULT, NAME, ...) BTF_ID(func, bpf_sched_##NAME) +BTF_SET_START(bpf_sched_hooks) +#include <linux/sched_hook_defs.h> +#undef BPF_SCHED_HOOK +BTF_SET_END(bpf_sched_hooks) + +int bpf_sched_verify_prog(struct bpf_verifier_log *vlog, + const struct bpf_prog *prog) +{ + if (!prog->gpl_compatible) { + bpf_log(vlog, + "sched programs must have a GPL compatible license\n"); + return -EINVAL; + } + + if (!btf_id_set_contains(&bpf_sched_hooks, prog->aux->attach_btf_id)) { + bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n", + prog->aux->attach_btf_id, prog->aux->attach_func_name); + return -EINVAL; + } + + return 0; +} + +static const struct bpf_func_proto * +bpf_sched_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) +{ + switch (func_id) { + case BPF_FUNC_trace_printk: + return bpf_get_trace_printk_proto(); + default: + return NULL; + } +} + +const struct bpf_prog_ops bpf_sched_prog_ops = { +}; + +const struct bpf_verifier_ops bpf_sched_verifier_ops = { + .get_func_proto = bpf_sched_func_proto, + .is_valid_access = btf_ctx_access, +}; diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index a44cb5155825..7d7c04f698ec 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -199,6 +199,7 @@ enum bpf_prog_type { BPF_PROG_TYPE_EXT, BPF_PROG_TYPE_LSM, BPF_PROG_TYPE_SK_LOOKUP, + BPF_PROG_TYPE_SCHED, }; enum bpf_attach_type { @@ -240,6 +241,7 @@ enum bpf_attach_type { BPF_XDP_CPUMAP, BPF_SK_LOOKUP, BPF_XDP, + BPF_SCHED, __MAX_BPF_ATTACH_TYPE }; -- 2.20.1

1 6

[PATCH openEuler-1.0-LTS 0/6] sched: Introduce dynamic affinity
by Yongqiang Liu 21 Jul '22

21 Jul '22

*** BLURB HERE *** Hui Tang (6): sched: Introduce dynamic affinity for cfs scheduler cpuset: Introduce new interface for scheduler dynamic affinity sched: Adjust wakeup cpu range according CPU util dynamicly sched: Adjust cpu range in load balance dynamicly sched: Add statistics for scheduler dynamic affinity config: enable CONFIG_QOS_SCHED_DYNAMIC_AFFINITY by default arch/arm64/configs/hulk_defconfig | 1 + arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/hulk_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/sched.h | 36 ++++++ include/linux/sched/sysctl.h | 4 + init/Kconfig | 10 ++ init/init_task.c | 3 + kernel/cgroup/cpuset.c | 151 ++++++++++++++++++++++- kernel/fork.c | 13 ++ kernel/sched/core.c | 103 ++++++++++++++++ kernel/sched/debug.c | 7 ++ kernel/sched/fair.c | 159 +++++++++++++++++++++++++ kernel/sysctl.c | 11 ++ 14 files changed, 500 insertions(+), 1 deletion(-) -- 2.25.1

1 6

[PATCH openEuler-1.0-LTS 1/3] video: fbdev: sm712fb: Fix crash in smtcfb_read()
by Yongqiang Liu 21 Jul '22

21 Jul '22

From: Helge Deller <deller(a)gmx.de> stable inclusion from stable-v4.19.238 commit 1caa40af491dcfe17b3ae870a854388d8ea01984 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5GKWU CVE: CVE-2022-2380 -------------------------------- Zheyu Ma reported this crash in the sm712fb driver when reading three bytes from the framebuffer: BUG: unable to handle page fault for address: ffffc90001ffffff RIP: 0010:smtcfb_read+0x230/0x3e0 Call Trace: vfs_read+0x198/0xa00 ? do_sys_openat2+0x27d/0x350 ? __fget_light+0x54/0x340 ksys_read+0xce/0x190 do_syscall_64+0x43/0x90 Fix it by removing the open-coded endianess fixup-code and by moving the pointer post decrement out the fb_readl() function. Reported-by: Zheyu Ma <zheyuma97(a)gmail.com> Signed-off-by: Helge Deller <deller(a)gmx.de> Tested-by: Zheyu Ma <zheyuma97(a)gmail.com> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xia Longlong <xialonglong1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/video/fbdev/sm712fb.c | 25 +++++++------------------ 1 file changed, 7 insertions(+), 18 deletions(-) diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c index f1dcc6766d1e..0713b8444ecc 100644 --- a/drivers/video/fbdev/sm712fb.c +++ b/drivers/video/fbdev/sm712fb.c @@ -1047,7 +1047,7 @@ static ssize_t smtcfb_read(struct fb_info *info, char __user *buf, if (count + p > total_size) count = total_size - p; - buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, GFP_KERNEL); + buffer = kmalloc(PAGE_SIZE, GFP_KERNEL); if (!buffer) return -ENOMEM; @@ -1059,24 +1059,13 @@ static ssize_t smtcfb_read(struct fb_info *info, char __user *buf, while (count) { c = (count > PAGE_SIZE) ? PAGE_SIZE : count; dst = buffer; - for (i = c >> 2; i--;) { - *dst = fb_readl(src++); - *dst = big_swap(*dst); - dst++; - } - if (c & 3) { - u8 *dst8 = (u8 *)dst; - u8 __iomem *src8 = (u8 __iomem *)src; + for (i = (c + 3) >> 2; i--;) { + u32 val; - for (i = c & 3; i--;) { - if (i & 1) { - *dst8++ = fb_readb(++src8); - } else { - *dst8++ = fb_readb(--src8); - src8 += 2; - } - } - src = (u32 __iomem *)src8; + val = fb_readl(src); + *dst = big_swap(val); + src++; + dst++; } if (copy_to_user(buf, buffer, c)) { -- 2.25.1

1 2

openEuler kernel SIG例会
by openEuler conference 21 Jul '22

21 Jul '22

您好！ Kernel SIG 邀请您参加 2022-07-22 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler kernel SIG例会会议内容： 1、introduce scheduler BPF特性回合评审 2、支持在离线混部任务优先级负载均衡特性回合评审 3、kernel仓支持PR回合补丁介绍 4、kernel仓库瘦身讨论会议链接：https://us06web.zoom.us/j/81074273618?pwd=dTV6UmRETzR6Umd3amU0OFRXVlhndz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-07-22 14:00, The subject of the conference is openEuler kernel SIG例会, Summary: 1、introduce scheduler BPF特性回合评审 2、支持在离线混部任务优先级负载均衡特性回合评审 3、kernel仓支持PR回合补丁介绍 4、kernel仓库瘦身讨论 You can join the meeting at https://us06web.zoom.us/j/81074273618?pwd=dTV6UmRETzR6Umd3amU0OFRXVlhndz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS 1/2] block: don't delete queue kobject before its children
by Yongqiang Liu 20 Jul '22

20 Jul '22

From: Eric Biggers <ebiggers(a)google.com> stable inclusion from linux-4.19.238 commit b2001eb10f59363da930cdd6e086a2861986fa18 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5EWKO CVE: NA -------------------------------- [ Upstream commit 0f69288253e9fc7c495047720e523b9f1aba5712 ] kobjects aren't supposed to be deleted before their child kobjects are deleted. Apparently this is usually benign; however, a WARN will be triggered if one of the child kobjects has a named attribute group: sysfs group 'modes' not found for kobject 'crypto' WARNING: CPU: 0 PID: 1 at fs/sysfs/group.c:278 sysfs_remove_group+0x72/0x80 ... Call Trace: sysfs_remove_groups+0x29/0x40 fs/sysfs/group.c:312 __kobject_del+0x20/0x80 lib/kobject.c:611 kobject_cleanup+0xa4/0x140 lib/kobject.c:696 kobject_release lib/kobject.c:736 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x53/0x70 lib/kobject.c:753 blk_crypto_sysfs_unregister+0x10/0x20 block/blk-crypto-sysfs.c:159 blk_unregister_queue+0xb0/0x110 block/blk-sysfs.c:962 del_gendisk+0x117/0x250 block/genhd.c:610 Fix this by moving the kobject_del() and the corresponding kobject_uevent() to the correct place. Fixes: 2c2086afc2b8 ("block: Protect less code with sysfs_lock in blk_{un,}register_queue()") Reviewed-by: Hannes Reinecke <hare(a)suse.de> Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Eric Biggers <ebiggers(a)google.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20220124215938.2769-3-ebiggers@kernel.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflict: block/blk-sysfs.c Signed-off-by: Zhang Wensheng <zhangwensheng5(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- block/blk-sysfs.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index 6beca7743c11..ee963759ae10 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -1037,8 +1037,6 @@ void blk_unregister_queue(struct gendisk *disk) blk_mq_unregister_dev(disk_to_dev(disk), q); mutex_unlock(&q->sysfs_lock); - kobject_uevent(&q->kobj, KOBJ_REMOVE); - kobject_del(&q->kobj); blk_trace_remove_sysfs(disk_to_dev(disk)); mutex_lock(&q->sysfs_lock); @@ -1046,5 +1044,9 @@ void blk_unregister_queue(struct gendisk *disk) elv_unregister_queue(q); mutex_unlock(&q->sysfs_lock); + /* Now that we've deleted all child objects, we can delete the queue. */ + kobject_uevent(&q->kobj, KOBJ_REMOVE); + kobject_del(&q->kobj); + kobject_put(&disk_to_dev(disk)->kobj); } -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/2] etmem:fix kasan slab-out-of-bounds in do_swapcache_reclaim
by Laibin Qiu 20 Jul '22

20 Jul '22

From: liubo <liubo254(a)huawei.com> euleros inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5GN7K CVE: NA -------------------------------- In the do_swapcache_reclaim interface, there is a slab-out-of-bounds kasan problem; The reason for the problem is that when list_for_each_entry_safe_reverse_from traverses the LRU linked list, it does not consider that next may be equal to the head address, which may lead to the head address being accessed as the page address, causing problems. In response to the above problems, add a judgment about whether pos is head. Signed-off-by: liubo <liubo254(a)huawei.com> Reviewed-by: Miaohe Lin <linmiaohe(a)huawei.com> Reviewed-by: wangkefeng <wangkefeng.wang(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- mm/vmscan.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/mm/vmscan.c b/mm/vmscan.c index 42f24473756b..011827f666cc 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -4555,7 +4555,6 @@ EXPORT_SYMBOL_GPL(get_page_from_vaddr); static int add_page_for_reclaim_swapcache(struct page *page, struct list_head *pagelist, struct lruvec *lruvec, enum lru_list lru) { - struct list_head *src = &lruvec->lists[lru]; struct page *head; /* If the page is mapped by more than one process, do not swap it */ @@ -4574,7 +4573,6 @@ static int add_page_for_reclaim_swapcache(struct page *page, reliable_lru_add(lru, head, -hpage_nr_pages(head)); break; case -EBUSY: - list_move(&head->lru, src); return -1; default: break; @@ -4744,7 +4742,7 @@ int do_swapcache_reclaim(unsigned long *swapcache_watermark, * check if pos page is been released or not in LRU list, if true, * cancel the subsequent page scanning of the current node. */ - if (!pos) { + if (!pos || &pos->lru == src) { spin_unlock_irq(&pgdat->lru_lock); continue; } -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/8] ext4: fix race condition between ext4_ioctl_setflags and ext4_fiemap
by Yongqiang Liu 20 Jul '22

20 Jul '22

From: Baokun Li <libaokun1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187222, https://gitee.com/openeuler/kernel/issues/I5H3KE CVE: NA -------------------------------- Hulk Robot reported a BUG: ================================================================== kernel BUG at fs/ext4/extents_status.c:762! invalid opcode: 0000 [#1] SMP KASAN PTI [...] Call Trace: ext4_cache_extents+0x238/0x2f0 ext4_find_extent+0x785/0xa40 ext4_fiemap+0x36d/0xe90 do_vfs_ioctl+0x6af/0x1200 [...] ================================================================== Above issue may happen as follows: ------------------------------------- cpu1 cpu2 _____________________|_____________________ do_vfs_ioctl ext4_ioctl ext4_ioctl_setflags ext4_ind_migrate do_vfs_ioctl ioctl_fiemap ext4_fiemap ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS) ext4_fill_fiemap_extents down_write(&EXT4_I(inode)->i_data_sem); ext4_ext_check_inode ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS) memset(ei->i_data, 0, sizeof(ei->i_data)) up_write(&EXT4_I(inode)->i_data_sem); down_read(&EXT4_I(inode)->i_data_sem); ext4_find_extent ext4_cache_extents ext4_es_cache_extent BUG_ON(end < lblk) We can easily reproduce this problem with the syzkaller testcase: ``` 02:37:07 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x40086602, &(0x7f0000000080)={0x17e}) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000180)={0x0, 0x1, 0x0, 0xef3, 0x6, []}) (async, rerun: 32) ioctl$FS_IOC_FSSETXATTR(r1, 0x40086602, &(0x7f0000000140)={0x17e}) (rerun: 32) ``` To solve this issue, we use __generic_block_fiemap() instead of generic_block_fiemap() and add inode_lock_shared to avoid race condition. Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/extents.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index d08e6d4afba6..8e5ed3e315cd 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -5267,13 +5267,18 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, return error; } + inode_lock_shared(inode); /* fallback to generic here if not in extents fmt */ - if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) - return generic_block_fiemap(inode, fieinfo, start, len, + if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) { + error = __generic_block_fiemap(inode, fieinfo, start, len, ext4_get_block); + goto out_unlock; + } - if (fiemap_check_flags(fieinfo, EXT4_FIEMAP_FLAGS)) - return -EBADR; + if (fiemap_check_flags(fieinfo, EXT4_FIEMAP_FLAGS)) { + error = -EBADR; + goto out_unlock; + } if (fieinfo->fi_flags & FIEMAP_FLAG_XATTR) { error = ext4_xattr_fiemap(inode, fieinfo); @@ -5294,6 +5299,8 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, error = ext4_fill_fiemap_extents(inode, start_blk, len_blks, fieinfo); } +out_unlock: + inode_unlock_shared(inode); return error; } -- 2.25.1

1 7

[PATCH openEuler-5.10 01/29] crypto: hisilicon/sec - don't sleep when in softirq
by Zheng Zengkai 19 Jul '22

19 Jul '22

From: Zhengchao Shao <shaozhengchao(a)huawei.com> mainline inclusion from mainline-v5.19-rc6 commit 02884a4f12de11f54d4ca67a07dd1f111d96fdbd category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5GEVR CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git/c… -------------------------------- When kunpeng920 encryption driver is used to deencrypt and decrypt packets during the softirq, it is not allowed to use mutex lock. The kernel will report the following error: BUG: scheduling while atomic: swapper/57/0/0x00000300 Call trace: dump_backtrace+0x0/0x1e4 show_stack+0x20/0x2c dump_stack+0xd8/0x140 __schedule_bug+0x68/0x80 __schedule+0x728/0x840 schedule+0x50/0xe0 schedule_preempt_disabled+0x18/0x24 __mutex_lock.constprop.0+0x594/0x5dc __mutex_lock_slowpath+0x1c/0x30 mutex_lock+0x50/0x60 sec_request_init+0x8c/0x1a0 [hisi_sec2] sec_process+0x28/0x1ac [hisi_sec2] sec_skcipher_crypto+0xf4/0x1d4 [hisi_sec2] sec_skcipher_encrypt+0x1c/0x30 [hisi_sec2] crypto_skcipher_encrypt+0x2c/0x40 crypto_authenc_encrypt+0xc8/0xfc [authenc] crypto_aead_encrypt+0x2c/0x40 echainiv_encrypt+0x144/0x1a0 [echainiv] crypto_aead_encrypt+0x2c/0x40 esp_output_tail+0x348/0x5c0 [esp4] esp_output+0x120/0x19c [esp4] xfrm_output_one+0x25c/0x4d4 xfrm_output_resume+0x6c/0x1fc xfrm_output+0xac/0x3c0 xfrm4_output+0x64/0x130 ip_build_and_send_pkt+0x158/0x20c tcp_v4_send_synack+0xdc/0x1f0 tcp_conn_request+0x7d0/0x994 tcp_v4_conn_request+0x58/0x6c tcp_v6_conn_request+0xf0/0x100 tcp_rcv_state_process+0x1cc/0xd60 tcp_v4_do_rcv+0x10c/0x250 tcp_v4_rcv+0xfc4/0x10a4 ip_protocol_deliver_rcu+0xf4/0x200 ip_local_deliver_finish+0x58/0x70 ip_local_deliver+0x68/0x120 ip_sublist_rcv_finish+0x70/0x94 ip_list_rcv_finish.constprop.0+0x17c/0x1d0 ip_sublist_rcv+0x40/0xb0 ip_list_rcv+0x140/0x1dc __netif_receive_skb_list_core+0x154/0x28c __netif_receive_skb_list+0x120/0x1a0 netif_receive_skb_list_internal+0xe4/0x1f0 napi_complete_done+0x70/0x1f0 gro_cell_poll+0x9c/0xb0 napi_poll+0xcc/0x264 net_rx_action+0xd4/0x21c __do_softirq+0x130/0x358 irq_exit+0x11c/0x13c __handle_domain_irq+0x88/0xf0 gic_handle_irq+0x78/0x2c0 el1_irq+0xb8/0x140 arch_cpu_idle+0x18/0x40 default_idle_call+0x5c/0x1c0 cpuidle_idle_call+0x174/0x1b0 do_idle+0xc8/0x160 cpu_startup_entry+0x30/0x11c secondary_start_kernel+0x158/0x1e4 softirq: huh, entered softirq 3 NET_RX 0000000093774ee4 with preempt_count 00000100, exited with fffffe00? Fixes: 416d82204df4 ("crypto: hisilicon - add HiSilicon SEC V2 driver") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/crypto/hisilicon/sec2/sec.h | 2 +- drivers/crypto/hisilicon/sec2/sec_crypto.c | 20 ++++++++++---------- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h index c2e9b01187a7..a44c8dba3cda 100644 --- a/drivers/crypto/hisilicon/sec2/sec.h +++ b/drivers/crypto/hisilicon/sec2/sec.h @@ -119,7 +119,7 @@ struct sec_qp_ctx { struct idr req_idr; struct sec_alg_res res[QM_Q_DEPTH]; struct sec_ctx *ctx; - struct mutex req_lock; + spinlock_t req_lock; struct list_head backlog; struct hisi_acc_sgl_pool *c_in_pool; struct hisi_acc_sgl_pool *c_out_pool; diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c index 6eebe739893c..71dfa7db6394 100644 --- a/drivers/crypto/hisilicon/sec2/sec_crypto.c +++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c @@ -127,11 +127,11 @@ static int sec_alloc_req_id(struct sec_req *req, struct sec_qp_ctx *qp_ctx) { int req_id; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); req_id = idr_alloc_cyclic(&qp_ctx->req_idr, NULL, 0, QM_Q_DEPTH, GFP_ATOMIC); - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); if (unlikely(req_id < 0)) { dev_err(req->ctx->dev, "alloc req id fail!\n"); return req_id; @@ -156,9 +156,9 @@ static void sec_free_req_id(struct sec_req *req) qp_ctx->req_list[req_id] = NULL; req->qp_ctx = NULL; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); idr_remove(&qp_ctx->req_idr, req_id); - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); } static u8 pre_parse_finished_bd(struct bd_status *status, void *resp) @@ -273,7 +273,7 @@ static int sec_bd_send(struct sec_ctx *ctx, struct sec_req *req) !(req->flag & CRYPTO_TFM_REQ_MAY_BACKLOG)) return -EBUSY; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); ret = hisi_qp_send(qp_ctx->qp, &req->sec_sqe); if (ctx->fake_req_limit <= @@ -281,10 +281,10 @@ static int sec_bd_send(struct sec_ctx *ctx, struct sec_req *req) list_add_tail(&req->backlog_head, &qp_ctx->backlog); atomic64_inc(&ctx->sec->debug.dfx.send_cnt); atomic64_inc(&ctx->sec->debug.dfx.send_busy_cnt); - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); return -EBUSY; } - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); if (unlikely(ret == -EBUSY)) return -ENOBUFS; @@ -487,7 +487,7 @@ static int sec_create_qp_ctx(struct hisi_qm *qm, struct sec_ctx *ctx, qp->req_cb = sec_req_cb; - mutex_init(&qp_ctx->req_lock); + spin_lock_init(&qp_ctx->req_lock); idr_init(&qp_ctx->req_idr); INIT_LIST_HEAD(&qp_ctx->backlog); @@ -1382,7 +1382,7 @@ static struct sec_req *sec_back_req_clear(struct sec_ctx *ctx, { struct sec_req *backlog_req = NULL; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); if (ctx->fake_req_limit >= atomic_read(&qp_ctx->qp->qp_status.used) && !list_empty(&qp_ctx->backlog)) { @@ -1390,7 +1390,7 @@ static struct sec_req *sec_back_req_clear(struct sec_ctx *ctx, typeof(*backlog_req), backlog_head); list_del(&backlog_req->backlog_head); } - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); return backlog_req; } -- 2.20.1

1 28

[PATCH openEuler-5.10-LTS 1/5] crypto: hisilicon/sec - don't sleep when in softirq
by Zheng Zengkai 19 Jul '22

19 Jul '22

From: Zhengchao Shao <shaozhengchao(a)huawei.com> mainline inclusion from mainline-v5.19-rc6 commit 02884a4f12de11f54d4ca67a07dd1f111d96fdbd category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5GEVR CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git/c… -------------------------------- When kunpeng920 encryption driver is used to deencrypt and decrypt packets during the softirq, it is not allowed to use mutex lock. The kernel will report the following error: BUG: scheduling while atomic: swapper/57/0/0x00000300 Call trace: dump_backtrace+0x0/0x1e4 show_stack+0x20/0x2c dump_stack+0xd8/0x140 __schedule_bug+0x68/0x80 __schedule+0x728/0x840 schedule+0x50/0xe0 schedule_preempt_disabled+0x18/0x24 __mutex_lock.constprop.0+0x594/0x5dc __mutex_lock_slowpath+0x1c/0x30 mutex_lock+0x50/0x60 sec_request_init+0x8c/0x1a0 [hisi_sec2] sec_process+0x28/0x1ac [hisi_sec2] sec_skcipher_crypto+0xf4/0x1d4 [hisi_sec2] sec_skcipher_encrypt+0x1c/0x30 [hisi_sec2] crypto_skcipher_encrypt+0x2c/0x40 crypto_authenc_encrypt+0xc8/0xfc [authenc] crypto_aead_encrypt+0x2c/0x40 echainiv_encrypt+0x144/0x1a0 [echainiv] crypto_aead_encrypt+0x2c/0x40 esp_output_tail+0x348/0x5c0 [esp4] esp_output+0x120/0x19c [esp4] xfrm_output_one+0x25c/0x4d4 xfrm_output_resume+0x6c/0x1fc xfrm_output+0xac/0x3c0 xfrm4_output+0x64/0x130 ip_build_and_send_pkt+0x158/0x20c tcp_v4_send_synack+0xdc/0x1f0 tcp_conn_request+0x7d0/0x994 tcp_v4_conn_request+0x58/0x6c tcp_v6_conn_request+0xf0/0x100 tcp_rcv_state_process+0x1cc/0xd60 tcp_v4_do_rcv+0x10c/0x250 tcp_v4_rcv+0xfc4/0x10a4 ip_protocol_deliver_rcu+0xf4/0x200 ip_local_deliver_finish+0x58/0x70 ip_local_deliver+0x68/0x120 ip_sublist_rcv_finish+0x70/0x94 ip_list_rcv_finish.constprop.0+0x17c/0x1d0 ip_sublist_rcv+0x40/0xb0 ip_list_rcv+0x140/0x1dc __netif_receive_skb_list_core+0x154/0x28c __netif_receive_skb_list+0x120/0x1a0 netif_receive_skb_list_internal+0xe4/0x1f0 napi_complete_done+0x70/0x1f0 gro_cell_poll+0x9c/0xb0 napi_poll+0xcc/0x264 net_rx_action+0xd4/0x21c __do_softirq+0x130/0x358 irq_exit+0x11c/0x13c __handle_domain_irq+0x88/0xf0 gic_handle_irq+0x78/0x2c0 el1_irq+0xb8/0x140 arch_cpu_idle+0x18/0x40 default_idle_call+0x5c/0x1c0 cpuidle_idle_call+0x174/0x1b0 do_idle+0xc8/0x160 cpu_startup_entry+0x30/0x11c secondary_start_kernel+0x158/0x1e4 softirq: huh, entered softirq 3 NET_RX 0000000093774ee4 with preempt_count 00000100, exited with fffffe00? Fixes: 416d82204df4 ("crypto: hisilicon - add HiSilicon SEC V2 driver") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/crypto/hisilicon/sec2/sec.h | 2 +- drivers/crypto/hisilicon/sec2/sec_crypto.c | 20 ++++++++++---------- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h index d97cf02b1df7..cff00fd29765 100644 --- a/drivers/crypto/hisilicon/sec2/sec.h +++ b/drivers/crypto/hisilicon/sec2/sec.h @@ -119,7 +119,7 @@ struct sec_qp_ctx { struct idr req_idr; struct sec_alg_res res[QM_Q_DEPTH]; struct sec_ctx *ctx; - struct mutex req_lock; + spinlock_t req_lock; struct list_head backlog; struct hisi_acc_sgl_pool *c_in_pool; struct hisi_acc_sgl_pool *c_out_pool; diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c index 9d0a39f60fb2..b2228a935dcd 100644 --- a/drivers/crypto/hisilicon/sec2/sec_crypto.c +++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c @@ -127,11 +127,11 @@ static int sec_alloc_req_id(struct sec_req *req, struct sec_qp_ctx *qp_ctx) { int req_id; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); req_id = idr_alloc_cyclic(&qp_ctx->req_idr, NULL, 0, QM_Q_DEPTH, GFP_ATOMIC); - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); if (unlikely(req_id < 0)) { dev_err(req->ctx->dev, "alloc req id fail!\n"); return req_id; @@ -156,9 +156,9 @@ static void sec_free_req_id(struct sec_req *req) qp_ctx->req_list[req_id] = NULL; req->qp_ctx = NULL; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); idr_remove(&qp_ctx->req_idr, req_id); - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); } static u8 pre_parse_finished_bd(struct bd_status *status, void *resp) @@ -273,7 +273,7 @@ static int sec_bd_send(struct sec_ctx *ctx, struct sec_req *req) !(req->flag & CRYPTO_TFM_REQ_MAY_BACKLOG)) return -EBUSY; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); ret = hisi_qp_send(qp_ctx->qp, &req->sec_sqe); if (ctx->fake_req_limit <= @@ -281,10 +281,10 @@ static int sec_bd_send(struct sec_ctx *ctx, struct sec_req *req) list_add_tail(&req->backlog_head, &qp_ctx->backlog); atomic64_inc(&ctx->sec->debug.dfx.send_cnt); atomic64_inc(&ctx->sec->debug.dfx.send_busy_cnt); - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); return -EBUSY; } - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); if (unlikely(ret == -EBUSY)) return -ENOBUFS; @@ -487,7 +487,7 @@ static int sec_create_qp_ctx(struct hisi_qm *qm, struct sec_ctx *ctx, qp->req_cb = sec_req_cb; - mutex_init(&qp_ctx->req_lock); + spin_lock_init(&qp_ctx->req_lock); idr_init(&qp_ctx->req_idr); INIT_LIST_HEAD(&qp_ctx->backlog); @@ -1382,7 +1382,7 @@ static struct sec_req *sec_back_req_clear(struct sec_ctx *ctx, { struct sec_req *backlog_req = NULL; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); if (ctx->fake_req_limit >= atomic_read(&qp_ctx->qp->qp_status.used) && !list_empty(&qp_ctx->backlog)) { @@ -1390,7 +1390,7 @@ static struct sec_req *sec_back_req_clear(struct sec_ctx *ctx, typeof(*backlog_req), backlog_head); list_del(&backlog_req->backlog_head); } - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); return backlog_req; } -- 2.20.1

1 4

[PATCH openEuler-5.10 01/46] Driver for Zhaoxin CPU core temperature monitoring
by Zheng Zengkai 19 Jul '22

19 Jul '22

From: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> zhaoxin inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I52DS7 CVE: NA -------------------------------------------- Add support for the temperature sensor inside CPU. Supported are all known variants of the Zhaoxin processors. v1: Fix some character encoding mistaken. Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/hwmon/Kconfig | 9 + drivers/hwmon/Makefile | 1 + drivers/hwmon/via-cputemp.c | 1 - drivers/hwmon/zhaoxin-cputemp.c | 292 ++++++++++++++++++++++++++++++++ 4 files changed, 302 insertions(+), 1 deletion(-) create mode 100644 drivers/hwmon/zhaoxin-cputemp.c diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig index 45a1a5969d01..f2fe56e6f8bd 100644 --- a/drivers/hwmon/Kconfig +++ b/drivers/hwmon/Kconfig @@ -1899,6 +1899,15 @@ config SENSORS_VIA_CPUTEMP sensor inside your CPU. Supported are all known variants of the VIA C7 and Nano. +config SENSORS_ZHAOXIN_CPUTEMP + tristate "Zhaoxin CPU temperature sensor" + depends on X86 + select HWMON_VID + help + If you say yes here you get support for the temperature + sensor inside your CPU. Supported are all known variants of + the Zhaoxin processors. + config SENSORS_VIA686A tristate "VIA686A" depends on PCI diff --git a/drivers/hwmon/Makefile b/drivers/hwmon/Makefile index c22a5316bd91..95908c478b94 100644 --- a/drivers/hwmon/Makefile +++ b/drivers/hwmon/Makefile @@ -184,6 +184,7 @@ obj-$(CONFIG_SENSORS_TMP421) += tmp421.o obj-$(CONFIG_SENSORS_TMP513) += tmp513.o obj-$(CONFIG_SENSORS_VEXPRESS) += vexpress-hwmon.o obj-$(CONFIG_SENSORS_VIA_CPUTEMP)+= via-cputemp.o +obj-$(CONFIG_SENSORS_ZHAOXIN_CPUTEMP) += zhaoxin-cputemp.o obj-$(CONFIG_SENSORS_VIA686A) += via686a.o obj-$(CONFIG_SENSORS_VT1211) += vt1211.o obj-$(CONFIG_SENSORS_VT8231) += vt8231.o diff --git a/drivers/hwmon/via-cputemp.c b/drivers/hwmon/via-cputemp.c index e5d18dac8ee7..0a5057dbe51a 100644 --- a/drivers/hwmon/via-cputemp.c +++ b/drivers/hwmon/via-cputemp.c @@ -273,7 +273,6 @@ static const struct x86_cpu_id __initconst cputemp_ids[] = { X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_C7_A, NULL), X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_C7_D, NULL), X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_NANO, NULL), - X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 7, X86_MODEL_ANY, NULL), {} }; MODULE_DEVICE_TABLE(x86cpu, cputemp_ids); diff --git a/drivers/hwmon/zhaoxin-cputemp.c b/drivers/hwmon/zhaoxin-cputemp.c new file mode 100644 index 000000000000..39e729590eba --- /dev/null +++ b/drivers/hwmon/zhaoxin-cputemp.c @@ -0,0 +1,292 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * zhaoxin-cputemp.c - Driver for Zhaoxin CPU core temperature monitoring + */ + +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + +#include <linux/module.h> +#include <linux/init.h> +#include <linux/slab.h> +#include <linux/hwmon.h> +#include <linux/hwmon-vid.h> +#include <linux/sysfs.h> +#include <linux/hwmon-sysfs.h> +#include <linux/err.h> +#include <linux/mutex.h> +#include <linux/list.h> +#include <linux/platform_device.h> +#include <linux/cpu.h> +#include <asm/msr.h> +#include <asm/processor.h> +#include <asm/cpu_device_id.h> + +#define DRVNAME "zhaoxin_cputemp" + +enum { SHOW_TEMP, SHOW_LABEL, SHOW_NAME }; + +/* Functions declaration */ + +struct zhaoxin_cputemp_data { + struct device *hwmon_dev; + const char *name; + u8 vrm; + u32 id; + u32 msr_temp; + u32 msr_vid; +}; + +/* Sysfs stuff */ + +static ssize_t name_show(struct device *dev, struct device_attribute *devattr, + char *buf) +{ + int ret; + struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr); + struct zhaoxin_cputemp_data *data = dev_get_drvdata(dev); + + if (attr->index == SHOW_NAME) + ret = sprintf(buf, "%s\n", data->name); + else /* show label */ + ret = sprintf(buf, "Core %d\n", data->id); + return ret; +} + +static ssize_t temp_show(struct device *dev, struct device_attribute *devattr, char *buf) +{ + struct zhaoxin_cputemp_data *data = dev_get_drvdata(dev); + u32 eax, edx; + int err; + + err = rdmsr_safe_on_cpu(data->id, data->msr_temp, &eax, &edx); + if (err) + return -EAGAIN; + + return sprintf(buf, "%lu\n", ((unsigned long)eax & 0xffffff) * 1000); +} + +static ssize_t cpu0_vid_show(struct device *dev, struct device_attribute *devattr, char *buf) +{ + struct zhaoxin_cputemp_data *data = dev_get_drvdata(dev); + u32 eax, edx; + int err; + + err = rdmsr_safe_on_cpu(data->id, data->msr_vid, &eax, &edx); + if (err) + return -EAGAIN; + + return sprintf(buf, "%d\n", vid_from_reg(~edx & 0x7f, data->vrm)); +} + +static SENSOR_DEVICE_ATTR_RO(temp1_input, temp, SHOW_TEMP); +static SENSOR_DEVICE_ATTR_RO(temp1_label, name, SHOW_LABEL); +static SENSOR_DEVICE_ATTR_RO(name, name, SHOW_NAME); + +static struct attribute *zhaoxin_cputemp_attributes[] = { + &sensor_dev_attr_name.dev_attr.attr, + &sensor_dev_attr_temp1_label.dev_attr.attr, + &sensor_dev_attr_temp1_input.dev_attr.attr, + NULL +}; + +static const struct attribute_group zhaoxin_cputemp_group = { + .attrs = zhaoxin_cputemp_attributes, +}; + +/* Optional attributes */ +static DEVICE_ATTR_RO(cpu0_vid); + +static int zhaoxin_cputemp_probe(struct platform_device *pdev) +{ + struct zhaoxin_cputemp_data *data; + int err; + u32 eax, edx; + + data = devm_kzalloc(&pdev->dev, sizeof(struct zhaoxin_cputemp_data), GFP_KERNEL); + if (!data) + return -ENOMEM; + + data->id = pdev->id; + data->name = "zhaoxin_cputemp"; + data->msr_temp = 0x1423; + + /* test if we can access the TEMPERATURE MSR */ + err = rdmsr_safe_on_cpu(data->id, data->msr_temp, &eax, &edx); + if (err) { + dev_err(&pdev->dev, "Unable to access TEMPERATURE MSR, giving up\n"); + return err; + } + + platform_set_drvdata(pdev, data); + + err = sysfs_create_group(&pdev->dev.kobj, &zhaoxin_cputemp_group); + if (err) + return err; + + if (data->msr_vid) + data->vrm = vid_which_vrm(); + + if (data->vrm) { + err = device_create_file(&pdev->dev, &dev_attr_cpu0_vid); + if (err) + goto exit_remove; + } + + data->hwmon_dev = hwmon_device_register(&pdev->dev); + if (IS_ERR(data->hwmon_dev)) { + err = PTR_ERR(data->hwmon_dev); + dev_err(&pdev->dev, "Class registration failed (%d)\n", err); + goto exit_remove; + } + + return 0; + +exit_remove: + if (data->vrm) + device_remove_file(&pdev->dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&pdev->dev.kobj, &zhaoxin_cputemp_group); + return err; +} + +static int zhaoxin_cputemp_remove(struct platform_device *pdev) +{ + struct zhaoxin_cputemp_data *data = platform_get_drvdata(pdev); + + hwmon_device_unregister(data->hwmon_dev); + if (data->vrm) + device_remove_file(&pdev->dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&pdev->dev.kobj, &zhaoxin_cputemp_group); + return 0; +} + +static struct platform_driver zhaoxin_cputemp_driver = { + .driver = { + .name = DRVNAME, + }, + .probe = zhaoxin_cputemp_probe, + .remove = zhaoxin_cputemp_remove, +}; + +struct pdev_entry { + struct list_head list; + struct platform_device *pdev; + unsigned int cpu; +}; + +static LIST_HEAD(pdev_list); +static DEFINE_MUTEX(pdev_list_mutex); + +static int zhaoxin_cputemp_online(unsigned int cpu) +{ + int err; + struct platform_device *pdev; + struct pdev_entry *pdev_entry; + + pdev = platform_device_alloc(DRVNAME, cpu); + if (!pdev) { + err = -ENOMEM; + pr_err("Device allocation failed\n"); + goto exit; + } + + pdev_entry = kzalloc(sizeof(struct pdev_entry), GFP_KERNEL); + if (!pdev_entry) { + err = -ENOMEM; + goto exit_device_put; + } + + err = platform_device_add(pdev); + if (err) { + pr_err("Device addition failed (%d)\n", err); + goto exit_device_free; + } + + pdev_entry->pdev = pdev; + pdev_entry->cpu = cpu; + mutex_lock(&pdev_list_mutex); + list_add_tail(&pdev_entry->list, &pdev_list); + mutex_unlock(&pdev_list_mutex); + + return 0; + +exit_device_free: + kfree(pdev_entry); +exit_device_put: + platform_device_put(pdev); +exit: + return err; +} + +static int zhaoxin_cputemp_down_prep(unsigned int cpu) +{ + struct pdev_entry *p; + + mutex_lock(&pdev_list_mutex); + list_for_each_entry(p, &pdev_list, list) { + if (p->cpu == cpu) { + platform_device_unregister(p->pdev); + list_del(&p->list); + mutex_unlock(&pdev_list_mutex); + kfree(p); + return 0; + } + } + mutex_unlock(&pdev_list_mutex); + return 0; +} + +static const struct x86_cpu_id __initconst cputemp_ids[] = { + X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 7, X86_MODEL_ANY, NULL), + X86_MATCH_VENDOR_FAM_MODEL(ZHAOXIN, 7, X86_MODEL_ANY, NULL), + {} +}; +MODULE_DEVICE_TABLE(x86cpu, cputemp_ids); + +static enum cpuhp_state zhaoxin_temp_online; + +static int __init zhaoxin_cputemp_init(void) +{ + int err; + + if (!x86_match_cpu(cputemp_ids)) + return -ENODEV; + + err = platform_driver_register(&zhaoxin_cputemp_driver); + if (err) + goto exit; + + err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "hwmon/zhaoxin:online", + zhaoxin_cputemp_online, zhaoxin_cputemp_down_prep); + if (err < 0) + goto exit_driver_unreg; + zhaoxin_temp_online = err; + +#ifndef CONFIG_HOTPLUG_CPU + if (list_empty(&pdev_list)) { + err = -ENODEV; + goto exit_hp_unreg; + } +#endif + return 0; + +#ifndef CONFIG_HOTPLUG_CPU +exit_hp_unreg: + cpuhp_remove_state_nocalls(zhaoxin_temp_online); +#endif +exit_driver_unreg: + platform_driver_unregister(&zhaoxin_cputemp_driver); +exit: + return err; +} + +static void __exit zhaoxin_cputemp_exit(void) +{ + cpuhp_remove_state(zhaoxin_temp_online); + platform_driver_unregister(&zhaoxin_cputemp_driver); +} + +MODULE_DESCRIPTION("Zhaoxin CPU temperature monitor"); +MODULE_LICENSE("GPL"); + +module_init(zhaoxin_cputemp_init) +module_exit(zhaoxin_cputemp_exit) -- 2.20.1

1 45

[PATCH openEuler-5.10-LTS 01/10] Driver for Zhaoxin CPU core temperature monitoring
by Zheng Zengkai 19 Jul '22

19 Jul '22

From: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> zhaoxin inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I52DS7 CVE: NA -------------------------------------------- Add support for the temperature sensor inside CPU. Supported are all known variants of the Zhaoxin processors. v1: Fix some character encoding mistaken. Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/hwmon/Kconfig | 9 + drivers/hwmon/Makefile | 1 + drivers/hwmon/via-cputemp.c | 1 - drivers/hwmon/zhaoxin-cputemp.c | 292 ++++++++++++++++++++++++++++++++ 4 files changed, 302 insertions(+), 1 deletion(-) create mode 100644 drivers/hwmon/zhaoxin-cputemp.c diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig index 45a1a5969d01..f2fe56e6f8bd 100644 --- a/drivers/hwmon/Kconfig +++ b/drivers/hwmon/Kconfig @@ -1899,6 +1899,15 @@ config SENSORS_VIA_CPUTEMP sensor inside your CPU. Supported are all known variants of the VIA C7 and Nano. +config SENSORS_ZHAOXIN_CPUTEMP + tristate "Zhaoxin CPU temperature sensor" + depends on X86 + select HWMON_VID + help + If you say yes here you get support for the temperature + sensor inside your CPU. Supported are all known variants of + the Zhaoxin processors. + config SENSORS_VIA686A tristate "VIA686A" depends on PCI diff --git a/drivers/hwmon/Makefile b/drivers/hwmon/Makefile index c22a5316bd91..95908c478b94 100644 --- a/drivers/hwmon/Makefile +++ b/drivers/hwmon/Makefile @@ -184,6 +184,7 @@ obj-$(CONFIG_SENSORS_TMP421) += tmp421.o obj-$(CONFIG_SENSORS_TMP513) += tmp513.o obj-$(CONFIG_SENSORS_VEXPRESS) += vexpress-hwmon.o obj-$(CONFIG_SENSORS_VIA_CPUTEMP)+= via-cputemp.o +obj-$(CONFIG_SENSORS_ZHAOXIN_CPUTEMP) += zhaoxin-cputemp.o obj-$(CONFIG_SENSORS_VIA686A) += via686a.o obj-$(CONFIG_SENSORS_VT1211) += vt1211.o obj-$(CONFIG_SENSORS_VT8231) += vt8231.o diff --git a/drivers/hwmon/via-cputemp.c b/drivers/hwmon/via-cputemp.c index e5d18dac8ee7..0a5057dbe51a 100644 --- a/drivers/hwmon/via-cputemp.c +++ b/drivers/hwmon/via-cputemp.c @@ -273,7 +273,6 @@ static const struct x86_cpu_id __initconst cputemp_ids[] = { X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_C7_A, NULL), X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_C7_D, NULL), X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_NANO, NULL), - X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 7, X86_MODEL_ANY, NULL), {} }; MODULE_DEVICE_TABLE(x86cpu, cputemp_ids); diff --git a/drivers/hwmon/zhaoxin-cputemp.c b/drivers/hwmon/zhaoxin-cputemp.c new file mode 100644 index 000000000000..39e729590eba --- /dev/null +++ b/drivers/hwmon/zhaoxin-cputemp.c @@ -0,0 +1,292 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * zhaoxin-cputemp.c - Driver for Zhaoxin CPU core temperature monitoring + */ + +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + +#include <linux/module.h> +#include <linux/init.h> +#include <linux/slab.h> +#include <linux/hwmon.h> +#include <linux/hwmon-vid.h> +#include <linux/sysfs.h> +#include <linux/hwmon-sysfs.h> +#include <linux/err.h> +#include <linux/mutex.h> +#include <linux/list.h> +#include <linux/platform_device.h> +#include <linux/cpu.h> +#include <asm/msr.h> +#include <asm/processor.h> +#include <asm/cpu_device_id.h> + +#define DRVNAME "zhaoxin_cputemp" + +enum { SHOW_TEMP, SHOW_LABEL, SHOW_NAME }; + +/* Functions declaration */ + +struct zhaoxin_cputemp_data { + struct device *hwmon_dev; + const char *name; + u8 vrm; + u32 id; + u32 msr_temp; + u32 msr_vid; +}; + +/* Sysfs stuff */ + +static ssize_t name_show(struct device *dev, struct device_attribute *devattr, + char *buf) +{ + int ret; + struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr); + struct zhaoxin_cputemp_data *data = dev_get_drvdata(dev); + + if (attr->index == SHOW_NAME) + ret = sprintf(buf, "%s\n", data->name); + else /* show label */ + ret = sprintf(buf, "Core %d\n", data->id); + return ret; +} + +static ssize_t temp_show(struct device *dev, struct device_attribute *devattr, char *buf) +{ + struct zhaoxin_cputemp_data *data = dev_get_drvdata(dev); + u32 eax, edx; + int err; + + err = rdmsr_safe_on_cpu(data->id, data->msr_temp, &eax, &edx); + if (err) + return -EAGAIN; + + return sprintf(buf, "%lu\n", ((unsigned long)eax & 0xffffff) * 1000); +} + +static ssize_t cpu0_vid_show(struct device *dev, struct device_attribute *devattr, char *buf) +{ + struct zhaoxin_cputemp_data *data = dev_get_drvdata(dev); + u32 eax, edx; + int err; + + err = rdmsr_safe_on_cpu(data->id, data->msr_vid, &eax, &edx); + if (err) + return -EAGAIN; + + return sprintf(buf, "%d\n", vid_from_reg(~edx & 0x7f, data->vrm)); +} + +static SENSOR_DEVICE_ATTR_RO(temp1_input, temp, SHOW_TEMP); +static SENSOR_DEVICE_ATTR_RO(temp1_label, name, SHOW_LABEL); +static SENSOR_DEVICE_ATTR_RO(name, name, SHOW_NAME); + +static struct attribute *zhaoxin_cputemp_attributes[] = { + &sensor_dev_attr_name.dev_attr.attr, + &sensor_dev_attr_temp1_label.dev_attr.attr, + &sensor_dev_attr_temp1_input.dev_attr.attr, + NULL +}; + +static const struct attribute_group zhaoxin_cputemp_group = { + .attrs = zhaoxin_cputemp_attributes, +}; + +/* Optional attributes */ +static DEVICE_ATTR_RO(cpu0_vid); + +static int zhaoxin_cputemp_probe(struct platform_device *pdev) +{ + struct zhaoxin_cputemp_data *data; + int err; + u32 eax, edx; + + data = devm_kzalloc(&pdev->dev, sizeof(struct zhaoxin_cputemp_data), GFP_KERNEL); + if (!data) + return -ENOMEM; + + data->id = pdev->id; + data->name = "zhaoxin_cputemp"; + data->msr_temp = 0x1423; + + /* test if we can access the TEMPERATURE MSR */ + err = rdmsr_safe_on_cpu(data->id, data->msr_temp, &eax, &edx); + if (err) { + dev_err(&pdev->dev, "Unable to access TEMPERATURE MSR, giving up\n"); + return err; + } + + platform_set_drvdata(pdev, data); + + err = sysfs_create_group(&pdev->dev.kobj, &zhaoxin_cputemp_group); + if (err) + return err; + + if (data->msr_vid) + data->vrm = vid_which_vrm(); + + if (data->vrm) { + err = device_create_file(&pdev->dev, &dev_attr_cpu0_vid); + if (err) + goto exit_remove; + } + + data->hwmon_dev = hwmon_device_register(&pdev->dev); + if (IS_ERR(data->hwmon_dev)) { + err = PTR_ERR(data->hwmon_dev); + dev_err(&pdev->dev, "Class registration failed (%d)\n", err); + goto exit_remove; + } + + return 0; + +exit_remove: + if (data->vrm) + device_remove_file(&pdev->dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&pdev->dev.kobj, &zhaoxin_cputemp_group); + return err; +} + +static int zhaoxin_cputemp_remove(struct platform_device *pdev) +{ + struct zhaoxin_cputemp_data *data = platform_get_drvdata(pdev); + + hwmon_device_unregister(data->hwmon_dev); + if (data->vrm) + device_remove_file(&pdev->dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&pdev->dev.kobj, &zhaoxin_cputemp_group); + return 0; +} + +static struct platform_driver zhaoxin_cputemp_driver = { + .driver = { + .name = DRVNAME, + }, + .probe = zhaoxin_cputemp_probe, + .remove = zhaoxin_cputemp_remove, +}; + +struct pdev_entry { + struct list_head list; + struct platform_device *pdev; + unsigned int cpu; +}; + +static LIST_HEAD(pdev_list); +static DEFINE_MUTEX(pdev_list_mutex); + +static int zhaoxin_cputemp_online(unsigned int cpu) +{ + int err; + struct platform_device *pdev; + struct pdev_entry *pdev_entry; + + pdev = platform_device_alloc(DRVNAME, cpu); + if (!pdev) { + err = -ENOMEM; + pr_err("Device allocation failed\n"); + goto exit; + } + + pdev_entry = kzalloc(sizeof(struct pdev_entry), GFP_KERNEL); + if (!pdev_entry) { + err = -ENOMEM; + goto exit_device_put; + } + + err = platform_device_add(pdev); + if (err) { + pr_err("Device addition failed (%d)\n", err); + goto exit_device_free; + } + + pdev_entry->pdev = pdev; + pdev_entry->cpu = cpu; + mutex_lock(&pdev_list_mutex); + list_add_tail(&pdev_entry->list, &pdev_list); + mutex_unlock(&pdev_list_mutex); + + return 0; + +exit_device_free: + kfree(pdev_entry); +exit_device_put: + platform_device_put(pdev); +exit: + return err; +} + +static int zhaoxin_cputemp_down_prep(unsigned int cpu) +{ + struct pdev_entry *p; + + mutex_lock(&pdev_list_mutex); + list_for_each_entry(p, &pdev_list, list) { + if (p->cpu == cpu) { + platform_device_unregister(p->pdev); + list_del(&p->list); + mutex_unlock(&pdev_list_mutex); + kfree(p); + return 0; + } + } + mutex_unlock(&pdev_list_mutex); + return 0; +} + +static const struct x86_cpu_id __initconst cputemp_ids[] = { + X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 7, X86_MODEL_ANY, NULL), + X86_MATCH_VENDOR_FAM_MODEL(ZHAOXIN, 7, X86_MODEL_ANY, NULL), + {} +}; +MODULE_DEVICE_TABLE(x86cpu, cputemp_ids); + +static enum cpuhp_state zhaoxin_temp_online; + +static int __init zhaoxin_cputemp_init(void) +{ + int err; + + if (!x86_match_cpu(cputemp_ids)) + return -ENODEV; + + err = platform_driver_register(&zhaoxin_cputemp_driver); + if (err) + goto exit; + + err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "hwmon/zhaoxin:online", + zhaoxin_cputemp_online, zhaoxin_cputemp_down_prep); + if (err < 0) + goto exit_driver_unreg; + zhaoxin_temp_online = err; + +#ifndef CONFIG_HOTPLUG_CPU + if (list_empty(&pdev_list)) { + err = -ENODEV; + goto exit_hp_unreg; + } +#endif + return 0; + +#ifndef CONFIG_HOTPLUG_CPU +exit_hp_unreg: + cpuhp_remove_state_nocalls(zhaoxin_temp_online); +#endif +exit_driver_unreg: + platform_driver_unregister(&zhaoxin_cputemp_driver); +exit: + return err; +} + +static void __exit zhaoxin_cputemp_exit(void) +{ + cpuhp_remove_state(zhaoxin_temp_online); + platform_driver_unregister(&zhaoxin_cputemp_driver); +} + +MODULE_DESCRIPTION("Zhaoxin CPU temperature monitor"); +MODULE_LICENSE("GPL"); + +module_init(zhaoxin_cputemp_init) +module_exit(zhaoxin_cputemp_exit) -- 2.20.1

1 9

[PATCH openEuler-5.10 00/95] Backport 5.10.112 LTS
by Zheng Zengkai 19 Jul '22

19 Jul '22

Backport 5.10.112 LTS patches from upstream. git cherry-pick v5.10.111..v5.10.112~1 -s Complicts: Already merged(10): 80a4df14643f7 hamradio: defer 6pack kfree after unregister_netdev cfa98ffc42f16 hamradio: remove needs_free_netdev to avoid UAF 5ea00fc60676 ax25: add refcount in ax25_dev to avoid UAF bugs 5ddae8d06441 ax25: fix reference count leaks of ax25_dev 57cc15f5fd55 ax25: fix UAF bugs of net_device caused by rebinding operation b20a5ab0f5fb ax25: Fix refcount leaks caused by ax25_cb_del() a4942c6fea87 ax25: fix UAF bug in ax25_send_control() 145ea8d213e8 ax25: fix NPD bug in ax25_disconnect f934fa478dd1 ax25: Fix NULL pointer dereferences in ax25 timers 5c62d3bf1410 ax25: Fix UAF bugs in ax25 timers Rejected(1, KABI changed and hard to fix): 845f44ce3d9f net/sched: flower: fix parsing of ethertype following VLAN header KABI fixes(2): scsi: iscsi: fix kabi broken in struct iscsi_cls_conn scsi: iscsi: fix kabi broken in struct iscsi_transport Total patches: 104 - 10 - 1 + 2 = 95 Adrian Hunter (1): perf tools: Fix misleading add event PMU debug message Ajish Koshy (2): scsi: pm80xx: Mask and unmask upper interrupt vectors 32-63 scsi: pm80xx: Enable upper inbound, outbound queues Alexey Galakhov (1): scsi: mvsas: Add PCI ID of RocketRaid 2640 Andy Chiu (1): net: axienet: setup mdio unconditionally Anna-Maria Behnsen (1): timers: Fix warning condition in __run_timers() Athira Rajeev (1): testing/selftests/mqueue: Fix mq_perf_tests to free the allocated cpu set Aurabindo Pillai (1): drm/amd: Add USBC connector ID Benedikt Spranger (1): net/sched: taprio: Check if socket flags are valid Borislav Petkov (1): perf/imx_ddr: Fix undefined behavior due to shift overflowing the constant Calvin Johnson (1): net: mdio: Alphabetically sort header inclusion Chandrakanth patil (1): scsi: megaraid_sas: Target with invalid LUN ID is deleted during scan Chao Gao (1): dma-direct: avoid redundant memory sync for swiotlb Charlene Liu (1): drm/amd/display: fix audio format not updated after edid updated Chiawen Huang (1): drm/amd/display: FEC check in timing validation Christian Lamparter (1): ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs Chuck Lever (1): SUNRPC: Fix the svc_deferred_event trace class Cristian Marussi (1): firmware: arm_scmi: Fix sorting of retrieved clock rates Darrick J. Wong (1): btrfs: fix fallocate to use file_modified to update permissions consistently Dinh Nguyen (1): net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link Duoming Zhou (1): drivers: net: slip: fix NPD bug in sl_tx_timeout() Fabio M. De Francesco (1): ALSA: pcm: Test for "silence" field in struct "pcm_format_data" Felix Kuehling (1): drm/amdkfd: Use drm_priv to pass VM from KFD to amdgpu Guillaume Nault (1): veth: Ensure eth header is in skb's linear part Harshit Mogalapalli (1): cifs: potential buffer overflow in handling symlinks James Smart (1): scsi: lpfc: Fix queue failures when recovering from PCI parity error Jason A. Donenfeld (1): gcc-plugins: latent_entropy: use /dev/urandom Jeremy Linton (1): net: bcmgenet: Revert "Use stronger register read/writes to assure ordering" Jia-Ju Bai (1): btrfs: fix root ref counts in error handling in btrfs_get_root_ref Joey Gouly (1): arm64: alternatives: mark patch_alternative() as `noinstr` Johan Hovold (1): memory: renesas-rpc-if: fix platform-device leak in error path Johannes Berg (1): nl80211: correctly check NL80211_ATTR_REG_ALPHA2 size Jonathan Bakker (1): regulator: wm8994: Add an off-on delay for WM8994 variant Josef Bacik (1): btrfs: do not warn for free space inode in cow_file_range Juergen Gross (1): mm, page_alloc: fix build_zonerefs_node() Karsten Graul (1): net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() Khazhismel Kumykov (1): dm mpath: only use ktime_get_ns() in historical selector Kyle Copperfield (1): media: rockchip/rga: do proper error checking in probe Leo (Hanghong) Ma (1): drm/amd/display: Update VTEM Infopacket definition Leo Ruan (1): gpu: ipu-v3: Fix dev_dbg frequency output Li Nan (1): scsi: iscsi: fix kabi broken in struct iscsi_transport Lin Ma (1): nfc: nci: add flush_workqueue to prevent uaf Linus Torvalds (1): gpiolib: acpi: use correct format characters Marcelo Ricardo Leitner (1): net/sched: fix initialization order when updating chain 0 head Marcin Kozlowski (1): net: usb: aqc111: Fix out-of-bounds accesses in RX fixup Mario Limonciello (2): cpuidle: PSCI: Move the `has_lpi` check to the beginning of the function ACPI: processor idle: Check for architectural support for LPI Martin Leung (1): drm/amd/display: Revert FEC check in validation Martin Povišer (1): i2c: pasemi: Wait for write xfers to finish Melissa Wen (1): drm/amd/display: don't ignore alpha property on pre-multiplied mode Miaoqian Lin (1): memory: atmel-ebi: Fix missing of_node_put in atmel_ebi_probe Michael Kelley (1): Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer Michael Walle (1): net: dsa: felix: suppress -EPROBE_DEFER errors Mike Christie (10): scsi: iscsi: Stop queueing during ep_disconnect scsi: iscsi: Force immediate failure during shutdown scsi: iscsi: Use system_unbound_wq for destroy_work scsi: iscsi: Rel ref after iscsi_lookup_endpoint() scsi: iscsi: Fix in-kernel conn failure handling scsi: iscsi: Move iscsi_ep_disconnect() scsi: iscsi: Fix offload conn cleanup when iscsid restarts scsi: iscsi: Fix conn cleanup and stop race during iscsid restart scsi: iscsi: Fix endpoint reuse regression scsi: iscsi: Fix unbound endpoint error handling Mikulas Patocka (1): dm integrity: fix memory corruption when tag_size is less than digest size Minchan Kim (1): mm: fix unexpected zeroed page mapping with zram swap Nadav Amit (1): smp: Fix offline cpu check in flush_smp_call_function_queue() Naohiro Aota (1): btrfs: mark resumed async balance as writing Nathan Chancellor (2): btrfs: remove unused variable in btrfs_{start,write}_dirty_block_groups() ARM: davinci: da850-evm: Avoid NULL pointer dereference Nicolas Dichtel (1): ipv6: fix panic when forwarding a pkt with no in6 dev Patrick Wang (1): mm: kmemleak: take a full lowmem check in kmemleak_*_phys() Paul Gortmaker (1): tick/nohz: Use WARN_ON_ONCE() to prevent console saturation Petr Malat (1): sctp: Initialize daddr on peeled off socket QintaoShen (1): drm/amdkfd: Check for potential null return of kmalloc_array() Rameshkumar Sundaram (1): cfg80211: hold bss_lock while updating nontrans_list Randy Dunlap (1): net: micrel: fix KS8851_MLL Kconfig Rei Yamamoto (1): genirq/affinity: Consider that CPUs on nodes can be unbalanced Rob Clark (2): drm/msm: Add missing put_task_struct() in debugfs path drm/msm: Fix range size vs end confusion Roman Li (1): drm/amd/display: Fix allocate_mst_payload assert on resume Sean Christopherson (1): KVM: x86/mmu: Resolve nx_huge_pages when kvm.ko is loaded Stephen Boyd (1): drm/msm/dsi: Use connector directly in msm_dsi_manager_connector_init() Steve Capper (1): tlb: hugetlb: Add more sizes to tlb_remove_huge_tlb_entry Tao Jin (1): ALSA: hda/realtek: add quirk for Lenovo Thinkpad X12 speakers Tianci Yin (1): drm/amdgpu/vcn: improve vcn dpg stop procedure Tim Crawford (1): ALSA: hda/realtek: Add quirk for Clevo PD50PNT Toke Høiland-Jørgensen (2): ath9k: Properly clear TX status area before reporting to mac80211 ath9k: Fix usage of driver-private space in tx_info Tomasz Moń (1): drm/amdgpu: Enable gfxoff quirk on MacBook Pro Tushar Patel (1): drm/amdkfd: Fix Incorrect VMIDs passed to HWS Tyrel Datwyler (1): scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024 Vadim Pasternak (1): mlxsw: i2c: Fix initialization error flow Xiaoguang Wang (1): scsi: target: tcmu: Fix possible page UAF Xiaomeng Tong (1): myri10ge: fix an incorrect free for skb in myri10ge_sw_tso Zhang Wensheng (1): scsi: iscsi: fix kabi broken in struct iscsi_cls_conn arch/arm/mach-davinci/board-da850-evm.c | 4 +- arch/arm64/kernel/alternative.c | 6 +- arch/arm64/kernel/cpuidle.c | 6 +- arch/x86/include/asm/kvm_host.h | 5 +- arch/x86/kvm/mmu/mmu.c | 20 +- arch/x86/kvm/x86.c | 20 +- drivers/acpi/processor_idle.c | 15 +- drivers/ata/libata-core.c | 3 + drivers/firmware/arm_scmi/clock.c | 3 +- drivers/gpio/gpiolib-acpi.c | 4 +- drivers/gpu/drm/amd/amdgpu/ObjectID.h | 1 + .../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 + drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 3 + drivers/gpu/drm/amd/amdkfd/kfd_device.c | 11 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 2 + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +- .../gpu/drm/amd/display/dc/core/dc_resource.c | 4 +- .../amd/display/dc/dcn10/dcn10_hw_sequencer.c | 14 +- .../drm/amd/display/dc/dcn20/dcn20_hwseq.c | 14 +- .../display/modules/info_packet/info_packet.c | 5 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 2 +- drivers/gpu/drm/msm/dsi/dsi_manager.c | 2 +- drivers/gpu/drm/msm/msm_gem.c | 1 + drivers/gpu/ipu-v3/ipu-di.c | 5 +- drivers/hv/ring_buffer.c | 11 +- drivers/i2c/busses/i2c-pasemi.c | 6 + drivers/infiniband/ulp/iser/iscsi_iser.c | 9 +- drivers/md/dm-historical-service-time.c | 10 +- drivers/md/dm-integrity.c | 7 +- drivers/media/platform/rockchip/rga/rga.c | 2 +- drivers/memory/atmel-ebi.c | 23 +- drivers/memory/renesas-rpc-if.c | 10 +- drivers/net/dsa/ocelot/felix_vsc9959.c | 2 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 4 +- drivers/net/ethernet/mellanox/mlxsw/i2c.c | 1 + drivers/net/ethernet/micrel/Kconfig | 1 + .../net/ethernet/myricom/myri10ge/myri10ge.c | 6 +- .../ethernet/stmicro/stmmac/altr_tse_pcs.c | 8 - .../ethernet/stmicro/stmmac/altr_tse_pcs.h | 4 + .../ethernet/stmicro/stmmac/dwmac-socfpga.c | 13 +- .../net/ethernet/xilinx/xilinx_axienet_main.c | 13 +- drivers/net/mdio/mdio-bcm-unimac.c | 16 +- drivers/net/mdio/mdio-bitbang.c | 4 +- drivers/net/mdio/mdio-cavium.c | 2 +- drivers/net/mdio/mdio-gpio.c | 10 +- drivers/net/mdio/mdio-ipq4019.c | 4 +- drivers/net/mdio/mdio-ipq8064.c | 4 +- drivers/net/mdio/mdio-mscc-miim.c | 8 +- drivers/net/mdio/mdio-mux-bcm-iproc.c | 10 +- drivers/net/mdio/mdio-mux-gpio.c | 8 +- drivers/net/mdio/mdio-mux-mmioreg.c | 6 +- drivers/net/mdio/mdio-mux-multiplexer.c | 2 +- drivers/net/mdio/mdio-mux.c | 6 +- drivers/net/mdio/mdio-octeon.c | 8 +- drivers/net/mdio/mdio-thunder.c | 10 +- drivers/net/mdio/mdio-xgene.c | 6 +- drivers/net/mdio/of_mdio.c | 10 +- drivers/net/slip/slip.c | 2 +- drivers/net/usb/aqc111.c | 9 +- drivers/net/veth.c | 2 +- drivers/net/wireless/ath/ath9k/main.c | 2 +- drivers/net/wireless/ath/ath9k/xmit.c | 33 +- drivers/perf/fsl_imx8_ddr_perf.c | 2 +- drivers/regulator/wm8994-regulator.c | 42 +- drivers/scsi/be2iscsi/be_iscsi.c | 19 +- drivers/scsi/be2iscsi/be_main.c | 8 +- drivers/scsi/bnx2i/bnx2i_iscsi.c | 31 +- drivers/scsi/cxgbi/cxgb3i/cxgb3i.c | 8 +- drivers/scsi/cxgbi/cxgb4i/cxgb4i.c | 8 +- drivers/scsi/cxgbi/libcxgbi.c | 12 +- drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 2 +- drivers/scsi/libiscsi.c | 70 ++- drivers/scsi/lpfc/lpfc_init.c | 2 + drivers/scsi/megaraid/megaraid_sas.h | 3 + drivers/scsi/megaraid/megaraid_sas_base.c | 7 + drivers/scsi/mvsas/mv_init.c | 1 + drivers/scsi/pm8001/pm80xx_hwi.c | 33 +- drivers/scsi/qedi/qedi_iscsi.c | 32 +- drivers/scsi/qla4xxx/ql4_os.c | 8 +- drivers/scsi/scsi_transport_iscsi.c | 587 +++++++++++------- drivers/target/target_core_user.c | 3 +- fs/btrfs/block-group.c | 4 - fs/btrfs/disk-io.c | 5 +- fs/btrfs/file.c | 13 +- fs/btrfs/inode.c | 1 - fs/btrfs/volumes.c | 2 + fs/cifs/link.c | 3 + include/asm-generic/tlb.h | 10 +- include/scsi/iscsi_if.h | 1 + include/scsi/libiscsi.h | 1 + include/scsi/scsi_transport_iscsi.h | 39 +- include/trace/events/sunrpc.h | 7 +- kernel/dma/direct.h | 3 +- kernel/irq/affinity.c | 5 +- kernel/smp.c | 2 +- kernel/time/tick-sched.c | 2 +- kernel/time/timer.c | 11 +- mm/kmemleak.c | 8 +- mm/page_alloc.c | 2 +- mm/page_io.c | 54 -- net/ipv6/ip6_output.c | 2 +- net/nfc/nci/core.c | 4 + net/sched/cls_api.c | 2 +- net/sched/sch_taprio.c | 3 +- net/sctp/socket.c | 2 +- net/smc/smc_pnet.c | 5 +- net/wireless/nl80211.c | 3 +- net/wireless/scan.c | 2 + scripts/gcc-plugins/latent_entropy_plugin.c | 44 +- sound/core/pcm_misc.c | 2 +- sound/pci/hda/patch_realtek.c | 2 + tools/perf/util/parse-events.c | 5 +- .../testing/selftests/mqueue/mq_perf_tests.c | 25 +- 115 files changed, 1046 insertions(+), 565 deletions(-) -- 2.20.1

1 95

[PATCH openEuler-5.10 01/23] mm/sharepool: Allow share THP to kernel
by Zheng Zengkai 19 Jul '22

19 Jul '22

From: Wang Wensheng <wangwensheng4(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5DS9S CVE: NA -------------------------------------------------- This is not used for THP but the user page table is just like THP. The user alloc hugepages via a special driver and its vma is not marked with VM_HUGETLB. This commit allow to share those vma to kernel. Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/share_pool.h | 1 + mm/share_pool.c | 44 +++++++++++++++++++++++++++++++++----- 2 files changed, 40 insertions(+), 5 deletions(-) diff --git a/include/linux/share_pool.h b/include/linux/share_pool.h index 6f294911c6af..d95084b8f624 100644 --- a/include/linux/share_pool.h +++ b/include/linux/share_pool.h @@ -178,6 +178,7 @@ struct sp_walk_data { unsigned long uva_aligned; unsigned long page_size; bool is_hugepage; + bool is_page_type_set; pmd_t *pmd; }; diff --git a/mm/share_pool.c b/mm/share_pool.c index 76088952d0a5..60ad48e238c4 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -2994,9 +2994,40 @@ EXPORT_SYMBOL_GPL(mg_sp_make_share_k2u); static int sp_pmd_entry(pmd_t *pmd, unsigned long addr, unsigned long next, struct mm_walk *walk) { + struct page *page; struct sp_walk_data *sp_walk_data = walk->private; + /* + * There exist a scene in DVPP where the pagetable is huge page but its + * vma doesn't record it, something like THP. + * So we cannot make out whether it is a hugepage map until we access the + * pmd here. If mixed size of pages appear, just return an error. + */ + if (pmd_huge(*pmd)) { + if (!sp_walk_data->is_page_type_set) { + sp_walk_data->is_page_type_set = true; + sp_walk_data->is_hugepage = true; + } else if (!sp_walk_data->is_hugepage) + return -EFAULT; + + /* To skip pte level walk */ + walk->action = ACTION_CONTINUE; + + page = pmd_page(*pmd); + get_page(page); + sp_walk_data->pages[sp_walk_data->page_count++] = page; + + return 0; + } + + if (!sp_walk_data->is_page_type_set) { + sp_walk_data->is_page_type_set = true; + sp_walk_data->is_hugepage = false; + } else if (sp_walk_data->is_hugepage) + return -EFAULT; + sp_walk_data->pmd = pmd; + return 0; } @@ -3140,6 +3171,8 @@ static int __sp_walk_page_range(unsigned long uva, unsigned long size, sp_walk.pmd_entry = sp_pmd_entry; } + sp_walk_data->is_page_type_set = false; + sp_walk_data->page_count = 0; sp_walk_data->page_size = page_size; uva_aligned = ALIGN_DOWN(uva, page_size); sp_walk_data->uva_aligned = uva_aligned; @@ -3164,8 +3197,12 @@ static int __sp_walk_page_range(unsigned long uva, unsigned long size, ret = walk_page_range(mm, uva_aligned, uva_aligned + size_aligned, &sp_walk, sp_walk_data); - if (ret) + if (ret) { + while (sp_walk_data->page_count--) + put_page(pages[sp_walk_data->page_count]); kvfree(pages); + sp_walk_data->pages = NULL; + } return ret; } @@ -3201,9 +3238,7 @@ void *sp_make_share_u2k(unsigned long uva, unsigned long size, int pid) int ret = 0; struct mm_struct *mm = current->mm; void *p = ERR_PTR(-ESRCH); - struct sp_walk_data sp_walk_data = { - .page_count = 0, - }; + struct sp_walk_data sp_walk_data; struct vm_struct *area; check_interrupt_context(); @@ -3544,7 +3579,6 @@ int sp_walk_page_range(unsigned long uva, unsigned long size, return -ESRCH; } - sp_walk_data->page_count = 0; down_write(&mm->mmap_lock); if (likely(!mm->core_state)) ret = __sp_walk_page_range(uva, size, mm, sp_walk_data); -- 2.20.1

1 22

[PATCH openEuler-5.10-LTS 00/94] Backport 5.10.112 LTS
by Zheng Zengkai 18 Jul '22

18 Jul '22

Backport 5.10.112 LTS patches from upstream. git cherry-pick v5.10.111..v5.10.112~1 -s Complicts: Already merged(10): 80a4df14643f7 hamradio: defer 6pack kfree after unregister_netdev cfa98ffc42f16 hamradio: remove needs_free_netdev to avoid UAF 5ea00fc60676 ax25: add refcount in ax25_dev to avoid UAF bugs 5ddae8d06441 ax25: fix reference count leaks of ax25_dev 57cc15f5fd55 ax25: fix UAF bugs of net_device caused by rebinding operation b20a5ab0f5fb ax25: Fix refcount leaks caused by ax25_cb_del() a4942c6fea87 ax25: fix UAF bug in ax25_send_control() 145ea8d213e8 ax25: fix NPD bug in ax25_disconnect f934fa478dd1 ax25: Fix NULL pointer dereferences in ax25 timers 5c62d3bf1410 ax25: Fix UAF bugs in ax25 timers Total patches: 104 - 10 = 94 Adrian Hunter (1): perf tools: Fix misleading add event PMU debug message Ajish Koshy (2): scsi: pm80xx: Mask and unmask upper interrupt vectors 32-63 scsi: pm80xx: Enable upper inbound, outbound queues Alexey Galakhov (1): scsi: mvsas: Add PCI ID of RocketRaid 2640 Andy Chiu (1): net: axienet: setup mdio unconditionally Anna-Maria Behnsen (1): timers: Fix warning condition in __run_timers() Athira Rajeev (1): testing/selftests/mqueue: Fix mq_perf_tests to free the allocated cpu set Aurabindo Pillai (1): drm/amd: Add USBC connector ID Benedikt Spranger (1): net/sched: taprio: Check if socket flags are valid Borislav Petkov (1): perf/imx_ddr: Fix undefined behavior due to shift overflowing the constant Calvin Johnson (1): net: mdio: Alphabetically sort header inclusion Chandrakanth patil (1): scsi: megaraid_sas: Target with invalid LUN ID is deleted during scan Chao Gao (1): dma-direct: avoid redundant memory sync for swiotlb Charlene Liu (1): drm/amd/display: fix audio format not updated after edid updated Chiawen Huang (1): drm/amd/display: FEC check in timing validation Christian Lamparter (1): ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs Chuck Lever (1): SUNRPC: Fix the svc_deferred_event trace class Cristian Marussi (1): firmware: arm_scmi: Fix sorting of retrieved clock rates Darrick J. Wong (1): btrfs: fix fallocate to use file_modified to update permissions consistently Dinh Nguyen (1): net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link Duoming Zhou (1): drivers: net: slip: fix NPD bug in sl_tx_timeout() Fabio M. De Francesco (1): ALSA: pcm: Test for "silence" field in struct "pcm_format_data" Felix Kuehling (1): drm/amdkfd: Use drm_priv to pass VM from KFD to amdgpu Guillaume Nault (1): veth: Ensure eth header is in skb's linear part Harshit Mogalapalli (1): cifs: potential buffer overflow in handling symlinks James Smart (1): scsi: lpfc: Fix queue failures when recovering from PCI parity error Jason A. Donenfeld (1): gcc-plugins: latent_entropy: use /dev/urandom Jeremy Linton (1): net: bcmgenet: Revert "Use stronger register read/writes to assure ordering" Jia-Ju Bai (1): btrfs: fix root ref counts in error handling in btrfs_get_root_ref Joey Gouly (1): arm64: alternatives: mark patch_alternative() as `noinstr` Johan Hovold (1): memory: renesas-rpc-if: fix platform-device leak in error path Johannes Berg (1): nl80211: correctly check NL80211_ATTR_REG_ALPHA2 size Jonathan Bakker (1): regulator: wm8994: Add an off-on delay for WM8994 variant Josef Bacik (1): btrfs: do not warn for free space inode in cow_file_range Juergen Gross (1): mm, page_alloc: fix build_zonerefs_node() Karsten Graul (1): net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() Khazhismel Kumykov (1): dm mpath: only use ktime_get_ns() in historical selector Kyle Copperfield (1): media: rockchip/rga: do proper error checking in probe Leo (Hanghong) Ma (1): drm/amd/display: Update VTEM Infopacket definition Leo Ruan (1): gpu: ipu-v3: Fix dev_dbg frequency output Lin Ma (1): nfc: nci: add flush_workqueue to prevent uaf Linus Torvalds (1): gpiolib: acpi: use correct format characters Marcelo Ricardo Leitner (1): net/sched: fix initialization order when updating chain 0 head Marcin Kozlowski (1): net: usb: aqc111: Fix out-of-bounds accesses in RX fixup Mario Limonciello (2): cpuidle: PSCI: Move the `has_lpi` check to the beginning of the function ACPI: processor idle: Check for architectural support for LPI Martin Leung (1): drm/amd/display: Revert FEC check in validation Martin Povišer (1): i2c: pasemi: Wait for write xfers to finish Melissa Wen (1): drm/amd/display: don't ignore alpha property on pre-multiplied mode Miaoqian Lin (1): memory: atmel-ebi: Fix missing of_node_put in atmel_ebi_probe Michael Kelley (1): Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer Michael Walle (1): net: dsa: felix: suppress -EPROBE_DEFER errors Mike Christie (10): scsi: iscsi: Stop queueing during ep_disconnect scsi: iscsi: Force immediate failure during shutdown scsi: iscsi: Use system_unbound_wq for destroy_work scsi: iscsi: Rel ref after iscsi_lookup_endpoint() scsi: iscsi: Fix in-kernel conn failure handling scsi: iscsi: Move iscsi_ep_disconnect() scsi: iscsi: Fix offload conn cleanup when iscsid restarts scsi: iscsi: Fix conn cleanup and stop race during iscsid restart scsi: iscsi: Fix endpoint reuse regression scsi: iscsi: Fix unbound endpoint error handling Mikulas Patocka (1): dm integrity: fix memory corruption when tag_size is less than digest size Minchan Kim (1): mm: fix unexpected zeroed page mapping with zram swap Nadav Amit (1): smp: Fix offline cpu check in flush_smp_call_function_queue() Naohiro Aota (1): btrfs: mark resumed async balance as writing Nathan Chancellor (2): btrfs: remove unused variable in btrfs_{start,write}_dirty_block_groups() ARM: davinci: da850-evm: Avoid NULL pointer dereference Nicolas Dichtel (1): ipv6: fix panic when forwarding a pkt with no in6 dev Patrick Wang (1): mm: kmemleak: take a full lowmem check in kmemleak_*_phys() Paul Gortmaker (1): tick/nohz: Use WARN_ON_ONCE() to prevent console saturation Petr Malat (1): sctp: Initialize daddr on peeled off socket QintaoShen (1): drm/amdkfd: Check for potential null return of kmalloc_array() Rameshkumar Sundaram (1): cfg80211: hold bss_lock while updating nontrans_list Randy Dunlap (1): net: micrel: fix KS8851_MLL Kconfig Rei Yamamoto (1): genirq/affinity: Consider that CPUs on nodes can be unbalanced Rob Clark (2): drm/msm: Add missing put_task_struct() in debugfs path drm/msm: Fix range size vs end confusion Roman Li (1): drm/amd/display: Fix allocate_mst_payload assert on resume Sean Christopherson (1): KVM: x86/mmu: Resolve nx_huge_pages when kvm.ko is loaded Stephen Boyd (1): drm/msm/dsi: Use connector directly in msm_dsi_manager_connector_init() Steve Capper (1): tlb: hugetlb: Add more sizes to tlb_remove_huge_tlb_entry Tao Jin (1): ALSA: hda/realtek: add quirk for Lenovo Thinkpad X12 speakers Tianci Yin (1): drm/amdgpu/vcn: improve vcn dpg stop procedure Tim Crawford (1): ALSA: hda/realtek: Add quirk for Clevo PD50PNT Toke Høiland-Jørgensen (2): ath9k: Properly clear TX status area before reporting to mac80211 ath9k: Fix usage of driver-private space in tx_info Tomasz Moń (1): drm/amdgpu: Enable gfxoff quirk on MacBook Pro Tushar Patel (1): drm/amdkfd: Fix Incorrect VMIDs passed to HWS Tyrel Datwyler (1): scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024 Vadim Pasternak (1): mlxsw: i2c: Fix initialization error flow Vlad Buslov (1): net/sched: flower: fix parsing of ethertype following VLAN header Xiaoguang Wang (1): scsi: target: tcmu: Fix possible page UAF Xiaomeng Tong (1): myri10ge: fix an incorrect free for skb in myri10ge_sw_tso arch/arm/mach-davinci/board-da850-evm.c | 4 +- arch/arm64/kernel/alternative.c | 6 +- arch/arm64/kernel/cpuidle.c | 6 +- arch/x86/include/asm/kvm_host.h | 5 +- arch/x86/kvm/mmu/mmu.c | 20 +- arch/x86/kvm/x86.c | 20 +- drivers/acpi/processor_idle.c | 15 +- drivers/ata/libata-core.c | 3 + drivers/firmware/arm_scmi/clock.c | 3 +- drivers/gpio/gpiolib-acpi.c | 4 +- drivers/gpu/drm/amd/amdgpu/ObjectID.h | 1 + .../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 + drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 3 + drivers/gpu/drm/amd/amdkfd/kfd_device.c | 11 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 2 + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +- .../gpu/drm/amd/display/dc/core/dc_resource.c | 4 +- .../amd/display/dc/dcn10/dcn10_hw_sequencer.c | 14 +- .../drm/amd/display/dc/dcn20/dcn20_hwseq.c | 14 +- .../display/modules/info_packet/info_packet.c | 5 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 2 +- drivers/gpu/drm/msm/dsi/dsi_manager.c | 2 +- drivers/gpu/drm/msm/msm_gem.c | 1 + drivers/gpu/ipu-v3/ipu-di.c | 5 +- drivers/hv/ring_buffer.c | 11 +- drivers/i2c/busses/i2c-pasemi.c | 6 + drivers/infiniband/ulp/iser/iscsi_iser.c | 2 + drivers/md/dm-historical-service-time.c | 10 +- drivers/md/dm-integrity.c | 7 +- drivers/media/platform/rockchip/rga/rga.c | 2 +- drivers/memory/atmel-ebi.c | 23 +- drivers/memory/renesas-rpc-if.c | 10 +- drivers/net/dsa/ocelot/felix_vsc9959.c | 2 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 4 +- drivers/net/ethernet/mellanox/mlxsw/i2c.c | 1 + drivers/net/ethernet/micrel/Kconfig | 1 + .../net/ethernet/myricom/myri10ge/myri10ge.c | 6 +- .../ethernet/stmicro/stmmac/altr_tse_pcs.c | 8 - .../ethernet/stmicro/stmmac/altr_tse_pcs.h | 4 + .../ethernet/stmicro/stmmac/dwmac-socfpga.c | 13 +- .../net/ethernet/xilinx/xilinx_axienet_main.c | 13 +- drivers/net/mdio/mdio-bcm-unimac.c | 16 +- drivers/net/mdio/mdio-bitbang.c | 4 +- drivers/net/mdio/mdio-cavium.c | 2 +- drivers/net/mdio/mdio-gpio.c | 10 +- drivers/net/mdio/mdio-ipq4019.c | 4 +- drivers/net/mdio/mdio-ipq8064.c | 4 +- drivers/net/mdio/mdio-mscc-miim.c | 8 +- drivers/net/mdio/mdio-mux-bcm-iproc.c | 10 +- drivers/net/mdio/mdio-mux-gpio.c | 8 +- drivers/net/mdio/mdio-mux-mmioreg.c | 6 +- drivers/net/mdio/mdio-mux-multiplexer.c | 2 +- drivers/net/mdio/mdio-mux.c | 6 +- drivers/net/mdio/mdio-octeon.c | 8 +- drivers/net/mdio/mdio-thunder.c | 10 +- drivers/net/mdio/mdio-xgene.c | 6 +- drivers/net/mdio/of_mdio.c | 10 +- drivers/net/slip/slip.c | 2 +- drivers/net/usb/aqc111.c | 9 +- drivers/net/veth.c | 2 +- drivers/net/wireless/ath/ath9k/main.c | 2 +- drivers/net/wireless/ath/ath9k/xmit.c | 33 +- drivers/perf/fsl_imx8_ddr_perf.c | 2 +- drivers/regulator/wm8994-regulator.c | 42 +- drivers/scsi/be2iscsi/be_iscsi.c | 19 +- drivers/scsi/be2iscsi/be_main.c | 1 + drivers/scsi/bnx2i/bnx2i_iscsi.c | 24 +- drivers/scsi/cxgbi/cxgb3i/cxgb3i.c | 1 + drivers/scsi/cxgbi/cxgb4i/cxgb4i.c | 1 + drivers/scsi/cxgbi/libcxgbi.c | 12 +- drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 2 +- drivers/scsi/libiscsi.c | 70 ++- drivers/scsi/lpfc/lpfc_init.c | 2 + drivers/scsi/megaraid/megaraid_sas.h | 3 + drivers/scsi/megaraid/megaraid_sas_base.c | 7 + drivers/scsi/mvsas/mv_init.c | 1 + drivers/scsi/pm8001/pm80xx_hwi.c | 33 +- drivers/scsi/qedi/qedi_iscsi.c | 26 +- drivers/scsi/qla4xxx/ql4_os.c | 2 + drivers/scsi/scsi_transport_iscsi.c | 541 +++++++++++------- drivers/target/target_core_user.c | 3 +- fs/btrfs/block-group.c | 4 - fs/btrfs/disk-io.c | 5 +- fs/btrfs/file.c | 13 +- fs/btrfs/inode.c | 1 - fs/btrfs/volumes.c | 2 + fs/cifs/link.c | 3 + include/asm-generic/tlb.h | 10 +- include/net/flow_dissector.h | 2 + include/scsi/libiscsi.h | 1 + include/scsi/scsi_transport_iscsi.h | 14 +- include/trace/events/sunrpc.h | 7 +- kernel/dma/direct.h | 3 +- kernel/irq/affinity.c | 5 +- kernel/smp.c | 2 +- kernel/time/tick-sched.c | 2 +- kernel/time/timer.c | 11 +- mm/kmemleak.c | 8 +- mm/page_alloc.c | 2 +- mm/page_io.c | 54 -- net/core/flow_dissector.c | 1 + net/ipv6/ip6_output.c | 2 +- net/nfc/nci/core.c | 4 + net/sched/cls_api.c | 2 +- net/sched/cls_flower.c | 18 +- net/sched/sch_taprio.c | 3 +- net/sctp/socket.c | 2 +- net/smc/smc_pnet.c | 5 +- net/wireless/nl80211.c | 3 +- net/wireless/scan.c | 2 + scripts/gcc-plugins/latent_entropy_plugin.c | 44 +- sound/core/pcm_misc.c | 2 +- sound/pci/hda/patch_realtek.c | 2 + tools/perf/util/parse-events.c | 5 +- .../testing/selftests/mqueue/mq_perf_tests.c | 25 +- 117 files changed, 959 insertions(+), 554 deletions(-) -- 2.20.1

1 94

[PATCH openEuler-5.10-LTS 000/166] Backport 5.10.111 LTS
by Zheng Zengkai 14 Jul '22

14 Jul '22

Backport 5.10.111 LTS patches from upstream. Complicts: Already merged(4): 2dc49f58a29c ubifs: Rectify space amount budget for mkdir/tmpfile operations c688705a3978 Revert "NFSv4: Handle the special Linux file open access mode" 2827328e646d io_uring: fix race between timeout flush and removal 4665722d36ad cgroup: Use open-time credentials for process migraton perm checks Context conflict(3): 4820847e8bc2 usb: ehci: add pci device support for Aspeed platforms 8a7ada4b8f5d scsi: hisi_sas: Free irq vectors in order for v3 HW 9de98470db6e arm64: Add part number for Arm Cortex-A78AE Rejected(1): 2f2f017ea873 dm: requeue IO if mapping table not yet available Implement changed(-1+1): d36febbcd537 powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit Added(1): ipv6: fix kabi for mc_forwarding in struct ipv6_devconf Total patches: 170 - 4 - 1 + 1 - 1 + 1 = 166 Adam Wujek (1): clk: si5341: fix reported clk_rate when output divider is 2 Adrian Hunter (1): perf tools: Fix perf's libperf_print callback Aharon Landau (1): RDMA/mlx5: Don't remove cache MRs when a delay is needed Alex Deucher (2): drm/amdkfd: make CRAT table missing message informational only drm/amdgpu/smu10: fix SoC/fclk units in auto mode Alexander Lobakin (1): MIPS: fix fortify panic when copying asm exception handlers Amjad Ouled-Ameur (1): phy: amlogic: meson8b-usb2: Use dev_err_probe() Anatolii Gerasymenko (2): ice: Set txq_teid to ICE_INVAL_TEID on ring creation ice: Do not skip not enabled queues in ice_vc_dis_qs_msg Andre Przywara (1): irqchip/gic, gic-v3: Prevent GSI to SGI translations Andrea Parri (Microsoft) (1): Drivers: hv: vmbus: Replace smp_store_mb() with virt_store_mb() Andreas Gruenbacher (2): gfs2: Check for active reservation in gfs2_release gfs2: gfs2_setattr_size error path fix Andy Gospodarek (1): bnxt_en: reserve space inside receive page for skb_shared_info Anisse Astier (1): drm: Add orientation quirk for GPD Win Max Arnaldo Carvalho de Melo (4): perf build: Don't use -ffat-lto-objects in the python feature test when building with clang-13 perf python: Fix probing for some clang command line options tools build: Filter out options and warnings not supported by clang tools build: Use $(shell ) instead of `` to get embedded libperl's ccopts Avraham Stern (1): cfg80211: don't add non transmitted BSS to 6GHz scanned channels Bob Peterson (1): gfs2: Fix gfs2_release for non-writers regression Chanho Park (1): arm64: Add part number for Arm Cortex-A78AE Chen-Yu Tsai (1): net: stmmac: Fix unset max_speed difference between DT and non-DT platforms Christian Lamparter (1): ata: sata_dwc_460ex: Fix crash due to OOB write Christophe JAILLET (1): scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one() Dale Zhao (1): drm/amd/display: Add signal type check when verify stream backends same Damien Le Moal (5): scsi: pm8001: Fix pm80xx_pci_mem_copy() interface scsi: pm8001: Fix pm8001_mpi_task_abort_resp() scsi: pm8001: Fix task leak in pm8001_send_abort_all() scsi: pm8001: Fix tag leaks on error scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req() Dan Carpenter (1): drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire() David Ahern (1): ipv6: Fix stats accounting in ip6_pkt_drop Denis Nikitin (1): perf session: Remap buf if there is no space for event Dongli Zhang (1): xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 Douglas Miller (1): RDMA/hfi1: Fix use-after-free bug for mm struct Dust Li (1): net/smc: correct settings of RMB window update limit Eric Dumazet (2): ipv6: make mc_forwarding atomic rxrpc: fix a race in rxrpc_exit_net() Ethan Lien (1): btrfs: fix qgroup reserve overflow the qgroup limit Evgeny Boger (1): power: supply: axp20x_battery: properly report current when discharging Fangrui Song (1): arm64: module: remove (NOLOAD) from linker script Guilherme G. Piccoli (1): Drivers: hv: vmbus: Fix potential crash on module unload Guo Ren (1): arm64: patch_text: Fixup last cpu should be master Guo Xuenan (1): lz4: fix LZ4_decompress_safe_partial read out of bound H. Nikolaus Schaller (1): usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm Haimin Zhang (1): jfs: prevent NULL deref in diFree Hangyu Hua (2): mips: ralink: fix a refcount leak in ill_acc_of_setup() powerpc/secvar: fix refcount leak in format_show() Hans de Goede (1): power: supply: axp288-charger: Set Vhold to 4.4V Harold Huang (1): tuntap: add sanity checks about msg_controllen in sendmsg Helge Deller (1): parisc: Fix CPU affinity for Lasi, WAX and Dino chips Hou Wenlong (1): KVM: x86/emulator: Emulate RDPID only if it is enabled in guest Hou Zhiqiang (1): PCI: endpoint: Fix alignment fault error in copy tests Ido Schimmel (1): ipv4: Invalidate neighbour for broadcast address upon address addition Ilan Peer (1): iwlwifi: mvm: Correctly set fragmented EBS Ilya Maximets (2): net: openvswitch: don't send internal clone attribute to the userspace. net: openvswitch: fix leak of nested actions Ivan Vecera (1): ice: Clear default forwarding VSI during VSI release Jakub Kicinski (2): net: account alternate interface name memory net: limit altnames to 64k total Jakub Sitnicki (1): bpf: Make dst_port field in struct bpf_sock 16-bit wide James Clark (1): perf: arm-spe: Fix perf report --mem-mode Jamie Bainbridge (1): qede: confirm skb is allocated before using Jianglei Nie (1): scsi: libfc: Fix use after free in fc_exch_abts_resp() Jiasheng Jiang (2): rtc: wm8350: Handle error for wm8350_register_irq drm/imx: imx-ldb: Check for null pointer after calling kmemdup Jim Mattson (1): KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs Jiri Slaby (1): serial: samsung_tty: do not unlock port->lock for uart_write_wakeup() John David Anglin (1): parisc: Fix patch code locking and flushing Jordy Zomer (1): dm ioctl: prevent potential spectre v1 gadget José Expósito (1): drm/imx: Fix memory leak in imx_pd_connector_get_modes Kaiwen Hu (1): btrfs: prevent subvol with swapfile from being deleted Kalle Valo (1): ath11k: mhi: use mhi_sync_power_up() Kamal Dasu (1): spi: bcm-qspi: fix MSPI only access with bcm_qspi_exec_mem_op() Karol Herbst (1): drm/nouveau/pmu: Add missing callbacks for Tegra devices Kees Cook (1): ubsan: remove CONFIG_UBSAN_OBJECT_SIZE Kefeng Wang (1): powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit Krzysztof Kozlowski (1): MIPS: ingenic: correct unit node address Lee Jones (1): drm/amdkfd: Create file descriptor after client is added to smi_clients list Li Chen (1): PCI: endpoint: Fix misused goto label Lorenzo Bianconi (1): mt76: dma: initialize skip_unmap in mt76_dma_rx_fill Lucas Denefle (1): w1: w1_therm: fixes w1_seq for ds28ea00 sensors Luiz Augusto von Dentz (2): Bluetooth: Fix not checking for valid hdev on bt_dev_{info,warn,err,dbg} Bluetooth: Fix use after free in hci_send_acl Lv Yunlong (1): drbd: Fix five use after free bugs in get_initial_state Maciej Fijalkowski (1): ice: synchronize_rcu() when terminating rings Manivannan Sadhasivam (1): PCI: pciehp: Add Qualcomm quirk for Command Completed erratum Marc Zyngier (1): irqchip/gic-v3: Fix GICR_CTLR.RWP polling Martin Habets (1): sfc: Do not free an empty page_ring Mauricio Faria de Oliveira (1): mm: fix race between MADV_FREE reclaim and blkdev direct IO read Max Filippov (1): xtensa: fix DTC warning unit_address_format Maxim Kiselev (1): powerpc: dts: t104xrdb: fix phy type for FMAN 4/5 Maxim Mikityanskiy (1): bpf: Support dual-stack sockets in bpf_tcp_check_syncookie Maxime Ripard (1): clk: Enforce that disjoints limits are invalid Miaohe Lin (1): mm/mempolicy: fix mpol_new leak in shared_policy_replace Miaoqian Lin (1): dpaa2-ptp: Fix refcount leak in dpaa2_ptp_probe Michael Chan (1): bnxt_en: Eliminate unintended link toggle during FW reset Michael Walle (2): net: sfp: add 2500base-X quirk for Lantech SFP module net: phy: mscc-miim: reject clause 45 register accesses Minghao Chi (CGEL ZTE) (1): Bluetooth: use memset avoid memory leaks Nathan Chancellor (1): x86/Kconfig: Do not allow CONFIG_X86_X32_ABI=y with llvm-objcopy Neal Liu (1): usb: ehci: add pci device support for Aspeed platforms NeilBrown (5): SUNRPC/call_alloc: async tasks mustn't block waiting for memory SUNRPC/xprt: async tasks mustn't block waiting for memory SUNRPC: remove scheduling boost for "SWAPPER" tasks. NFS: swap IO handling is slightly different for O_DIRECT IO NFS: swap-out must always use STABLE writes. Niels Dossche (1): IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition Nikolay Aleksandrov (1): net: ipv4: fix route with nexthop object delete warning Oliver Hartkopp (1): can: isotp: set default value for N_As to 50 micro seconds Pali Rohár (2): PCI: aardvark: Fix support for MSI interrupts Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning" Paolo Bonzini (1): mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) Pavel Begunkov (1): io_uring: don't touch scm_fp_list after queueing skb Pawan Gupta (2): x86/pm: Save the MSR validity status at context setup x86/speculation: Restore speculation related MSRs during S3 resume Peter Xu (1): mm: don't skip swap entry even if zap_details specified Qi Liu (1): scsi: hisi_sas: Free irq vectors in order for v3 HW Qinghua Jin (1): minix: fix bug when opening a file with O_DIRECT Rajneesh Bhardwaj (1): drm/amdgpu: Fix recursive locking warning Randy Dunlap (3): scsi: aha152x: Fix aha152x_setup() __setup handler return value init/main.c: return 1 from handled __setup() functions virtio_console: eliminate anonymous module_init & module_exit Sachin Sant (1): selftests/cgroup: Fix build on older distros Sasha Levin (1): Revert "hv: utils: add PTP_1588_CLOCK to Kconfig to fix build" Sebastian Andrzej Siewior (1): tcp: Don't acquire inet_listen_hashbucket::lock with disabled BH. Shreeya Patel (1): gpio: Restrict usage of GPIO chip irq members before initialization Sourabh Jain (1): powerpc: Set crashkernel offset to mid of RMA region Stefan Wahren (1): staging: vchiq_core: handle NULL result of find_service_by_handle Sven Eckelmann (1): macvtap: advertise link netns via netlink Tejun Heo (3): selftests: cgroup: Make cg_create() use 0755 for permission instead of 0644 selftests: cgroup: Test open-time credential usage for migration checks selftests: cgroup: Test open-time cgroup namespace usage for migration checks Tony Lindgren (2): clk: ti: Preserve node in ti_dt_clocks_register() iommu/omap: Fix regression in probe for NULL pointer dereference Trond Myklebust (7): NFSv4: Protect the state recovery thread against direct reclaim SUNRPC: Fix socket waits for write buffer space NFS: nfsiod should not block forever in mempool_alloc() NFS: Avoid writeback threads getting stuck in mempool_alloc() SUNRPC: Handle ENOMEM in call_transmit_status() SUNRPC: Handle low memory situations in call_status() SUNRPC: svc_tcp_sendmsg() should handle errors from xdr_alloc_bvec() Venkateswara Naralasetty (1): ath11k: fix kernel panic during unload/load ath11k modules Vinod Koul (1): dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error" Waiman Long (1): mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning Wang Yufen (1): netlabel: fix out-of-bounds memory accesses Wayne Chang (2): usb: gadget: tegra-xudc: Do not program SPARAM usb: gadget: tegra-xudc: Fix control endpoint's definitions Wolfram Sang (1): mmc: renesas_sdhi: don't overwrite TAP settings when HS400 tuning is complete Xiaoke Wang (1): staging: wfx: fix an error handling in wfx_init_common() Xiaomeng Tong (1): perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator Xin Xiong (2): drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify() Xiubo Li (1): ceph: fix memory leak in ceph_readdir when note_last_dentry returns error Yang Guang (3): ptp: replace snprintf with sysfs_emit scsi: mvsas: Replace snprintf() with sysfs_emit() scsi: bfa: Replace snprintf() with sysfs_emit() Yang Li (1): mt76: mt7615: Fix assigning negative values to unsigned variable Yann Gautier (1): mmc: mmci: stm32: correctly check all elements of sg list Yonghong Song (1): libbpf: Fix build issue with llvm-readelf Zekun Shen (1): ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 Zheng Zengkai (2): ipv6: fix kabi for mc_forwarding in struct ipv6_devconf Revert "powerpc: Fix virt_addr_valid() check" Zhou Guanghui (1): iommu/arm-smmu-v3: fix event handling soft lockup Ziyang Xuan (1): net/tls: fix slab-out-of-bounds bug in decrypt_internal arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/module.lds.h | 6 +- arch/arm64/kernel/insn.c | 4 +- arch/arm64/kernel/proton-pack.c | 1 + arch/mips/boot/dts/ingenic/jz4780.dtsi | 2 +- arch/mips/include/asm/setup.h | 2 +- arch/mips/kernel/traps.c | 22 +-- arch/mips/ralink/ill_acc.c | 1 + arch/parisc/kernel/patch.c | 25 ++- arch/powerpc/boot/dts/fsl/t104xrdb.dtsi | 4 +- arch/powerpc/include/asm/page.h | 7 +- arch/powerpc/kernel/rtas.c | 6 + arch/powerpc/kernel/secvar-sysfs.c | 9 +- arch/powerpc/kexec/core.c | 15 +- arch/x86/Kconfig | 5 + arch/x86/kvm/emulate.c | 4 +- arch/x86/kvm/kvm_emulate.h | 1 + arch/x86/kvm/svm/pmu.c | 8 +- arch/x86/kvm/x86.c | 6 + arch/x86/power/cpu.c | 21 ++- arch/x86/xen/smp_hvm.c | 6 + arch/x86/xen/time.c | 24 ++- arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi | 8 +- arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi | 8 +- arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi | 4 +- drivers/ata/sata_dwc_460ex.c | 6 +- drivers/block/drbd/drbd_int.h | 8 +- drivers/block/drbd/drbd_nl.c | 41 +++-- drivers/block/drbd/drbd_state.c | 18 +- drivers/block/drbd/drbd_state_change.h | 8 +- drivers/char/virtio_console.c | 8 +- drivers/clk/clk-si5341.c | 16 +- drivers/clk/clk.c | 24 +++ drivers/clk/ti/clk.c | 13 +- drivers/dma/sh/shdma-base.c | 4 +- drivers/gpio/gpiolib.c | 19 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c | 24 ++- .../gpu/drm/amd/display/dc/core/dc_resource.c | 3 + .../drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c | 8 +- .../gpu/drm/drm_panel_orientation_quirks.c | 6 + drivers/gpu/drm/imx/imx-ldb.c | 2 + drivers/gpu/drm/imx/parallel-display.c | 4 +- .../gpu/drm/nouveau/nvkm/subdev/pmu/gm20b.c | 1 + .../gpu/drm/nouveau/nvkm/subdev/pmu/gp102.c | 2 +- .../gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c | 1 + .../gpu/drm/nouveau/nvkm/subdev/pmu/priv.h | 1 + drivers/hv/Kconfig | 1 - drivers/hv/channel_mgmt.c | 6 +- drivers/hv/vmbus_drv.c | 9 +- drivers/infiniband/hw/hfi1/mmu_rb.c | 6 + drivers/infiniband/hw/mlx5/mr.c | 4 +- drivers/infiniband/sw/rdmavt/qp.c | 6 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 1 + drivers/iommu/omap-iommu.c | 2 +- drivers/irqchip/irq-gic-v3.c | 14 +- drivers/irqchip/irq-gic.c | 6 + drivers/md/dm-ioctl.c | 2 + drivers/mmc/host/mmci_stm32_sdmmc.c | 6 +- drivers/mmc/host/renesas_sdhi_core.c | 4 +- drivers/mmc/host/sdhci-xenon.c | 10 -- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 3 +- .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 4 +- .../net/ethernet/freescale/dpaa2/dpaa2-ptp.c | 4 +- drivers/net/ethernet/intel/ice/ice.h | 2 +- drivers/net/ethernet/intel/ice/ice_lib.c | 3 + drivers/net/ethernet/intel/ice/ice_main.c | 4 +- .../net/ethernet/intel/ice/ice_virtchnl_pf.c | 4 +- drivers/net/ethernet/intel/ice/ice_xsk.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 3 + drivers/net/ethernet/sfc/rx_common.c | 3 + .../ethernet/stmicro/stmmac/stmmac_platform.c | 3 +- drivers/net/macvtap.c | 6 + drivers/net/mdio/mdio-mscc-miim.c | 6 + drivers/net/phy/sfp-bus.c | 6 + drivers/net/tap.c | 3 +- drivers/net/tun.c | 3 +- drivers/net/wireless/ath/ath11k/ahb.c | 2 + drivers/net/wireless/ath/ath11k/mhi.c | 2 +- drivers/net/wireless/ath/ath5k/eeprom.c | 3 + drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 5 +- drivers/net/wireless/mediatek/mt76/dma.c | 1 + .../net/wireless/mediatek/mt76/mt7615/mac.c | 2 +- drivers/parisc/dino.c | 41 ++++- drivers/parisc/gsc.c | 31 ++++ drivers/parisc/gsc.h | 1 + drivers/parisc/lasi.c | 7 +- drivers/parisc/wax.c | 7 +- drivers/pci/controller/pci-aardvark.c | 16 +- drivers/pci/endpoint/functions/pci-epf-test.c | 14 +- drivers/pci/hotplug/pciehp_hpc.c | 2 + drivers/perf/qcom_l2_pmu.c | 6 +- drivers/phy/amlogic/phy-meson8b-usb2.c | 5 +- drivers/power/supply/axp20x_battery.c | 13 +- drivers/power/supply/axp288_charger.c | 14 +- drivers/ptp/ptp_sysfs.c | 4 +- drivers/rtc/rtc-wm8350.c | 11 +- drivers/scsi/aha152x.c | 6 +- drivers/scsi/bfa/bfad_attr.c | 26 +-- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 16 +- drivers/scsi/libfc/fc_exch.c | 1 + drivers/scsi/mvsas/mv_init.c | 4 +- drivers/scsi/pm8001/pm8001_hwi.c | 27 ++- drivers/scsi/pm8001/pm8001_sas.c | 2 +- drivers/scsi/pm8001/pm80xx_hwi.c | 17 +- drivers/scsi/zorro7xx.c | 2 + drivers/spi/spi-bcm-qspi.c | 4 +- .../interface/vchiq_arm/vchiq_core.c | 6 + drivers/staging/wfx/main.c | 7 +- drivers/tty/serial/samsung_tty.c | 5 +- drivers/usb/dwc3/dwc3-omap.c | 2 +- drivers/usb/gadget/udc/tegra-xudc.c | 20 +-- drivers/usb/host/ehci-pci.c | 9 + drivers/vhost/net.c | 1 + drivers/w1/slaves/w1_therm.c | 8 +- fs/btrfs/extent_io.h | 2 +- fs/btrfs/inode.c | 22 +++ fs/ceph/dir.c | 11 +- fs/gfs2/bmap.c | 2 +- fs/gfs2/file.c | 3 +- fs/gfs2/inode.c | 2 +- fs/gfs2/rgrp.c | 7 +- fs/gfs2/rgrp.h | 2 +- fs/gfs2/super.c | 2 +- fs/io_uring.c | 8 +- fs/jfs/inode.c | 3 +- fs/minix/inode.c | 3 +- fs/nfs/direct.c | 48 +++-- fs/nfs/file.c | 4 +- fs/nfs/internal.h | 7 + fs/nfs/nfs42proc.c | 9 +- fs/nfs/nfs4state.c | 12 ++ fs/nfs/pagelist.c | 10 +- fs/nfs/pnfs_nfs.c | 8 +- fs/nfs/write.c | 34 ++-- include/linux/gpio/driver.h | 9 + include/linux/ipv6.h | 2 +- include/linux/mmzone.h | 11 +- include/linux/nfs_fs.h | 10 +- include/net/arp.h | 1 + include/net/bluetooth/bluetooth.h | 14 +- include/uapi/linux/bpf.h | 3 +- include/uapi/linux/can/isotp.h | 28 ++- init/main.c | 6 +- lib/lz4/lz4_decompress.c | 8 +- lib/test_ubsan.c | 11 -- mm/memory.c | 25 ++- mm/mempolicy.c | 1 + mm/mremap.c | 3 + mm/rmap.c | 25 ++- net/batman-adv/multicast.c | 2 +- net/bluetooth/hci_event.c | 3 +- net/bluetooth/l2cap_core.c | 1 + net/can/isotp.c | 12 +- net/core/filter.c | 27 ++- net/core/rtnetlink.c | 13 +- net/ipv4/arp.c | 9 +- net/ipv4/fib_frontend.c | 5 +- net/ipv4/fib_semantics.c | 7 +- net/ipv4/inet_hashtables.c | 53 +++--- net/ipv6/addrconf.c | 4 +- net/ipv6/inet6_hashtables.c | 5 +- net/ipv6/ip6_input.c | 2 +- net/ipv6/ip6mr.c | 8 +- net/ipv6/route.c | 2 +- net/netlabel/netlabel_kapi.c | 2 + net/openvswitch/actions.c | 2 +- net/openvswitch/flow_netlink.c | 99 ++++++++++- net/rxrpc/net_ns.c | 2 +- net/smc/smc_core.c | 2 +- net/sunrpc/clnt.c | 7 + net/sunrpc/sched.c | 11 +- net/sunrpc/svcsock.c | 4 +- net/sunrpc/xprt.c | 16 +- net/sunrpc/xprtrdma/transport.c | 6 +- net/sunrpc/xprtsock.c | 54 ++++-- net/tls/tls_sw.c | 2 +- net/wireless/scan.c | 9 +- scripts/Makefile.ubsan | 1 - tools/build/feature/Makefile | 9 +- tools/lib/bpf/Makefile | 4 +- tools/perf/Makefile.config | 6 + tools/perf/arch/arm64/util/arm-spe.c | 6 + tools/perf/perf.c | 2 +- tools/perf/util/session.c | 15 +- tools/perf/util/setup.py | 8 +- tools/testing/selftests/cgroup/cgroup_util.c | 6 +- tools/testing/selftests/cgroup/test_core.c | 165 ++++++++++++++++++ 191 files changed, 1365 insertions(+), 496 deletions(-) -- 2.20.1

1 165

[PATCH openEuler-1.0-LTS 1/5] rcu/tree: Mark functions as notrace
by Yongqiang Liu 14 Jul '22

14 Jul '22

From: Zheng Yejian <zhengyejian1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187209, https://gitee.com/openeuler/kernel/issues/I5GWFT CVE: NA -------------------------------- Syzkaller report a softlockup problem, see following logs: [ 41.463870] watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [ksoftirqd/0:9] [ 41.509763] Modules linked in: [ 41.512295] CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 4.19.90 #13 [ 41.516134] Hardware name: linux,dummy-virt (DT) [ 41.519182] pstate: 80c00005 (Nzcv daif +PAN +UAO) [ 41.522415] pc : perf_trace_buf_alloc+0x138/0x238 [ 41.525583] lr : perf_trace_buf_alloc+0x138/0x238 [ 41.528656] sp : ffff8000c137e880 [ 41.531050] x29: ffff8000c137e880 x28: ffff20000850ced0 [ 41.534759] x27: 0000000000000000 x26: ffff8000c137e9c0 [ 41.538456] x25: ffff8000ce5c2ae0 x24: ffff200008358b08 [ 41.542151] x23: 0000000000000000 x22: ffff2000084a50ac [ 41.545834] x21: ffff8000c137e880 x20: 000000000000001c [ 41.549516] x19: ffff7dffbfdf88e8 x18: 0000000000000000 [ 41.553202] x17: 0000000000000000 x16: 0000000000000000 [ 41.556892] x15: 1ffff00036e07805 x14: 0000000000000000 [ 41.560592] x13: 0000000000000004 x12: 0000000000000000 [ 41.564315] x11: 1fffefbff7fbf120 x10: ffff0fbff7fbf120 [ 41.568003] x9 : dfff200000000000 x8 : ffff7dffbfdf8904 [ 41.571699] x7 : 0000000000000000 x6 : ffff0fbff7fbf121 [ 41.575398] x5 : ffff0fbff7fbf121 x4 : ffff0fbff7fbf121 [ 41.579086] x3 : ffff20000850cdc8 x2 : 0000000000000008 [ 41.582773] x1 : ffff8000c1376000 x0 : 0000000000000100 [ 41.586495] Call trace: [ 41.588922] perf_trace_buf_alloc+0x138/0x238 [ 41.591912] perf_ftrace_function_call+0x1ac/0x248 [ 41.595123] ftrace_ops_no_ops+0x3a4/0x488 [ 41.597998] ftrace_graph_call+0x0/0xc [ 41.600715] rcu_dynticks_curr_cpu_in_eqs+0x14/0x70 [ 41.603962] rcu_is_watching+0xc/0x20 [ 41.606635] ftrace_ops_no_ops+0x240/0x488 [ 41.609530] ftrace_graph_call+0x0/0xc [ 41.612249] __read_once_size_nocheck.constprop.0+0x1c/0x38 [ 41.615905] unwind_frame+0x140/0x358 [ 41.618597] walk_stackframe+0x34/0x60 [ 41.621359] __save_stack_trace+0x204/0x3b8 [ 41.624328] save_stack_trace+0x2c/0x38 [ 41.627112] __kasan_slab_free+0x120/0x228 [ 41.630018] kasan_slab_free+0x10/0x18 [ 41.632752] kfree+0x84/0x250 [ 41.635107] skb_free_head+0x70/0xb0 [ 41.637772] skb_release_data+0x3f8/0x730 [ 41.640626] skb_release_all+0x50/0x68 [ 41.643350] kfree_skb+0x84/0x278 [ 41.645890] kfree_skb_list+0x4c/0x78 [ 41.648595] __dev_queue_xmit+0x1a4c/0x23a0 [ 41.651541] dev_queue_xmit+0x28/0x38 [ 41.654254] ip6_finish_output2+0xeb0/0x1630 [ 41.657261] ip6_finish_output+0x2d8/0x7f8 [ 41.660174] ip6_output+0x19c/0x348 [ 41.663850] mld_sendpack+0x560/0x9e0 [ 41.666564] mld_ifc_timer_expire+0x484/0x8a8 [ 41.669624] call_timer_fn+0x68/0x4b0 [ 41.672355] expire_timers+0x168/0x498 [ 41.675126] run_timer_softirq+0x230/0x7a8 [ 41.678052] __do_softirq+0x2d0/0xba0 [ 41.680763] run_ksoftirqd+0x110/0x1a0 [ 41.683512] smpboot_thread_fn+0x31c/0x620 [ 41.686429] kthread+0x2c8/0x348 [ 41.688927] ret_from_fork+0x10/0x18 Look into above call stack, we found a recursive call in 'ftrace_graph_call', see a snippet: __read_once_size_nocheck.constprop.0 ftrace_graph_call ...... rcu_dynticks_curr_cpu_in_eqs ftrace_graph_call We analyze that 'rcu_dynticks_curr_cpu_in_eqs' should not be tracable, and we verify that mark related functions as 'notrace' can avoid the problem. Comparing mainline kernel, we find that commit ff5c4f5cad33 ("rcu/tree: Mark the idle relevant functions noinstr") mark related functions as 'noinstr' which implies notrace, noinline and sticks things in the .noinstr.text section. Link: https://lore.kernel.org/all/20200416114706.625340212@infradead.org/ Currently 'noinstr' mechanism has not been introduced, so we would not directly backport that commit (otherwise more changes may be introduced). Instead, we mark the functions as 'notrace' where it is 'noinstr' in that commit. Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Reviewed-by: Zhen Lei <thunder.leizhen(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/rcu/tree.c | 22 +++++++++++----------- kernel/rcu/tree_plugin.h | 4 ++-- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c index 594d6ea99024..ea05c59096a2 100644 --- a/kernel/rcu/tree.c +++ b/kernel/rcu/tree.c @@ -275,7 +275,7 @@ static DEFINE_PER_CPU(struct rcu_dynticks, rcu_dynticks) = { * Record entry into an extended quiescent state. This is only to be * called when not already in an extended quiescent state. */ -static void rcu_dynticks_eqs_enter(void) +static notrace void rcu_dynticks_eqs_enter(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); int seq; @@ -298,7 +298,7 @@ static void rcu_dynticks_eqs_enter(void) * Record exit from an extended quiescent state. This is only to be * called from an extended quiescent state. */ -static void rcu_dynticks_eqs_exit(void) +static notrace void rcu_dynticks_eqs_exit(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); int seq; @@ -343,7 +343,7 @@ static void rcu_dynticks_eqs_online(void) * * No ordering, as we are sampling CPU-local information. */ -bool rcu_dynticks_curr_cpu_in_eqs(void) +static __always_inline bool rcu_dynticks_curr_cpu_in_eqs(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); @@ -706,7 +706,7 @@ static struct rcu_node *rcu_get_root(struct rcu_state *rsp) * the possibility of usermode upcalls having messed up our count * of interrupt nesting level during the prior busy period. */ -static void rcu_eqs_enter(bool user) +static notrace void rcu_eqs_enter(bool user) { struct rcu_state *rsp; struct rcu_data *rdp; @@ -763,7 +763,7 @@ void rcu_idle_enter(void) * If you add or remove a call to rcu_user_enter(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_user_enter(void) +notrace void rcu_user_enter(void) { lockdep_assert_irqs_disabled(); rcu_eqs_enter(true); @@ -781,7 +781,7 @@ void rcu_user_enter(void) * If you add or remove a call to rcu_nmi_exit(), be sure to test * with CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_nmi_exit(void) +notrace void rcu_nmi_exit(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); @@ -829,7 +829,7 @@ void rcu_nmi_exit(void) * If you add or remove a call to rcu_irq_exit(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_irq_exit(void) +notrace void rcu_irq_exit(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); @@ -864,7 +864,7 @@ void rcu_irq_exit_irqson(void) * allow for the possibility of usermode upcalls messing up our count of * interrupt nesting level during the busy period that is just now starting. */ -static void rcu_eqs_exit(bool user) +static notrace void rcu_eqs_exit(bool user) { struct rcu_dynticks *rdtp; long oldval; @@ -914,7 +914,7 @@ void rcu_idle_exit(void) * If you add or remove a call to rcu_user_exit(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_user_exit(void) +void notrace rcu_user_exit(void) { rcu_eqs_exit(1); } @@ -932,7 +932,7 @@ void rcu_user_exit(void) * If you add or remove a call to rcu_nmi_enter(), be sure to test * with CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_nmi_enter(void) +notrace void rcu_nmi_enter(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); long incby = 2; @@ -982,7 +982,7 @@ void rcu_nmi_enter(void) * If you add or remove a call to rcu_irq_enter(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_irq_enter(void) +notrace void rcu_irq_enter(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h index 5f6de49dc78e..568818bef28f 100644 --- a/kernel/rcu/tree_plugin.h +++ b/kernel/rcu/tree_plugin.h @@ -2677,7 +2677,7 @@ static void rcu_bind_gp_kthread(void) } /* Record the current task on dyntick-idle entry. */ -static void rcu_dynticks_task_enter(void) +static notrace void rcu_dynticks_task_enter(void) { #if defined(CONFIG_TASKS_RCU) && defined(CONFIG_NO_HZ_FULL) WRITE_ONCE(current->rcu_tasks_idle_cpu, smp_processor_id()); @@ -2685,7 +2685,7 @@ static void rcu_dynticks_task_enter(void) } /* Record no current task on dyntick-idle exit. */ -static void rcu_dynticks_task_exit(void) +static notrace void rcu_dynticks_task_exit(void) { #if defined(CONFIG_TASKS_RCU) && defined(CONFIG_NO_HZ_FULL) WRITE_ONCE(current->rcu_tasks_idle_cpu, -1); -- 2.25.1

1 4

[PATCH openEuler-1.0-LTS 1/5] rcu/tree: Mark functions as notrace
by Yongqiang Liu 14 Jul '22

14 Jul '22

From: Zheng Yejian <zhengyejian1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187209, https://gitee.com/openeuler/kernel/issues/I5GWFT CVE: NA -------------------------------- Syzkaller report a softlockup problem, see following logs: [ 41.463870] watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [ksoftirqd/0:9] [ 41.509763] Modules linked in: [ 41.512295] CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 4.19.90 #13 [ 41.516134] Hardware name: linux,dummy-virt (DT) [ 41.519182] pstate: 80c00005 (Nzcv daif +PAN +UAO) [ 41.522415] pc : perf_trace_buf_alloc+0x138/0x238 [ 41.525583] lr : perf_trace_buf_alloc+0x138/0x238 [ 41.528656] sp : ffff8000c137e880 [ 41.531050] x29: ffff8000c137e880 x28: ffff20000850ced0 [ 41.534759] x27: 0000000000000000 x26: ffff8000c137e9c0 [ 41.538456] x25: ffff8000ce5c2ae0 x24: ffff200008358b08 [ 41.542151] x23: 0000000000000000 x22: ffff2000084a50ac [ 41.545834] x21: ffff8000c137e880 x20: 000000000000001c [ 41.549516] x19: ffff7dffbfdf88e8 x18: 0000000000000000 [ 41.553202] x17: 0000000000000000 x16: 0000000000000000 [ 41.556892] x15: 1ffff00036e07805 x14: 0000000000000000 [ 41.560592] x13: 0000000000000004 x12: 0000000000000000 [ 41.564315] x11: 1fffefbff7fbf120 x10: ffff0fbff7fbf120 [ 41.568003] x9 : dfff200000000000 x8 : ffff7dffbfdf8904 [ 41.571699] x7 : 0000000000000000 x6 : ffff0fbff7fbf121 [ 41.575398] x5 : ffff0fbff7fbf121 x4 : ffff0fbff7fbf121 [ 41.579086] x3 : ffff20000850cdc8 x2 : 0000000000000008 [ 41.582773] x1 : ffff8000c1376000 x0 : 0000000000000100 [ 41.586495] Call trace: [ 41.588922] perf_trace_buf_alloc+0x138/0x238 [ 41.591912] perf_ftrace_function_call+0x1ac/0x248 [ 41.595123] ftrace_ops_no_ops+0x3a4/0x488 [ 41.597998] ftrace_graph_call+0x0/0xc [ 41.600715] rcu_dynticks_curr_cpu_in_eqs+0x14/0x70 [ 41.603962] rcu_is_watching+0xc/0x20 [ 41.606635] ftrace_ops_no_ops+0x240/0x488 [ 41.609530] ftrace_graph_call+0x0/0xc [ 41.612249] __read_once_size_nocheck.constprop.0+0x1c/0x38 [ 41.615905] unwind_frame+0x140/0x358 [ 41.618597] walk_stackframe+0x34/0x60 [ 41.621359] __save_stack_trace+0x204/0x3b8 [ 41.624328] save_stack_trace+0x2c/0x38 [ 41.627112] __kasan_slab_free+0x120/0x228 [ 41.630018] kasan_slab_free+0x10/0x18 [ 41.632752] kfree+0x84/0x250 [ 41.635107] skb_free_head+0x70/0xb0 [ 41.637772] skb_release_data+0x3f8/0x730 [ 41.640626] skb_release_all+0x50/0x68 [ 41.643350] kfree_skb+0x84/0x278 [ 41.645890] kfree_skb_list+0x4c/0x78 [ 41.648595] __dev_queue_xmit+0x1a4c/0x23a0 [ 41.651541] dev_queue_xmit+0x28/0x38 [ 41.654254] ip6_finish_output2+0xeb0/0x1630 [ 41.657261] ip6_finish_output+0x2d8/0x7f8 [ 41.660174] ip6_output+0x19c/0x348 [ 41.663850] mld_sendpack+0x560/0x9e0 [ 41.666564] mld_ifc_timer_expire+0x484/0x8a8 [ 41.669624] call_timer_fn+0x68/0x4b0 [ 41.672355] expire_timers+0x168/0x498 [ 41.675126] run_timer_softirq+0x230/0x7a8 [ 41.678052] __do_softirq+0x2d0/0xba0 [ 41.680763] run_ksoftirqd+0x110/0x1a0 [ 41.683512] smpboot_thread_fn+0x31c/0x620 [ 41.686429] kthread+0x2c8/0x348 [ 41.688927] ret_from_fork+0x10/0x18 Look into above call stack, we found a recursive call in 'ftrace_graph_call', see a snippet: __read_once_size_nocheck.constprop.0 ftrace_graph_call ...... rcu_dynticks_curr_cpu_in_eqs ftrace_graph_call We analyze that 'rcu_dynticks_curr_cpu_in_eqs' should not be tracable, and we verify that mark related functions as 'notrace' can avoid the problem. Comparing mainline kernel, we find that commit ff5c4f5cad33 ("rcu/tree: Mark the idle relevant functions noinstr") mark related functions as 'noinstr' which implies notrace, noinline and sticks things in the .noinstr.text section. Link: https://lore.kernel.org/all/20200416114706.625340212@infradead.org/ Currently 'noinstr' mechanism has not been introduced, so we would not directly backport that commit (otherwise more changes may be introduced). Instead, we mark the functions as 'notrace' where it is 'noinstr' in that commit. Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Reviewed-by: Zhen Lei <thunder.leizhen(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/rcu/tree.c | 22 +++++++++++----------- kernel/rcu/tree_plugin.h | 4 ++-- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c index 594d6ea99024..ea05c59096a2 100644 --- a/kernel/rcu/tree.c +++ b/kernel/rcu/tree.c @@ -275,7 +275,7 @@ static DEFINE_PER_CPU(struct rcu_dynticks, rcu_dynticks) = { * Record entry into an extended quiescent state. This is only to be * called when not already in an extended quiescent state. */ -static void rcu_dynticks_eqs_enter(void) +static notrace void rcu_dynticks_eqs_enter(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); int seq; @@ -298,7 +298,7 @@ static void rcu_dynticks_eqs_enter(void) * Record exit from an extended quiescent state. This is only to be * called from an extended quiescent state. */ -static void rcu_dynticks_eqs_exit(void) +static notrace void rcu_dynticks_eqs_exit(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); int seq; @@ -343,7 +343,7 @@ static void rcu_dynticks_eqs_online(void) * * No ordering, as we are sampling CPU-local information. */ -bool rcu_dynticks_curr_cpu_in_eqs(void) +static __always_inline bool rcu_dynticks_curr_cpu_in_eqs(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); @@ -706,7 +706,7 @@ static struct rcu_node *rcu_get_root(struct rcu_state *rsp) * the possibility of usermode upcalls having messed up our count * of interrupt nesting level during the prior busy period. */ -static void rcu_eqs_enter(bool user) +static notrace void rcu_eqs_enter(bool user) { struct rcu_state *rsp; struct rcu_data *rdp; @@ -763,7 +763,7 @@ void rcu_idle_enter(void) * If you add or remove a call to rcu_user_enter(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_user_enter(void) +notrace void rcu_user_enter(void) { lockdep_assert_irqs_disabled(); rcu_eqs_enter(true); @@ -781,7 +781,7 @@ void rcu_user_enter(void) * If you add or remove a call to rcu_nmi_exit(), be sure to test * with CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_nmi_exit(void) +notrace void rcu_nmi_exit(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); @@ -829,7 +829,7 @@ void rcu_nmi_exit(void) * If you add or remove a call to rcu_irq_exit(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_irq_exit(void) +notrace void rcu_irq_exit(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); @@ -864,7 +864,7 @@ void rcu_irq_exit_irqson(void) * allow for the possibility of usermode upcalls messing up our count of * interrupt nesting level during the busy period that is just now starting. */ -static void rcu_eqs_exit(bool user) +static notrace void rcu_eqs_exit(bool user) { struct rcu_dynticks *rdtp; long oldval; @@ -914,7 +914,7 @@ void rcu_idle_exit(void) * If you add or remove a call to rcu_user_exit(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_user_exit(void) +void notrace rcu_user_exit(void) { rcu_eqs_exit(1); } @@ -932,7 +932,7 @@ void rcu_user_exit(void) * If you add or remove a call to rcu_nmi_enter(), be sure to test * with CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_nmi_enter(void) +notrace void rcu_nmi_enter(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); long incby = 2; @@ -982,7 +982,7 @@ void rcu_nmi_enter(void) * If you add or remove a call to rcu_irq_enter(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_irq_enter(void) +notrace void rcu_irq_enter(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h index 5f6de49dc78e..568818bef28f 100644 --- a/kernel/rcu/tree_plugin.h +++ b/kernel/rcu/tree_plugin.h @@ -2677,7 +2677,7 @@ static void rcu_bind_gp_kthread(void) } /* Record the current task on dyntick-idle entry. */ -static void rcu_dynticks_task_enter(void) +static notrace void rcu_dynticks_task_enter(void) { #if defined(CONFIG_TASKS_RCU) && defined(CONFIG_NO_HZ_FULL) WRITE_ONCE(current->rcu_tasks_idle_cpu, smp_processor_id()); @@ -2685,7 +2685,7 @@ static void rcu_dynticks_task_enter(void) } /* Record no current task on dyntick-idle exit. */ -static void rcu_dynticks_task_exit(void) +static notrace void rcu_dynticks_task_exit(void) { #if defined(CONFIG_TASKS_RCU) && defined(CONFIG_NO_HZ_FULL) WRITE_ONCE(current->rcu_tasks_idle_cpu, -1); -- 2.25.1

1 4

[PATCH openEuler-1.0-LTS 1/4] vt: drop old FONT ioctls
by Yongqiang Liu 13 Jul '22

13 Jul '22

From: Jiri Slaby <jslaby(a)suse.cz> stable inclusion from stable-4.19.250 commit b15d5731b708a2190fec836990b8aefbbf36b07a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5GKVX CVE: CVE-2021-33656 -------------------------------- commit ff2047fb755d4415ec3c70ac799889371151796d upstream. Drop support for these ioctls: * PIO_FONT, PIO_FONTX * GIO_FONT, GIO_FONTX * PIO_FONTRESET As was demonstrated by commit 90bfdeef83f1 (tty: make FONTX ioctl use the tty pointer they were actually passed), these ioctls are not used from userspace, as: 1) they used to be broken (set up font on current console, not the open one) and racy (before the commit above) 2) KDFONTOP ioctl is used for years instead Note that PIO_FONTRESET is defunct on most systems as VGA_CONSOLE is set on them for ages. That turns on BROKEN_GRAPHICS_PROGRAMS which makes PIO_FONTRESET just return an error. We are removing KD_FONT_FLAG_OLD here as it was used only by these removed ioctls. kd.h header exists both in kernel and uapi headers, so we can remove the kernel one completely. Everyone includeing kd.h will now automatically get the uapi one. There are now unused definitions of the ioctl numbers and "struct consolefontdesc" in kd.h, but as it is a uapi header, I am not touching these. Signed-off-by: Jiri Slaby <jslaby(a)suse.cz> Link: https://lore.kernel.org/r/20210105120239.28031-8-jslaby@suse.cz Cc: guodaxing <guodaxing(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/tty/vt/vt.c | 39 +--------- drivers/tty/vt/vt_ioctl.c | 149 -------------------------------------- include/linux/kd.h | 8 -- 3 files changed, 3 insertions(+), 193 deletions(-) delete mode 100644 include/linux/kd.h diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 72e3989dffa6..dca627ccece5 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -4472,16 +4472,8 @@ static int con_font_get(struct vc_data *vc, struct console_font_op *op) if (op->data && font.charcount > op->charcount) rc = -ENOSPC; - if (!(op->flags & KD_FONT_FLAG_OLD)) { - if (font.width > op->width || font.height > op->height) - rc = -ENOSPC; - } else { - if (font.width != 8) - rc = -EIO; - else if ((op->height && font.height > op->height) || - font.height > 32) - rc = -ENOSPC; - } + if (font.width > op->width || font.height > op->height) + rc = -ENOSPC; if (rc) goto out; @@ -4509,7 +4501,7 @@ static int con_font_set(struct vc_data *vc, struct console_font_op *op) return -EINVAL; if (op->charcount > 512) return -EINVAL; - if (op->width <= 0 || op->width > 32 || op->height > 32) + if (op->width <= 0 || op->width > 32 || !op->height || op->height > 32) return -EINVAL; size = (op->width+7)/8 * 32 * op->charcount; if (size > max_font_size) @@ -4519,31 +4511,6 @@ static int con_font_set(struct vc_data *vc, struct console_font_op *op) if (IS_ERR(font.data)) return PTR_ERR(font.data); - if (!op->height) { /* Need to guess font height [compat] */ - int h, i; - u8 *charmap = font.data; - - /* - * If from KDFONTOP ioctl, don't allow things which can be done - * in userland,so that we can get rid of this soon - */ - if (!(op->flags & KD_FONT_FLAG_OLD)) { - kfree(font.data); - return -EINVAL; - } - - for (h = 32; h > 0; h--) - for (i = 0; i < op->charcount; i++) - if (charmap[32*i+h-1]) - goto nonzero; - - kfree(font.data); - return -EINVAL; - - nonzero: - op->height = h; - } - font.charcount = op->charcount; font.width = op->width; font.height = op->height; diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c index 13675008d1c7..915b0173b4f8 100644 --- a/drivers/tty/vt/vt_ioctl.c +++ b/drivers/tty/vt/vt_ioctl.c @@ -241,48 +241,6 @@ int vt_waitactive(int n) #define GPLAST 0x3df #define GPNUM (GPLAST - GPFIRST + 1) - - -static inline int -do_fontx_ioctl(struct vc_data *vc, int cmd, struct consolefontdesc __user *user_cfd, int perm, struct console_font_op *op) -{ - struct consolefontdesc cfdarg; - int i; - - if (copy_from_user(&cfdarg, user_cfd, sizeof(struct consolefontdesc))) - return -EFAULT; - - switch (cmd) { - case PIO_FONTX: - if (!perm) - return -EPERM; - op->op = KD_FONT_OP_SET; - op->flags = KD_FONT_FLAG_OLD; - op->width = 8; - op->height = cfdarg.charheight; - op->charcount = cfdarg.charcount; - op->data = cfdarg.chardata; - return con_font_op(vc, op); - - case GIO_FONTX: - op->op = KD_FONT_OP_GET; - op->flags = KD_FONT_FLAG_OLD; - op->width = 8; - op->height = cfdarg.charheight; - op->charcount = cfdarg.charcount; - op->data = cfdarg.chardata; - i = con_font_op(vc, op); - if (i) - return i; - cfdarg.charheight = op->height; - cfdarg.charcount = op->charcount; - if (copy_to_user(user_cfd, &cfdarg, sizeof(struct consolefontdesc))) - return -EFAULT; - return 0; - } - return -EINVAL; -} - static inline int do_unimap_ioctl(int cmd, struct unimapdesc __user *user_ud, int perm, struct vc_data *vc) { @@ -918,30 +876,6 @@ int vt_ioctl(struct tty_struct *tty, break; } - case PIO_FONT: { - if (!perm) - return -EPERM; - op.op = KD_FONT_OP_SET; - op.flags = KD_FONT_FLAG_OLD | KD_FONT_FLAG_DONT_RECALC; /* Compatibility */ - op.width = 8; - op.height = 0; - op.charcount = 256; - op.data = up; - ret = con_font_op(vc, &op); - break; - } - - case GIO_FONT: { - op.op = KD_FONT_OP_GET; - op.flags = KD_FONT_FLAG_OLD; - op.width = 8; - op.height = 32; - op.charcount = 256; - op.data = up; - ret = con_font_op(vc, &op); - break; - } - case PIO_CMAP: if (!perm) ret = -EPERM; @@ -953,36 +887,6 @@ int vt_ioctl(struct tty_struct *tty, ret = con_get_cmap(up); break; - case PIO_FONTX: - case GIO_FONTX: - ret = do_fontx_ioctl(vc, cmd, up, perm, &op); - break; - - case PIO_FONTRESET: - { - if (!perm) - return -EPERM; - -#ifdef BROKEN_GRAPHICS_PROGRAMS - /* With BROKEN_GRAPHICS_PROGRAMS defined, the default - font is not saved. */ - ret = -ENOSYS; - break; -#else - { - op.op = KD_FONT_OP_SET_DEFAULT; - op.data = NULL; - ret = con_font_op(vc, &op); - if (ret) - break; - console_lock(); - con_set_default_unimap(vc); - console_unlock(); - break; - } -#endif - } - case KDFONTOP: { if (copy_from_user(&op, up, sizeof(op))) { ret = -EFAULT; @@ -1096,54 +1000,6 @@ void vc_SAK(struct work_struct *work) #ifdef CONFIG_COMPAT -struct compat_consolefontdesc { - unsigned short charcount; /* characters in font (256 or 512) */ - unsigned short charheight; /* scan lines per character (1-32) */ - compat_caddr_t chardata; /* font data in expanded form */ -}; - -static inline int -compat_fontx_ioctl(struct vc_data *vc, int cmd, - struct compat_consolefontdesc __user *user_cfd, - int perm, struct console_font_op *op) -{ - struct compat_consolefontdesc cfdarg; - int i; - - if (copy_from_user(&cfdarg, user_cfd, sizeof(struct compat_consolefontdesc))) - return -EFAULT; - - switch (cmd) { - case PIO_FONTX: - if (!perm) - return -EPERM; - op->op = KD_FONT_OP_SET; - op->flags = KD_FONT_FLAG_OLD; - op->width = 8; - op->height = cfdarg.charheight; - op->charcount = cfdarg.charcount; - op->data = compat_ptr(cfdarg.chardata); - return con_font_op(vc, op); - - case GIO_FONTX: - op->op = KD_FONT_OP_GET; - op->flags = KD_FONT_FLAG_OLD; - op->width = 8; - op->height = cfdarg.charheight; - op->charcount = cfdarg.charcount; - op->data = compat_ptr(cfdarg.chardata); - i = con_font_op(vc, op); - if (i) - return i; - cfdarg.charheight = op->height; - cfdarg.charcount = op->charcount; - if (copy_to_user(user_cfd, &cfdarg, sizeof(struct compat_consolefontdesc))) - return -EFAULT; - return 0; - } - return -EINVAL; -} - struct compat_console_font_op { compat_uint_t op; /* operation code KD_FONT_OP_* */ compat_uint_t flags; /* KD_FONT_FLAG_* */ @@ -1221,11 +1077,6 @@ long vt_compat_ioctl(struct tty_struct *tty, /* * these need special handlers for incompatible data structures */ - case PIO_FONTX: - case GIO_FONTX: - ret = compat_fontx_ioctl(vc, cmd, up, perm, &op); - break; - case KDFONTOP: ret = compat_kdfontop_ioctl(up, perm, &op, vc); break; diff --git a/include/linux/kd.h b/include/linux/kd.h deleted file mode 100644 index b130a18f860f..000000000000 --- a/include/linux/kd.h +++ /dev/null @@ -1,8 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -#ifndef _LINUX_KD_H -#define _LINUX_KD_H - -#include <uapi/linux/kd.h> - -#define KD_FONT_FLAG_OLD 0x80000000 /* Invoked via old interface [compat] */ -#endif /* _LINUX_KD_H */ -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS] dm thin: Fix crash in dm_sm_register_threshold_callback()
by Yongqiang Liu 13 Jul '22

13 Jul '22

From: Luo Meng <luomeng12(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5GRX6 CVE: NA -------------------------------- Fault inject on pool metadata device report: BUG: KASAN: use-after-free in dm_pool_register_metadata_threshold+0x40/0x80 Read of size 8 at addr ffff8881b9d50068 by task dmsetup/950 CPU: 7 PID: 950 Comm: dmsetup Tainted: G W 5.19.0-rc6 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_address_description.constprop.0.cold+0xeb/0x3f4 kasan_report.cold+0xe6/0x147 dm_pool_register_metadata_threshold+0x40/0x80 pool_ctr+0xa0a/0x1150 dm_table_add_target+0x2c8/0x640 table_load+0x1fd/0x430 ctl_ioctl+0x2c4/0x5a0 dm_ctl_ioctl+0xa/0x10 __x64_sys_ioctl+0xb3/0xd0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 This can be easy reproduce: echo offline > /sys/block/sda/device/state dd if=/dev/zero of=/dev/mapper/thin bs=4k count=10 dmsetup load pool --table "0 20971520 thin-pool /dev/sda /dev/sdb 128 0 0" If metadata commit failed, the transaction will be aborted and the metadata space manager will be destroyed. If load table on this pool, when register the metadata threshold callback, the UAF will happen on metadata space manager. So return error when load table if the pool is on FAIL status. Fixes: ac8c3f3df65e4 ("dm thin: generate event when metadata threshold passed") Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Luo Meng <luomeng12(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/md/dm-thin-metadata.c | 8 +++++++- drivers/md/dm-thin.c | 4 +++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c index a6a5cee6b943..c3dc171114dc 100644 --- a/drivers/md/dm-thin-metadata.c +++ b/drivers/md/dm-thin-metadata.c @@ -1997,9 +1997,15 @@ int dm_pool_register_metadata_threshold(struct dm_pool_metadata *pmd, int r; down_write(&pmd->root_lock); + if (pmd->fail_io) { + r = -EINVAL; + goto out; + } + r = dm_sm_register_threshold_callback(pmd->metadata_sm, threshold, fn, context); - up_write(&pmd->root_lock); +out: + up_write(&pmd->root_lock); return r; } diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c index 435a2ee4a392..2b6dd7a275eb 100644 --- a/drivers/md/dm-thin.c +++ b/drivers/md/dm-thin.c @@ -3383,8 +3383,10 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv) calc_metadata_threshold(pt), metadata_low_callback, pool); - if (r) + if (r) { + ti->error = "Error registering metadata threshold"; goto out_flags_changed; + } pt->callbacks.congested_fn = pool_is_congested; dm_table_add_target_callbacks(ti->table, &pt->callbacks); -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS 01/21] kabi: deduplication friendly structs
by Zheng Zengkai 13 Jul '22

13 Jul '22

From: Li Lingfeng <lilingfeng3(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5DI4S CVE: NA Reference: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/commit… --------------------------- We don't really need the field names to be globally unique, it is enough when they are unique in the given struct. Since structs do not generally span mutliple files, using the line number is enough to ensure an unique identifier. It means that we can't use two KABI_RENAME macros on the same line but that's not happening anyway. This allows pahole to deduplicate the type info of structs using KABI macros, lowering the size of vmlinuz from 26M to 8.5 Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/kabi.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/include/linux/kabi.h b/include/linux/kabi.h index a52d9fa72cfa..fe3213c0f576 100644 --- a/include/linux/kabi.h +++ b/include/linux/kabi.h @@ -393,6 +393,8 @@ # define __KABI_CHECK_SIZE(_item, _size) #endif +#define KABI_UNIQUE_ID __PASTE(kabi_hidden_, __LINE__) + # define _KABI_DEPRECATE(_type, _orig) _type kabi_reserved_##_orig # define _KABI_DEPRECATE_FN(_type, _orig, _args...) \ _type (* kabi_reserved_##_orig)(_args) @@ -402,7 +404,7 @@ _new; \ struct { \ _orig; \ - } __UNIQUE_ID(kabi_hide); \ + } KABI_UNIQUE_ID; \ __KABI_CHECK_SIZE_ALIGN(_orig, _new); \ } #else -- 2.20.1

1 20

[PATCH openEuler-1.0-LTS 1/6] xen/blkfront: fix memory allocation flags in blkfront_setup_indirect()
by Yongqiang Liu 13 Jul '22

13 Jul '22

From: Juergen Gross <jgross(a)suse.com> stable inclusion from stable-v4.19.116 commit 5f547e7cbd8435be3aa2a27e2ae594b4fd94865b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5GLXT CVE: CVE-2022-26365 -------------------------------- commit 3a169c0be75b59dd85d159493634870cdec6d3c4 upstream. Commit 1d5c76e664333 ("xen-blkfront: switch kcalloc to kvcalloc for large array allocation") didn't fix the issue it was meant to, as the flags for allocating the memory are GFP_NOIO, which will lead the memory allocation falling back to kmalloc(). So instead of GFP_NOIO use GFP_KERNEL and do all the memory allocation in blkfront_setup_indirect() in a memalloc_noio_{save,restore} section. Fixes: 1d5c76e664333 ("xen-blkfront: switch kcalloc to kvcalloc for large array allocation") Cc: stable(a)vger.kernel.org Signed-off-by: Juergen Gross <jgross(a)suse.com> Reviewed-by: Boris Ostrovsky <boris.ostrovsky(a)oracle.com> Acked-by: Roger Pau Monné <roger.pau(a)citrix.com> Link: https://lore.kernel.org/r/20200403090034.8753-1-jgross@suse.com Signed-off-by: Juergen Gross <jgross(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ChenXiaoSong <chenxiaosong2(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/block/xen-blkfront.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c index 0e451b17f33a..8059ff5ab4a6 100644 --- a/drivers/block/xen-blkfront.c +++ b/drivers/block/xen-blkfront.c @@ -47,6 +47,7 @@ #include <linux/bitmap.h> #include <linux/list.h> #include <linux/workqueue.h> +#include <linux/sched/mm.h> #include <xen/xen.h> #include <xen/xenbus.h> @@ -2251,10 +2252,12 @@ static void blkfront_setup_discard(struct blkfront_info *info) static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo) { - unsigned int psegs, grants; + unsigned int psegs, grants, memflags; int err, i; struct blkfront_info *info = rinfo->dev_info; + memflags = memalloc_noio_save(); + if (info->max_indirect_segments == 0) { if (!HAS_EXTRA_REQ) grants = BLKIF_MAX_SEGMENTS_PER_REQUEST; @@ -2286,7 +2289,7 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo) BUG_ON(!list_empty(&rinfo->indirect_pages)); for (i = 0; i < num; i++) { - struct page *indirect_page = alloc_page(GFP_NOIO); + struct page *indirect_page = alloc_page(GFP_KERNEL); if (!indirect_page) goto out_of_memory; list_add(&indirect_page->lru, &rinfo->indirect_pages); @@ -2297,15 +2300,15 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo) rinfo->shadow[i].grants_used = kvcalloc(grants, sizeof(rinfo->shadow[i].grants_used[0]), - GFP_NOIO); + GFP_KERNEL); rinfo->shadow[i].sg = kvcalloc(psegs, sizeof(rinfo->shadow[i].sg[0]), - GFP_NOIO); + GFP_KERNEL); if (info->max_indirect_segments) rinfo->shadow[i].indirect_grants = kvcalloc(INDIRECT_GREFS(grants), sizeof(rinfo->shadow[i].indirect_grants[0]), - GFP_NOIO); + GFP_KERNEL); if ((rinfo->shadow[i].grants_used == NULL) || (rinfo->shadow[i].sg == NULL) || (info->max_indirect_segments && @@ -2314,6 +2317,7 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo) sg_init_table(rinfo->shadow[i].sg, psegs); } + memalloc_noio_restore(memflags); return 0; @@ -2333,6 +2337,9 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo) __free_page(indirect_page); } } + + memalloc_noio_restore(memflags); + return -ENOMEM; } -- 2.25.1

1 5

[PATCH openEuler-5.10 01/23] blk-throttle: fix io hung due to configuration updates
by Zheng Zengkai 12 Jul '22

12 Jul '22

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I58VE5 CVE: NA -------------------------------- If new configuration is submitted while a bio is throttled, then new waiting time is recaculated regardless that the bio might aready wait for some time: tg_conf_updated throtl_start_new_slice tg_update_disptime throtl_schedule_next_dispatch Then io hung can be triggered by always submmiting new configuration before the throttled bio is dispatched. Fix the problem by respecting the time that throttled bio aready waited. In order to do that, instead of start new slice in tg_conf_updated(), just update 'bytes_disp' and 'io_disp' based on the new configuration. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- block/blk-throttle.c | 79 ++++++++++++++++++++++++++++++++++++-------- 1 file changed, 66 insertions(+), 13 deletions(-) diff --git a/block/blk-throttle.c b/block/blk-throttle.c index 95a13da1f343..0427c9c63e81 100644 --- a/block/blk-throttle.c +++ b/block/blk-throttle.c @@ -1421,7 +1421,57 @@ static int tg_print_conf_uint(struct seq_file *sf, void *v) return 0; } -static void tg_conf_updated(struct throtl_grp *tg, bool global) +static u64 throtl_update_bytes_disp(u64 dispatched, u64 new_limit, + u64 old_limit) +{ + if (new_limit == old_limit) + return dispatched; + + if (!dispatched) + return 0; + + /* + * In the case that multiply will overflow, just return 0. It will only + * let bios to be dispatched earlier. + */ + if (div64_u64(U64_MAX, dispatched) < new_limit) + return 0; + + dispatched *= new_limit; + return div64_u64(dispatched, old_limit); +} + +static u32 throtl_update_io_disp(u32 dispatched, u32 new_limit, u32 old_limit) +{ + if (new_limit == old_limit) + return dispatched; + + if (!dispatched) + return 0; + /* + * In the case that multiply will overflow, just return 0. It will only + * let bios to be dispatched earlier. + */ + if (UINT_MAX / dispatched < new_limit) + return 0; + + dispatched *= new_limit; + return dispatched / old_limit; +} + +static void throtl_update_slice(struct throtl_grp *tg, u64 *old_limits) +{ + tg->bytes_disp[READ] = throtl_update_bytes_disp(tg->bytes_disp[READ], + tg_bps_limit(tg, READ), old_limits[0]); + tg->bytes_disp[WRITE] = throtl_update_bytes_disp(tg->bytes_disp[WRITE], + tg_bps_limit(tg, WRITE), old_limits[1]); + tg->io_disp[READ] = throtl_update_io_disp(tg->io_disp[READ], + tg_iops_limit(tg, READ), (u32)old_limits[2]); + tg->io_disp[WRITE] = throtl_update_io_disp(tg->io_disp[WRITE], + tg_iops_limit(tg, WRITE), (u32)old_limits[3]); +} + +static void tg_conf_updated(struct throtl_grp *tg, u64 *old_limits, bool global) { struct throtl_service_queue *sq = &tg->service_queue; struct cgroup_subsys_state *pos_css; @@ -1460,16 +1510,7 @@ static void tg_conf_updated(struct throtl_grp *tg, bool global) parent_tg->latency_target); } - /* - * We're already holding queue_lock and know @tg is valid. Let's - * apply the new config directly. - * - * Restart the slices for both READ and WRITES. It might happen - * that a group's limit are dropped suddenly and we don't want to - * account recently dispatched IO with new low rate. - */ - throtl_start_new_slice(tg, READ); - throtl_start_new_slice(tg, WRITE); + throtl_update_slice(tg, old_limits); if (tg->flags & THROTL_TG_PENDING) { tg_update_disptime(tg); @@ -1502,6 +1543,14 @@ static inline int throtl_restart_syscall_when_busy(int errno) return ret; } +static void tg_get_limits(struct throtl_grp *tg, u64 *limits) +{ + limits[0] = tg_bps_limit(tg, READ); + limits[1] = tg_bps_limit(tg, WRITE); + limits[2] = tg_iops_limit(tg, READ); + limits[3] = tg_iops_limit(tg, WRITE); +} + static ssize_t tg_set_conf(struct kernfs_open_file *of, char *buf, size_t nbytes, loff_t off, bool is_u64) { @@ -1510,6 +1559,7 @@ static ssize_t tg_set_conf(struct kernfs_open_file *of, struct throtl_grp *tg; int ret; u64 v; + u64 old_limits[4]; ret = blkg_conf_prep(blkcg, &blkcg_policy_throtl, buf, &ctx); if (ret) @@ -1526,13 +1576,14 @@ static ssize_t tg_set_conf(struct kernfs_open_file *of, v = U64_MAX; tg = blkg_to_tg(ctx.blkg); + tg_get_limits(tg, old_limits); if (is_u64) *(u64 *)((void *)tg + of_cft(of)->private) = v; else *(unsigned int *)((void *)tg + of_cft(of)->private) = v; - tg_conf_updated(tg, false); + tg_conf_updated(tg, old_limits, false); ret = 0; out_finish: blkg_conf_finish(&ctx); @@ -1703,6 +1754,7 @@ static ssize_t tg_set_limit(struct kernfs_open_file *of, struct blkg_conf_ctx ctx; struct throtl_grp *tg; u64 v[4]; + u64 old_limits[4]; unsigned long idle_time; unsigned long latency_time; int ret; @@ -1721,6 +1773,7 @@ static ssize_t tg_set_limit(struct kernfs_open_file *of, v[1] = tg->bps_conf[WRITE][index]; v[2] = tg->iops_conf[READ][index]; v[3] = tg->iops_conf[WRITE][index]; + tg_get_limits(tg, old_limits); idle_time = tg->idletime_threshold_conf; latency_time = tg->latency_target_conf; @@ -1807,7 +1860,7 @@ static ssize_t tg_set_limit(struct kernfs_open_file *of, tg->td->limit_index = LIMIT_LOW; } else tg->td->limit_index = LIMIT_MAX; - tg_conf_updated(tg, index == LIMIT_LOW && + tg_conf_updated(tg, old_limits, index == LIMIT_LOW && tg->td->limit_valid[LIMIT_LOW]); ret = 0; out_finish: -- 2.20.1

1 22

[PATCH openEuler-1.0-LTS 1/2] tmpfs: fix undefined-behaviour in shmem_reconfigure()
by Yongqiang Liu 12 Jul '22

12 Jul '22

From: Luo Meng <luomeng12(a)huawei.com> mainline inclusion from mainline-v5.19-rc3 commit d14f5efadd846dbde561bd734318de6a9e6b26e6 category: bugfix bugzilla: 186471 https://gitee.com/openeuler/kernel/issues/I5DRKR CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- When shmem_reconfigure() calls __percpu_counter_compare(), the second parameter is unsigned long long. But in the definition of __percpu_counter_compare(), the second parameter is s64. So when __percpu_counter_compare() executes abs(count - rhs), UBSAN shows the following warning: Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> ================================================================================ UBSAN: Undefined behaviour in lib/percpu_counter.c:209:6 signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long long int' CPU: 1 PID: 9636 Comm: syz-executor.2 Tainted: G ---------r- - 4.18.0 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack home/install/linux-rh-3-10/lib/dump_stack.c:77 [inline] dump_stack+0x125/0x1ae home/install/linux-rh-3-10/lib/dump_stack.c:117 ubsan_epilogue+0xe/0x81 home/install/linux-rh-3-10/lib/ubsan.c:159 handle_overflow+0x19d/0x1ec home/install/linux-rh-3-10/lib/ubsan.c:190 __percpu_counter_compare+0x124/0x140 home/install/linux-rh-3-10/lib/percpu_counter.c:209 percpu_counter_compare home/install/linux-rh-3-10/./include/linux/percpu_counter.h:50 [inline] shmem_remount_fs+0x1ce/0x6b0 home/install/linux-rh-3-10/mm/shmem.c:3530 do_remount_sb+0x11b/0x530 home/install/linux-rh-3-10/fs/super.c:888 do_remount home/install/linux-rh-3-10/fs/namespace.c:2344 [inline] do_mount+0xf8d/0x26b0 home/install/linux-rh-3-10/fs/namespace.c:2844 ksys_mount+0xad/0x120 home/install/linux-rh-3-10/fs/namespace.c:3075 __do_sys_mount home/install/linux-rh-3-10/fs/namespace.c:3089 [inline] __se_sys_mount home/install/linux-rh-3-10/fs/namespace.c:3086 [inline] __x64_sys_mount+0xbf/0x160 home/install/linux-rh-3-10/fs/namespace.c:3086 do_syscall_64+0xca/0x5c0 home/install/linux-rh-3-10/arch/x86/entry/common.c:298 entry_SYSCALL_64_after_hwframe+0x6a/0xdf RIP: 0033:0x46b5e9 Code: 5d db fa ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b db fa ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f54d5f22c68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 000000000077bf60 RCX: 000000000046b5e9 RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000000 RBP: 000000000077bf60 R08: 0000000020000140 R09: 0000000000000000 R10: 00000000026740a4 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd1fb1592f R14: 00007f54d5f239c0 R15: 000000000077bf6c ================================================================================ [akpm(a)linux-foundation.org: tweak error message text] Link: https://lkml.kernel.org/r/20220513025225.2678727-1-luomeng12@huawei.com Signed-off-by: Luo Meng <luomeng12(a)huawei.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/shmem.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/shmem.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/mm/shmem.c b/mm/shmem.c index 8915a5b9ad0a..be91fb743426 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -3605,6 +3605,10 @@ static int shmem_remount_fs(struct super_block *sb, int *flags, char *data) spin_lock(&sbinfo->stat_lock); inodes = sbinfo->max_inodes - sbinfo->free_inodes; + if (config.max_blocks > S64_MAX) { + pr_err("Number of blocks too large"); + goto out; + } if (percpu_counter_compare(&sbinfo->used_blocks, config.max_blocks) > 0) goto out; if (config.max_inodes < inodes) -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] mm/sharepool: Check sp_is_enabled() before show spa_stat
by Yongqiang Liu 12 Jul '22

12 Jul '22

From: Wang Wensheng <wangwensheng4(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5GO4E CVE: NA -------------------------------- When we read file /proc/sharepool/spa_stat, we use sp_mapping_normal to iterator all the normal sp_area. The global pointer sp_mapping_normal is NULL if the sharepool feature is not enabled via kernel bootarg. This leads to a null-pointer-dereference issue. Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/share_pool.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/mm/share_pool.c b/mm/share_pool.c index 893e5352bf01..661036a7df64 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -4365,6 +4365,9 @@ void spg_overview_show(struct seq_file *seq) static int spa_stat_show(struct seq_file *seq, void *offset) { + if (!sp_is_enabled()) + return 0; + spg_overview_show(seq); spa_overview_show(seq); /* print the file header */ @@ -4425,6 +4428,9 @@ static int idr_proc_stat_cb(int id, void *p, void *data) static int proc_stat_show(struct seq_file *seq, void *offset) { + if (!sp_is_enabled()) + return 0; + spg_overview_show(seq); spa_overview_show(seq); /* print the file header */ @@ -4474,6 +4480,9 @@ static int idr_proc_overview_cb(int id, void *p, void *data) static int proc_overview_show(struct seq_file *seq, void *offset) { + if (!sp_is_enabled()) + return 0; + seq_printf(seq, "%-8s %-16s %-9s %-9s %-9s %-10s %-10s %-8s\n", "PID", "COMM", "SP_ALLOC", "SP_K2U", "SP_RES", "Non-SP_RES", "Non-SP_Shm", "VIRT"); -- 2.25.1

1 0

[PATCH v1 OLK-5.10 51/71] sw64: iommu: fix iommu interrupt handler
by Gu Zitao 12 Jul '22

12 Jul '22

From: Zheng Chongzhen <zhengchongzhen(a)wxiat.com> Sunway inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I56OSP -------------------------------- When porting ZX200 chipset driver on SW64 platform, we meet an IOMMU exception show as follows: iommu_interrupt, iommu_status = 0xc8014000dffe0000, devid 0xa00, dva 0xdffe0000, 1Unable to handle kernel paging request at virtual address 0000000000000040 CPU 0 swapper/0(0): Oops 0 pc = [<ffffffff81424b80>] ra = [<ffffffff81424b24>] ps = 0001 Not tainted pc is at iommu_interrupt+0x140/0x3e0 ra is at iommu_interrupt+0xe4/0x3e0 v0 = 0000000000000051 t0 = c8014000dffe0000 t1 = 0000000000000000 t2 = 0000000000000000 t3 = 0000000000000000 t4 = 0000000000000001 t5 = 0000000000000001 t6 = 0000000000000000 t7 = ffffffff82948000 s0 = fff00003ffff0400 s1 = 0000000000000001 s2 = 0000000000000a00 s3 = 0000000000000a00 s4 = 00000000dffe0000 s5 = fff0000100680e80 s6 = ffffffff8294ba70 a0 = 0000000000000001 a1 = 0000000000000001 a2 = ffffffff8294b790 a3 = ffffffff8294b7a8 a4 = 0000000000000000 a5 = ffffffff82c5fb7a t8 = 0000000000000001 t9 = fffffffffffcac48 t10 = 0000000000000000 t11= 0000000000000000 pv = ffffffff809f4f10 at = ffffffff82bff6c0 gp = ffffffff82c1f510 sp = (____ptrval____) The root cause is that the device which raises iommu exception is not in the device list, then reference a null sdev will cause a page fualt. To work around this problem, we apply this patch by just clearing IOMMUEXCPT_STATUS and then go on. BTW, why the device raise IOMMU exception is not a valid device ID, it's a puzzling problem. Signed-off-by: Zheng Chongzhen <zhengchongzhen(a)wxiat.com> Signed-off-by: Gu Zitao <guzitao(a)wxiat.com> --- drivers/iommu/sw64/sunway_iommu.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/drivers/iommu/sw64/sunway_iommu.c b/drivers/iommu/sw64/sunway_iommu.c index 5797adf8fbc5..b6c8f1272d28 100644 --- a/drivers/iommu/sw64/sunway_iommu.c +++ b/drivers/iommu/sw64/sunway_iommu.c @@ -648,10 +648,21 @@ irqreturn_t iommu_interrupt(int irq, void *dev) type = (iommu_status >> 59) & 0x7; devid = (iommu_status >> 37) & 0xffff; dva = iommu_status & 0xffffffff; - sdev = search_dev_data(devid); - sdomain = sdev->domain; pr_info("%s, iommu_status = %#lx, devid %#lx, dva %#lx, ", __func__, iommu_status, devid, dva); + + sdev = search_dev_data(devid); + if (sdev == NULL) { + pr_info("no such dev!!!\n"); + + iommu_status &= ~(1UL << 62); + write_piu_ior0(hose->node, hose->index, + IOMMUEXCPT_STATUS, iommu_status); + + return IRQ_HANDLED; + } + + sdomain = sdev->domain; switch (type) { case DTE_LEVEL1: pr_info("invalid level1 dte, addr:%#lx, val:%#lx\n", @@ -674,7 +685,6 @@ irqreturn_t iommu_interrupt(int irq, void *dev) fetch_pte(sdomain, dva, PTE_LEVEL2_VAL)); iommu_status &= ~(1UL << 62); - iommu_status = iommu_status | (1UL << 63); write_piu_ior0(hose->node, hose->index, IOMMUEXCPT_STATUS, iommu_status); break; -- 2.17.1

1 20

[PATCH v1 OLK-5.10 00/71] sw64 update
by Gu Zitao 12 Jul '22

12 Jul '22

Gu Zitao (2): sw64: add ARCH_TRACEHOOK and regset support sw64: rename CONFIG_HAVE_GENERIC_GUP to CONFIG_HAVE_FAST_GUP Hang Xiaoqian (2): sw64: change the value of physical_id in /proc/cpuinfo sw64: remove unaligned count He Chuyue (6): sw64: simplify __phys_addr and __virt_addr_valid sw64: check integrity for dtb passed by BIOS sw64: fix some structs related to pt_regs sw64: perf: add exclude_user and exclude_kernel support sw64: perf: fix the number of supported raw events sw64: perf: fix raw event count He Sheng (36): sw64: remove unused header files sw64: uapi: generate some uapi headers from generic ones sw64: uapi: include generic param.h sw64: kapi: remove unused header-y from Kbuild sw64: kapi: generate some kapi headers from generic ones sw64: move ucontext.h to uapi sw64: kapi: remove redudant SMP_CACHE_BYTES sw64: kapi: remove unimplemented IPLs sw64: kapi: include generic modules.h sw64: remove VGA_HOSE things sw64: clean up unused pci iounmap operation sw64: kapi: use generic vga.h sw64: remove unused IO_CONCAT sw64: do not include sw64io.h in io.h sw64: read host IO registers with rdio64 hmcall sw64: map logical address with __va() sw64: access IO space with readX/writeX sw64: add fpu state save/restore interfaces sw64: switch to generic fork like system calls sw64: remove r9_r15 argument of dik_show_regs and die_if_kernel sw64: remove switch_stack from entMM and entSys sw64: remove switch_stack from signal handling sw64: dump callee-saved registers from pt_regs sw64: get blocked thread's frame pointer from thread_struct sw64: remove switch_stack and allregs from entUna sw64: remove switch_stack from __sw64_vcpu_run sw64: remove other struct switch_stack things sw64: access pt_regs with regoffsets where appropriate sw64: move struct pt_regs to kapi ptrace.h sw64: avoid copying thread_struct twice sw64: simplify pgtable helpers sw64: remove discontiguous memory support sw64: merge user_fpsimd_state into thread_struct sw64: fix ptrace.h with types.h and NOT __ASSEMBLY__ sw64: rewrite elf core copy interfaces sw64: rename debugfs dir sw_64 to sw64 Lu Feifei (2): sw64: add memhotplug support for guest os sw64: add a misc device to chip_vt.dts for memory-hotplug Mao Minkai (2): sw64: fix __csum_and_copy when dest is not 8-byte aligned sw64: fix simd version of memset Min Fanlei (1): sw64: kvm: fix incorrect page_ref_count() call Wang Yuanheng (1): sw64: kvm: enable binding_vcpu debug dynamically Wu Liliu (4): sw64: perf: add fp based stack trace support sw64: reimplement show_stack() method sw64: reimplement get_wchan() sw64: reimplement save_stack_trace() Xiong Aifei (2): sw64: gpu: correct low-level mmio memset/memcpy direct calls sw64: gpu: replace '_memset_c_io' by 'memset_io' Xu Chenjiao (2): sw64: fix compile errors for NOT chip3 sw64: pcie: fix lack of PME and AER interrupt service routines Yang Qiang (2): sw64: dtb: check address validity with physical address sw64: pci: fix maximum bus number for pci scan Zhao Yihan (1): sw64: map address by OR operation in __va() Zheng Chongzhen (2): sw64: fix dma features for zx200 sw64: iommu: fix iommu interrupt handler Zhou Qihang (1): sw64: iommu: work around iova mapping on pci bars Zhou Xuemei (1): sw64: fix floating point register corruption Zhu Donghong (4): irqchip: add sw64 chip3 builtin LPC interrupt controller driver sw64: add builtin LPC interrupt controller to chip3.dts drivers/irqchip: add sw64 interrupt controller support sw64: deliver a hot reset to Root Complex with plugin JMicron 585 card arch/sw_64/Kconfig | 28 +- arch/sw_64/boot/dts/chip3.dts | 16 +- arch/sw_64/boot/dts/chip_vt.dts | 12 + arch/sw_64/chip/chip3/Makefile | 1 - arch/sw_64/chip/chip3/chip.c | 66 ++- arch/sw_64/chip/chip3/i2c-lib.c | 41 +- arch/sw_64/include/asm/Kbuild | 26 +- arch/sw_64/include/asm/agp.h | 19 - arch/sw_64/include/asm/asm-prototypes.h | 1 - arch/sw_64/include/asm/cache.h | 4 +- arch/sw_64/include/asm/compiler.h | 7 - arch/sw_64/include/asm/console.h | 11 - arch/sw_64/include/asm/div64.h | 7 - arch/sw_64/include/asm/elf.h | 40 +- arch/sw_64/include/asm/emergency-restart.h | 7 - arch/sw_64/include/asm/exec.h | 7 - arch/sw_64/include/asm/extable.h | 4 + arch/sw_64/include/asm/floppy.h | 116 ----- arch/sw_64/include/asm/hcall.h | 1 + arch/sw_64/include/asm/io.h | 33 -- arch/sw_64/include/asm/irq_impl.h | 3 + arch/sw_64/include/asm/irq_regs.h | 7 - arch/sw_64/include/asm/irqflags.h | 8 - arch/sw_64/include/asm/kmap_types.h | 15 - arch/sw_64/include/asm/kvm_asm.h | 3 + arch/sw_64/include/asm/kvm_host.h | 11 +- arch/sw_64/include/asm/local.h | 125 ----- arch/sw_64/include/asm/local64.h | 7 - arch/sw_64/include/asm/memory.h | 1 + arch/sw_64/include/asm/mmu_context.h | 8 +- arch/sw_64/include/asm/mmzone.h | 30 -- arch/sw_64/include/asm/module.h | 10 +- arch/sw_64/include/asm/page.h | 5 +- arch/sw_64/include/asm/param.h | 11 - arch/sw_64/include/asm/parport.h | 19 - arch/sw_64/include/asm/pci.h | 4 +- arch/sw_64/include/asm/pgalloc.h | 2 +- arch/sw_64/include/asm/pgtable.h | 98 ++-- arch/sw_64/include/asm/preempt.h | 7 - arch/sw_64/include/asm/processor.h | 49 +- arch/sw_64/include/asm/ptrace.h | 54 +- arch/sw_64/include/asm/seccomp.h | 15 - arch/sw_64/include/asm/sections.h | 8 - arch/sw_64/include/asm/segment.h | 7 - arch/sw_64/include/asm/serial.h | 16 - arch/sw_64/include/asm/shmparam.h | 7 - arch/sw_64/include/asm/special_insns.h | 20 - arch/sw_64/include/asm/stacktrace.h | 72 +++ arch/sw_64/include/asm/sw64_init.h | 1 + arch/sw_64/include/asm/sw64io.h | 89 ++-- arch/sw_64/include/asm/switch_to.h | 37 +- arch/sw_64/include/asm/thread_info.h | 5 + arch/sw_64/include/asm/trace_clock.h | 10 - arch/sw_64/include/asm/types.h | 7 - arch/sw_64/include/asm/unaligned.h | 12 - arch/sw_64/include/asm/vga.h | 85 ---- arch/sw_64/include/asm/wrperfmon.h | 8 +- arch/sw_64/include/uapi/asm/Kbuild | 1 + arch/sw_64/include/uapi/asm/console.h | 51 -- arch/sw_64/include/uapi/asm/ipcbuf.h | 7 - arch/sw_64/include/uapi/asm/kvm_para.h | 7 - arch/sw_64/include/uapi/asm/msgbuf.h | 28 -- arch/sw_64/include/uapi/asm/param.h | 9 +- arch/sw_64/include/uapi/asm/perf_regs.h | 7 + arch/sw_64/include/uapi/asm/poll.h | 7 - arch/sw_64/include/uapi/asm/posix_types.h | 18 - arch/sw_64/include/uapi/asm/ptrace.h | 76 +-- arch/sw_64/include/uapi/asm/sembuf.h | 23 - arch/sw_64/include/uapi/asm/shmbuf.h | 39 -- arch/sw_64/include/uapi/asm/statfs.h | 9 - arch/sw_64/include/uapi/asm/types.h | 28 -- arch/sw_64/include/{ => uapi}/asm/ucontext.h | 8 +- arch/sw_64/kernel/Makefile | 7 +- arch/sw_64/kernel/asm-offsets.c | 136 ++--- arch/sw_64/kernel/bindvcpu.c | 29 ++ arch/sw_64/kernel/core.c | 35 -- arch/sw_64/kernel/dup_print.c | 10 +- arch/sw_64/kernel/entry.S | 467 +++++------------- arch/sw_64/kernel/fpu.S | 102 ++++ arch/sw_64/kernel/kgdb.c | 14 +- arch/sw_64/kernel/pci.c | 55 ++- arch/sw_64/kernel/pci_impl.h | 2 + arch/sw_64/kernel/perf_event.c | 100 +++- arch/sw_64/kernel/process.c | 156 ++---- arch/sw_64/kernel/proto.h | 5 +- arch/sw_64/kernel/ptrace.c | 245 ++++----- arch/sw_64/kernel/setup.c | 19 +- arch/sw_64/kernel/signal.c | 51 +- arch/sw_64/kernel/stacktrace.c | 212 +++++++- arch/sw_64/kernel/syscalls/syscall.tbl | 6 +- arch/sw_64/kernel/traps.c | 182 ++----- arch/sw_64/kernel/unaligned.c | 56 --- arch/sw_64/kvm/Kconfig | 7 + arch/sw_64/kvm/entry.S | 97 ++-- arch/sw_64/kvm/handle_exit.c | 5 + arch/sw_64/kvm/kvm-sw64.c | 137 ++++- arch/sw_64/lib/csum_partial_copy.c | 15 +- arch/sw_64/lib/deep-memset.S | 5 +- arch/sw_64/lib/iomap.c | 40 +- arch/sw_64/mm/fault.c | 20 +- arch/sw_64/mm/init.c | 25 +- arch/sw_64/mm/physaddr.c | 30 +- arch/sw_64/platform/platform_xuelang.c | 18 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 12 + drivers/gpu/drm/radeon/radeon_vce.c | 2 +- drivers/gpu/drm/radeon/vce_v1_0.c | 5 + drivers/iommu/sw64/sunway_iommu.c | 21 +- drivers/irqchip/Kconfig | 26 +- drivers/irqchip/Makefile | 3 +- drivers/irqchip/irq-intc-v1.c | 104 ---- .../irqchip/irq-sw64-intc-v2.c | 64 ++- drivers/irqchip/irq-sw64-lpc-intc.c | 137 +++++ drivers/mfd/lpc_sunway_chip3.c | 130 ----- drivers/misc/Kconfig | 8 + drivers/misc/Makefile | 1 + drivers/misc/sunway-ged.c | 253 ++++++++++ 116 files changed, 2009 insertions(+), 2686 deletions(-) delete mode 100644 arch/sw_64/include/asm/agp.h delete mode 100644 arch/sw_64/include/asm/compiler.h delete mode 100644 arch/sw_64/include/asm/console.h delete mode 100644 arch/sw_64/include/asm/div64.h delete mode 100644 arch/sw_64/include/asm/emergency-restart.h delete mode 100644 arch/sw_64/include/asm/exec.h delete mode 100644 arch/sw_64/include/asm/floppy.h delete mode 100644 arch/sw_64/include/asm/irq_regs.h delete mode 100644 arch/sw_64/include/asm/kmap_types.h delete mode 100644 arch/sw_64/include/asm/local.h delete mode 100644 arch/sw_64/include/asm/local64.h delete mode 100644 arch/sw_64/include/asm/param.h delete mode 100644 arch/sw_64/include/asm/parport.h delete mode 100644 arch/sw_64/include/asm/preempt.h delete mode 100644 arch/sw_64/include/asm/seccomp.h delete mode 100644 arch/sw_64/include/asm/sections.h delete mode 100644 arch/sw_64/include/asm/segment.h delete mode 100644 arch/sw_64/include/asm/serial.h delete mode 100644 arch/sw_64/include/asm/shmparam.h delete mode 100644 arch/sw_64/include/asm/special_insns.h create mode 100644 arch/sw_64/include/asm/stacktrace.h delete mode 100644 arch/sw_64/include/asm/trace_clock.h delete mode 100644 arch/sw_64/include/asm/types.h delete mode 100644 arch/sw_64/include/asm/unaligned.h delete mode 100644 arch/sw_64/include/asm/vga.h delete mode 100644 arch/sw_64/include/uapi/asm/console.h delete mode 100644 arch/sw_64/include/uapi/asm/ipcbuf.h delete mode 100644 arch/sw_64/include/uapi/asm/kvm_para.h delete mode 100644 arch/sw_64/include/uapi/asm/msgbuf.h delete mode 100644 arch/sw_64/include/uapi/asm/poll.h delete mode 100644 arch/sw_64/include/uapi/asm/posix_types.h delete mode 100644 arch/sw_64/include/uapi/asm/sembuf.h delete mode 100644 arch/sw_64/include/uapi/asm/shmbuf.h delete mode 100644 arch/sw_64/include/uapi/asm/statfs.h delete mode 100644 arch/sw_64/include/uapi/asm/types.h rename arch/sw_64/include/{ => uapi}/asm/ucontext.h (56%) create mode 100644 arch/sw_64/kernel/bindvcpu.c delete mode 100644 arch/sw_64/kernel/core.c create mode 100644 arch/sw_64/kernel/fpu.S delete mode 100644 arch/sw_64/kernel/unaligned.c delete mode 100644 drivers/irqchip/irq-intc-v1.c rename arch/sw_64/chip/chip3/irq_chip.c => drivers/irqchip/irq-sw64-intc-v2.c (59%) create mode 100644 drivers/irqchip/irq-sw64-lpc-intc.c create mode 100644 drivers/misc/sunway-ged.c -- 2.17.1

1 50

[PATCH openEuler-5.10-LTS 1/7] arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory zones
by Zheng Zengkai 11 Jul '22

11 Jul '22

From: Vijay Balakrishna <vijayb(a)linux.microsoft.com> stable inclusion from stable-v5.10.110 commit a25864c5bc20966cdc5ba5eb65b74b9b1e9ec8d2 bugzilla: https://gitee.com/openeuler/kernel/issues/I574AL Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 031495635b4668f94e964e037ca93d0d38bfde58 upstream. The following patches resulted in deferring crash kernel reservation to mem_init(), mainly aimed at platforms with DMA memory zones (no IOMMU), in particular Raspberry Pi 4. commit 1a8e1cef7603 ("arm64: use both ZONE_DMA and ZONE_DMA32") commit 8424ecdde7df ("arm64: mm: Set ZONE_DMA size based on devicetree's dma-ranges") commit 0a30c53573b0 ("arm64: mm: Move reserve_crashkernel() into mem_init()") commit 2687275a5843 ("arm64: Force NO_BLOCK_MAPPINGS if crashkernel reservation is required") Above changes introduced boot slowdown due to linear map creation for all the memory banks with NO_BLOCK_MAPPINGS, see discussion[1]. The proposed changes restore crash kernel reservation to earlier behavior thus avoids slow boot, particularly for platforms with IOMMU (no DMA memory zones). Tested changes to confirm no ~150ms boot slowdown on our SoC with IOMMU and 8GB memory. Also tested with ZONE_DMA and/or ZONE_DMA32 configs to confirm no regression to deferring scheme of crash kernel memory reservation. In both cases successfully collected kernel crash dump. [1] https://lore.kernel.org/all/9436d033-579b-55fa-9b00-6f4b661c2dd7@linux.micr… Signed-off-by: Vijay Balakrishna <vijayb(a)linux.microsoft.com> Cc: stable(a)vger.kernel.org Reviewed-by: Pasha Tatashin <pasha.tatashin(a)soleen.com> Link: https://lore.kernel.org/r/1646242689-20744-1-git-send-email-vijayb@linux.mi… [will: Add #ifdef CONFIG_KEXEC_CORE guards to fix 'crashk_res' references in allnoconfig build] Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> Conflicts: arch/arm64/mm/mmu.c Reviewed-by: Wei Li <liwei391(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- arch/arm64/mm/init.c | 36 ++++++++++++++++++++++++++++++++---- arch/arm64/mm/mmu.c | 26 ++++++++++++++++---------- 2 files changed, 48 insertions(+), 14 deletions(-) diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c index f5bd046f9e19..5023c7e1f754 100644 --- a/arch/arm64/mm/init.c +++ b/arch/arm64/mm/init.c @@ -63,8 +63,34 @@ EXPORT_SYMBOL(memstart_addr); * unless restricted on specific platforms (e.g. 30-bit on Raspberry Pi 4). * In such case, ZONE_DMA32 covers the rest of the 32-bit addressable memory, * otherwise it is empty. + * + * Memory reservation for crash kernel either done early or deferred + * depending on DMA memory zones configs (ZONE_DMA) -- + * + * In absence of ZONE_DMA configs arm64_dma_phys_limit initialized + * here instead of max_zone_phys(). This lets early reservation of + * crash kernel memory which has a dependency on arm64_dma_phys_limit. + * Reserving memory early for crash kernel allows linear creation of block + * mappings (greater than page-granularity) for all the memory bank rangs. + * In this scheme a comparatively quicker boot is observed. + * + * If ZONE_DMA configs are defined, crash kernel memory reservation + * is delayed until DMA zone memory range size initilazation performed in + * zone_sizes_init(). The defer is necessary to steer clear of DMA zone + * memory range to avoid overlap allocation. So crash kernel memory boundaries + * are not known when mapping all bank memory ranges, which otherwise means + * not possible to exclude crash kernel range from creating block mappings + * so page-granularity mappings are created for the entire memory range. + * Hence a slightly slower boot is observed. + * + * Note: Page-granularity mapppings are necessary for crash kernel memory + * range for shrinking its size via /sys/kernel/kexec_crash_size interface. */ -phys_addr_t arm64_dma_phys_limit __ro_after_init; +#if IS_ENABLED(CONFIG_ZONE_DMA) || IS_ENABLED(CONFIG_ZONE_DMA32) +phys_addr_t __ro_after_init arm64_dma_phys_limit; +#else +phys_addr_t __ro_after_init arm64_dma_phys_limit = PHYS_MASK + 1; +#endif #ifndef CONFIG_KEXEC_CORE static void __init reserve_crashkernel(void) @@ -173,8 +199,6 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max) if (!arm64_dma_phys_limit) arm64_dma_phys_limit = dma32_phys_limit; #endif - if (!arm64_dma_phys_limit) - arm64_dma_phys_limit = PHYS_MASK + 1; max_zone_pfns[ZONE_NORMAL] = max; free_area_init(max_zone_pfns); @@ -498,6 +522,9 @@ void __init arm64_memblock_init(void) reserve_elfcorehdr(); + if (!IS_ENABLED(CONFIG_ZONE_DMA) && !IS_ENABLED(CONFIG_ZONE_DMA32)) + reserve_crashkernel(); + high_memory = __va(memblock_end_of_DRAM() - 1) + 1; } @@ -553,7 +580,8 @@ void __init bootmem_init(void) * request_standard_resources() depends on crashkernel's memory being * reserved, so do it here. */ - reserve_crashkernel(); + if (IS_ENABLED(CONFIG_ZONE_DMA) || IS_ENABLED(CONFIG_ZONE_DMA32)) + reserve_crashkernel(); reserve_quick_kexec(); diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c index 00e89be15ad2..e76765354040 100644 --- a/arch/arm64/mm/mmu.c +++ b/arch/arm64/mm/mmu.c @@ -562,16 +562,6 @@ static void __init map_mem(pgd_t *pgdp) PAGE_KERNEL, NO_CONT_MAPPINGS); memblock_clear_nomap(kernel_start, kernel_end - kernel_start); -#ifdef CONFIG_KEXEC_CORE - if (crashk_res.end) { - __map_memblock(pgdp, crashk_res.start, - crashk_res.end + 1, - PAGE_KERNEL, - NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS); - memblock_clear_nomap(crashk_res.start, - resource_size(&crashk_res)); - } -#endif #ifdef CONFIG_KFENCE /* * Map the __kfence_pool at page granularity now. @@ -584,6 +574,22 @@ static void __init map_mem(pgd_t *pgdp) memblock_clear_nomap(__pa(__kfence_pool), KFENCE_POOL_SIZE); } #endif + + /* + * Use page-level mappings here so that we can shrink the region + * in page granularity and put back unused memory to buddy system + * through /sys/kernel/kexec_crash_size interface. + */ +#ifdef CONFIG_KEXEC_CORE + if (crashk_res.end) { + __map_memblock(pgdp, crashk_res.start, + crashk_res.end + 1, + PAGE_KERNEL, + NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS); + memblock_clear_nomap(crashk_res.start, + resource_size(&crashk_res)); + } +#endif } void mark_rodata_ro(void) -- 2.20.1

1 6

[PATCH 01/34] ARM: 9196/1: spectre-bhb: enable for Cortex-A15
by Laibin Qiu 08 Jul '22

08 Jul '22

From: Ard Biesheuvel <ardb(a)kernel.org> stable inclusion from stable-4.19.245 commit 0569702c238290924fc1c7c6954258aa4a5fd649 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5FNPY CVE: NA -------------------------------- [ Upstream commit 0dc14aa94ccd8ba35eb17a0f9b123d1566efd39e ] The Spectre-BHB mitigations were inadvertently left disabled for Cortex-A15, due to the fact that cpu_v7_bugs_init() is not called in that case. So fix that. Fixes: b9baf5c8c5c3 ("ARM: Spectre-BHB workaround") Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- arch/arm/mm/proc-v7-bugs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c index 87a93b76e148..8c7d00cb63ef 100644 --- a/arch/arm/mm/proc-v7-bugs.c +++ b/arch/arm/mm/proc-v7-bugs.c @@ -299,6 +299,7 @@ void cpu_v7_ca15_ibe(void) { if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(0))) cpu_v7_spectre_v2_init(); + cpu_v7_spectre_bhb_init(); } void cpu_v7_bugs_init(void) -- 2.25.1

1 33

[PATCH openEuler-1.0-LTS 1/4] block: rename bd_invalidated
by Laibin Qiu 08 Jul '22

08 Jul '22

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v5.10-rc1 commit f4ad06f2bb8476548b08f89919ee65abc4e40212 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5ETAB CVE: NA ------------------------------------------------- Replace bd_invalidate with a new BDEV_NEED_PART_SCAN flag in a bd_flags variable to better describe the condition. Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: fs/block_dev.c include/linux/blk_types.h Signed-off-by: Luo Meng <luomeng12(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- block/genhd.c | 2 +- block/partition-generic.c | 6 +++--- drivers/block/nbd.c | 8 ++++---- fs/block_dev.c | 12 ++++++------ include/linux/fs.h | 4 +++- 5 files changed, 17 insertions(+), 15 deletions(-) diff --git a/block/genhd.c b/block/genhd.c index fc24384e2c85..afa3cf525f43 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -646,7 +646,7 @@ static void register_disk(struct device *parent, struct gendisk *disk) if (!bdev) goto exit; - bdev->bd_invalidated = 1; + set_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); err = blkdev_get(bdev, FMODE_READ, NULL); if (err < 0) goto exit; diff --git a/block/partition-generic.c b/block/partition-generic.c index 2261566741f4..ae3761fed854 100644 --- a/block/partition-generic.c +++ b/block/partition-generic.c @@ -546,7 +546,7 @@ int rescan_partitions(struct gendisk *disk, struct block_device *bdev) if (disk->fops->revalidate_disk) disk->fops->revalidate_disk(disk); check_disk_size_change(disk, bdev, true); - bdev->bd_invalidated = 0; + clear_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); if (!get_capacity(disk) || !(state = check_partition(disk, bdev))) return 0; if (IS_ERR(state)) { @@ -662,7 +662,7 @@ int invalidate_partitions(struct gendisk *disk, struct block_device *bdev) { int res; - if (!bdev->bd_invalidated) + if (!test_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags)) return 0; res = drop_partitions(disk, bdev); @@ -671,7 +671,7 @@ int invalidate_partitions(struct gendisk *disk, struct block_device *bdev) set_capacity(disk, 0); check_disk_size_change(disk, bdev, false); - bdev->bd_invalidated = 0; + clear_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); /* tell userspace that the media / partition table may have changed */ kobject_uevent(&disk_to_dev(disk)->kobj, KOBJ_CHANGE); diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index c2e5ba599418..f1986d8bb47c 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -317,7 +317,7 @@ static void nbd_size_update(struct nbd_device *nbd, bool start) if (start) set_blocksize(bdev, config->blksize); } else - bdev->bd_invalidated = 1; + set_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); bdput(bdev); } kobject_uevent(&nbd_to_dev(nbd)->kobj, KOBJ_CHANGE); @@ -1343,7 +1343,7 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b return ret; if (max_part) - bdev->bd_invalidated = 1; + set_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); mutex_unlock(&nbd->config_lock); ret = wait_event_interruptible(config->recv_wq, atomic_read(&config->recv_threads) == 0); @@ -1518,9 +1518,9 @@ static int nbd_open(struct block_device *bdev, fmode_t mode) refcount_set(&nbd->config_refs, 1); refcount_inc(&nbd->refs); mutex_unlock(&nbd->config_lock); - bdev->bd_invalidated = 1; + set_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); } else if (nbd_disconnected(nbd->config)) { - bdev->bd_invalidated = 1; + set_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); } out: mutex_unlock(&nbd_index_mutex); diff --git a/fs/block_dev.c b/fs/block_dev.c index 9868b21b8ef9..f521b7cf907f 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -922,7 +922,7 @@ struct block_device *bdget(dev_t dev) bdev->bd_inode = inode; bdev->bd_block_size = i_blocksize(inode); bdev->bd_part_count = 0; - bdev->bd_invalidated = 0; + bdev->bd_flags = 0; inode->i_mode = S_IFBLK; inode->i_rdev = dev; inode->i_bdev = bdev; @@ -1404,7 +1404,7 @@ static void flush_disk(struct block_device *bdev, bool kill_dirty) "resized disk %s\n", bdev->bd_disk ? bdev->bd_disk->disk_name : ""); } - bdev->bd_invalidated = 1; + set_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); } /** @@ -1457,7 +1457,7 @@ int revalidate_disk(struct gendisk *disk) mutex_lock(&bdev->bd_mutex); check_disk_size_change(disk, bdev, ret == 0); - bdev->bd_invalidated = 0; + clear_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); mutex_unlock(&bdev->bd_mutex); bdput(bdev); return ret; @@ -1520,7 +1520,7 @@ static void bdev_disk_changed(struct block_device *bdev, bool invalidate) up_read(&disk->lookup_sem); } else { check_disk_size_change(bdev->bd_disk, bdev, !invalidate); - bdev->bd_invalidated = 0; + clear_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); } } @@ -1605,7 +1605,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) * The latter is necessary to prevent ghost * partitions on a removed medium. */ - if (bdev->bd_invalidated && + if (test_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags) && (!ret || ret == -ENOMEDIUM)) bdev_disk_changed(bdev, ret == -ENOMEDIUM); @@ -1642,7 +1642,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) if (bdev->bd_disk->fops->open) ret = bdev->bd_disk->fops->open(bdev, mode); /* the same as first opener case, read comment there */ - if (bdev->bd_invalidated && + if (test_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags) && (!ret || ret == -ENOMEDIUM)) bdev_disk_changed(bdev, ret == -ENOMEDIUM); if (ret) diff --git a/include/linux/fs.h b/include/linux/fs.h index bcd2131ca06c..480936c2d938 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -459,6 +459,8 @@ struct address_space { */ struct request_queue; +#define BDEV_NEED_PART_SCAN 0 + struct block_device { dev_t bd_dev; /* not a kdev_t - it's a search key */ int bd_openers; @@ -479,7 +481,7 @@ struct block_device { struct hd_struct * bd_part; /* number of times partitions within this device have been opened. */ unsigned bd_part_count; - int bd_invalidated; + unsigned long bd_flags; struct gendisk * bd_disk; struct request_queue * bd_queue; struct backing_dev_info *bd_bdi; -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS 1/3] scsi: hisi_sas: Change DMA setup lock timeout to 2.5s
by Laibin Qiu 07 Jul '22

07 Jul '22

From: Xingui Yang <yangxingui(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5BXH1 CVE: NA ------------------------------------------------------------------- DMA setup lock timeout protection is added when DMA setup frames are received, it's a function outside the protocol and used to prevent SATA disk I/Os from being delivered for a long time. The default value is 100ms , it's too strict and easily triggered timeout when the disk is overloaded or faulty. Based on the average I/O latency of 300 disks, we adjust the value to 2.5s. Signed-off-by: Xingui Yang <yangxingui(a)huawei.com> Reviewed-by: kang fenglong <kangfenglong(a)huawei.com> Acked-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c index baae04adc8e4..91f02357d5b4 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c @@ -35,6 +35,7 @@ #define SATA_INITI_D2H_STORE_ADDR_HI 0x64 #define CFG_MAX_TAG 0x68 #define SAS_DMAC_OUTSTAND 0x6c +#define TRANS_LOCK_ICT_TIME 0X70 #define HGC_SAS_TX_OPEN_FAIL_RETRY_CTRL 0x84 #define HGC_SAS_TXFAIL_RETRY_CTRL 0x88 #define HGC_GET_ITV_TIME 0x90 @@ -596,6 +597,8 @@ static void init_reg_v3_hw(struct hisi_hba *hisi_hba) (u32)((1ULL << hisi_hba->queue_count) - 1)); hisi_sas_write32(hisi_hba, SAS_AXI_USER3, 0); hisi_sas_write32(hisi_hba, CFG_MAX_TAG, 0xfff0400); + /* time / CLK_AHB = 2.5s / 2ns = 0x4A817C80 */ + hisi_sas_write32(hisi_hba, TRANS_LOCK_ICT_TIME, 0x4A817C80); hisi_sas_write32(hisi_hba, HGC_SAS_TXFAIL_RETRY_CTRL, 0x108); hisi_sas_write32(hisi_hba, CFG_AGING_TIME, 0x1); hisi_sas_write32(hisi_hba, INT_COAL_EN, 0x1); @@ -3061,6 +3064,7 @@ static const struct hisi_sas_debugfs_reg_lu debugfs_global_reg_lu[] = { HISI_SAS_DEBUGFS_REG(SATA_INITI_D2H_STORE_ADDR_LO), HISI_SAS_DEBUGFS_REG(SATA_INITI_D2H_STORE_ADDR_HI), HISI_SAS_DEBUGFS_REG(CFG_MAX_TAG), + HISI_SAS_DEBUGFS_REG(TRANS_LOCK_ICT_TIME), HISI_SAS_DEBUGFS_REG(HGC_SAS_TX_OPEN_FAIL_RETRY_CTRL), HISI_SAS_DEBUGFS_REG(HGC_SAS_TXFAIL_RETRY_CTRL), HISI_SAS_DEBUGFS_REG(HGC_GET_ITV_TIME), -- 2.25.1

1 2

[PATCH openEuler-5.10 01/40] mm,hwpoison: drain pcplists before bailing out for non-buddy zero-refcount page
by Zheng Zengkai 06 Jul '22

06 Jul '22

From: Oscar Salvador <osalvador(a)suse.de> mainline inclusion from mainline-v5.11-rc1 commit 17e395b60f5b3dea204fcae60c7b38e84a00d87a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5E2IG CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Patch series "HWpoison: further fixes and cleanups", v5. This patchset includes some more fixes and a cleanup. Patch#2 and patch#3 are both fixes for taking a HWpoison page off a buddy freelist, since having them there has proved to be bad (see [1] and pathch#2's commit log). Patch#3 does the same for hugetlb pages. [1] https://lkml.org/lkml/2020/9/22/565 This patch (of 4): A page with 0-refcount and !PageBuddy could perfectly be a pcppage. Currently, we bail out with an error if we encounter such a page, meaning that we do not handle pcppages neither from hard-offline nor from soft-offline path. Fix this by draining pcplists whenever we find this kind of page and retry the check again. It might be that pcplists have been spilled into the buddy allocator and so we can handle it. Link: https://lkml.kernel.org/r/20201013144447.6706-1-osalvador@suse.de Link: https://lkml.kernel.org/r/20201013144447.6706-2-osalvador@suse.de Signed-off-by: Oscar Salvador <osalvador(a)suse.de> Acked-by: Naoya Horiguchi <naoya.horiguchi(a)nec.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- mm/memory-failure.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 63bacfcca122..de36b4aa4b6f 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -947,13 +947,13 @@ static int page_action(struct page_state *ps, struct page *p, } /** - * get_hwpoison_page() - Get refcount for memory error handling: + * __get_hwpoison_page() - Get refcount for memory error handling: * @page: raw error page (hit by memory error) * * Return: return 0 if failed to grab the refcount, otherwise true (some * non-zero value.) */ -static int get_hwpoison_page(struct page *page) +static int __get_hwpoison_page(struct page *page) { struct page *head = compound_head(page); @@ -983,6 +983,26 @@ static int get_hwpoison_page(struct page *page) return 0; } +static int get_hwpoison_page(struct page *p) +{ + int ret; + bool drained = false; + +retry: + ret = __get_hwpoison_page(p); + if (!ret && !is_free_buddy_page(p) && !page_count(p) && !drained) { + /* + * The page might be in a pcplist, so try to drain those + * and see if we are lucky. + */ + drain_all_pages(page_zone(p)); + drained = true; + goto retry; + } + + return ret; +} + /* * Do all that is necessary to remove user space mappings. Unmap * the pages and send SIGBUS to the processes if the data was dirty. -- 2.20.1

1 38

[PATCH openEuler-5.10 01/30] Documentation: Add documentation for Processor MMIO Stale Data
by Zheng Zengkai 06 Jul '22

06 Jul '22

From: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> stable inclusion from stable-v5.10.123 commit f8a85334a57e7842320476ff27be3a5f151da364 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5D5RS CVE: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4419470191386456e0b8ed4eb06a70b0021798a6 upstream Add the admin guide for Processor MMIO stale data vulnerabilities. Signed-off-by: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> Signed-off-by: Borislav Petkov <bp(a)suse.de> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Liao Chang <liaochang1(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- Documentation/admin-guide/hw-vuln/index.rst | 1 + .../hw-vuln/processor_mmio_stale_data.rst | 246 ++++++++++++++++++ 2 files changed, 247 insertions(+) create mode 100644 Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst diff --git a/Documentation/admin-guide/hw-vuln/index.rst b/Documentation/admin-guide/hw-vuln/index.rst index ca4dbdd9016d..2adec1e6520a 100644 --- a/Documentation/admin-guide/hw-vuln/index.rst +++ b/Documentation/admin-guide/hw-vuln/index.rst @@ -15,3 +15,4 @@ are configurable at compile, boot or run time. tsx_async_abort multihit.rst special-register-buffer-data-sampling.rst + processor_mmio_stale_data.rst diff --git a/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst b/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst new file mode 100644 index 000000000000..9393c50b5afc --- /dev/null +++ b/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst @@ -0,0 +1,246 @@ +========================================= +Processor MMIO Stale Data Vulnerabilities +========================================= + +Processor MMIO Stale Data Vulnerabilities are a class of memory-mapped I/O +(MMIO) vulnerabilities that can expose data. The sequences of operations for +exposing data range from simple to very complex. Because most of the +vulnerabilities require the attacker to have access to MMIO, many environments +are not affected. System environments using virtualization where MMIO access is +provided to untrusted guests may need mitigation. These vulnerabilities are +not transient execution attacks. However, these vulnerabilities may propagate +stale data into core fill buffers where the data can subsequently be inferred +by an unmitigated transient execution attack. Mitigation for these +vulnerabilities includes a combination of microcode update and software +changes, depending on the platform and usage model. Some of these mitigations +are similar to those used to mitigate Microarchitectural Data Sampling (MDS) or +those used to mitigate Special Register Buffer Data Sampling (SRBDS). + +Data Propagators +================ +Propagators are operations that result in stale data being copied or moved from +one microarchitectural buffer or register to another. Processor MMIO Stale Data +Vulnerabilities are operations that may result in stale data being directly +read into an architectural, software-visible state or sampled from a buffer or +register. + +Fill Buffer Stale Data Propagator (FBSDP) +----------------------------------------- +Stale data may propagate from fill buffers (FB) into the non-coherent portion +of the uncore on some non-coherent writes. Fill buffer propagation by itself +does not make stale data architecturally visible. Stale data must be propagated +to a location where it is subject to reading or sampling. + +Sideband Stale Data Propagator (SSDP) +------------------------------------- +The sideband stale data propagator (SSDP) is limited to the client (including +Intel Xeon server E3) uncore implementation. The sideband response buffer is +shared by all client cores. For non-coherent reads that go to sideband +destinations, the uncore logic returns 64 bytes of data to the core, including +both requested data and unrequested stale data, from a transaction buffer and +the sideband response buffer. As a result, stale data from the sideband +response and transaction buffers may now reside in a core fill buffer. + +Primary Stale Data Propagator (PSDP) +------------------------------------ +The primary stale data propagator (PSDP) is limited to the client (including +Intel Xeon server E3) uncore implementation. Similar to the sideband response +buffer, the primary response buffer is shared by all client cores. For some +processors, MMIO primary reads will return 64 bytes of data to the core fill +buffer including both requested data and unrequested stale data. This is +similar to the sideband stale data propagator. + +Vulnerabilities +=============== +Device Register Partial Write (DRPW) (CVE-2022-21166) +----------------------------------------------------- +Some endpoint MMIO registers incorrectly handle writes that are smaller than +the register size. Instead of aborting the write or only copying the correct +subset of bytes (for example, 2 bytes for a 2-byte write), more bytes than +specified by the write transaction may be written to the register. On +processors affected by FBSDP, this may expose stale data from the fill buffers +of the core that created the write transaction. + +Shared Buffers Data Sampling (SBDS) (CVE-2022-21125) +---------------------------------------------------- +After propagators may have moved data around the uncore and copied stale data +into client core fill buffers, processors affected by MFBDS can leak data from +the fill buffer. It is limited to the client (including Intel Xeon server E3) +uncore implementation. + +Shared Buffers Data Read (SBDR) (CVE-2022-21123) +------------------------------------------------ +It is similar to Shared Buffer Data Sampling (SBDS) except that the data is +directly read into the architectural software-visible state. It is limited to +the client (including Intel Xeon server E3) uncore implementation. + +Affected Processors +=================== +Not all the CPUs are affected by all the variants. For instance, most +processors for the server market (excluding Intel Xeon E3 processors) are +impacted by only Device Register Partial Write (DRPW). + +Below is the list of affected Intel processors [#f1]_: + + =================== ============ ========= + Common name Family_Model Steppings + =================== ============ ========= + HASWELL_X 06_3FH 2,4 + SKYLAKE_L 06_4EH 3 + BROADWELL_X 06_4FH All + SKYLAKE_X 06_55H 3,4,6,7,11 + BROADWELL_D 06_56H 3,4,5 + SKYLAKE 06_5EH 3 + ICELAKE_X 06_6AH 4,5,6 + ICELAKE_D 06_6CH 1 + ICELAKE_L 06_7EH 5 + ATOM_TREMONT_D 06_86H All + LAKEFIELD 06_8AH 1 + KABYLAKE_L 06_8EH 9 to 12 + ATOM_TREMONT 06_96H 1 + ATOM_TREMONT_L 06_9CH 0 + KABYLAKE 06_9EH 9 to 13 + COMETLAKE 06_A5H 2,3,5 + COMETLAKE_L 06_A6H 0,1 + ROCKETLAKE 06_A7H 1 + =================== ============ ========= + +If a CPU is in the affected processor list, but not affected by a variant, it +is indicated by new bits in MSR IA32_ARCH_CAPABILITIES. As described in a later +section, mitigation largely remains the same for all the variants, i.e. to +clear the CPU fill buffers via VERW instruction. + +New bits in MSRs +================ +Newer processors and microcode update on existing affected processors added new +bits to IA32_ARCH_CAPABILITIES MSR. These bits can be used to enumerate +specific variants of Processor MMIO Stale Data vulnerabilities and mitigation +capability. + +MSR IA32_ARCH_CAPABILITIES +-------------------------- +Bit 13 - SBDR_SSDP_NO - When set, processor is not affected by either the + Shared Buffers Data Read (SBDR) vulnerability or the sideband stale + data propagator (SSDP). +Bit 14 - FBSDP_NO - When set, processor is not affected by the Fill Buffer + Stale Data Propagator (FBSDP). +Bit 15 - PSDP_NO - When set, processor is not affected by Primary Stale Data + Propagator (PSDP). +Bit 17 - FB_CLEAR - When set, VERW instruction will overwrite CPU fill buffer + values as part of MD_CLEAR operations. Processors that do not + enumerate MDS_NO (meaning they are affected by MDS) but that do + enumerate support for both L1D_FLUSH and MD_CLEAR implicitly enumerate + FB_CLEAR as part of their MD_CLEAR support. +Bit 18 - FB_CLEAR_CTRL - Processor supports read and write to MSR + IA32_MCU_OPT_CTRL[FB_CLEAR_DIS]. On such processors, the FB_CLEAR_DIS + bit can be set to cause the VERW instruction to not perform the + FB_CLEAR action. Not all processors that support FB_CLEAR will support + FB_CLEAR_CTRL. + +MSR IA32_MCU_OPT_CTRL +--------------------- +Bit 3 - FB_CLEAR_DIS - When set, VERW instruction does not perform the FB_CLEAR +action. This may be useful to reduce the performance impact of FB_CLEAR in +cases where system software deems it warranted (for example, when performance +is more critical, or the untrusted software has no MMIO access). Note that +FB_CLEAR_DIS has no impact on enumeration (for example, it does not change +FB_CLEAR or MD_CLEAR enumeration) and it may not be supported on all processors +that enumerate FB_CLEAR. + +Mitigation +========== +Like MDS, all variants of Processor MMIO Stale Data vulnerabilities have the +same mitigation strategy to force the CPU to clear the affected buffers before +an attacker can extract the secrets. + +This is achieved by using the otherwise unused and obsolete VERW instruction in +combination with a microcode update. The microcode clears the affected CPU +buffers when the VERW instruction is executed. + +Kernel reuses the MDS function to invoke the buffer clearing: + + mds_clear_cpu_buffers() + +On MDS affected CPUs, the kernel already invokes CPU buffer clear on +kernel/userspace, hypervisor/guest and C-state (idle) transitions. No +additional mitigation is needed on such CPUs. + +For CPUs not affected by MDS or TAA, mitigation is needed only for the attacker +with MMIO capability. Therefore, VERW is not required for kernel/userspace. For +virtualization case, VERW is only needed at VMENTER for a guest with MMIO +capability. + +Mitigation points +----------------- +Return to user space +^^^^^^^^^^^^^^^^^^^^ +Same mitigation as MDS when affected by MDS/TAA, otherwise no mitigation +needed. + +C-State transition +^^^^^^^^^^^^^^^^^^ +Control register writes by CPU during C-state transition can propagate data +from fill buffer to uncore buffers. Execute VERW before C-state transition to +clear CPU fill buffers. + +Guest entry point +^^^^^^^^^^^^^^^^^ +Same mitigation as MDS when processor is also affected by MDS/TAA, otherwise +execute VERW at VMENTER only for MMIO capable guests. On CPUs not affected by +MDS/TAA, guest without MMIO access cannot extract secrets using Processor MMIO +Stale Data vulnerabilities, so there is no need to execute VERW for such guests. + +Mitigation control on the kernel command line +--------------------------------------------- +The kernel command line allows to control the Processor MMIO Stale Data +mitigations at boot time with the option "mmio_stale_data=". The valid +arguments for this option are: + + ========== ================================================================= + full If the CPU is vulnerable, enable mitigation; CPU buffer clearing + on exit to userspace and when entering a VM. Idle transitions are + protected as well. It does not automatically disable SMT. + full,nosmt Same as full, with SMT disabled on vulnerable CPUs. This is the + complete mitigation. + off Disables mitigation completely. + ========== ================================================================= + +If the CPU is affected and mmio_stale_data=off is not supplied on the kernel +command line, then the kernel selects the appropriate mitigation. + +Mitigation status information +----------------------------- +The Linux kernel provides a sysfs interface to enumerate the current +vulnerability status of the system: whether the system is vulnerable, and +which mitigations are active. The relevant sysfs file is: + + /sys/devices/system/cpu/vulnerabilities/mmio_stale_data + +The possible values in this file are: + + .. list-table:: + + * - 'Not affected' + - The processor is not vulnerable + * - 'Vulnerable' + - The processor is vulnerable, but no mitigation enabled + * - 'Vulnerable: Clear CPU buffers attempted, no microcode' + - The processor is vulnerable, but microcode is not updated. The + mitigation is enabled on a best effort basis. + * - 'Mitigation: Clear CPU buffers' + - The processor is vulnerable and the CPU buffer clearing mitigation is + enabled. + +If the processor is vulnerable then the following information is appended to +the above information: + + ======================== =========================================== + 'SMT vulnerable' SMT is enabled + 'SMT disabled' SMT is disabled + 'SMT Host state unknown' Kernel runs in a VM, Host SMT state unknown + ======================== =========================================== + +References +---------- +.. [#f1] Affected Processors + https://www.intel.com/content/www/us/en/developer/topic-technology/software… -- 2.20.1

1 29

[PATCH openEuler-5.10 000/557] Backport 5.10.110 LTS
by Zheng Zengkai 06 Jul '22

06 Jul '22

Backport 5.10.110 LTS patches from upstream arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory zones PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup" can: m_can: m_can_tx_handler(): fix use after free of skb openvswitch: Fixed nd target mask field in the flow dump. docs: sysctl/kernel: add missing bit to panic_print um: Fix uml_mconsole stop/go ARM: dts: spear13xx: Update SPI dma properties ARM: dts: spear1340: Update serial node properties ASoC: topology: Allow TLV control to be either read or write dt-bindings: spi: mxic: The interrupt property is not mandatory dt-bindings: mtd: nand-controller: Fix a comment in the examples dt-bindings: mtd: nand-controller: Fix the reg property description bpf: Fix comment for helper bpf_current_task_under_cgroup() bpf: Adjust BPF stack helper functions to accommodate skip > 0 mm/usercopy: return 1 from hardened_usercopy __setup() handler mm/memcontrol: return 1 from cgroup.memory __setup() handler ARM: 9187/1: JIVE: fix return value of __setup handler mm/mmap: return 1 from stack_guard_gap __setup() handler batman-adv: Check ptr for NULL before reducing its refcnt ASoC: soc-compress: Change the check for codec_dai staging: mt7621-dts: fix pinctrl-0 items to be size-1 items on ethernet proc: bootconfig: Add null pointer check can: isotp: restore accidentally removed MSG_PEEK feature platform/chrome: cros_ec_typec: Check for EC device ACPI: CPPC: Avoid out of bounds access when parsing _CPC data riscv module: remove (NOLOAD) io_uring: fix memory leak of uid in files registration ARM: iop32x: offset IRQ numbers by 1 ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE() pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR() watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function pinctrl: pinconf-generic: Print arguments for bias-pull-* watch_queue: Free the page array when watch_queue is dismantled crypto: arm/aes-neonbs-cbc - Select generic cbc and aes mailbox: imx: fix wakeup failure from freeze mode rxrpc: Fix call timer start racing with call destruction gfs2: Make sure FITRIM minlen is rounded up to fs block size rtc: check if __rtc_read_time was successful XArray: Update the LRU list in xas_split() can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value can: mcba_usb: properly check endpoint type XArray: Fix xas_create_range() when multi-order entry present wireguard: socket: ignore v6 endpoints when ipv6 is disabled wireguard: socket: free skb in send6 when ipv6 is disabled wireguard: queueing: use CFI-safe ptr_ring cleanup function ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM KVM: SVM: fix panic on out-of-bounds guest IRQ KVM: x86: fix sending PV IPI KVM: Prevent module exit until all VMs are freed KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated platform: chrome: Split trace include file scsi: qla2xxx: Use correct feature type field during RFF_ID processing scsi: qla2xxx: Reduce false trigger to login scsi: qla2xxx: Fix N2N inconsistent PLOGI scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests scsi: qla2xxx: Fix hang due to session stuck scsi: qla2xxx: Fix incorrect reporting of task management failure scsi: qla2xxx: Fix disk failure to rediscover scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() scsi: qla2xxx: Check for firmware dump already collected scsi: qla2xxx: Add devids and conditionals for 28xx scsi: qla2xxx: Fix device reconnect in loop topology scsi: qla2xxx: Fix warning for missing error code scsi: qla2xxx: Fix wrong FDMI data for 64G adapter scsi: qla2xxx: Fix scheduling while atomic scsi: qla2xxx: Fix stuck session in gpdb powerpc: Fix build errors with newer binutils powerpc/lib/sstep: Fix build errors with newer binutils powerpc/lib/sstep: Fix 'sthcx' instruction powerpc/kasan: Fix early region not updated correctly KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP MMU ALSA: hda/realtek: Add alc256-samsung-headphone fixup media: atomisp: fix bad usage at error handling logic mmc: host: Return an error when ->enable_sdio_irq() ops is missing media: hdpvr: initialize dev->worker at hdpvr_register_videodev media: Revert "media: em28xx: add missing em28xx_close_extension" video: fbdev: sm712fb: Fix crash in smtcfb_write() ARM: mmp: Fix failure to remove sram device ARM: tegra: tamonten: Fix I2C3 pad setting lib/test_lockup: fix kernel pointer check for separate address spaces uaccess: fix type mismatch warnings from access_ok() media: cx88-mpeg: clear interrupt status register before streaming video ASoC: soc-core: skip zero num_dai component in searching dai name ARM: dts: bcm2711: Add the missing L1/L2 cache information video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() arm64: defconfig: build imx-sdma as a module ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk ARM: ftrace: avoid redundant loads or clobbering IP media: atomisp: fix dummy_ptr check to avoid duplicate active_bo media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator off on some boards ASoC: madera: Add dependencies on MFD ARM: dts: bcm2837: Add the missing L1/L2 cache information ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit video: fbdev: cirrusfb: check pixclock to avoid divide by zero video: fbdev: w100fb: Reset global state video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow media: ir_toy: free before error exiting media: staging: media: zoran: fix various V4L2 compliance errors media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com media: staging: media: zoran: move videodev alloc ntfs: add sanity check on allocation size f2fs: compress: fix to print raw data size in error path of lz4 decompression NFSD: Fix nfsd_breaker_owns_lease() return values f2fs: fix to do sanity check on curseg->alloc_type ext4: don't BUG if someone dirty pages without asking ext4 first ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb locking/lockdep: Iterate lock_classes directly when reading lockdep files spi: tegra20: Use of_device_get_match_data() nvme-tcp: lockdep: annotate in-kernel sockets parisc: Fix handling off probe non-access faults PM: core: keep irq flags in device_pm_check_callbacks() ACPI/APEI: Limit printable size of BERT table data Revert "Revert "block, bfq: honor already-setup queue merges"" lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3 ACPICA: Avoid walking the ACPI Namespace if it is not there fs/binfmt_elf: Fix AT_PHDR for unusual ELF files irqchip/nvic: Release nvic_base upon failure irqchip/qcom-pdc: Fix broken locking Fix incorrect type in assignment of ipv6 port for audit loop: use sysfs_emit() in the sysfs xxx show() selinux: allow FIOCLEX and FIONCLEX with policy capability selinux: use correct type for context length pinctrl: npcm: Fix broken references to chip->parent_device gcc-plugins/stackleak: Exactly match strings instead of prefixes regulator: rpi-panel: Handle I2C errors/timing to the Atmel LSM: general protection fault in legacy_parse_param fs: fix fd table size alignment properly lib/test: use after free in register_test_dev_kmod() fs: fd tables have to be multiples of BITS_PER_LONG net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator NFSv4/pNFS: Fix another issue with a list iterator pointing to the head qlcnic: dcb: default to returning -EOPNOTSUPP selftests: test_vxlan_under_vrf: Fix broken test case net: phy: broadcom: Fix brcm_fet_config_init() net: enetc: report software timestamping via SO_TIMESTAMPING xen: fix is_xen_pmu() clk: Initialize orphan req_rate clk: qcom: gcc-msm8994: Fix gpll4 width kdb: Fix the putarea helper function NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options jfs: fix divide error in dbNextAG driver core: dd: fix return value of __setup handler firmware: google: Properly state IOMEM dependency kgdbts: fix return value of __setup handler serial: 8250: fix XOFF/XON sending when DMA is used kgdboc: fix return value of __setup handler tty: hvc: fix return value of __setup handler pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual GPIOs pinctrl: mediatek: paris: Fix pingroup pin config state readback pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get() pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init staging: mt7621-dts: fix GB-PC2 devicetree staging: mt7621-dts: fix pinctrl properties for ethernet staging: mt7621-dts: fix formatting staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree NFS: remove unneeded check in decode_devicenotify_args() clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver clk: clps711x: Terminate clk_div_table with sentinel element clk: loongson1: Terminate clk_div_table with sentinel element clk: actions: Terminate clk_div_table with sentinel element nvdimm/region: Fix default alignment for small regions remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma clk: qcom: clk-rcg2: Update the frac table for pixel clock clk: qcom: clk-rcg2: Update logic to calculate D value for RCG clk: at91: sama7g5: fix parents of PDMCs' GCLK clk: imx7d: Remove audio_mclk_root_clk dma-debug: fix return value of __setup handlers NFS: Return valid errors from nfs2/3_decode_dirent() habanalabs: Add check for pci_enable_device iio: adc: Add check for devm_request_threaded_irq serial: 8250: Fix race condition in RTS-after-send handling NFS: Use of mapping_set_error() results in spurious errors serial: 8250_lpss: Balance reference count for PCI DMA device serial: 8250_mid: Balance reference count for PCI DMA device phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure}) clk: qcom: ipq8074: Use floor ops for SDCC1 clock pinctrl: renesas: checker: Fix miscalculation of number of states pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel staging:iio:adc:ad7280a: Fix handing of device address bit reversing. iio: mma8452: Fix probe failing when an i2c_device_id is used clk: qcom: ipq8074: fix PCI-E clock oops soundwire: intel: fix wrong register name in intel_shim_wake cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse misc: alcor_pci: Fix an error handling path fsi: Aspeed: Fix a potential double free fsi: aspeed: convert to devm_platform_ioremap_resource pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add() mxser: fix xmit_buf leak in activate when LSR == 0xff mfd: asic3: Add missing iounmap() on error asic3_mfd_probe tipc: fix the timer expires after interval 100ms openvswitch: always update flow key after nat tcp: ensure PMTU updates are processed during fastopen net: bcmgenet: Use stronger register read/writes to assure ordering PCI: Avoid broken MSI on SB600 USB devices selftests/bpf/test_lirc_mode2.sh: Exit with proper code i2c: mux: demux-pinctrl: do not deactivate a master that is not active i2c: meson: Fix wrong speed use from probe af_netlink: Fix shift out of bounds in group mask calculation ipv4: Fix route lookups when handling ICMP redirects and PMTU updates Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed selftests/bpf: Fix error reporting from sock_fields programs bareudp: use ipv6_mod_enabled to check if IPv6 enabled can: isotp: support MSG_TRUNC flag when reading from socket can: isotp: return -EADDRNOTAVAIL when reading from unbound socket USB: storage: ums-realtek: fix error code in rts51x_read_mem() samples/bpf, xdpsock: Fix race when running for fix duration of time RDMA/mlx5: Fix memory leak in error flow for subscribe event routine mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init MIPS: pgalloc: fix memory leak caused by pgd_free() MIPS: RB532: fix return value of __setup handler mips: cdmm: Fix refcount leak in mips_cdmm_phys_base ath10k: Fix error handling in ath10k_setup_msa_resources vxcan: enable local echo for sent CAN frames powerpc: 8xx: fix a return value error in mpc8xx_pic_init platform/x86: huawei-wmi: check the return value of device_create_file() selftests/bpf: Make test_lwt_ip_encap more stable and faster libbpf: Unmap rings when umem deleted mfd: mc13xxx: Add check for mc13xxx_irq_request powerpc/sysdev: fix incorrect use to determine if list is empty mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n net: axienet: fix RX ring refill allocation failure handling IB/hfi1: Allow larger MTU without AIP power: supply: wm8350-power: Add missing free in free_charger_irq power: supply: wm8350-power: Handle error for wm8350_register_irq i2c: xiic: Make bus names unique hv_balloon: rate-limit "Unhandled message" warning KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() KVM: x86: Fix emulation in writing cr8 powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties() libbpf: Skip forward declaration when counting duplicated type names gpu: host1x: Fix a memory leak in 'host1x_remove()' bpf, arm64: Feed byte-offset into bpf line info bpf, arm64: Call build_prologue() first in first JIT pass drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt scsi: hisi_sas: Change permission of parameter prot_mask power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return drm/tegra: Fix reference leak in tegra_dsi_ganged_probe ext2: correct max file size computing TOMOYO: fix __setup handlers return values drm/amd/display: Remove vupdate_int_entry definition RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR scsi: pm8001: Fix abort all task initialization scsi: pm8001: Fix NCQ NON DATA command completion handling scsi: pm8001: Fix NCQ NON DATA command task initialization scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req() scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req() scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update() scsi: pm8001: Fix le32 values handling in pm80xx_set_sas_protocol_timer_config() scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config() scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() scsi: pm8001: Fix command initialization in pm80XX_send_read_log() dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS drm/msm/dpu: fix dp audio condition drm/msm/dpu: add DSPP blocks teardown drm/msm/dp: populate connector of struct dp_panel iwlwifi: mvm: Fix an error code in iwl_mvm_up() iwlwifi: Fix -EIO error code that is never returned dax: make sure inodes are flushed before destroy cache IB/cma: Allow XRC INI QPs to set their local ACK timeout drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug drm/amd/pm: enable pm sysfs write for one VF mode iommu/ipmmu-vmsa: Check for error num after setting mask HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init drm/bridge: dw-hdmi: use safe format when first in bridge chain PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge scripts/dtc: Call pkg-config POSIXly correct net: dsa: mv88e6xxx: Enable port policy support on 6097 mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in sta mode powerpc/perf: Don't use perf_hw_context for trace IMC PMU KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch ray_cs: Check ioremap return value power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe i40e: respect metadata on XSK Rx to skb i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb KVM: PPC: Fix vmx/vsx mixup in mmio emulation RDMA/core: Set MR type in ib_reg_user_mr ath9k_htc: fix uninit value bugs drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl() ionic: fix type complaint in ionic_dev_cmd_clean() drm/edid: Don't clear formats if using deep color mtd: rawnand: gpmi: fix controller timings setting mtd: onenand: Check for error irq Bluetooth: hci_serdev: call init_rwsem() before p->open() udmabuf: validate ubuf->pagecount libbpf: Fix possible NULL pointer dereference when destroying skeleton drm/panfrost: Check for error num after setting mask ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern drm: bridge: adv7511: Fix ADV7535 HPD enablement drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe ASoC: atmel: sam9x5_wm8731: use devm_snd_soc_register_card() mmc: davinci_mmc: Handle error for clk_enable ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digital_probe ASoC: imx-es8328: Fix error return code in imx_es8328_probe() ASoC: fsl_spdif: Disable TX clock when stop ASoC: mxs: Fix error handling in mxs_sgtl5000_probe ASoC: dmaengine: do not use a NULL prepare_slave_config() callback ASoC: SOF: Add missing of_node_put() in imx8m_probe ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in rockchip_i2s_probe ASoC: rockchip: i2s: Use devm_platform_get_and_ioremap_resource() ivtv: fix incorrect device_caps for ivtvfb media: saa7134: fix incorrect use to determine if list is empty media: saa7134: convert list_for_each to entry variant video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of ASoC: fsi: Add check for clk_enable ASoC: wm8350: Handle error for wm8350_register_irq ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe media: vidtv: Check for null return of vzalloc media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction memory: emif: check the pointer temp in get_device_details() memory: emif: Add check for setup_interrupts ASoC: soc-compress: prevent the potentially use of null pointer ASoC: dwc-i2s: Handle errors for clk_enable ASoC: atmel_ssc_dai: Handle errors for clk_enable ASoC: mxs-saif: Handle errors for clk_enable printk: fix return value of printk.devkmsg __setup handler arm64: dts: broadcom: Fix sata nodename arm64: dts: ns2: Fix spi-cpol and spi-cpha property ALSA: spi: Add check for clk_enable() ASoC: ti: davinci-i2s: Add check for clk_enable() ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp() uaccess: fix nios2 and microblaze get_user_8() ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put media: cedrus: h264: Fix neighbour info buffer size media: cedrus: H265: Fix neighbour info buffer size media: usb: go7007: s2250-board: fix leak in probe() media: em28xx: initialize refcount before kref_get media: video/hdmi: handle short reads of hdmi info frame. ARM: dts: imx: Add missing LVDS decoder on M53Menlo ARM: dts: sun8i: v3s: Move the csi1 block to follow address order soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is not defined arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc arm64: dts: qcom: sdm845: fix microphone bias properties and values soc: qcom: aoss: remove spurious IRQF_ONESHOT flags soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem soc: qcom: rpmpd: Check for null return of devm_kcalloc ARM: dts: qcom: ipq4019: fix sleep clock firmware: qcom: scm: Remove reassignment to desc following initializer video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() video: fbdev: controlfb: Fix COMPILE_TEST build video: fbdev: controlfb: Fix set but not used warnings video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen media: aspeed: Correct value for h-total-pixels media: hantro: Fix overfill bottom register field name media: meson: vdec: potential dereference of null pointer media: coda: Fix missing put_device() call in coda_get_vdoa_data ASoC: generic: simple-card-utils: remove useless assignment ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting media: bttv: fix WARNING regression on tunerless devices media: mtk-vcodec: potential dereference of null pointer media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls media: staging: media: zoran: fix usage of vb2_dma_contig_set_max_seg_size kunit: make kunit_test_timeout compatible with comment selftests, x86: fix how check_cc.sh is being invoked f2fs: fix compressed file start atomic write may cause data corruption f2fs: compress: remove unneeded read when rewrite whole cluster btrfs: fix unexpected error path when reflinking an inline extent f2fs: fix to avoid potential deadlock nfsd: more robust allocation failure handling in nfsd_file_cache_init f2fs: fix missing free nid in f2fs_handle_failed_inode perf/x86/intel/pt: Fix address filter config for 32-bit kernel perf/core: Fix address filter parser for multiple filters rseq: Optimise rseq_get_rseq_cs() and clear_rseq_cs() sched/core: Export pelt_thermal_tp sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa f2fs: fix to enable ATGC correctly via gc_idle sysfs interface watch_queue: Actually free the watch watch_queue: Fix NULL dereference in error cleanup io_uring: terminate manual loop iterator loop correctly for non-vecs clocksource: acpi_pm: fix return value of __setup handler hwmon: (pmbus) Add Vin unit off handling hwrng: nomadik - Change clk_disable to clk_disable_unprepare amba: Make the remove callback return void vfio: platform: simplify device removal crypto: ccree - Fix use after free in cc_cipher_exit() crypto: ccp - ccp_dmaengine_unregister release dma channels ACPI: APEI: fix return value of __setup handlers clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_init() clocksource/drivers/timer-microchip-pit64b: Use notrace clocksource/drivers/exynos_mct: Handle DTS with higher number of interrupts clocksource/drivers/exynos_mct: Refactor resources allocation clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix crypto: vmx - add missing dependencies crypto: amlogic - call finalize with bh disabled crypto: sun8i-ce - call finalize with bh disabled crypto: sun8i-ss - call finalize with bh disabled hwrng: atmel - disable trng on failure path spi: spi-zynqmp-gqspi: Handle error for dma_set_mask PM: suspend: fix return value of __setup handler PM: hibernate: fix __setup handler error handling block: don't delete queue kobject before its children nvme: cleanup __nvme_check_ids hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING hwmon: (pmbus) Add mutex to regulator ops spi: pxa2xx-pci: Balance reference count for PCI DMA device crypto: ccree - don't attempt 0 len DMA mappings EVM: fix the evm= __setup handler return value audit: log AUDIT_TIME_* records only from rules crypto: rockchip - ECB does not need IV selftests/x86: Add validity check and allow field splitting arm64/mm: avoid fixmap race condition when create pud mapping spi: tegra114: Add missing IRQ check in tegra_spi_probe thermal: int340x: Check for NULL after calling kmemdup() crypto: mxs-dcp - Fix scatterlist processing crypto: authenc - Fix sleep in atomic context in decrypt_tail crypto: sun8i-ss - really disable hash on A80 hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER hwrng: cavium - Check health status while reading random data selinux: check return value of sel_make_avc_files regulator: qcom_smd: fix for_each_child.cocci warnings PCI: xgene: Revert "PCI: xgene: Fix IB window setup" PCI: pciehp: Clear cmd_busy bit in polling mode drm/i915/gem: add missing boundary check in vm_access brcmfmac: pcie: Fix crashes due to early IRQs brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path brcmfmac: firmware: Allocate space for default boardrev in nvram xtensa: fix xtensa_wsr always writing 0 xtensa: fix stop_machine_cpuslocked call in patch_text media: davinci: vpif: fix unbalanced runtime PM enable media: davinci: vpif: fix unbalanced runtime PM get media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC DEC: Limit PMAX memory probing to R3k systems crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() crypto: rsa-pkcs1pad - restore signature length check crypto: rsa-pkcs1pad - correctly get hash from source scatterlist crypto: rsa-pkcs1pad - only allow with rsa exec: Force single empty string when argv is empty lib/raid6/test: fix multiple definition linking error thermal: int340x: Increase bitmap size pstore: Don't use semaphores in always-atomic-context code carl9170: fix missing bit-wise or operator for tx_params mgag200 fix memmapsl configuration in GCTL6 register ARM: dts: exynos: add missing HDMI supplies on SMDK5420 ARM: dts: exynos: add missing HDMI supplies on SMDK5250 ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 ARM: dts: at91: sama5d2: Fix PMERRLOC resource size video: fbdev: atari: Atari 2 bpp (STe) palette bugfix video: fbdev: sm712fb: Fix crash in smtcfb_read() drm/edid: check basic audio support on CEA extension block block: limit request dispatch loop duration mailbox: tegra-hsp: Flush whole channel ext4: fix fs corruption when tring to remove a non-empty directory with IO error ext4: fix ext4_fc_stats trace point coredump: Also dump first pages of non-executable ELF libraries ACPI: properties: Consistently return -ENOENT if there are no more references arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs arm64: signal: nofpsimd: Do not allocate fp/simd context when not available udp: call udp_encap_enable for v6 sockets when enabling encap powerpc/kvm: Fix kvm_use_magic_page can: isotp: sanitize CAN ID checks in isotp_bind() drbd: fix potential silent data corruption dm integrity: set journal entry unused when shrinking device mm/kmemleak: reset tag when compare object pointer mm,hwpoison: unmap poisoned page before invalidation Revert "mm: madvise: skip unmapped vma holes passed to process_madvise" mm: madvise: return correct bytes advised with process_madvise mm: madvise: skip unmapped vma holes passed to process_madvise ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock ALSA: hda: Avoid unsol event during RPM suspending ALSA: cs4236: fix an incorrect NULL check on list iterator cifs: fix NULL ptr dereference in smb2_ioctl_query_info() cifs: prevent bad output lengths in smb2_ioctl_query_info() Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" riscv: Increase stack size under KASAN riscv: Fix fill_callchain return value qed: display VF trust config scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands mempolicy: mbind_range() set_policy() after vma_merge() mm: invalidate hwpoison page cache page in fault path mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node mtd: rawnand: protect access to rawnand devices while in suspend spi: mxic: Fix the transmit path pinctrl: samsung: drop pin banks references on error paths remoteproc: Fix count check in rproc_coredump_write() f2fs: fix to do sanity check on .cp_pack_total_block_count f2fs: quota: fix loop condition at f2fs_quota_sync() f2fs: fix to unlock page correctly in error path of is_alive() NFSD: prevent integer overflow on 32 bit systems NFSD: prevent underflow in nfssvc_decode_writeargs() SUNRPC: avoid race between mod_timer() and del_timer_sync() HID: intel-ish-hid: Use dma_alloc_coherent for firmware update firmware: stratix10-svc: add missing callback parameter on RSU Documentation: update stable tree link Documentation: add link to stable release candidate tree KEYS: fix length validation in keyctl_pkey_params_get_2() clk: uniphier: Fix fixed-rate initialization greybus: svc: fix an error handling bug in gb_svc_hello() iio: inkern: make a best effort on offset calculation iio: inkern: apply consumer scale when no channel scale is available iio: inkern: apply consumer scale on IIO_VAL_INT cases iio: afe: rescale: use s64 for temporary scale calculations coresight: Fix TRCCONFIGR.QE sysfs interface mei: avoid iterator usage outside of list_for_each_entry mei: me: add Alder Lake N device id. xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx() xhci: make xhci_handshake timeout for xhci_reset() adjustable xhci: fix runtime PM imbalance in USB2 resume xhci: fix garbage USBSTS being logged in some cases USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c virtio-blk: Use blk_validate_block_size() to validate block size tpm: fix reference counting for struct tpm_chip iommu/iova: Improve 32-bit free space estimate locking/lockdep: Avoid potential access of invalid memory in lock_class net: dsa: microchip: add spi_device_id tables Input: zinitix - do not report shadow fingers spi: Fix erroneous sgs value with min_t() Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)" net:mcf8390: Use platform_get_irq() to get the interrupt spi: Fix invalid sgs value gpio: Revert regression in sysfs-gpio (gpiolib.c) ethernet: sun: Free the coherent when failing in probing tools/virtio: fix virtio_test execution vdpa/mlx5: should verify CTRL_VQ feature exists for MQ virtio_console: break out of buf poll on remove ARM: mstar: Select HAVE_ARM_ARCH_TIMER xfrm: fix tunnel model fragmentation behavior HID: logitech-dj: add new lightspeed receiver id hv: utils: add PTP_1588_CLOCK to Kconfig to fix build USB: serial: simple: add Nokia phone driver USB: serial: pl2303: add IBM device IDs already merged(32) can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path KVM: x86/mmu: do compare-and-exchange of gPTE via the user address ubi: fastmap: Return error code if memory allocation fails in add_aeb() ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl net: hns3: fix software vlan talbe of vlan 0 inconsistent with hardware can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path ubifs: rename_whiteout: correct old_dir size computing ubifs: Fix to add refcount once page is set private ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() ubifs: setflags: Make dirtied_ino_d 8 bytes aligned ubifs: Add missing iput if do_tmpfile() failed in rename whiteout ubifs: Fix deadlock in concurrent rename whiteout and inode writeback ubifs: rename_whiteout: Fix double free for whiteout_ui->data bfq: fix use-after-free in bfq_dispatch_request block, bfq: don't move oom_bfqq net/x25: Fix null-ptr-deref caused by x25_disconnect net: hns3: fix bug when PF set the duplicate MAC address for VFs bpf, sockmap: Fix double uncharge the mem of sk_msg bpf, sockmap: Fix more uncharged while msg has more_data bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full livepatch: Fix build failure on 32 bits processors drm/i915/opregion: check port number bounds for SWSCI display power state bcache: fixup multiple threads crash drivers: hamradio: 6pack: fix UAF bug caused by mod_timer() jffs2: fix memory leak in jffs2_scan_medium jffs2: fix memory leak in jffs2_do_mount_fs jffs2: fix use-after-free in jffs2_clear_xattr_subsystem can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register netdevice: add the case if dev is NULL swiotlb: fix info leak with DMA_FROM_DEVICE kabi conflict(8) PCI: Reduce warnings on possible RW1C corruption qed: validate and restrict untrusted VFs vlan promisc mode block: don't merge across cgroup boundaries if blkcg is enabled rseq: Remove broken uapi field layout on 32-bit little endian coredump: Use the vma snapshot in fill_files_note coredump/elf: Pass coredump_params into fill_note_info coredump: Remove the WARN_ON in dump_vma_snapshot coredump: Snapshot the vmas in do_coredump Total Patches = 597 - 32 - 8 = 557 Aaron Conole (1): openvswitch: always update flow key after nat Aashish Sharma (1): dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS Abel Vesa (2): clk: imx7d: Remove audio_mclk_root_clk ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk Adrian Hunter (2): perf/core: Fix address filter parser for multiple filters perf/x86/intel/pt: Fix address filter config for 32-bit kernel Aharon Landau (1): RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR Akira Kawata (1): fs/binfmt_elf: Fix AT_PHDR for unusual ELF files Alan Stern (1): USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c Alexander Lobakin (2): i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb i40e: respect metadata on XSK Rx to skb Alexander Usyskin (2): mei: me: add Alder Lake N device id. mei: avoid iterator usage outside of list_for_each_entry Alexey Khoroshilov (1): NFS: remove unneeded check in decode_devicenotify_args() Alistair Delva (1): remoteproc: Fix count check in rproc_coredump_write() Alistair Popple (1): mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node Amadeusz Sławiński (1): ASoC: topology: Allow TLV control to be either read or write Amir Goldstein (1): nfsd: more robust allocation failure handling in nfsd_file_cache_init Ammar Faizi (1): ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM Anders Roxell (3): powerpc/lib/sstep: Fix 'sthcx' instruction powerpc/lib/sstep: Fix build errors with newer binutils powerpc: Fix build errors with newer binutils Andre Przywara (1): ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS Andreas Gruenbacher (1): powerpc/kvm: Fix kvm_use_magic_page Andrew Price (1): gfs2: Make sure FITRIM minlen is rounded up to fs block size Andy Shevchenko (3): spi: pxa2xx-pci: Balance reference count for PCI DMA device serial: 8250_mid: Balance reference count for PCI DMA device serial: 8250_lpss: Balance reference count for PCI DMA device Ang Tien Sung (1): firmware: stratix10-svc: add missing callback parameter on RSU Anssi Hannula (3): xhci: fix garbage USBSTS being logged in some cases xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx() hv_balloon: rate-limit "Unhandled message" warning Anton Ivanov (1): um: Fix uml_mconsole stop/go Ard Biesheuvel (1): ARM: ftrace: avoid redundant loads or clobbering IP Armin Wolf (1): hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING Arnd Bergmann (4): uaccess: fix nios2 and microblaze get_user_8() uaccess: fix type mismatch warnings from access_ok() lib/test_lockup: fix kernel pointer check for separate address spaces ARM: iop32x: offset IRQ numbers by 1 Arun Easi (2): scsi: qla2xxx: Fix device reconnect in loop topology scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests Arınç ÜNAL (5): staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree staging: mt7621-dts: fix formatting staging: mt7621-dts: fix pinctrl properties for ethernet staging: mt7621-dts: fix GB-PC2 devicetree staging: mt7621-dts: fix pinctrl-0 items to be size-1 items on ethernet Athira Rajeev (1): powerpc/perf: Don't use perf_hw_context for trace IMC PMU Bagas Sanjaya (2): Documentation: add link to stable release candidate tree Documentation: update stable tree link Bartosz Golaszewski (1): Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)" Bharata B Rao (1): sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa Biju Das (2): spi: Fix invalid sgs value spi: Fix erroneous sgs value with min_t() Bikash Hazarika (1): scsi: qla2xxx: Fix wrong FDMI data for 64G adapter Bjorn Helgaas (1): PCI: Avoid broken MSI on SB600 USB devices Brandon Wyman (1): hwmon: (pmbus) Add Vin unit off handling Casey Schaufler (2): LSM: general protection fault in legacy_parse_param Fix incorrect type in assignment of ipv6 port for audit Chaitanya Kulkarni (1): loop: use sysfs_emit() in the sysfs xxx show() Chao Yu (6): f2fs: fix to unlock page correctly in error path of is_alive() f2fs: fix to do sanity check on .cp_pack_total_block_count f2fs: fix to enable ATGC correctly via gc_idle sysfs interface f2fs: fix to avoid potential deadlock f2fs: fix to do sanity check on curseg->alloc_type f2fs: compress: fix to print raw data size in error path of lz4 decompression Charan Teja Kalla (3): mm: madvise: skip unmapped vma holes passed to process_madvise mm: madvise: return correct bytes advised with process_madvise Revert "mm: madvise: skip unmapped vma holes passed to process_madvise" Charles Keepax (1): ASoC: madera: Add dependencies on MFD Chen Jingwen (1): powerpc/kasan: Fix early region not updated correctly Chen-Yu Tsai (7): media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls media: hantro: Fix overfill bottom register field name pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get() pinctrl: mediatek: paris: Fix pingroup pin config state readback pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual GPIOs pinctrl: pinconf-generic: Print arguments for bias-pull-* Chris Leech (1): nvme-tcp: lockdep: annotate in-kernel sockets Christian Göttsche (2): selinux: check return value of sel_make_avc_files selinux: use correct type for context length Christoph Hellwig (1): nvme: cleanup __nvme_check_ids Christophe JAILLET (4): firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is not defined gpu: host1x: Fix a memory leak in 'host1x_remove()' fsi: Aspeed: Fix a potential double free misc: alcor_pci: Fix an error handling path Chuck Lever (1): NFSD: Fix nfsd_breaker_owns_lease() return values Claudiu Beznea (3): net: dsa: microchip: add spi_device_id tables hwrng: atmel - disable trng on failure path clocksource/drivers/timer-microchip-pit64b: Use notrace Codrin Ciubotariu (2): ASoC: dmaengine: do not use a NULL prepare_slave_config() callback clk: at91: sama7g5: fix parents of PDMCs' GCLK Colin Ian King (2): carl9170: fix missing bit-wise or operator for tx_params iwlwifi: Fix -EIO error code that is never returned Cooper Chiou (1): drm/edid: check basic audio support on CEA extension block Corentin Labbe (8): crypto: sun8i-ss - really disable hash on A80 crypto: rockchip - ECB does not need IV crypto: sun8i-ss - call finalize with bh disabled crypto: sun8i-ce - call finalize with bh disabled crypto: amlogic - call finalize with bh disabled media: staging: media: zoran: fix usage of vb2_dma_contig_set_max_seg_size media: staging: media: zoran: move videodev alloc media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com Dafna Hirschfeld (1): media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED Damien Le Moal (11): scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands scsi: pm8001: Fix command initialization in pm80XX_send_read_log() scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config() scsi: pm8001: Fix le32 values handling in pm80xx_set_sas_protocol_timer_config() scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update() scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req() scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req() scsi: pm8001: Fix NCQ NON DATA command task initialization scsi: pm8001: Fix NCQ NON DATA command completion handling scsi: pm8001: Fix abort all task initialization Dan Carpenter (9): greybus: svc: fix an error handling bug in gb_svc_hello() NFSD: prevent underflow in nfssvc_decode_writeargs() NFSD: prevent integer overflow on 32 bit systems video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() media: usb: go7007: s2250-board: fix leak in probe() iwlwifi: mvm: Fix an error code in iwl_mvm_up() USB: storage: ums-realtek: fix error code in rts51x_read_mem() lib/test: use after free in register_test_dev_kmod() Dan Williams (1): nvdimm/region: Fix default alignment for small regions Daniel González Cabanelas (1): media: cx88-mpeg: clear interrupt status register before streaming video Daniel Henrique Barboza (1): powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties() Daniel Palmer (1): ARM: mstar: Select HAVE_ARM_ARCH_TIMER Daniel Thompson (2): soc: qcom: aoss: remove spurious IRQF_ONESHOT flags kdb: Fix the putarea helper function Dario Binacchi (1): mtd: rawnand: gpmi: fix controller timings setting Darren Hart (1): ACPI/APEI: Limit printable size of BERT table data Dave Stevenson (1): regulator: rpi-panel: Handle I2C errors/timing to the Atmel David Engraf (1): arm64: signal: nofpsimd: Do not allocate fp/simd context when not available David Gow (1): firmware: google: Properly state IOMEM dependency David Heidelberg (2): arm64: dts: qcom: sdm845: fix microphone bias properties and values ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 David Howells (3): watch_queue: Fix NULL dereference in error cleanup watch_queue: Actually free the watch rxrpc: Fix call timer start racing with call destruction David Matlack (1): KVM: Prevent module exit until all VMs are freed Dirk Buchwalder (1): clk: qcom: ipq8074: Use floor ops for SDCC1 clock Dirk Müller (1): lib/raid6/test: fix multiple definition linking error Dmitry Baryshkov (3): drm/msm/dpu: add DSPP blocks teardown drm/msm/dpu: fix dp audio condition PM: core: keep irq flags in device_pm_check_callbacks() Dmitry Torokhov (1): HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports Dmitry Vyukov (1): riscv: Increase stack size under KASAN Dongliang Mu (3): media: em28xx: initialize refcount before kref_get ntfs: add sanity check on allocation size media: hdpvr: initialize dev->worker at hdpvr_register_videodev Drew Fustini (1): clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix Dāvis Mosāns (1): crypto: ccp - ccp_dmaengine_unregister release dma channels Eddie James (1): USB: serial: pl2303: add IBM device IDs Eric Biggers (6): KEYS: fix length validation in keyctl_pkey_params_get_2() crypto: rsa-pkcs1pad - only allow with rsa crypto: rsa-pkcs1pad - correctly get hash from source scatterlist crypto: rsa-pkcs1pad - restore signature length check crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() block: don't delete queue kobject before its children Eric Dumazet (2): rseq: Optimise rseq_get_rseq_cs() and clear_rseq_cs() watch_queue: Free the page array when watch_queue is dismantled Evgeny Novikov (1): video: fbdev: w100fb: Reset global state Fabiano Rosas (2): KVM: PPC: Fix vmx/vsx mixup in mmio emulation KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init Fangrui Song (1): riscv module: remove (NOLOAD) Felix Maurer (1): selftests/bpf: Make test_lwt_ip_encap more stable and faster Fengnan Chang (2): f2fs: compress: remove unneeded read when rewrite whole cluster f2fs: fix compressed file start atomic write may cause data corruption Filipe Manana (1): btrfs: fix unexpected error path when reflinking an inline extent Florian Fainelli (1): net: phy: broadcom: Fix brcm_fet_config_init() Frank Wunderlich (1): arm64: dts: broadcom: Fix sata nodename Geert Uytterhoeven (3): hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel pinctrl: renesas: checker: Fix miscalculation of number of states George Kennedy (1): video: fbdev: cirrusfb: check pixclock to avoid divide by zero Gilad Ben-Yossef (1): crypto: ccree - don't attempt 0 len DMA mappings Guilherme G. Piccoli (1): docs: sysctl/kernel: add missing bit to panic_print Guillaume Nault (1): ipv4: Fix route lookups when handling ICMP redirects and PMTU updates Guillaume Ranquet (1): clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_init() Guillaume Tucker (1): selftests, x86: fix how check_cc.sh is being invoked Gwendal Grignou (2): HID: intel-ish-hid: Use dma_alloc_coherent for firmware update platform: chrome: Split trace include file Hangbin Liu (2): bareudp: use ipv6_mod_enabled to check if IPv6 enabled selftests/bpf/test_lirc_mode2.sh: Exit with proper code Hangyu Hua (1): powerpc: 8xx: fix a return value error in mpc8xx_pic_init Hans Verkuil (2): ivtv: fix incorrect device_caps for ivtvfb media: staging: media: zoran: fix various V4L2 compliance errors Hans de Goede (3): power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return iio: mma8452: Fix probe failing when an i2c_device_id is used media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator off on some boards Hector Martin (4): brcmfmac: firmware: Allocate space for default boardrev in nvram brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio brcmfmac: pcie: Fix crashes due to early IRQs Helge Deller (1): video: fbdev: sm712fb: Fix crash in smtcfb_read() Hengqi Chen (1): bpf: Fix comment for helper bpf_current_task_under_cgroup() Henry Lin (1): xhci: fix runtime PM imbalance in USB2 resume Herbert Xu (2): crypto: authenc - Fix sleep in atomic context in decrypt_tail crypto: arm/aes-neonbs-cbc - Select generic cbc and aes Hoang Le (1): tipc: fix the timer expires after interval 100ms Hou Tao (2): bpf, arm64: Call build_prologue() first in first JIT pass bpf, arm64: Feed byte-offset into bpf line info Hou Wenlong (1): KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() Hugh Dickins (1): mempolicy: mbind_range() set_policy() after vma_merge() Håkon Bugge (1): IB/cma: Allow XRC INI QPs to set their local ACK timeout Ido Schimmel (1): selftests: test_vxlan_under_vrf: Fix broken test case Ilpo Järvinen (1): serial: 8250: fix XOFF/XON sending when DMA is used Jaegeuk Kim (1): f2fs: fix missing free nid in f2fs_handle_failed_inode Jagan Teki (1): drm: bridge: adv7511: Fix ADV7535 HPD enablement Jakob Koschel (2): media: saa7134: fix incorrect use to determine if list is empty powerpc/sysdev: fix incorrect use to determine if list is empty Jakub Kicinski (1): tcp: ensure PMTU updates are processed during fastopen Jakub Sitnicki (1): selftests/bpf: Fix error reporting from sock_fields programs James Clark (1): coresight: Fix TRCCONFIGR.QE sysfs interface Jammy Huang (1): media: aspeed: Correct value for h-total-pixels Jann Horn (2): coredump: Also dump first pages of non-executable ELF libraries pstore: Don't use semaphores in always-atomic-context code Jason A. Donenfeld (2): wireguard: queueing: use CFI-safe ptr_ring cleanup function wireguard: socket: ignore v6 endpoints when ipv6 is disabled Jens Axboe (1): io_uring: terminate manual loop iterator loop correctly for non-vecs Jeremy Linton (1): net: bcmgenet: Use stronger register read/writes to assure ordering Jernej Skrabec (2): media: cedrus: H265: Fix neighbour info buffer size media: cedrus: h264: Fix neighbour info buffer size Jia-Ju Bai (3): ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp() memory: emif: check the pointer temp in get_device_details() platform/x86: huawei-wmi: check the return value of device_create_file() Jianglei Nie (1): crypto: ccree - Fix use after free in cc_cipher_exit() Jianyong Wu (1): arm64/mm: avoid fixmap race condition when create pud mapping Jiasheng Jiang (26): thermal: int340x: Check for NULL after calling kmemdup() spi: spi-zynqmp-gqspi: Handle error for dma_set_mask media: mtk-vcodec: potential dereference of null pointer media: meson: vdec: potential dereference of null pointer soc: qcom: rpmpd: Check for null return of devm_kcalloc ASoC: ti: davinci-i2s: Add check for clk_enable() ALSA: spi: Add check for clk_enable() ASoC: mxs-saif: Handle errors for clk_enable ASoC: atmel_ssc_dai: Handle errors for clk_enable ASoC: dwc-i2s: Handle errors for clk_enable ASoC: soc-compress: prevent the potentially use of null pointer memory: emif: Add check for setup_interrupts media: vidtv: Check for null return of vzalloc ASoC: wm8350: Handle error for wm8350_register_irq ASoC: fsi: Add check for clk_enable mmc: davinci_mmc: Handle error for clk_enable drm/panfrost: Check for error num after setting mask mtd: onenand: Check for error irq ray_cs: Check ioremap return value iommu/ipmmu-vmsa: Check for error num after setting mask power: supply: wm8350-power: Handle error for wm8350_register_irq power: supply: wm8350-power: Add missing free in free_charger_irq mfd: mc13xxx: Add check for mc13xxx_irq_request iio: adc: Add check for devm_request_threaded_irq habanalabs: Add check for pci_enable_device ASoC: soc-compress: Change the check for codec_dai Jiaxin Yu (1): ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs Jie Hai (1): dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma Jing Yao (3): video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit Jiri Slaby (1): mxser: fix xmit_buf leak in activate when LSR == 0xff Jocelyn Falempe (1): mgag200 fix memmapsl configuration in GCTL6 register Joe Carnuccio (2): scsi: qla2xxx: Add devids and conditionals for 28xx scsi: qla2xxx: Check for firmware dump already collected Johan Hovold (3): USB: serial: simple: add Nokia phone driver media: davinci: vpif: fix unbalanced runtime PM get media: davinci: vpif: fix unbalanced runtime PM enable John David Anglin (1): parisc: Fix handling off probe non-access faults Jonathan Cameron (1): staging:iio:adc:ad7280a: Fix handing of device address bit reversing. Jonathan Neuschäfer (5): clk: actions: Terminate clk_div_table with sentinel element clk: loongson1: Terminate clk_div_table with sentinel element clk: clps711x: Terminate clk_div_table with sentinel element pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR() pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE() José Expósito (1): Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" Juergen Gross (1): xen: fix is_xen_pmu() Juhyung Park (1): f2fs: quota: fix loop condition at f2fs_quota_sync() Kai-Heng Feng (1): ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 Kees Cook (2): exec: Force single empty string when argv is empty gcc-plugins/stackleak: Exactly match strings instead of prefixes Konrad Dybcio (1): clk: qcom: gcc-msm8994: Fix gpll4 width Krzysztof Kozlowski (5): pinctrl: samsung: drop pin banks references on error paths ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5420 clocksource/drivers/exynos_mct: Handle DTS with higher number of interrupts Kuan-Ying Lee (1): mm/kmemleak: reset tag when compare object pointer Kuldeep Singh (3): arm64: dts: ns2: Fix spi-cpol and spi-cpha property ARM: dts: spear1340: Update serial node properties ARM: dts: spear13xx: Update SPI dma properties Kunihiko Hayashi (1): clk: uniphier: Fix fixed-rate initialization Kuogee Hsieh (1): drm/msm/dp: populate connector of struct dp_panel Lars Ellenberg (1): drbd: fix potential silent data corruption Li RongQing (1): KVM: x86: fix sending PV IPI Liam Beguin (4): iio: afe: rescale: use s64 for temporary scale calculations iio: inkern: apply consumer scale on IIO_VAL_INT cases iio: inkern: apply consumer scale when no channel scale is available iio: inkern: make a best effort on offset calculation Libin Yang (1): soundwire: intel: fix wrong register name in intel_shim_wake Liguang Zhang (1): PCI: pciehp: Clear cmd_busy bit in polling mode Lina Wang (1): xfrm: fix tunnel model fragmentation behavior Lino Sanfilippo (1): tpm: fix reference counting for struct tpm_chip Linus Torvalds (2): fs: fd tables have to be multiples of BITS_PER_LONG fs: fix fd table size alignment properly Linus Walleij (1): Input: zinitix - do not report shadow fingers Liu Ying (1): phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure}) Lorenzo Bianconi (4): mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in sta mode mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update Luca Weiss (1): cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse Lucas Tanure (1): i2c: meson: Fix wrong speed use from probe Lucas Zampieri (1): HID: logitech-dj: add new lightspeed receiver id Lv Ruyi (1): proc: bootconfig: Add null pointer check Maciej W. Rozycki (1): DEC: Limit PMAX memory probing to R3k systems Manish Chopra (1): qed: display VF trust config Manish Rangankar (1): scsi: qla2xxx: Use correct feature type field during RFF_ID processing Maor Gottlieb (1): RDMA/core: Set MR type in ib_reg_user_mr Marc Kleine-Budde (1): can: m_can: m_can_tx_handler(): fix use after free of skb Marc Zyngier (4): PCI: xgene: Revert "PCI: xgene: Fix IB window setup" pinctrl: npcm: Fix broken references to chip->parent_device irqchip/qcom-pdc: Fix broken locking PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup" Marcel Ziswiler (1): arm64: defconfig: build imx-sdma as a module Marcelo Roberto Jimenez (1): gpio: Revert regression in sysfs-gpio (gpiolib.c) Marek Szyprowski (1): clocksource/drivers/exynos_mct: Refactor resources allocation Marek Vasut (1): ARM: dts: imx: Add missing LVDS decoder on M53Menlo Marijn Suijten (1): firmware: qcom: scm: Remove reassignment to desc following initializer Martin Blumenstingl (1): drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops Martin Varghese (1): openvswitch: Fixed nd target mask field in the flow dump. Mastan Katragadda (1): drm/i915/gem: add missing boundary check in vm_access Mathias Nyman (1): xhci: make xhci_handshake timeout for xhci_reset() adjustable Matt Kramer (1): ALSA: hda/realtek: Add alc256-samsung-headphone fixup Matthew Wilcox (Oracle) (2): XArray: Fix xas_create_range() when multi-order entry present XArray: Update the LRU list in xas_split() Maulik Shah (1): arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc Mauro Carvalho Chehab (1): media: atomisp: fix bad usage at error handling logic Max Filippov (2): xtensa: fix stop_machine_cpuslocked call in patch_text xtensa: fix xtensa_wsr always writing 0 Maxim Kiselev (1): powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch Maxime Ripard (2): drm/edid: Don't clear formats if using deep color clk: Initialize orphan req_rate Maíra Canal (1): drm/amd/display: Remove vupdate_int_entry definition Miaoqian Lin (31): spi: tegra114: Add missing IRQ check in tegra_spi_probe hwrng: nomadik - Change clk_disable to clk_disable_unprepare media: coda: Fix missing put_device() call in coda_get_vdoa_data soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in rockchip_i2s_probe ASoC: SOF: Add missing of_node_put() in imx8m_probe ASoC: mxs: Fix error handling in mxs_sgtl5000_probe ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digital_probe ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init drm/tegra: Fix reference leak in tegra_dsi_ganged_probe ath10k: Fix error handling in ath10k_setup_msa_resources mips: cdmm: Fix refcount leak in mips_cdmm_phys_base mfd: asic3: Add missing iounmap() on error asic3_mfd_probe remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function Michael Ellerman (1): powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit Michael S. Tsirkin (1): virtio_console: break out of buf poll on remove Michael Schmitz (1): video: fbdev: atari: Atari 2 bpp (STe) palette bugfix Mike Marciniszyn (1): IB/hfi1: Allow larger MTU without AIP Mikulas Patocka (1): dm integrity: set journal entry unused when shrinking device Minghao Chi (1): spi: tegra20: Use of_device_get_match_data() Minghao Chi (CGEL ZTE) (1): net:mcf8390: Use platform_get_irq() to get the interrupt Miquel Raynal (4): spi: mxic: Fix the transmit path dt-bindings: mtd: nand-controller: Fix the reg property description dt-bindings: mtd: nand-controller: Fix a comment in the examples dt-bindings: spi: mxic: The interrupt property is not mandatory Mohan Kumar (1): ALSA: hda: Avoid unsol event during RPM suspending Muhammad Usama Anjum (1): selftests/x86: Add validity check and allow field splitting Namhyung Kim (1): bpf: Adjust BPF stack helper functions to accommodate skip > 0 Neil Armstrong (1): drm/bridge: dw-hdmi: use safe format when first in bridge chain NeilBrown (1): SUNRPC: avoid race between mod_timer() and del_timer_sync() Niels Dossche (1): Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed Nikita Shubin (1): riscv: Fix fill_callchain return value Niklas Söderlund (1): samples/bpf, xdpsock: Fix race when running for fix duration of time Nilesh Javali (1): scsi: qla2xxx: Fix warning for missing error code Nishanth Menon (4): arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt Olga Kornievskaia (1): NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error Oliver Hartkopp (5): can: isotp: sanitize CAN ID checks in isotp_bind() vxcan: enable local echo for sent CAN frames can: isotp: return -EADDRNOTAVAIL when reading from unbound socket can: isotp: support MSG_TRUNC flag when reading from socket can: isotp: restore accidentally removed MSG_PEEK feature Ondrej Zary (1): media: bttv: fix WARNING regression on tunerless devices Pablo Neira Ayuso (1): netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options Pali Rohár (1): PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge Paolo Valente (1): Revert "Revert "block, bfq: honor already-setup queue merges"" Patrick Rudolph (1): hwmon: (pmbus) Add mutex to regulator ops Paul Kocialkowski (1): ARM: dts: sun8i: v3s: Move the csi1 block to follow address order Paul Menzel (1): lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3 Paulo Alcantara (2): cifs: prevent bad output lengths in smb2_ioctl_query_info() cifs: fix NULL ptr dereference in smb2_ioctl_query_info() Pavel Begunkov (1): io_uring: fix memory leak of uid in files registration Pavel Kubelun (1): ARM: dts: qcom: ipq4019: fix sleep clock Pavel Skripkin (6): udmabuf: validate ubuf->pagecount Bluetooth: hci_serdev: call init_rwsem() before p->open() ath9k_htc: fix uninit value bugs jfs: fix divide error in dbNextAG media: Revert "media: em28xx: add missing em28xx_close_extension" can: mcba_usb: properly check endpoint type Peiwei Hu (1): media: ir_toy: free before error exiting Pekka Pessi (1): mailbox: tegra-hsp: Flush whole channel Peng Liu (1): kunit: make kunit_test_timeout compatible with comment Peter Rosin (1): i2c: mux: demux-pinctrl: do not deactivate a master that is not active Petr Machata (1): af_netlink: Fix shift out of bounds in group mask calculation Petr Vorel (1): crypto: vmx - add missing dependencies Pierre-Louis Bossart (1): ASoC: generic: simple-card-utils: remove useless assignment Prashant Malani (1): platform/chrome: cros_ec_typec: Check for EC device Qais Yousef (1): sched/core: Export pelt_thermal_tp Quinn Tran (7): scsi: qla2xxx: Fix stuck session in gpdb scsi: qla2xxx: Fix scheduling while atomic scsi: qla2xxx: Fix disk failure to rediscover scsi: qla2xxx: Fix incorrect reporting of task management failure scsi: qla2xxx: Fix hang due to session stuck scsi: qla2xxx: Fix N2N inconsistent PLOGI scsi: qla2xxx: Reduce false trigger to login Rafael J. Wysocki (2): ACPICA: Avoid walking the ACPI Namespace if it is not there ACPI: CPPC: Avoid out of bounds access when parsing _CPC data Randy Dunlap (20): hv: utils: add PTP_1588_CLOCK to Kconfig to fix build EVM: fix the evm= __setup handler return value PM: hibernate: fix __setup handler error handling PM: suspend: fix return value of __setup handler ACPI: APEI: fix return value of __setup handlers clocksource: acpi_pm: fix return value of __setup handler printk: fix return value of printk.devkmsg __setup handler m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined TOMOYO: fix __setup handlers return values mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n MIPS: RB532: fix return value of __setup handler dma-debug: fix return value of __setup handlers tty: hvc: fix return value of __setup handler kgdboc: fix return value of __setup handler kgdbts: fix return value of __setup handler driver core: dd: fix return value of __setup handler mm/mmap: return 1 from stack_guard_gap __setup() handler ARM: 9187/1: JIVE: fix return value of __setup handler mm/memcontrol: return 1 from cgroup.memory __setup() handler mm/usercopy: return 1 from hardened_usercopy __setup() handler Richard Guy Briggs (1): audit: log AUDIT_TIME_* records only from rules Richard Haines (1): selinux: allow FIOCLEX and FIONCLEX with policy capability Richard Leitner (1): ARM: tegra: tamonten: Fix I2C3 pad setting Richard Schleich (2): ARM: dts: bcm2837: Add the missing L1/L2 cache information ARM: dts: bcm2711: Add the missing L1/L2 cache information Rik van Riel (2): mm: invalidate hwpoison page cache page in fault path mm,hwpoison: unmap poisoned page before invalidation Ritesh Harjani (3): ext4: fix ext4_fc_stats trace point ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit Rob Herring (1): arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly Robert Hancock (3): ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting i2c: xiic: Make bus names unique net: axienet: fix RX ring refill allocation failure handling Robert Marko (1): clk: qcom: ipq8074: fix PCI-E clock oops Robin Gong (1): mailbox: imx: fix wakeup failure from freeze mode Robin Murphy (1): iommu/iova: Improve 32-bit free space estimate Roman Li (1): drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug Sakari Ailus (1): ACPI: properties: Consistently return -ENOENT if there are no more references Sam Ravnborg (1): video: fbdev: controlfb: Fix set but not used warnings Saurav Kashyap (1): scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() Sean Christopherson (1): KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP MMU Sean Nyekjaer (1): mtd: rawnand: protect access to rawnand devices while in suspend Sean Young (1): media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC Shannon Nelson (1): ionic: fix type complaint in ionic_dev_cmd_clean() Shengjiu Wang (2): ASoC: fsl_spdif: Disable TX clock when stop ASoC: soc-core: skip zero num_dai component in searching dai name Shin'ichiro Kawasaki (1): block: limit request dispatch loop duration Si-Wei Liu (1): vdpa/mlx5: should verify CTRL_VQ feature exists for MQ Souptick Joarder (HPE) (1): irqchip/nvic: Release nvic_base upon failure Srinivas Kandagatla (1): ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put Srinivas Pandruvada (1): thermal: int340x: Increase bitmap size Stefano Garzarella (1): tools/virtio: fix virtio_test execution Sunil Goutham (1): hwrng: cavium - Check health status while reading random data Sven Eckelmann (1): batman-adv: Check ptr for NULL before reducing its refcnt Takashi Iwai (1): ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock Takashi Sakamoto (1): ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction Taniya Das (2): clk: qcom: clk-rcg2: Update logic to calculate D value for RCG clk: qcom: clk-rcg2: Update the frac table for pixel clock Theodore Ts'o (1): ext4: don't BUG if someone dirty pages without asking ext4 first Thomas Bracht Laumann Jespersen (1): scripts/dtc: Call pkg-config POSIXly correct Tim Gardner (1): video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow Tobias Waldekranz (1): net: dsa: mv88e6xxx: Enable port policy support on 6097 Tom Rix (5): media: video/hdmi: handle short reads of hdmi info frame. drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function qlcnic: dcb: default to returning -EOPNOTSUPP can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value rtc: check if __rtc_read_time was successful Tomas Paukrt (1): crypto: mxs-dcp - Fix scatterlist processing Tong Zhang (1): dax: make sure inodes are flushed before destroy cache Trond Myklebust (3): NFS: Use of mapping_set_error() results in spurious errors NFS: Return valid errors from nfs2/3_decode_dirent() NFSv4/pNFS: Fix another issue with a list iterator pointing to the head Tsuchiya Yuto (1): media: atomisp: fix dummy_ptr check to avoid duplicate active_bo Tudor Ambarus (1): ARM: dts: at91: sama5d2: Fix PMERRLOC resource size Ulf Hansson (1): mmc: host: Return an error when ->enable_sdio_irq() ops is missing Uwe Kleine-König (5): vfio: platform: simplify device removal amba: Make the remove callback return void pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add() serial: 8250: Fix race condition in RTS-after-send handling ARM: mmp: Fix failure to remove sram device Vijay Balakrishna (1): arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory zones Vitaly Kuznetsov (1): KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated Vladimir Oltean (1): net: enetc: report software timestamping via SO_TIMESTAMPING Waiman Long (2): locking/lockdep: Avoid potential access of invalid memory in lock_class locking/lockdep: Iterate lock_classes directly when reading lockdep files Wang Hai (2): video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() wireguard: socket: free skb in send6 when ipv6 is disabled Wang Wensheng (1): ASoC: imx-es8328: Fix error return code in imx_es8328_probe() Wen Gong (1): ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern Xiang Chen (1): scsi: hisi_sas: Change permission of parameter prot_mask Xiaomeng Tong (2): ALSA: cs4236: fix an incorrect NULL check on list iterator net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator Xie Yongji (1): virtio-blk: Use blk_validate_block_size() to validate block size Xin Long (1): udp: call udp_encap_enable for v6 sockets when enabling encap Xin Xiong (1): mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init Xu Kuohai (1): libbpf: Skip forward declaration when counting duplicated type names Yafang Shao (1): libbpf: Fix possible NULL pointer dereference when destroying skeleton Yake Yang (1): Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt Yaliang Wang (1): MIPS: pgalloc: fix memory leak caused by pgd_free() Yang Guang (1): video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit Yang Yingliang (3): media: saa7134: convert list_for_each to entry variant ASoC: rockchip: i2s: Use devm_platform_get_and_ioremap_resource() ASoC: atmel: sam9x5_wm8731: use devm_snd_soc_register_card() Yangtao Li (1): fsi: aspeed: convert to devm_platform_ioremap_resource Ye Bin (1): ext4: fix fs corruption when tring to remove a non-empty directory with IO error Yi Wang (1): KVM: SVM: fix panic on out-of-bounds guest IRQ Yiqing Yao (1): drm/amd/pm: enable pm sysfs write for one VF mode Yongzhi Liu (1): RDMA/mlx5: Fix memory leak in error flow for subscribe event routine YueHaibing (1): video: fbdev: controlfb: Fix COMPILE_TEST build Z. Liu (1): video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen Zhang Yi (1): ext2: correct max file size computing Zhenzhong Duan (1): KVM: x86: Fix emulation in writing cr8 Zheyu Ma (2): ethernet: sun: Free the coherent when failing in probing video: fbdev: sm712fb: Fix crash in smtcfb_write() Zhou Qingyang (2): drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl() drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() kernel test robot (1): regulator: qcom_smd: fix for_each_child.cocci warnings lic121 (1): libbpf: Unmap rings when umem deleted Documentation/admin-guide/sysctl/kernel.rst | 1 + .../bindings/mtd/nand-controller.yaml | 4 +- .../devicetree/bindings/spi/spi-mxic.txt | 4 +- Documentation/process/stable-kernel-rules.rst | 11 +- Documentation/sound/hd-audio/models.rst | 4 + arch/arc/kernel/process.c | 2 +- arch/arm/boot/dts/bcm2711.dtsi | 50 +++++ arch/arm/boot/dts/bcm2837.dtsi | 49 ++++ arch/arm/boot/dts/dra7-l4.dtsi | 5 +- arch/arm/boot/dts/dra7.dtsi | 8 +- arch/arm/boot/dts/exynos5250-pinctrl.dtsi | 2 +- arch/arm/boot/dts/exynos5250-smdk5250.dts | 3 + arch/arm/boot/dts/exynos5420-smdk5420.dts | 3 + arch/arm/boot/dts/imx53-m53menlo.dts | 29 ++- arch/arm/boot/dts/imx7-colibri.dtsi | 4 +- arch/arm/boot/dts/imx7-mba7.dtsi | 2 +- arch/arm/boot/dts/imx7d-nitrogen7.dts | 2 +- arch/arm/boot/dts/imx7d-pico-hobbit.dts | 4 +- arch/arm/boot/dts/imx7d-pico-pi.dts | 4 +- arch/arm/boot/dts/imx7d-sdb.dts | 4 +- arch/arm/boot/dts/imx7s-warp.dts | 4 +- arch/arm/boot/dts/qcom-ipq4019.dtsi | 3 +- arch/arm/boot/dts/qcom-msm8960.dtsi | 8 +- arch/arm/boot/dts/sama5d2.dtsi | 2 +- arch/arm/boot/dts/spear1340.dtsi | 6 +- arch/arm/boot/dts/spear13xx.dtsi | 6 +- arch/arm/boot/dts/sun8i-v3s.dtsi | 22 +- arch/arm/boot/dts/tegra20-tamonten.dtsi | 6 +- arch/arm/configs/multi_v5_defconfig | 1 + arch/arm/crypto/Kconfig | 2 + arch/arm/kernel/entry-ftrace.S | 51 ++--- arch/arm/kernel/swp_emulate.c | 2 +- arch/arm/kernel/traps.c | 2 +- .../mach-iop32x/include/mach/entry-macro.S | 2 +- arch/arm/mach-iop32x/include/mach/irqs.h | 2 +- arch/arm/mach-iop32x/irq.c | 6 +- arch/arm/mach-iop32x/irqs.h | 60 ++--- arch/arm/mach-mmp/sram.c | 22 +- arch/arm/mach-mstar/Kconfig | 1 + arch/arm/mach-s3c/mach-jive.c | 6 +- .../boot/dts/broadcom/northstar2/ns2-svk.dts | 8 +- .../boot/dts/broadcom/northstar2/ns2.dtsi | 2 +- arch/arm64/boot/dts/qcom/sdm845.dtsi | 8 +- arch/arm64/boot/dts/qcom/sm8150.dtsi | 6 +- .../boot/dts/rockchip/rk3399-firefly.dts | 4 +- arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 5 +- arch/arm64/boot/dts/ti/k3-am65.dtsi | 1 + arch/arm64/boot/dts/ti/k3-j7200-main.dtsi | 5 +- arch/arm64/boot/dts/ti/k3-j7200.dtsi | 1 + arch/arm64/boot/dts/ti/k3-j721e-main.dtsi | 5 +- arch/arm64/boot/dts/ti/k3-j721e.dtsi | 1 + arch/arm64/configs/defconfig | 2 +- arch/arm64/kernel/signal.c | 10 +- arch/arm64/mm/init.c | 36 ++- arch/arm64/mm/mmu.c | 36 ++- arch/arm64/net/bpf_jit_comp.c | 18 +- arch/csky/kernel/perf_callchain.c | 2 +- arch/csky/kernel/signal.c | 2 +- arch/m68k/coldfire/device.c | 6 +- arch/microblaze/include/asm/uaccess.h | 18 +- arch/mips/dec/int-handler.S | 6 +- arch/mips/dec/prom/Makefile | 2 +- arch/mips/dec/setup.c | 3 +- arch/mips/include/asm/dec/prom.h | 15 +- arch/mips/include/asm/pgalloc.h | 6 + arch/mips/rb532/devices.c | 6 +- arch/nios2/include/asm/uaccess.h | 26 ++- arch/nios2/kernel/signal.c | 20 +- arch/parisc/include/asm/traps.h | 1 + arch/parisc/kernel/traps.c | 2 + arch/parisc/mm/fault.c | 89 ++++++++ arch/powerpc/Makefile | 2 +- arch/powerpc/boot/dts/fsl/t1040rdb-rev-a.dts | 30 +++ arch/powerpc/boot/dts/fsl/t1040rdb.dts | 8 +- arch/powerpc/include/asm/io.h | 40 +++- arch/powerpc/include/asm/uaccess.h | 3 + arch/powerpc/kernel/kvm.c | 2 +- arch/powerpc/kvm/book3s_hv.c | 5 +- arch/powerpc/kvm/powerpc.c | 4 +- arch/powerpc/lib/sstep.c | 12 +- arch/powerpc/mm/kasan/kasan_init_32.c | 3 +- arch/powerpc/mm/numa.c | 4 +- arch/powerpc/perf/imc-pmu.c | 6 +- arch/powerpc/platforms/8xx/pic.c | 1 + arch/powerpc/platforms/powernv/rng.c | 6 +- arch/powerpc/sysdev/fsl_gtm.c | 4 +- arch/riscv/include/asm/module.lds.h | 6 +- arch/riscv/include/asm/thread_info.h | 10 +- arch/riscv/kernel/perf_callchain.c | 6 +- arch/sparc/kernel/signal_32.c | 2 +- arch/um/drivers/mconsole_kern.c | 3 +- arch/x86/events/intel/pt.c | 2 +- arch/x86/kernel/kvm.c | 2 +- arch/x86/kvm/emulate.c | 14 +- arch/x86/kvm/hyperv.c | 9 +- arch/x86/kvm/lapic.c | 5 +- arch/x86/kvm/mmu/tdp_mmu.c | 3 + arch/x86/kvm/svm/avic.c | 10 +- arch/x86/xen/pmu.c | 10 +- arch/x86/xen/pmu.h | 3 +- arch/x86/xen/smp_pv.c | 2 +- arch/xtensa/include/asm/processor.h | 4 +- arch/xtensa/kernel/jump_label.c | 2 +- block/bfq-iosched.c | 16 +- block/blk-mq-sched.c | 9 +- block/blk-sysfs.c | 8 +- crypto/authenc.c | 2 +- crypto/rsa-pkcs1pad.c | 11 +- drivers/acpi/acpica/nswalk.c | 3 + drivers/acpi/apei/bert.c | 10 +- drivers/acpi/apei/erst.c | 2 +- drivers/acpi/apei/hest.c | 2 +- drivers/acpi/cppc_acpi.c | 5 + drivers/acpi/property.c | 2 +- drivers/amba/bus.c | 5 +- drivers/base/dd.c | 2 +- drivers/base/power/main.c | 6 +- drivers/block/drbd/drbd_req.c | 3 +- drivers/block/loop.c | 10 +- drivers/block/virtio_blk.c | 12 +- drivers/bluetooth/btmtksdio.c | 4 +- drivers/bluetooth/hci_serdev.c | 3 +- drivers/bus/mips_cdmm.c | 1 + drivers/char/hw_random/Kconfig | 2 +- drivers/char/hw_random/atmel-rng.c | 1 + drivers/char/hw_random/cavium-rng-vf.c | 194 +++++++++++++++- drivers/char/hw_random/cavium-rng.c | 11 +- drivers/char/hw_random/nomadik-rng.c | 7 +- drivers/char/tpm/tpm-chip.c | 46 +--- drivers/char/tpm/tpm.h | 2 + drivers/char/tpm/tpm2-space.c | 65 ++++++ drivers/char/virtio_console.c | 7 + drivers/clk/actions/owl-s700.c | 1 + drivers/clk/actions/owl-s900.c | 2 +- drivers/clk/at91/sama7g5.c | 8 +- drivers/clk/clk-clps711x.c | 2 + drivers/clk/clk.c | 13 ++ drivers/clk/imx/clk-imx7d.c | 1 - drivers/clk/loongson1/clk-loongson1c.c | 1 + drivers/clk/qcom/clk-rcg2.c | 14 +- drivers/clk/qcom/gcc-ipq8074.c | 21 +- drivers/clk/qcom/gcc-msm8994.c | 1 + drivers/clk/tegra/clk-tegra124-emc.c | 1 + .../clk/uniphier/clk-uniphier-fixed-rate.c | 1 + drivers/clocksource/acpi_pm.c | 6 +- drivers/clocksource/exynos_mct.c | 60 +++-- drivers/clocksource/timer-microchip-pit64b.c | 2 +- drivers/clocksource/timer-of.c | 6 +- drivers/clocksource/timer-ti-dm-systimer.c | 4 +- drivers/cpufreq/qcom-cpufreq-nvmem.c | 2 +- .../allwinner/sun8i-ce/sun8i-ce-cipher.c | 3 + .../crypto/allwinner/sun8i-ce/sun8i-ce-hash.c | 3 + .../allwinner/sun8i-ss/sun8i-ss-cipher.c | 3 + .../crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 2 + .../crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 3 + drivers/crypto/amlogic/amlogic-gxl-cipher.c | 2 + drivers/crypto/ccp/ccp-dmaengine.c | 16 ++ drivers/crypto/ccree/cc_buffer_mgr.c | 7 + drivers/crypto/ccree/cc_cipher.c | 2 +- drivers/crypto/mxs-dcp.c | 2 +- .../crypto/rockchip/rk3288_crypto_skcipher.c | 1 - drivers/crypto/vmx/Kconfig | 4 + drivers/dax/super.c | 1 + drivers/dma-buf/udmabuf.c | 4 + drivers/dma/hisi_dma.c | 2 +- drivers/dma/pl330.c | 3 +- drivers/firmware/efi/efi-pstore.c | 2 +- drivers/firmware/google/Kconfig | 2 +- drivers/firmware/qcom_scm.c | 6 - drivers/firmware/stratix10-svc.c | 2 +- drivers/fsi/fsi-master-aspeed.c | 21 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 +- .../display/dc/irq/dcn21/irq_service_dcn21.c | 14 -- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 4 +- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 2 +- drivers/gpu/drm/bridge/adv7511/adv7511.h | 1 + drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 29 ++- drivers/gpu/drm/bridge/cdns-dsi.c | 1 + drivers/gpu/drm/bridge/nwl-dsi.c | 1 + drivers/gpu/drm/bridge/sil-sii8620.c | 2 +- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 5 +- drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c | 1 + drivers/gpu/drm/drm_edid.c | 11 +- drivers/gpu/drm/i915/gem/i915_gem_mman.c | 2 +- drivers/gpu/drm/meson/meson_drv.c | 6 +- drivers/gpu/drm/meson/meson_osd_afbcd.c | 41 ++-- drivers/gpu/drm/meson/meson_osd_afbcd.h | 1 + drivers/gpu/drm/mgag200/mgag200_mode.c | 5 +- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 +- drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c | 8 + drivers/gpu/drm/msm/dp/dp_display.c | 5 + .../gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c | 9 +- drivers/gpu/drm/panfrost/panfrost_gpu.c | 5 +- drivers/gpu/drm/pl111/pl111_drv.c | 4 +- drivers/gpu/drm/tegra/dsi.c | 4 +- drivers/gpu/host1x/dev.c | 1 + drivers/greybus/svc.c | 8 +- drivers/hid/hid-logitech-dj.c | 1 + drivers/hid/i2c-hid/i2c-hid-core.c | 32 ++- drivers/hid/intel-ish-hid/ishtp-fw-loader.c | 29 +-- drivers/hv/Kconfig | 1 + drivers/hv/hv_balloon.c | 2 +- drivers/hwmon/pmbus/pmbus.h | 1 + drivers/hwmon/pmbus/pmbus_core.c | 18 +- drivers/hwmon/sch56xx-common.c | 2 +- drivers/hwtracing/coresight/coresight-catu.c | 3 +- .../hwtracing/coresight/coresight-cpu-debug.c | 4 +- .../hwtracing/coresight/coresight-cti-core.c | 4 +- drivers/hwtracing/coresight/coresight-etb10.c | 4 +- .../coresight/coresight-etm3x-core.c | 4 +- .../coresight/coresight-etm4x-core.c | 4 +- .../coresight/coresight-etm4x-sysfs.c | 8 +- .../hwtracing/coresight/coresight-funnel.c | 4 +- .../coresight/coresight-replicator.c | 4 +- drivers/hwtracing/coresight/coresight-stm.c | 4 +- .../hwtracing/coresight/coresight-tmc-core.c | 4 +- drivers/hwtracing/coresight/coresight-tpiu.c | 4 +- drivers/i2c/busses/i2c-meson.c | 12 +- drivers/i2c/busses/i2c-nomadik.c | 4 +- drivers/i2c/busses/i2c-xiic.c | 3 +- drivers/i2c/muxes/i2c-demux-pinctrl.c | 5 +- drivers/iio/accel/mma8452.c | 29 ++- drivers/iio/adc/twl6030-gpadc.c | 2 + drivers/iio/afe/iio-rescale.c | 8 +- drivers/iio/inkern.c | 40 +++- drivers/infiniband/core/cma.c | 2 +- drivers/infiniband/core/verbs.c | 1 + drivers/infiniband/hw/hfi1/verbs.c | 3 +- drivers/infiniband/hw/mlx5/devx.c | 4 +- drivers/infiniband/hw/mlx5/mr.c | 2 + drivers/input/input.c | 6 - drivers/input/serio/ambakmi.c | 3 +- drivers/input/touchscreen/zinitix.c | 44 +++- drivers/iommu/iova.c | 5 +- drivers/iommu/ipmmu-vmsa.c | 4 +- drivers/irqchip/irq-nvic.c | 2 + drivers/irqchip/qcom-pdc.c | 5 +- drivers/mailbox/imx-mailbox.c | 9 + drivers/mailbox/tegra-hsp.c | 5 + drivers/md/dm-crypt.c | 2 +- drivers/md/dm-integrity.c | 6 +- drivers/media/i2c/adv7511-v4l2.c | 2 +- drivers/media/i2c/adv7604.c | 2 +- drivers/media/i2c/adv7842.c | 2 +- drivers/media/pci/bt8xx/bttv-driver.c | 4 +- drivers/media/pci/cx88/cx88-mpeg.c | 3 + drivers/media/pci/ivtv/ivtv-driver.h | 1 - drivers/media/pci/ivtv/ivtv-ioctl.c | 10 +- drivers/media/pci/ivtv/ivtv-streams.c | 11 +- drivers/media/pci/saa7134/saa7134-alsa.c | 8 +- drivers/media/platform/aspeed-video.c | 9 +- drivers/media/platform/coda/coda-common.c | 1 + drivers/media/platform/davinci/vpif.c | 12 +- .../platform/mtk-vcodec/mtk_vcodec_fw_vpu.c | 2 + drivers/media/rc/gpio-ir-tx.c | 28 ++- drivers/media/rc/ir_toy.c | 2 +- .../media/test-drivers/vidtv/vidtv_s302m.c | 17 +- drivers/media/usb/em28xx/em28xx-cards.c | 13 +- drivers/media/usb/go7007/s2250-board.c | 10 +- drivers/media/usb/hdpvr/hdpvr-video.c | 4 +- drivers/media/usb/stk1160/stk1160-core.c | 2 +- drivers/media/usb/stk1160/stk1160-v4l.c | 10 +- drivers/media/usb/stk1160/stk1160.h | 2 +- drivers/media/v4l2-core/v4l2-mem2mem.c | 53 ++++- drivers/memory/emif.c | 8 +- drivers/memory/pl172.c | 4 +- drivers/memory/pl353-smc.c | 4 +- drivers/mfd/asic3.c | 10 +- drivers/mfd/mc13xxx-core.c | 4 +- drivers/misc/cardreader/alcor_pci.c | 9 +- drivers/misc/habanalabs/common/debugfs.c | 2 + drivers/misc/kgdbts.c | 4 +- drivers/misc/mei/hw-me-regs.h | 1 + drivers/misc/mei/interrupt.c | 35 ++- drivers/misc/mei/pci-me.c | 1 + drivers/mmc/core/host.c | 15 +- drivers/mmc/host/davinci_mmc.c | 6 +- drivers/mmc/host/mmci.c | 4 +- drivers/mtd/nand/onenand/generic.c | 7 +- drivers/mtd/nand/raw/atmel/nand-controller.c | 14 +- drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 3 + drivers/mtd/nand/raw/nand_base.c | 44 ++-- drivers/net/bareudp.c | 25 +-- drivers/net/can/m_can/m_can.c | 5 +- .../net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 +- drivers/net/can/usb/mcba_usb.c | 26 ++- drivers/net/can/vxcan.c | 2 +- drivers/net/dsa/bcm_sf2_cfp.c | 6 +- drivers/net/dsa/microchip/ksz8795_spi.c | 11 + drivers/net/dsa/microchip/ksz9477_spi.c | 12 + drivers/net/dsa/mv88e6xxx/chip.c | 1 + drivers/net/ethernet/8390/mcf8390.c | 10 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 4 +- .../ethernet/freescale/enetc/enetc_ethtool.c | 5 +- drivers/net/ethernet/intel/i40e/i40e_xsk.c | 16 +- .../net/ethernet/pensando/ionic/ionic_main.c | 6 +- drivers/net/ethernet/qlogic/qed/qed_sriov.c | 1 + .../net/ethernet/qlogic/qlcnic/qlcnic_dcb.h | 10 +- drivers/net/ethernet/sun/sunhme.c | 6 +- .../net/ethernet/xilinx/xilinx_axienet_main.c | 72 +++--- drivers/net/phy/broadcom.c | 21 ++ drivers/net/wireguard/queueing.c | 3 +- drivers/net/wireguard/socket.c | 5 +- drivers/net/wireless/ath/ath10k/snoc.c | 2 +- drivers/net/wireless/ath/ath10k/wow.c | 7 +- drivers/net/wireless/ath/ath9k/htc_hst.c | 5 + drivers/net/wireless/ath/carl9170/main.c | 2 +- .../broadcom/brcm80211/brcmfmac/firmware.c | 2 + .../broadcom/brcm80211/brcmfmac/pcie.c | 66 ++---- .../net/wireless/intel/iwlwifi/dvm/mac80211.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 4 +- .../net/wireless/mediatek/mt76/mt7603/main.c | 3 + .../net/wireless/mediatek/mt76/mt7615/main.c | 3 + .../net/wireless/mediatek/mt76/mt7915/mcu.c | 9 +- drivers/net/wireless/ray_cs.c | 6 + drivers/nvdimm/region_devs.c | 3 + drivers/nvme/host/core.c | 9 +- drivers/nvme/host/tcp.c | 40 ++++ drivers/pci/controller/pci-aardvark.c | 4 +- drivers/pci/controller/pci-xgene.c | 35 ++- drivers/pci/hotplug/pciehp_hpc.c | 2 + drivers/pci/quirks.c | 12 + drivers/phy/phy-core-mipi-dphy.c | 4 +- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 2 + drivers/pinctrl/mediatek/pinctrl-paris.c | 30 ++- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 4 +- drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 185 ++++++++-------- drivers/pinctrl/pinconf-generic.c | 6 +- drivers/pinctrl/pinctrl-rockchip.c | 2 + drivers/pinctrl/renesas/core.c | 5 +- drivers/pinctrl/renesas/pfc-r8a77470.c | 4 +- drivers/pinctrl/samsung/pinctrl-samsung.c | 30 ++- drivers/platform/chrome/Makefile | 3 +- .../platform/chrome/cros_ec_sensorhub_ring.c | 3 +- .../platform/chrome/cros_ec_sensorhub_trace.h | 123 +++++++++++ drivers/platform/chrome/cros_ec_trace.h | 95 -------- drivers/platform/chrome/cros_ec_typec.c | 6 + drivers/platform/x86/huawei-wmi.c | 13 +- drivers/power/reset/gemini-poweroff.c | 4 +- drivers/power/supply/ab8500_fg.c | 4 +- drivers/power/supply/bq24190_charger.c | 7 +- drivers/power/supply/wm8350_power.c | 97 ++++++-- drivers/pwm/pwm-lpc18xx-sct.c | 20 +- drivers/regulator/qcom_smd-regulator.c | 4 +- .../regulator/rpi-panel-attiny-regulator.c | 56 ++++- drivers/remoteproc/qcom_q6v5_adsp.c | 1 + drivers/remoteproc/qcom_q6v5_mss.c | 11 +- drivers/remoteproc/qcom_wcnss.c | 1 + drivers/remoteproc/remoteproc_debugfs.c | 2 +- drivers/rtc/interface.c | 7 +- drivers/rtc/rtc-pl030.c | 4 +- drivers/rtc/rtc-pl031.c | 4 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +- drivers/scsi/libsas/sas_ata.c | 2 +- drivers/scsi/pm8001/pm8001_hwi.c | 23 +- drivers/scsi/pm8001/pm80xx_hwi.c | 209 ++++++++++-------- drivers/scsi/qla2xxx/qla_attr.c | 7 +- drivers/scsi/qla2xxx/qla_def.h | 10 +- drivers/scsi/qla2xxx/qla_gs.c | 5 +- drivers/scsi/qla2xxx/qla_init.c | 73 ++++-- drivers/scsi/qla2xxx/qla_iocb.c | 8 +- drivers/scsi/qla2xxx/qla_isr.c | 1 + drivers/scsi/qla2xxx/qla_mbx.c | 14 +- drivers/scsi/qla2xxx/qla_nvme.c | 22 ++ drivers/scsi/qla2xxx/qla_os.c | 8 +- drivers/scsi/qla2xxx/qla_sup.c | 4 +- drivers/scsi/qla2xxx/qla_target.c | 4 +- drivers/soc/qcom/ocmem.c | 1 + drivers/soc/qcom/qcom_aoss.c | 2 +- drivers/soc/qcom/rpmpd.c | 3 + drivers/soc/ti/wkup_m3_ipc.c | 4 +- drivers/soundwire/intel.c | 4 +- drivers/spi/spi-mxic.c | 28 +-- drivers/spi/spi-pl022.c | 5 +- drivers/spi/spi-pxa2xx-pci.c | 17 +- drivers/spi/spi-tegra114.c | 4 + drivers/spi/spi-tegra20-slink.c | 8 +- drivers/spi/spi-zynqmp-gqspi.c | 5 +- drivers/spi/spi.c | 4 +- drivers/staging/iio/adc/ad7280a.c | 4 +- .../staging/media/atomisp/pci/atomisp_acc.c | 28 ++- .../media/atomisp/pci/atomisp_gmin_platform.c | 18 ++ drivers/staging/media/atomisp/pci/hmm/hmm.c | 7 +- .../staging/media/hantro/hantro_h1_jpeg_enc.c | 2 +- drivers/staging/media/hantro/hantro_h1_regs.h | 2 +- drivers/staging/media/meson/vdec/esparser.c | 7 +- .../staging/media/meson/vdec/vdec_helpers.c | 8 +- .../staging/media/meson/vdec/vdec_helpers.h | 4 +- .../staging/media/sunxi/cedrus/cedrus_h264.c | 2 +- .../staging/media/sunxi/cedrus/cedrus_h265.c | 2 +- drivers/staging/media/zoran/zoran.h | 2 +- drivers/staging/media/zoran/zoran_card.c | 86 ++++--- drivers/staging/media/zoran/zoran_device.c | 7 +- drivers/staging/media/zoran/zoran_driver.c | 18 +- drivers/staging/mt7621-dts/gbpc1.dts | 40 ++-- drivers/staging/mt7621-dts/gbpc2.dts | 116 +++++++++- drivers/staging/mt7621-dts/mt7621.dtsi | 26 ++- .../intel/int340x_thermal/int3400_thermal.c | 7 +- drivers/tty/hvc/hvc_iucv.c | 4 +- drivers/tty/mxser.c | 15 +- drivers/tty/serial/8250/8250_dma.c | 11 +- drivers/tty/serial/8250/8250_lpss.c | 28 ++- drivers/tty/serial/8250/8250_mid.c | 19 +- drivers/tty/serial/8250/8250_port.c | 16 +- drivers/tty/serial/amba-pl010.c | 4 +- drivers/tty/serial/amba-pl011.c | 3 +- drivers/tty/serial/kgdboc.c | 6 +- drivers/tty/serial/serial_core.c | 14 ++ drivers/usb/host/xhci-hub.c | 5 +- drivers/usb/host/xhci-mem.c | 2 +- drivers/usb/host/xhci.c | 20 +- drivers/usb/host/xhci.h | 14 +- drivers/usb/serial/Kconfig | 1 + drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 3 + drivers/usb/serial/usb-serial-simple.c | 7 + drivers/usb/storage/ene_ub6250.c | 155 +++++++------ drivers/usb/storage/realtek_cr.c | 2 +- drivers/vdpa/mlx5/net/mlx5_vnet.c | 18 +- drivers/vfio/platform/vfio_amba.c | 15 +- drivers/video/fbdev/amba-clcd.c | 4 +- drivers/video/fbdev/atafb.c | 12 +- drivers/video/fbdev/atmel_lcdfb.c | 11 +- drivers/video/fbdev/cirrusfb.c | 16 +- drivers/video/fbdev/controlfb.c | 6 +- drivers/video/fbdev/core/fbcvt.c | 53 ++--- drivers/video/fbdev/matrox/matroxfb_base.c | 2 +- drivers/video/fbdev/nvidia/nv_i2c.c | 2 +- .../omap2/omapfb/displays/connector-dvi.c | 1 + .../omap2/omapfb/displays/panel-dsi-cm.c | 8 +- .../omapfb/displays/panel-sony-acx565akm.c | 2 +- .../omapfb/displays/panel-tpo-td043mtea1.c | 4 +- drivers/video/fbdev/sm712fb.c | 46 +--- drivers/video/fbdev/smscufx.c | 3 +- drivers/video/fbdev/udlfb.c | 8 +- drivers/video/fbdev/w100fb.c | 15 +- drivers/watchdog/rti_wdt.c | 1 + drivers/watchdog/sp805_wdt.c | 4 +- fs/binfmt_elf.c | 24 +- fs/btrfs/reflink.c | 7 +- fs/cifs/smb2ops.c | 130 ++++++----- fs/coredump.c | 39 +++- fs/exec.c | 26 ++- fs/ext2/super.c | 6 +- fs/ext4/inline.c | 9 +- fs/ext4/inode.c | 25 +++ fs/ext4/mballoc.c | 126 ++++++----- fs/ext4/namei.c | 10 +- fs/f2fs/checkpoint.c | 8 +- fs/f2fs/compress.c | 5 +- fs/f2fs/data.c | 9 +- fs/f2fs/file.c | 5 +- fs/f2fs/gc.c | 4 +- fs/f2fs/inode.c | 1 + fs/f2fs/node.c | 6 +- fs/f2fs/segment.c | 7 + fs/f2fs/super.c | 6 +- fs/f2fs/sysfs.c | 2 +- fs/file.c | 31 ++- fs/gfs2/rgrp.c | 3 +- fs/io_uring.c | 7 +- fs/jfs/jfs_dmap.c | 7 + fs/nfs/callback_proc.c | 27 +-- fs/nfs/callback_xdr.c | 4 - fs/nfs/nfs2xdr.c | 2 +- fs/nfs/nfs3xdr.c | 21 +- fs/nfs/nfs4proc.c | 1 + fs/nfs/pnfs.c | 11 + fs/nfs/pnfs.h | 2 + fs/nfs/write.c | 5 +- fs/nfsd/filecache.c | 6 +- fs/nfsd/nfs4state.c | 12 +- fs/nfsd/nfsproc.c | 2 +- fs/nfsd/xdr.h | 2 +- fs/ntfs/inode.c | 4 + fs/proc/bootconfig.c | 2 + fs/pstore/platform.c | 38 ++-- include/linux/amba/bus.h | 2 +- include/linux/mtd/rawnand.h | 2 + include/linux/pstore.h | 6 +- include/linux/serial_core.h | 2 + include/linux/soc/ti/ti_sci_protocol.h | 2 +- include/linux/sunrpc/xdr.h | 2 + include/net/udp.h | 1 + include/net/udp_tunnel.h | 3 +- include/sound/pcm.h | 1 + include/trace/events/ext4.h | 78 ++++--- include/trace/events/rxrpc.h | 8 +- include/uapi/linux/bpf.h | 12 +- kernel/audit.h | 4 + kernel/auditsc.c | 87 ++++++-- kernel/bpf/stackmap.c | 56 ++--- kernel/debug/kdb/kdb_support.c | 2 +- kernel/dma/debug.c | 4 +- kernel/events/core.c | 3 + kernel/locking/lockdep.c | 38 ++-- kernel/locking/lockdep_internals.h | 6 +- kernel/locking/lockdep_proc.c | 51 ++++- kernel/power/hibernate.c | 2 +- kernel/power/suspend_test.c | 8 +- kernel/printk/printk.c | 6 +- kernel/rseq.c | 9 + kernel/sched/core.c | 1 + kernel/sched/debug.c | 10 - kernel/watch_queue.c | 4 +- lib/kunit/try-catch.c | 2 +- lib/raid6/test/Makefile | 4 +- lib/raid6/test/test.c | 1 - lib/test_kmod.c | 1 + lib/test_lockup.c | 11 +- lib/test_xarray.c | 22 ++ lib/xarray.c | 4 + mm/kmemleak.c | 9 +- mm/madvise.c | 3 +- mm/memcontrol.c | 2 +- mm/memory.c | 17 +- mm/mempolicy.c | 8 +- mm/mmap.c | 2 +- mm/page_alloc.c | 9 +- mm/usercopy.c | 5 +- net/batman-adv/bridge_loop_avoidance.c | 6 + net/batman-adv/distributed-arp-table.c | 3 + net/batman-adv/gateway_client.c | 12 +- net/batman-adv/gateway_client.h | 16 +- net/batman-adv/hard-interface.h | 3 + net/batman-adv/network-coding.c | 6 + net/batman-adv/originator.c | 72 +----- net/batman-adv/originator.h | 96 +++++++- net/batman-adv/soft-interface.c | 15 +- net/batman-adv/soft-interface.h | 16 +- net/batman-adv/tp_meter.c | 3 + net/batman-adv/translation-table.c | 22 +- net/batman-adv/translation-table.h | 18 +- net/batman-adv/tvlv.c | 6 + net/bluetooth/hci_conn.c | 2 + net/can/isotp.c | 69 +++--- net/ipv4/route.c | 18 +- net/ipv4/tcp_output.c | 5 +- net/ipv4/udp.c | 6 + net/ipv6/udp.c | 4 +- net/ipv6/xfrm6_output.c | 16 ++ net/netfilter/nf_conntrack_proto_tcp.c | 17 +- net/netlink/af_netlink.c | 2 + net/openvswitch/conntrack.c | 118 +++++----- net/openvswitch/flow_netlink.c | 4 +- net/rxrpc/ar-internal.h | 15 +- net/rxrpc/call_event.c | 2 +- net/rxrpc/call_object.c | 40 +++- net/sunrpc/xprt.c | 7 + net/tipc/socket.c | 3 +- net/xfrm/xfrm_interface.c | 5 +- samples/bpf/xdpsock_user.c | 5 +- scripts/dtc/Makefile | 2 +- scripts/gcc-plugins/stackleak_plugin.c | 25 ++- security/integrity/evm/evm_main.c | 2 +- security/keys/keyctl_pkey.c | 14 +- security/security.c | 17 +- security/selinux/hooks.c | 11 +- security/selinux/include/policycap.h | 1 + security/selinux/include/policycap_names.h | 3 +- security/selinux/include/security.h | 7 + security/selinux/selinuxfs.c | 2 + security/selinux/xfrm.c | 2 +- security/smack/smack_lsm.c | 2 +- security/tomoyo/load_policy.c | 4 +- sound/arm/aaci.c | 4 +- sound/core/pcm.c | 1 + sound/core/pcm_lib.c | 9 +- sound/core/pcm_native.c | 39 +++- sound/firewire/fcp.c | 4 +- sound/isa/cs423x/cs4236.c | 8 +- sound/pci/hda/patch_hdmi.c | 8 +- sound/pci/hda/patch_realtek.c | 15 +- sound/soc/atmel/atmel_ssc_dai.c | 5 +- sound/soc/atmel/sam9g20_wm8731.c | 1 + sound/soc/atmel/sam9x5_wm8731.c | 16 +- sound/soc/codecs/Kconfig | 5 + sound/soc/codecs/msm8916-wcd-analog.c | 22 +- sound/soc/codecs/msm8916-wcd-digital.c | 5 +- sound/soc/codecs/mt6358.c | 4 + sound/soc/codecs/rt5663.c | 2 + sound/soc/codecs/wcd934x.c | 6 +- sound/soc/codecs/wm8350.c | 28 ++- sound/soc/dwc/dwc-i2s.c | 17 +- sound/soc/fsl/fsl_spdif.c | 2 + sound/soc/fsl/imx-es8328.c | 1 + sound/soc/generic/simple-card-utils.c | 2 +- sound/soc/mxs/mxs-saif.c | 5 +- sound/soc/mxs/mxs-sgtl5000.c | 3 + sound/soc/rockchip/rockchip_i2s.c | 18 +- sound/soc/sh/fsi.c | 19 +- sound/soc/soc-compress.c | 5 + sound/soc/soc-core.c | 2 +- sound/soc/soc-generic-dmaengine-pcm.c | 6 +- sound/soc/soc-topology.c | 3 +- sound/soc/sof/imx/imx8m.c | 1 + sound/soc/sof/intel/hda-loader.c | 11 +- sound/soc/ti/davinci-i2s.c | 5 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 25 +++ sound/spi/at73c213.c | 27 ++- tools/include/uapi/linux/bpf.h | 4 +- tools/lib/bpf/btf_dump.c | 5 + tools/lib/bpf/libbpf.c | 3 + tools/lib/bpf/xsk.c | 11 + .../selftests/bpf/progs/test_sock_fields.c | 2 +- .../testing/selftests/bpf/test_lirc_mode2.sh | 5 +- .../selftests/bpf/test_lwt_ip_encap.sh | 10 +- .../selftests/net/test_vxlan_under_vrf.sh | 8 +- tools/testing/selftests/vm/Makefile | 6 +- tools/testing/selftests/x86/Makefile | 6 +- tools/testing/selftests/x86/check_cc.sh | 2 +- tools/virtio/virtio_test.c | 1 + virt/kvm/kvm_main.c | 13 ++ 613 files changed, 4980 insertions(+), 2512 deletions(-) create mode 100644 arch/powerpc/boot/dts/fsl/t1040rdb-rev-a.dts create mode 100644 drivers/platform/chrome/cros_ec_sensorhub_trace.h -- 2.20.1

1 557

[PATCH openEuler-1.0-LTS 00/16] intel CVEs fix
by Yongqiang Liu 06 Jul '22

06 Jul '22

CVE-2022-21123,CVE-2022-21125,CVE-2022-21166 Gayatri Kammela (2): x86/cpu: Add Elkhart Lake to Intel family x86/cpu: Add another Alder Lake CPU to the Intel family Guenter Roeck (1): cpu/speculation: Add prototype for cpu_show_srbds() Josh Poimboeuf (1): x86/speculation/mmio: Print SMT warning Pawan Gupta (10): Documentation: Add documentation for Processor MMIO Stale Data x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug x86/speculation: Add a common function for MD_CLEAR mitigation update x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations x86/speculation/mmio: Enable CPU Fill buffer clearing on idle x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data x86/speculation/srbds: Update SRBDS mitigation selection x86/speculation/mmio: Reuse SRBDS mitigation for SBDS KVM: x86/speculation: Disable Fill buffer clear within guests Tony Luck (1): x86/cpu: Add Lakefield, Alder Lake and Rocket Lake models to the to Intel CPU family Zhang Rui (1): x86/cpu: Add Jasper Lake to Intel family .../ABI/testing/sysfs-devices-system-cpu | 1 + Documentation/admin-guide/hw-vuln/index.rst | 1 + .../hw-vuln/processor_mmio_stale_data.rst | 246 ++++++++++++++++++ .../admin-guide/kernel-parameters.txt | 36 +++ arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/intel-family.h | 11 + arch/x86/include/asm/msr-index.h | 25 ++ arch/x86/include/asm/nospec-branch.h | 2 + arch/x86/kernel/cpu/bugs.c | 235 ++++++++++++++--- arch/x86/kernel/cpu/common.c | 52 +++- arch/x86/kvm/vmx.c | 76 +++++- arch/x86/kvm/x86.c | 4 + drivers/base/cpu.c | 8 + include/linux/cpu.h | 4 + 14 files changed, 662 insertions(+), 40 deletions(-) create mode 100644 Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst -- 2.25.1

1 16

[PATCH openEuler-1.0-LTS 1/4] fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages
by Yongqiang Liu 06 Jul '22

06 Jul '22

From: Zhihao Cheng <chengzhihao1(a)huawei.com> mainline inclusion from mainline-5.19-rc1 commit 68f4c6eba70df70a720188bce95c85570ddfcc87 category: bugfix bugzilla: 186540, https://gitee.com/openeuler/kernel/issues/I55AKK CVE: NA -------------------------------- Commit 505a666ee3fc ("writeback: plug writeback in wb_writeback() and writeback_inodes_wb()") has us holding a plug during wb_writeback, which may cause a potential ABBA dead lock: wb_writeback fat_file_fsync blk_start_plug(&plug) for (;;) { iter i-1: some reqs have been added into plug->mq_list // LOCK A iter i: progress = __writeback_inodes_wb(wb, work) . writeback_sb_inodes // fat's bdev . __writeback_single_inode . . generic_writepages . . __block_write_full_page . . . . __generic_file_fsync . . . . sync_inode_metadata . . . . writeback_single_inode . . . . __writeback_single_inode . . . . fat_write_inode . . . . __fat_write_inode . . . . sync_dirty_buffer // fat's bdev . . . . lock_buffer(bh) // LOCK B . . . . submit_bh . . . . blk_mq_get_tag // LOCK A . . . trylock_buffer(bh) // LOCK B . . . redirty_page_for_writepage . . . wbc->pages_skipped++ . . --wbc->nr_to_write . wrote += write_chunk - wbc.nr_to_write // wrote > 0 . requeue_inode . redirty_tail_locked if (progress) // progress > 0 continue; iter i+1: queue_io // similar process with iter i, infinite for-loop ! } blk_finish_plug(&plug) // flush plug won't be called Above process triggers a hungtask like: [ 399.044861] INFO: task bb:2607 blocked for more than 30 seconds. [ 399.046824] Not tainted 5.18.0-rc1-00005-gefae4d9eb6a2-dirty [ 399.051539] task:bb state:D stack: 0 pid: 2607 ppid: 2426 flags:0x00004000 [ 399.051556] Call Trace: [ 399.051570] __schedule+0x480/0x1050 [ 399.051592] schedule+0x92/0x1a0 [ 399.051602] io_schedule+0x22/0x50 [ 399.051613] blk_mq_get_tag+0x1d3/0x3c0 [ 399.051640] __blk_mq_alloc_requests+0x21d/0x3f0 [ 399.051657] blk_mq_submit_bio+0x68d/0xca0 [ 399.051674] __submit_bio+0x1b5/0x2d0 [ 399.051708] submit_bio_noacct+0x34e/0x720 [ 399.051718] submit_bio+0x3b/0x150 [ 399.051725] submit_bh_wbc+0x161/0x230 [ 399.051734] __sync_dirty_buffer+0xd1/0x420 [ 399.051744] sync_dirty_buffer+0x17/0x20 [ 399.051750] __fat_write_inode+0x289/0x310 [ 399.051766] fat_write_inode+0x2a/0xa0 [ 399.051783] __writeback_single_inode+0x53c/0x6f0 [ 399.051795] writeback_single_inode+0x145/0x200 [ 399.051803] sync_inode_metadata+0x45/0x70 [ 399.051856] __generic_file_fsync+0xa3/0x150 [ 399.051880] fat_file_fsync+0x1d/0x80 [ 399.051895] vfs_fsync_range+0x40/0xb0 [ 399.051929] __x64_sys_fsync+0x18/0x30 In my test, 'need_resched()' (which is imported by 590dca3a71 "fs-writeback: unplug before cond_resched in writeback_sb_inodes") in function 'writeback_sb_inodes()' seldom comes true, unless cond_resched() is deleted from write_cache_pages(). Fix it by correcting wrote number according number of skipped pages in writeback_sb_inodes(). Goto Link to find a reproducer. Link: https://bugzilla.kernel.org/show_bug.cgi?id=215837 Cc: stable(a)vger.kernel.org # v4.3 Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20220510133805.1988292-1-chengzhihao1@huawei.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/fs-writeback.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c index 5abb71da2b9a..23a632f02839 100644 --- a/fs/fs-writeback.c +++ b/fs/fs-writeback.c @@ -1568,11 +1568,12 @@ static long writeback_sb_inodes(struct super_block *sb, }; unsigned long start_time = jiffies; long write_chunk; - long wrote = 0; /* count both pages and inodes */ + long total_wrote = 0; /* count both pages and inodes */ while (!list_empty(&wb->b_io)) { struct inode *inode = wb_inode(wb->b_io.prev); struct bdi_writeback *tmp_wb; + long wrote; if (inode->i_sb != sb) { if (work->sb) { @@ -1648,7 +1649,9 @@ static long writeback_sb_inodes(struct super_block *sb, wbc_detach_inode(&wbc); work->nr_pages -= write_chunk - wbc.nr_to_write; - wrote += write_chunk - wbc.nr_to_write; + wrote = write_chunk - wbc.nr_to_write - wbc.pages_skipped; + wrote = wrote < 0 ? 0 : wrote; + total_wrote += wrote; if (need_resched()) { /* @@ -1670,7 +1673,7 @@ static long writeback_sb_inodes(struct super_block *sb, tmp_wb = inode_to_wb_and_lock_list(inode); spin_lock(&inode->i_lock); if (!(inode->i_state & I_DIRTY_ALL)) - wrote++; + total_wrote++; requeue_inode(inode, tmp_wb, &wbc); inode_sync_complete(inode); spin_unlock(&inode->i_lock); @@ -1684,14 +1687,14 @@ static long writeback_sb_inodes(struct super_block *sb, * bail out to wb_writeback() often enough to check * background threshold and other termination conditions. */ - if (wrote) { + if (total_wrote) { if (time_is_before_jiffies(start_time + HZ / 10UL)) break; if (work->nr_pages <= 0) break; } } - return wrote; + return total_wrote; } static long __writeback_inodes_wb(struct bdi_writeback *wb, -- 2.25.1

1 3

[PATCH openEuler-5.10-LTS 01/30] Documentation: Add documentation for Processor MMIO Stale Data
by Zheng Zengkai 05 Jul '22

05 Jul '22

From: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> stable inclusion from stable-v5.10.123 commit f8a85334a57e7842320476ff27be3a5f151da364 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5D5RS CVE: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4419470191386456e0b8ed4eb06a70b0021798a6 upstream Add the admin guide for Processor MMIO stale data vulnerabilities. Signed-off-by: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> Signed-off-by: Borislav Petkov <bp(a)suse.de> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- Documentation/admin-guide/hw-vuln/index.rst | 1 + .../hw-vuln/processor_mmio_stale_data.rst | 246 ++++++++++++++++++ 2 files changed, 247 insertions(+) create mode 100644 Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst diff --git a/Documentation/admin-guide/hw-vuln/index.rst b/Documentation/admin-guide/hw-vuln/index.rst index ca4dbdd9016d..2adec1e6520a 100644 --- a/Documentation/admin-guide/hw-vuln/index.rst +++ b/Documentation/admin-guide/hw-vuln/index.rst @@ -15,3 +15,4 @@ are configurable at compile, boot or run time. tsx_async_abort multihit.rst special-register-buffer-data-sampling.rst + processor_mmio_stale_data.rst diff --git a/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst b/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst new file mode 100644 index 000000000000..9393c50b5afc --- /dev/null +++ b/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst @@ -0,0 +1,246 @@ +========================================= +Processor MMIO Stale Data Vulnerabilities +========================================= + +Processor MMIO Stale Data Vulnerabilities are a class of memory-mapped I/O +(MMIO) vulnerabilities that can expose data. The sequences of operations for +exposing data range from simple to very complex. Because most of the +vulnerabilities require the attacker to have access to MMIO, many environments +are not affected. System environments using virtualization where MMIO access is +provided to untrusted guests may need mitigation. These vulnerabilities are +not transient execution attacks. However, these vulnerabilities may propagate +stale data into core fill buffers where the data can subsequently be inferred +by an unmitigated transient execution attack. Mitigation for these +vulnerabilities includes a combination of microcode update and software +changes, depending on the platform and usage model. Some of these mitigations +are similar to those used to mitigate Microarchitectural Data Sampling (MDS) or +those used to mitigate Special Register Buffer Data Sampling (SRBDS). + +Data Propagators +================ +Propagators are operations that result in stale data being copied or moved from +one microarchitectural buffer or register to another. Processor MMIO Stale Data +Vulnerabilities are operations that may result in stale data being directly +read into an architectural, software-visible state or sampled from a buffer or +register. + +Fill Buffer Stale Data Propagator (FBSDP) +----------------------------------------- +Stale data may propagate from fill buffers (FB) into the non-coherent portion +of the uncore on some non-coherent writes. Fill buffer propagation by itself +does not make stale data architecturally visible. Stale data must be propagated +to a location where it is subject to reading or sampling. + +Sideband Stale Data Propagator (SSDP) +------------------------------------- +The sideband stale data propagator (SSDP) is limited to the client (including +Intel Xeon server E3) uncore implementation. The sideband response buffer is +shared by all client cores. For non-coherent reads that go to sideband +destinations, the uncore logic returns 64 bytes of data to the core, including +both requested data and unrequested stale data, from a transaction buffer and +the sideband response buffer. As a result, stale data from the sideband +response and transaction buffers may now reside in a core fill buffer. + +Primary Stale Data Propagator (PSDP) +------------------------------------ +The primary stale data propagator (PSDP) is limited to the client (including +Intel Xeon server E3) uncore implementation. Similar to the sideband response +buffer, the primary response buffer is shared by all client cores. For some +processors, MMIO primary reads will return 64 bytes of data to the core fill +buffer including both requested data and unrequested stale data. This is +similar to the sideband stale data propagator. + +Vulnerabilities +=============== +Device Register Partial Write (DRPW) (CVE-2022-21166) +----------------------------------------------------- +Some endpoint MMIO registers incorrectly handle writes that are smaller than +the register size. Instead of aborting the write or only copying the correct +subset of bytes (for example, 2 bytes for a 2-byte write), more bytes than +specified by the write transaction may be written to the register. On +processors affected by FBSDP, this may expose stale data from the fill buffers +of the core that created the write transaction. + +Shared Buffers Data Sampling (SBDS) (CVE-2022-21125) +---------------------------------------------------- +After propagators may have moved data around the uncore and copied stale data +into client core fill buffers, processors affected by MFBDS can leak data from +the fill buffer. It is limited to the client (including Intel Xeon server E3) +uncore implementation. + +Shared Buffers Data Read (SBDR) (CVE-2022-21123) +------------------------------------------------ +It is similar to Shared Buffer Data Sampling (SBDS) except that the data is +directly read into the architectural software-visible state. It is limited to +the client (including Intel Xeon server E3) uncore implementation. + +Affected Processors +=================== +Not all the CPUs are affected by all the variants. For instance, most +processors for the server market (excluding Intel Xeon E3 processors) are +impacted by only Device Register Partial Write (DRPW). + +Below is the list of affected Intel processors [#f1]_: + + =================== ============ ========= + Common name Family_Model Steppings + =================== ============ ========= + HASWELL_X 06_3FH 2,4 + SKYLAKE_L 06_4EH 3 + BROADWELL_X 06_4FH All + SKYLAKE_X 06_55H 3,4,6,7,11 + BROADWELL_D 06_56H 3,4,5 + SKYLAKE 06_5EH 3 + ICELAKE_X 06_6AH 4,5,6 + ICELAKE_D 06_6CH 1 + ICELAKE_L 06_7EH 5 + ATOM_TREMONT_D 06_86H All + LAKEFIELD 06_8AH 1 + KABYLAKE_L 06_8EH 9 to 12 + ATOM_TREMONT 06_96H 1 + ATOM_TREMONT_L 06_9CH 0 + KABYLAKE 06_9EH 9 to 13 + COMETLAKE 06_A5H 2,3,5 + COMETLAKE_L 06_A6H 0,1 + ROCKETLAKE 06_A7H 1 + =================== ============ ========= + +If a CPU is in the affected processor list, but not affected by a variant, it +is indicated by new bits in MSR IA32_ARCH_CAPABILITIES. As described in a later +section, mitigation largely remains the same for all the variants, i.e. to +clear the CPU fill buffers via VERW instruction. + +New bits in MSRs +================ +Newer processors and microcode update on existing affected processors added new +bits to IA32_ARCH_CAPABILITIES MSR. These bits can be used to enumerate +specific variants of Processor MMIO Stale Data vulnerabilities and mitigation +capability. + +MSR IA32_ARCH_CAPABILITIES +-------------------------- +Bit 13 - SBDR_SSDP_NO - When set, processor is not affected by either the + Shared Buffers Data Read (SBDR) vulnerability or the sideband stale + data propagator (SSDP). +Bit 14 - FBSDP_NO - When set, processor is not affected by the Fill Buffer + Stale Data Propagator (FBSDP). +Bit 15 - PSDP_NO - When set, processor is not affected by Primary Stale Data + Propagator (PSDP). +Bit 17 - FB_CLEAR - When set, VERW instruction will overwrite CPU fill buffer + values as part of MD_CLEAR operations. Processors that do not + enumerate MDS_NO (meaning they are affected by MDS) but that do + enumerate support for both L1D_FLUSH and MD_CLEAR implicitly enumerate + FB_CLEAR as part of their MD_CLEAR support. +Bit 18 - FB_CLEAR_CTRL - Processor supports read and write to MSR + IA32_MCU_OPT_CTRL[FB_CLEAR_DIS]. On such processors, the FB_CLEAR_DIS + bit can be set to cause the VERW instruction to not perform the + FB_CLEAR action. Not all processors that support FB_CLEAR will support + FB_CLEAR_CTRL. + +MSR IA32_MCU_OPT_CTRL +--------------------- +Bit 3 - FB_CLEAR_DIS - When set, VERW instruction does not perform the FB_CLEAR +action. This may be useful to reduce the performance impact of FB_CLEAR in +cases where system software deems it warranted (for example, when performance +is more critical, or the untrusted software has no MMIO access). Note that +FB_CLEAR_DIS has no impact on enumeration (for example, it does not change +FB_CLEAR or MD_CLEAR enumeration) and it may not be supported on all processors +that enumerate FB_CLEAR. + +Mitigation +========== +Like MDS, all variants of Processor MMIO Stale Data vulnerabilities have the +same mitigation strategy to force the CPU to clear the affected buffers before +an attacker can extract the secrets. + +This is achieved by using the otherwise unused and obsolete VERW instruction in +combination with a microcode update. The microcode clears the affected CPU +buffers when the VERW instruction is executed. + +Kernel reuses the MDS function to invoke the buffer clearing: + + mds_clear_cpu_buffers() + +On MDS affected CPUs, the kernel already invokes CPU buffer clear on +kernel/userspace, hypervisor/guest and C-state (idle) transitions. No +additional mitigation is needed on such CPUs. + +For CPUs not affected by MDS or TAA, mitigation is needed only for the attacker +with MMIO capability. Therefore, VERW is not required for kernel/userspace. For +virtualization case, VERW is only needed at VMENTER for a guest with MMIO +capability. + +Mitigation points +----------------- +Return to user space +^^^^^^^^^^^^^^^^^^^^ +Same mitigation as MDS when affected by MDS/TAA, otherwise no mitigation +needed. + +C-State transition +^^^^^^^^^^^^^^^^^^ +Control register writes by CPU during C-state transition can propagate data +from fill buffer to uncore buffers. Execute VERW before C-state transition to +clear CPU fill buffers. + +Guest entry point +^^^^^^^^^^^^^^^^^ +Same mitigation as MDS when processor is also affected by MDS/TAA, otherwise +execute VERW at VMENTER only for MMIO capable guests. On CPUs not affected by +MDS/TAA, guest without MMIO access cannot extract secrets using Processor MMIO +Stale Data vulnerabilities, so there is no need to execute VERW for such guests. + +Mitigation control on the kernel command line +--------------------------------------------- +The kernel command line allows to control the Processor MMIO Stale Data +mitigations at boot time with the option "mmio_stale_data=". The valid +arguments for this option are: + + ========== ================================================================= + full If the CPU is vulnerable, enable mitigation; CPU buffer clearing + on exit to userspace and when entering a VM. Idle transitions are + protected as well. It does not automatically disable SMT. + full,nosmt Same as full, with SMT disabled on vulnerable CPUs. This is the + complete mitigation. + off Disables mitigation completely. + ========== ================================================================= + +If the CPU is affected and mmio_stale_data=off is not supplied on the kernel +command line, then the kernel selects the appropriate mitigation. + +Mitigation status information +----------------------------- +The Linux kernel provides a sysfs interface to enumerate the current +vulnerability status of the system: whether the system is vulnerable, and +which mitigations are active. The relevant sysfs file is: + + /sys/devices/system/cpu/vulnerabilities/mmio_stale_data + +The possible values in this file are: + + .. list-table:: + + * - 'Not affected' + - The processor is not vulnerable + * - 'Vulnerable' + - The processor is vulnerable, but no mitigation enabled + * - 'Vulnerable: Clear CPU buffers attempted, no microcode' + - The processor is vulnerable, but microcode is not updated. The + mitigation is enabled on a best effort basis. + * - 'Mitigation: Clear CPU buffers' + - The processor is vulnerable and the CPU buffer clearing mitigation is + enabled. + +If the processor is vulnerable then the following information is appended to +the above information: + + ======================== =========================================== + 'SMT vulnerable' SMT is enabled + 'SMT disabled' SMT is disabled + 'SMT Host state unknown' Kernel runs in a VM, Host SMT state unknown + ======================== =========================================== + +References +---------- +.. [#f1] Affected Processors + https://www.intel.com/content/www/us/en/developer/topic-technology/software… -- 2.20.1

1 29

[PATCH openEuler-5.10-LTS 000/559] Backport 5.10.110 LTS
by Zheng Zengkai 05 Jul '22

05 Jul '22

Backport 5.10.110 LTS patches from upstream PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup" can: m_can: m_can_tx_handler(): fix use after free of skb openvswitch: Fixed nd target mask field in the flow dump. docs: sysctl/kernel: add missing bit to panic_print um: Fix uml_mconsole stop/go ARM: dts: spear13xx: Update SPI dma properties ARM: dts: spear1340: Update serial node properties ASoC: topology: Allow TLV control to be either read or write dt-bindings: spi: mxic: The interrupt property is not mandatory dt-bindings: mtd: nand-controller: Fix a comment in the examples dt-bindings: mtd: nand-controller: Fix the reg property description bpf: Fix comment for helper bpf_current_task_under_cgroup() bpf: Adjust BPF stack helper functions to accommodate skip > 0 mm/usercopy: return 1 from hardened_usercopy __setup() handler mm/memcontrol: return 1 from cgroup.memory __setup() handler ARM: 9187/1: JIVE: fix return value of __setup handler mm/mmap: return 1 from stack_guard_gap __setup() handler batman-adv: Check ptr for NULL before reducing its refcnt ASoC: soc-compress: Change the check for codec_dai staging: mt7621-dts: fix pinctrl-0 items to be size-1 items on ethernet proc: bootconfig: Add null pointer check can: isotp: restore accidentally removed MSG_PEEK feature platform/chrome: cros_ec_typec: Check for EC device ACPI: CPPC: Avoid out of bounds access when parsing _CPC data riscv module: remove (NOLOAD) io_uring: fix memory leak of uid in files registration ARM: iop32x: offset IRQ numbers by 1 ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE() pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR() watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function pinctrl: pinconf-generic: Print arguments for bias-pull-* watch_queue: Free the page array when watch_queue is dismantled crypto: arm/aes-neonbs-cbc - Select generic cbc and aes mailbox: imx: fix wakeup failure from freeze mode rxrpc: Fix call timer start racing with call destruction gfs2: Make sure FITRIM minlen is rounded up to fs block size rtc: check if __rtc_read_time was successful XArray: Update the LRU list in xas_split() can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value can: mcba_usb: properly check endpoint type XArray: Fix xas_create_range() when multi-order entry present wireguard: socket: ignore v6 endpoints when ipv6 is disabled wireguard: socket: free skb in send6 when ipv6 is disabled wireguard: queueing: use CFI-safe ptr_ring cleanup function ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM KVM: SVM: fix panic on out-of-bounds guest IRQ KVM: x86: fix sending PV IPI KVM: Prevent module exit until all VMs are freed KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated platform: chrome: Split trace include file scsi: qla2xxx: Use correct feature type field during RFF_ID processing scsi: qla2xxx: Reduce false trigger to login scsi: qla2xxx: Fix N2N inconsistent PLOGI scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests scsi: qla2xxx: Fix hang due to session stuck scsi: qla2xxx: Fix incorrect reporting of task management failure scsi: qla2xxx: Fix disk failure to rediscover scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() scsi: qla2xxx: Check for firmware dump already collected scsi: qla2xxx: Add devids and conditionals for 28xx scsi: qla2xxx: Fix device reconnect in loop topology scsi: qla2xxx: Fix warning for missing error code scsi: qla2xxx: Fix wrong FDMI data for 64G adapter scsi: qla2xxx: Fix scheduling while atomic scsi: qla2xxx: Fix stuck session in gpdb powerpc: Fix build errors with newer binutils powerpc/lib/sstep: Fix build errors with newer binutils powerpc/lib/sstep: Fix 'sthcx' instruction powerpc/kasan: Fix early region not updated correctly KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP MMU ALSA: hda/realtek: Add alc256-samsung-headphone fixup media: atomisp: fix bad usage at error handling logic mmc: host: Return an error when ->enable_sdio_irq() ops is missing media: hdpvr: initialize dev->worker at hdpvr_register_videodev media: Revert "media: em28xx: add missing em28xx_close_extension" video: fbdev: sm712fb: Fix crash in smtcfb_write() ARM: mmp: Fix failure to remove sram device ARM: tegra: tamonten: Fix I2C3 pad setting lib/test_lockup: fix kernel pointer check for separate address spaces uaccess: fix type mismatch warnings from access_ok() media: cx88-mpeg: clear interrupt status register before streaming video ASoC: soc-core: skip zero num_dai component in searching dai name ARM: dts: bcm2711: Add the missing L1/L2 cache information video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() arm64: defconfig: build imx-sdma as a module ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk ARM: ftrace: avoid redundant loads or clobbering IP media: atomisp: fix dummy_ptr check to avoid duplicate active_bo media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator off on some boards ASoC: madera: Add dependencies on MFD ARM: dts: bcm2837: Add the missing L1/L2 cache information ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit video: fbdev: cirrusfb: check pixclock to avoid divide by zero video: fbdev: w100fb: Reset global state video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow media: ir_toy: free before error exiting media: staging: media: zoran: fix various V4L2 compliance errors media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com media: staging: media: zoran: move videodev alloc ntfs: add sanity check on allocation size f2fs: compress: fix to print raw data size in error path of lz4 decompression NFSD: Fix nfsd_breaker_owns_lease() return values f2fs: fix to do sanity check on curseg->alloc_type ext4: don't BUG if someone dirty pages without asking ext4 first ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb locking/lockdep: Iterate lock_classes directly when reading lockdep files spi: tegra20: Use of_device_get_match_data() nvme-tcp: lockdep: annotate in-kernel sockets parisc: Fix handling off probe non-access faults PM: core: keep irq flags in device_pm_check_callbacks() ACPI/APEI: Limit printable size of BERT table data Revert "Revert "block, bfq: honor already-setup queue merges"" lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3 ACPICA: Avoid walking the ACPI Namespace if it is not there fs/binfmt_elf: Fix AT_PHDR for unusual ELF files irqchip/nvic: Release nvic_base upon failure irqchip/qcom-pdc: Fix broken locking Fix incorrect type in assignment of ipv6 port for audit loop: use sysfs_emit() in the sysfs xxx show() selinux: allow FIOCLEX and FIONCLEX with policy capability selinux: use correct type for context length pinctrl: npcm: Fix broken references to chip->parent_device gcc-plugins/stackleak: Exactly match strings instead of prefixes regulator: rpi-panel: Handle I2C errors/timing to the Atmel LSM: general protection fault in legacy_parse_param fs: fix fd table size alignment properly lib/test: use after free in register_test_dev_kmod() fs: fd tables have to be multiples of BITS_PER_LONG net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator NFSv4/pNFS: Fix another issue with a list iterator pointing to the head qlcnic: dcb: default to returning -EOPNOTSUPP selftests: test_vxlan_under_vrf: Fix broken test case net: phy: broadcom: Fix brcm_fet_config_init() net: enetc: report software timestamping via SO_TIMESTAMPING xen: fix is_xen_pmu() clk: Initialize orphan req_rate clk: qcom: gcc-msm8994: Fix gpll4 width kdb: Fix the putarea helper function NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options jfs: fix divide error in dbNextAG driver core: dd: fix return value of __setup handler firmware: google: Properly state IOMEM dependency kgdbts: fix return value of __setup handler serial: 8250: fix XOFF/XON sending when DMA is used kgdboc: fix return value of __setup handler tty: hvc: fix return value of __setup handler pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual GPIOs pinctrl: mediatek: paris: Fix pingroup pin config state readback pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get() pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init staging: mt7621-dts: fix GB-PC2 devicetree staging: mt7621-dts: fix pinctrl properties for ethernet staging: mt7621-dts: fix formatting staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree NFS: remove unneeded check in decode_devicenotify_args() clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver clk: clps711x: Terminate clk_div_table with sentinel element clk: loongson1: Terminate clk_div_table with sentinel element clk: actions: Terminate clk_div_table with sentinel element nvdimm/region: Fix default alignment for small regions remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma clk: qcom: clk-rcg2: Update the frac table for pixel clock clk: qcom: clk-rcg2: Update logic to calculate D value for RCG clk: at91: sama7g5: fix parents of PDMCs' GCLK clk: imx7d: Remove audio_mclk_root_clk dma-debug: fix return value of __setup handlers NFS: Return valid errors from nfs2/3_decode_dirent() habanalabs: Add check for pci_enable_device iio: adc: Add check for devm_request_threaded_irq serial: 8250: Fix race condition in RTS-after-send handling NFS: Use of mapping_set_error() results in spurious errors serial: 8250_lpss: Balance reference count for PCI DMA device serial: 8250_mid: Balance reference count for PCI DMA device phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure}) clk: qcom: ipq8074: Use floor ops for SDCC1 clock pinctrl: renesas: checker: Fix miscalculation of number of states pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel staging:iio:adc:ad7280a: Fix handing of device address bit reversing. iio: mma8452: Fix probe failing when an i2c_device_id is used clk: qcom: ipq8074: fix PCI-E clock oops soundwire: intel: fix wrong register name in intel_shim_wake cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse misc: alcor_pci: Fix an error handling path fsi: Aspeed: Fix a potential double free fsi: aspeed: convert to devm_platform_ioremap_resource pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add() mxser: fix xmit_buf leak in activate when LSR == 0xff mfd: asic3: Add missing iounmap() on error asic3_mfd_probe tipc: fix the timer expires after interval 100ms openvswitch: always update flow key after nat tcp: ensure PMTU updates are processed during fastopen net: bcmgenet: Use stronger register read/writes to assure ordering PCI: Avoid broken MSI on SB600 USB devices selftests/bpf/test_lirc_mode2.sh: Exit with proper code i2c: mux: demux-pinctrl: do not deactivate a master that is not active i2c: meson: Fix wrong speed use from probe af_netlink: Fix shift out of bounds in group mask calculation ipv4: Fix route lookups when handling ICMP redirects and PMTU updates Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed selftests/bpf: Fix error reporting from sock_fields programs bareudp: use ipv6_mod_enabled to check if IPv6 enabled can: isotp: support MSG_TRUNC flag when reading from socket can: isotp: return -EADDRNOTAVAIL when reading from unbound socket USB: storage: ums-realtek: fix error code in rts51x_read_mem() samples/bpf, xdpsock: Fix race when running for fix duration of time bpf, sockmap: Fix double uncharge the mem of sk_msg bpf, sockmap: Fix more uncharged while msg has more_data bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full RDMA/mlx5: Fix memory leak in error flow for subscribe event routine mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init MIPS: pgalloc: fix memory leak caused by pgd_free() MIPS: RB532: fix return value of __setup handler mips: cdmm: Fix refcount leak in mips_cdmm_phys_base ath10k: Fix error handling in ath10k_setup_msa_resources vxcan: enable local echo for sent CAN frames powerpc: 8xx: fix a return value error in mpc8xx_pic_init platform/x86: huawei-wmi: check the return value of device_create_file() selftests/bpf: Make test_lwt_ip_encap more stable and faster libbpf: Unmap rings when umem deleted mfd: mc13xxx: Add check for mc13xxx_irq_request powerpc/sysdev: fix incorrect use to determine if list is empty mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n net: axienet: fix RX ring refill allocation failure handling IB/hfi1: Allow larger MTU without AIP power: supply: wm8350-power: Add missing free in free_charger_irq power: supply: wm8350-power: Handle error for wm8350_register_irq i2c: xiic: Make bus names unique hv_balloon: rate-limit "Unhandled message" warning KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() KVM: x86: Fix emulation in writing cr8 powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties() libbpf: Skip forward declaration when counting duplicated type names gpu: host1x: Fix a memory leak in 'host1x_remove()' bpf, arm64: Feed byte-offset into bpf line info bpf, arm64: Call build_prologue() first in first JIT pass drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt scsi: hisi_sas: Change permission of parameter prot_mask power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return drm/tegra: Fix reference leak in tegra_dsi_ganged_probe ext2: correct max file size computing TOMOYO: fix __setup handlers return values drm/amd/display: Remove vupdate_int_entry definition RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR scsi: pm8001: Fix abort all task initialization scsi: pm8001: Fix NCQ NON DATA command completion handling scsi: pm8001: Fix NCQ NON DATA command task initialization scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req() scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req() scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update() scsi: pm8001: Fix le32 values handling in pm80xx_set_sas_protocol_timer_config() scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config() scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() scsi: pm8001: Fix command initialization in pm80XX_send_read_log() dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS drm/msm/dpu: fix dp audio condition drm/msm/dpu: add DSPP blocks teardown drm/msm/dp: populate connector of struct dp_panel iwlwifi: mvm: Fix an error code in iwl_mvm_up() iwlwifi: Fix -EIO error code that is never returned dax: make sure inodes are flushed before destroy cache IB/cma: Allow XRC INI QPs to set their local ACK timeout drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug drm/amd/pm: enable pm sysfs write for one VF mode iommu/ipmmu-vmsa: Check for error num after setting mask HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init drm/bridge: dw-hdmi: use safe format when first in bridge chain PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge scripts/dtc: Call pkg-config POSIXly correct net: dsa: mv88e6xxx: Enable port policy support on 6097 mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in sta mode powerpc/perf: Don't use perf_hw_context for trace IMC PMU KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch ray_cs: Check ioremap return value power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe i40e: respect metadata on XSK Rx to skb i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb KVM: PPC: Fix vmx/vsx mixup in mmio emulation RDMA/core: Set MR type in ib_reg_user_mr ath9k_htc: fix uninit value bugs drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl() ionic: fix type complaint in ionic_dev_cmd_clean() drm/edid: Don't clear formats if using deep color mtd: rawnand: gpmi: fix controller timings setting mtd: onenand: Check for error irq Bluetooth: hci_serdev: call init_rwsem() before p->open() udmabuf: validate ubuf->pagecount libbpf: Fix possible NULL pointer dereference when destroying skeleton drm/panfrost: Check for error num after setting mask ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern drm: bridge: adv7511: Fix ADV7535 HPD enablement drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe ASoC: atmel: sam9x5_wm8731: use devm_snd_soc_register_card() mmc: davinci_mmc: Handle error for clk_enable ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digital_probe ASoC: imx-es8328: Fix error return code in imx_es8328_probe() ASoC: fsl_spdif: Disable TX clock when stop ASoC: mxs: Fix error handling in mxs_sgtl5000_probe ASoC: dmaengine: do not use a NULL prepare_slave_config() callback ASoC: SOF: Add missing of_node_put() in imx8m_probe ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in rockchip_i2s_probe ASoC: rockchip: i2s: Use devm_platform_get_and_ioremap_resource() ivtv: fix incorrect device_caps for ivtvfb media: saa7134: fix incorrect use to determine if list is empty media: saa7134: convert list_for_each to entry variant video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of ASoC: fsi: Add check for clk_enable ASoC: wm8350: Handle error for wm8350_register_irq ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe media: vidtv: Check for null return of vzalloc media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction memory: emif: check the pointer temp in get_device_details() memory: emif: Add check for setup_interrupts ASoC: soc-compress: prevent the potentially use of null pointer ASoC: dwc-i2s: Handle errors for clk_enable ASoC: atmel_ssc_dai: Handle errors for clk_enable ASoC: mxs-saif: Handle errors for clk_enable printk: fix return value of printk.devkmsg __setup handler arm64: dts: broadcom: Fix sata nodename arm64: dts: ns2: Fix spi-cpol and spi-cpha property ALSA: spi: Add check for clk_enable() ASoC: ti: davinci-i2s: Add check for clk_enable() ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp() uaccess: fix nios2 and microblaze get_user_8() ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put media: cedrus: h264: Fix neighbour info buffer size media: cedrus: H265: Fix neighbour info buffer size media: usb: go7007: s2250-board: fix leak in probe() media: em28xx: initialize refcount before kref_get media: video/hdmi: handle short reads of hdmi info frame. ARM: dts: imx: Add missing LVDS decoder on M53Menlo ARM: dts: sun8i: v3s: Move the csi1 block to follow address order soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is not defined arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc arm64: dts: qcom: sdm845: fix microphone bias properties and values soc: qcom: aoss: remove spurious IRQF_ONESHOT flags soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem soc: qcom: rpmpd: Check for null return of devm_kcalloc ARM: dts: qcom: ipq4019: fix sleep clock firmware: qcom: scm: Remove reassignment to desc following initializer video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() video: fbdev: controlfb: Fix COMPILE_TEST build video: fbdev: controlfb: Fix set but not used warnings video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen media: aspeed: Correct value for h-total-pixels media: hantro: Fix overfill bottom register field name media: meson: vdec: potential dereference of null pointer media: coda: Fix missing put_device() call in coda_get_vdoa_data ASoC: generic: simple-card-utils: remove useless assignment ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting media: bttv: fix WARNING regression on tunerless devices media: mtk-vcodec: potential dereference of null pointer media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls media: staging: media: zoran: fix usage of vb2_dma_contig_set_max_seg_size kunit: make kunit_test_timeout compatible with comment selftests, x86: fix how check_cc.sh is being invoked f2fs: fix compressed file start atomic write may cause data corruption f2fs: compress: remove unneeded read when rewrite whole cluster btrfs: fix unexpected error path when reflinking an inline extent f2fs: fix to avoid potential deadlock nfsd: more robust allocation failure handling in nfsd_file_cache_init f2fs: fix missing free nid in f2fs_handle_failed_inode perf/x86/intel/pt: Fix address filter config for 32-bit kernel perf/core: Fix address filter parser for multiple filters rseq: Optimise rseq_get_rseq_cs() and clear_rseq_cs() sched/core: Export pelt_thermal_tp sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa f2fs: fix to enable ATGC correctly via gc_idle sysfs interface watch_queue: Actually free the watch watch_queue: Fix NULL dereference in error cleanup io_uring: terminate manual loop iterator loop correctly for non-vecs clocksource: acpi_pm: fix return value of __setup handler hwmon: (pmbus) Add Vin unit off handling hwrng: nomadik - Change clk_disable to clk_disable_unprepare amba: Make the remove callback return void vfio: platform: simplify device removal crypto: ccree - Fix use after free in cc_cipher_exit() crypto: ccp - ccp_dmaengine_unregister release dma channels ACPI: APEI: fix return value of __setup handlers clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_init() clocksource/drivers/timer-microchip-pit64b: Use notrace clocksource/drivers/exynos_mct: Handle DTS with higher number of interrupts clocksource/drivers/exynos_mct: Refactor resources allocation clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix crypto: vmx - add missing dependencies crypto: amlogic - call finalize with bh disabled crypto: sun8i-ce - call finalize with bh disabled crypto: sun8i-ss - call finalize with bh disabled hwrng: atmel - disable trng on failure path spi: spi-zynqmp-gqspi: Handle error for dma_set_mask PM: suspend: fix return value of __setup handler PM: hibernate: fix __setup handler error handling block: don't delete queue kobject before its children nvme: cleanup __nvme_check_ids hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING hwmon: (pmbus) Add mutex to regulator ops spi: pxa2xx-pci: Balance reference count for PCI DMA device crypto: ccree - don't attempt 0 len DMA mappings EVM: fix the evm= __setup handler return value audit: log AUDIT_TIME_* records only from rules crypto: rockchip - ECB does not need IV selftests/x86: Add validity check and allow field splitting arm64/mm: avoid fixmap race condition when create pud mapping spi: tegra114: Add missing IRQ check in tegra_spi_probe thermal: int340x: Check for NULL after calling kmemdup() crypto: mxs-dcp - Fix scatterlist processing crypto: authenc - Fix sleep in atomic context in decrypt_tail crypto: sun8i-ss - really disable hash on A80 hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER hwrng: cavium - Check health status while reading random data selinux: check return value of sel_make_avc_files regulator: qcom_smd: fix for_each_child.cocci warnings PCI: xgene: Revert "PCI: xgene: Fix IB window setup" PCI: pciehp: Clear cmd_busy bit in polling mode drm/i915/gem: add missing boundary check in vm_access brcmfmac: pcie: Fix crashes due to early IRQs brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path brcmfmac: firmware: Allocate space for default boardrev in nvram xtensa: fix xtensa_wsr always writing 0 xtensa: fix stop_machine_cpuslocked call in patch_text media: davinci: vpif: fix unbalanced runtime PM enable media: davinci: vpif: fix unbalanced runtime PM get media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC DEC: Limit PMAX memory probing to R3k systems crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() crypto: rsa-pkcs1pad - restore signature length check crypto: rsa-pkcs1pad - correctly get hash from source scatterlist crypto: rsa-pkcs1pad - only allow with rsa exec: Force single empty string when argv is empty lib/raid6/test: fix multiple definition linking error thermal: int340x: Increase bitmap size pstore: Don't use semaphores in always-atomic-context code carl9170: fix missing bit-wise or operator for tx_params mgag200 fix memmapsl configuration in GCTL6 register ARM: dts: exynos: add missing HDMI supplies on SMDK5420 ARM: dts: exynos: add missing HDMI supplies on SMDK5250 ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 ARM: dts: at91: sama5d2: Fix PMERRLOC resource size video: fbdev: atari: Atari 2 bpp (STe) palette bugfix video: fbdev: sm712fb: Fix crash in smtcfb_read() drm/edid: check basic audio support on CEA extension block block: limit request dispatch loop duration mailbox: tegra-hsp: Flush whole channel ext4: fix fs corruption when tring to remove a non-empty directory with IO error ext4: fix ext4_fc_stats trace point coredump: Also dump first pages of non-executable ELF libraries ACPI: properties: Consistently return -ENOENT if there are no more references arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs arm64: signal: nofpsimd: Do not allocate fp/simd context when not available udp: call udp_encap_enable for v6 sockets when enabling encap powerpc/kvm: Fix kvm_use_magic_page can: isotp: sanitize CAN ID checks in isotp_bind() drbd: fix potential silent data corruption dm integrity: set journal entry unused when shrinking device mm/kmemleak: reset tag when compare object pointer mm,hwpoison: unmap poisoned page before invalidation Revert "mm: madvise: skip unmapped vma holes passed to process_madvise" mm: madvise: return correct bytes advised with process_madvise mm: madvise: skip unmapped vma holes passed to process_madvise ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock ALSA: hda: Avoid unsol event during RPM suspending ALSA: cs4236: fix an incorrect NULL check on list iterator cifs: fix NULL ptr dereference in smb2_ioctl_query_info() cifs: prevent bad output lengths in smb2_ioctl_query_info() Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" riscv: Increase stack size under KASAN riscv: Fix fill_callchain return value qed: display VF trust config scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands mempolicy: mbind_range() set_policy() after vma_merge() mm: invalidate hwpoison page cache page in fault path mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node mtd: rawnand: protect access to rawnand devices while in suspend spi: mxic: Fix the transmit path pinctrl: samsung: drop pin banks references on error paths remoteproc: Fix count check in rproc_coredump_write() f2fs: fix to do sanity check on .cp_pack_total_block_count f2fs: quota: fix loop condition at f2fs_quota_sync() f2fs: fix to unlock page correctly in error path of is_alive() NFSD: prevent integer overflow on 32 bit systems NFSD: prevent underflow in nfssvc_decode_writeargs() SUNRPC: avoid race between mod_timer() and del_timer_sync() HID: intel-ish-hid: Use dma_alloc_coherent for firmware update firmware: stratix10-svc: add missing callback parameter on RSU Documentation: update stable tree link Documentation: add link to stable release candidate tree KEYS: fix length validation in keyctl_pkey_params_get_2() clk: uniphier: Fix fixed-rate initialization greybus: svc: fix an error handling bug in gb_svc_hello() iio: inkern: make a best effort on offset calculation iio: inkern: apply consumer scale when no channel scale is available iio: inkern: apply consumer scale on IIO_VAL_INT cases iio: afe: rescale: use s64 for temporary scale calculations coresight: Fix TRCCONFIGR.QE sysfs interface mei: avoid iterator usage outside of list_for_each_entry mei: me: add Alder Lake N device id. xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx() xhci: make xhci_handshake timeout for xhci_reset() adjustable xhci: fix runtime PM imbalance in USB2 resume xhci: fix garbage USBSTS being logged in some cases USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c virtio-blk: Use blk_validate_block_size() to validate block size tpm: fix reference counting for struct tpm_chip iommu/iova: Improve 32-bit free space estimate locking/lockdep: Avoid potential access of invalid memory in lock_class net: dsa: microchip: add spi_device_id tables Input: zinitix - do not report shadow fingers spi: Fix erroneous sgs value with min_t() Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)" net:mcf8390: Use platform_get_irq() to get the interrupt spi: Fix invalid sgs value gpio: Revert regression in sysfs-gpio (gpiolib.c) ethernet: sun: Free the coherent when failing in probing tools/virtio: fix virtio_test execution vdpa/mlx5: should verify CTRL_VQ feature exists for MQ virtio_console: break out of buf poll on remove ARM: mstar: Select HAVE_ARM_ARCH_TIMER xfrm: fix tunnel model fragmentation behavior HID: logitech-dj: add new lightspeed receiver id hv: utils: add PTP_1588_CLOCK to Kconfig to fix build USB: serial: simple: add Nokia phone driver USB: serial: pl2303: add IBM device IDs already merged(30) arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory zones can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path KVM: x86/mmu: do compare-and-exchange of gPTE via the user address ubi: fastmap: Return error code if memory allocation fails in add_aeb() ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl net: hns3: fix software vlan talbe of vlan 0 inconsistent with hardware can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path ubifs: rename_whiteout: correct old_dir size computing ubifs: Fix to add refcount once page is set private ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() ubifs: setflags: Make dirtied_ino_d 8 bytes aligned ubifs: Add missing iput if do_tmpfile() failed in rename whiteout ubifs: Fix deadlock in concurrent rename whiteout and inode writeback ubifs: rename_whiteout: Fix double free for whiteout_ui->data bfq: fix use-after-free in bfq_dispatch_request net/x25: Fix null-ptr-deref caused by x25_disconnect net: hns3: fix bug when PF set the duplicate MAC address for VFs livepatch: Fix build failure on 32 bits processors bcache: fixup multiple threads crash drivers: hamradio: 6pack: fix UAF bug caused by mod_timer() jffs2: fix memory leak in jffs2_scan_medium jffs2: fix memory leak in jffs2_do_mount_fs jffs2: fix use-after-free in jffs2_clear_xattr_subsystem can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register netdevice: add the case if dev is NULL swiotlb: fix info leak with DMA_FROM_DEVICE block, bfq: don't move oom_bfqq drm/i915/opregion: check port number bounds for SWSCI display power state kabi conflict(8) PCI: Reduce warnings on possible RW1C corruption qed: validate and restrict untrusted VFs vlan promisc mode block: don't merge across cgroup boundaries if blkcg is enabled rseq: Remove broken uapi field layout on 32-bit little endian coredump: Snapshot the vmas in do_coredump coredump: Use the vma snapshot in fill_files_note coredump/elf: Pass coredump_params into fill_note_info coredump: Remove the WARN_ON in dump_vma_snapshot all patches: 597 - 30 - 8 = 559 Aaron Conole (1): openvswitch: always update flow key after nat Aashish Sharma (1): dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS Abel Vesa (2): clk: imx7d: Remove audio_mclk_root_clk ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk Adrian Hunter (2): perf/core: Fix address filter parser for multiple filters perf/x86/intel/pt: Fix address filter config for 32-bit kernel Aharon Landau (1): RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR Akira Kawata (1): fs/binfmt_elf: Fix AT_PHDR for unusual ELF files Alan Stern (1): USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c Alexander Lobakin (2): i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb i40e: respect metadata on XSK Rx to skb Alexander Usyskin (2): mei: me: add Alder Lake N device id. mei: avoid iterator usage outside of list_for_each_entry Alexey Khoroshilov (1): NFS: remove unneeded check in decode_devicenotify_args() Alistair Delva (1): remoteproc: Fix count check in rproc_coredump_write() Alistair Popple (1): mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node Amadeusz Sławiński (1): ASoC: topology: Allow TLV control to be either read or write Amir Goldstein (1): nfsd: more robust allocation failure handling in nfsd_file_cache_init Ammar Faizi (1): ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM Anders Roxell (3): powerpc/lib/sstep: Fix 'sthcx' instruction powerpc/lib/sstep: Fix build errors with newer binutils powerpc: Fix build errors with newer binutils Andre Przywara (1): ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS Andreas Gruenbacher (1): powerpc/kvm: Fix kvm_use_magic_page Andrew Price (1): gfs2: Make sure FITRIM minlen is rounded up to fs block size Andy Shevchenko (3): spi: pxa2xx-pci: Balance reference count for PCI DMA device serial: 8250_mid: Balance reference count for PCI DMA device serial: 8250_lpss: Balance reference count for PCI DMA device Ang Tien Sung (1): firmware: stratix10-svc: add missing callback parameter on RSU Anssi Hannula (3): xhci: fix garbage USBSTS being logged in some cases xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx() hv_balloon: rate-limit "Unhandled message" warning Anton Ivanov (1): um: Fix uml_mconsole stop/go Ard Biesheuvel (1): ARM: ftrace: avoid redundant loads or clobbering IP Armin Wolf (1): hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING Arnd Bergmann (4): uaccess: fix nios2 and microblaze get_user_8() uaccess: fix type mismatch warnings from access_ok() lib/test_lockup: fix kernel pointer check for separate address spaces ARM: iop32x: offset IRQ numbers by 1 Arun Easi (2): scsi: qla2xxx: Fix device reconnect in loop topology scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests Arınç ÜNAL (5): staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree staging: mt7621-dts: fix formatting staging: mt7621-dts: fix pinctrl properties for ethernet staging: mt7621-dts: fix GB-PC2 devicetree staging: mt7621-dts: fix pinctrl-0 items to be size-1 items on ethernet Athira Rajeev (1): powerpc/perf: Don't use perf_hw_context for trace IMC PMU Bagas Sanjaya (2): Documentation: add link to stable release candidate tree Documentation: update stable tree link Bartosz Golaszewski (1): Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)" Bharata B Rao (1): sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa Biju Das (2): spi: Fix invalid sgs value spi: Fix erroneous sgs value with min_t() Bikash Hazarika (1): scsi: qla2xxx: Fix wrong FDMI data for 64G adapter Bjorn Helgaas (1): PCI: Avoid broken MSI on SB600 USB devices Brandon Wyman (1): hwmon: (pmbus) Add Vin unit off handling Casey Schaufler (2): LSM: general protection fault in legacy_parse_param Fix incorrect type in assignment of ipv6 port for audit Chaitanya Kulkarni (1): loop: use sysfs_emit() in the sysfs xxx show() Chao Yu (6): f2fs: fix to unlock page correctly in error path of is_alive() f2fs: fix to do sanity check on .cp_pack_total_block_count f2fs: fix to enable ATGC correctly via gc_idle sysfs interface f2fs: fix to avoid potential deadlock f2fs: fix to do sanity check on curseg->alloc_type f2fs: compress: fix to print raw data size in error path of lz4 decompression Charan Teja Kalla (3): mm: madvise: skip unmapped vma holes passed to process_madvise mm: madvise: return correct bytes advised with process_madvise Revert "mm: madvise: skip unmapped vma holes passed to process_madvise" Charles Keepax (1): ASoC: madera: Add dependencies on MFD Chen Jingwen (1): powerpc/kasan: Fix early region not updated correctly Chen-Yu Tsai (7): media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls media: hantro: Fix overfill bottom register field name pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get() pinctrl: mediatek: paris: Fix pingroup pin config state readback pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual GPIOs pinctrl: pinconf-generic: Print arguments for bias-pull-* Chris Leech (1): nvme-tcp: lockdep: annotate in-kernel sockets Christian Göttsche (2): selinux: check return value of sel_make_avc_files selinux: use correct type for context length Christoph Hellwig (1): nvme: cleanup __nvme_check_ids Christophe JAILLET (4): firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is not defined gpu: host1x: Fix a memory leak in 'host1x_remove()' fsi: Aspeed: Fix a potential double free misc: alcor_pci: Fix an error handling path Chuck Lever (1): NFSD: Fix nfsd_breaker_owns_lease() return values Claudiu Beznea (3): net: dsa: microchip: add spi_device_id tables hwrng: atmel - disable trng on failure path clocksource/drivers/timer-microchip-pit64b: Use notrace Codrin Ciubotariu (2): ASoC: dmaengine: do not use a NULL prepare_slave_config() callback clk: at91: sama7g5: fix parents of PDMCs' GCLK Colin Ian King (2): carl9170: fix missing bit-wise or operator for tx_params iwlwifi: Fix -EIO error code that is never returned Cooper Chiou (1): drm/edid: check basic audio support on CEA extension block Corentin Labbe (8): crypto: sun8i-ss - really disable hash on A80 crypto: rockchip - ECB does not need IV crypto: sun8i-ss - call finalize with bh disabled crypto: sun8i-ce - call finalize with bh disabled crypto: amlogic - call finalize with bh disabled media: staging: media: zoran: fix usage of vb2_dma_contig_set_max_seg_size media: staging: media: zoran: move videodev alloc media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com Dafna Hirschfeld (1): media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED Damien Le Moal (11): scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands scsi: pm8001: Fix command initialization in pm80XX_send_read_log() scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config() scsi: pm8001: Fix le32 values handling in pm80xx_set_sas_protocol_timer_config() scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update() scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req() scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req() scsi: pm8001: Fix NCQ NON DATA command task initialization scsi: pm8001: Fix NCQ NON DATA command completion handling scsi: pm8001: Fix abort all task initialization Dan Carpenter (9): greybus: svc: fix an error handling bug in gb_svc_hello() NFSD: prevent underflow in nfssvc_decode_writeargs() NFSD: prevent integer overflow on 32 bit systems video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() media: usb: go7007: s2250-board: fix leak in probe() iwlwifi: mvm: Fix an error code in iwl_mvm_up() USB: storage: ums-realtek: fix error code in rts51x_read_mem() lib/test: use after free in register_test_dev_kmod() Dan Williams (1): nvdimm/region: Fix default alignment for small regions Daniel González Cabanelas (1): media: cx88-mpeg: clear interrupt status register before streaming video Daniel Henrique Barboza (1): powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties() Daniel Palmer (1): ARM: mstar: Select HAVE_ARM_ARCH_TIMER Daniel Thompson (2): soc: qcom: aoss: remove spurious IRQF_ONESHOT flags kdb: Fix the putarea helper function Dario Binacchi (1): mtd: rawnand: gpmi: fix controller timings setting Darren Hart (1): ACPI/APEI: Limit printable size of BERT table data Dave Stevenson (1): regulator: rpi-panel: Handle I2C errors/timing to the Atmel David Engraf (1): arm64: signal: nofpsimd: Do not allocate fp/simd context when not available David Gow (1): firmware: google: Properly state IOMEM dependency David Heidelberg (2): arm64: dts: qcom: sdm845: fix microphone bias properties and values ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 David Howells (3): watch_queue: Fix NULL dereference in error cleanup watch_queue: Actually free the watch rxrpc: Fix call timer start racing with call destruction David Matlack (1): KVM: Prevent module exit until all VMs are freed Dirk Buchwalder (1): clk: qcom: ipq8074: Use floor ops for SDCC1 clock Dirk Müller (1): lib/raid6/test: fix multiple definition linking error Dmitry Baryshkov (3): drm/msm/dpu: add DSPP blocks teardown drm/msm/dpu: fix dp audio condition PM: core: keep irq flags in device_pm_check_callbacks() Dmitry Torokhov (1): HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports Dmitry Vyukov (1): riscv: Increase stack size under KASAN Dongliang Mu (3): media: em28xx: initialize refcount before kref_get ntfs: add sanity check on allocation size media: hdpvr: initialize dev->worker at hdpvr_register_videodev Drew Fustini (1): clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix Dāvis Mosāns (1): crypto: ccp - ccp_dmaengine_unregister release dma channels Eddie James (1): USB: serial: pl2303: add IBM device IDs Eric Biggers (6): KEYS: fix length validation in keyctl_pkey_params_get_2() crypto: rsa-pkcs1pad - only allow with rsa crypto: rsa-pkcs1pad - correctly get hash from source scatterlist crypto: rsa-pkcs1pad - restore signature length check crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() block: don't delete queue kobject before its children Eric Dumazet (2): rseq: Optimise rseq_get_rseq_cs() and clear_rseq_cs() watch_queue: Free the page array when watch_queue is dismantled Evgeny Novikov (1): video: fbdev: w100fb: Reset global state Fabiano Rosas (2): KVM: PPC: Fix vmx/vsx mixup in mmio emulation KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init Fangrui Song (1): riscv module: remove (NOLOAD) Felix Maurer (1): selftests/bpf: Make test_lwt_ip_encap more stable and faster Fengnan Chang (2): f2fs: compress: remove unneeded read when rewrite whole cluster f2fs: fix compressed file start atomic write may cause data corruption Filipe Manana (1): btrfs: fix unexpected error path when reflinking an inline extent Florian Fainelli (1): net: phy: broadcom: Fix brcm_fet_config_init() Frank Wunderlich (1): arm64: dts: broadcom: Fix sata nodename Geert Uytterhoeven (3): hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel pinctrl: renesas: checker: Fix miscalculation of number of states George Kennedy (1): video: fbdev: cirrusfb: check pixclock to avoid divide by zero Gilad Ben-Yossef (1): crypto: ccree - don't attempt 0 len DMA mappings Guilherme G. Piccoli (1): docs: sysctl/kernel: add missing bit to panic_print Guillaume Nault (1): ipv4: Fix route lookups when handling ICMP redirects and PMTU updates Guillaume Ranquet (1): clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_init() Guillaume Tucker (1): selftests, x86: fix how check_cc.sh is being invoked Gwendal Grignou (2): HID: intel-ish-hid: Use dma_alloc_coherent for firmware update platform: chrome: Split trace include file Hangbin Liu (2): bareudp: use ipv6_mod_enabled to check if IPv6 enabled selftests/bpf/test_lirc_mode2.sh: Exit with proper code Hangyu Hua (1): powerpc: 8xx: fix a return value error in mpc8xx_pic_init Hans Verkuil (2): ivtv: fix incorrect device_caps for ivtvfb media: staging: media: zoran: fix various V4L2 compliance errors Hans de Goede (3): power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return iio: mma8452: Fix probe failing when an i2c_device_id is used media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator off on some boards Hector Martin (4): brcmfmac: firmware: Allocate space for default boardrev in nvram brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio brcmfmac: pcie: Fix crashes due to early IRQs Helge Deller (1): video: fbdev: sm712fb: Fix crash in smtcfb_read() Hengqi Chen (1): bpf: Fix comment for helper bpf_current_task_under_cgroup() Henry Lin (1): xhci: fix runtime PM imbalance in USB2 resume Herbert Xu (2): crypto: authenc - Fix sleep in atomic context in decrypt_tail crypto: arm/aes-neonbs-cbc - Select generic cbc and aes Hoang Le (1): tipc: fix the timer expires after interval 100ms Hou Tao (2): bpf, arm64: Call build_prologue() first in first JIT pass bpf, arm64: Feed byte-offset into bpf line info Hou Wenlong (1): KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() Hugh Dickins (1): mempolicy: mbind_range() set_policy() after vma_merge() Håkon Bugge (1): IB/cma: Allow XRC INI QPs to set their local ACK timeout Ido Schimmel (1): selftests: test_vxlan_under_vrf: Fix broken test case Ilpo Järvinen (1): serial: 8250: fix XOFF/XON sending when DMA is used Jaegeuk Kim (1): f2fs: fix missing free nid in f2fs_handle_failed_inode Jagan Teki (1): drm: bridge: adv7511: Fix ADV7535 HPD enablement Jakob Koschel (2): media: saa7134: fix incorrect use to determine if list is empty powerpc/sysdev: fix incorrect use to determine if list is empty Jakub Kicinski (1): tcp: ensure PMTU updates are processed during fastopen Jakub Sitnicki (1): selftests/bpf: Fix error reporting from sock_fields programs James Clark (1): coresight: Fix TRCCONFIGR.QE sysfs interface Jammy Huang (1): media: aspeed: Correct value for h-total-pixels Jann Horn (2): coredump: Also dump first pages of non-executable ELF libraries pstore: Don't use semaphores in always-atomic-context code Jason A. Donenfeld (2): wireguard: queueing: use CFI-safe ptr_ring cleanup function wireguard: socket: ignore v6 endpoints when ipv6 is disabled Jens Axboe (1): io_uring: terminate manual loop iterator loop correctly for non-vecs Jeremy Linton (1): net: bcmgenet: Use stronger register read/writes to assure ordering Jernej Skrabec (2): media: cedrus: H265: Fix neighbour info buffer size media: cedrus: h264: Fix neighbour info buffer size Jia-Ju Bai (3): ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp() memory: emif: check the pointer temp in get_device_details() platform/x86: huawei-wmi: check the return value of device_create_file() Jianglei Nie (1): crypto: ccree - Fix use after free in cc_cipher_exit() Jianyong Wu (1): arm64/mm: avoid fixmap race condition when create pud mapping Jiasheng Jiang (26): thermal: int340x: Check for NULL after calling kmemdup() spi: spi-zynqmp-gqspi: Handle error for dma_set_mask media: mtk-vcodec: potential dereference of null pointer media: meson: vdec: potential dereference of null pointer soc: qcom: rpmpd: Check for null return of devm_kcalloc ASoC: ti: davinci-i2s: Add check for clk_enable() ALSA: spi: Add check for clk_enable() ASoC: mxs-saif: Handle errors for clk_enable ASoC: atmel_ssc_dai: Handle errors for clk_enable ASoC: dwc-i2s: Handle errors for clk_enable ASoC: soc-compress: prevent the potentially use of null pointer memory: emif: Add check for setup_interrupts media: vidtv: Check for null return of vzalloc ASoC: wm8350: Handle error for wm8350_register_irq ASoC: fsi: Add check for clk_enable mmc: davinci_mmc: Handle error for clk_enable drm/panfrost: Check for error num after setting mask mtd: onenand: Check for error irq ray_cs: Check ioremap return value iommu/ipmmu-vmsa: Check for error num after setting mask power: supply: wm8350-power: Handle error for wm8350_register_irq power: supply: wm8350-power: Add missing free in free_charger_irq mfd: mc13xxx: Add check for mc13xxx_irq_request iio: adc: Add check for devm_request_threaded_irq habanalabs: Add check for pci_enable_device ASoC: soc-compress: Change the check for codec_dai Jiaxin Yu (1): ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs Jie Hai (1): dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma Jing Yao (3): video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit Jiri Slaby (1): mxser: fix xmit_buf leak in activate when LSR == 0xff Jocelyn Falempe (1): mgag200 fix memmapsl configuration in GCTL6 register Joe Carnuccio (2): scsi: qla2xxx: Add devids and conditionals for 28xx scsi: qla2xxx: Check for firmware dump already collected Johan Hovold (3): USB: serial: simple: add Nokia phone driver media: davinci: vpif: fix unbalanced runtime PM get media: davinci: vpif: fix unbalanced runtime PM enable John David Anglin (1): parisc: Fix handling off probe non-access faults Jonathan Cameron (1): staging:iio:adc:ad7280a: Fix handing of device address bit reversing. Jonathan Neuschäfer (5): clk: actions: Terminate clk_div_table with sentinel element clk: loongson1: Terminate clk_div_table with sentinel element clk: clps711x: Terminate clk_div_table with sentinel element pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR() pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE() José Expósito (1): Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" Juergen Gross (1): xen: fix is_xen_pmu() Juhyung Park (1): f2fs: quota: fix loop condition at f2fs_quota_sync() Kai-Heng Feng (1): ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 Kees Cook (2): exec: Force single empty string when argv is empty gcc-plugins/stackleak: Exactly match strings instead of prefixes Konrad Dybcio (1): clk: qcom: gcc-msm8994: Fix gpll4 width Krzysztof Kozlowski (5): pinctrl: samsung: drop pin banks references on error paths ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5420 clocksource/drivers/exynos_mct: Handle DTS with higher number of interrupts Kuan-Ying Lee (1): mm/kmemleak: reset tag when compare object pointer Kuldeep Singh (3): arm64: dts: ns2: Fix spi-cpol and spi-cpha property ARM: dts: spear1340: Update serial node properties ARM: dts: spear13xx: Update SPI dma properties Kunihiko Hayashi (1): clk: uniphier: Fix fixed-rate initialization Kuogee Hsieh (1): drm/msm/dp: populate connector of struct dp_panel Lars Ellenberg (1): drbd: fix potential silent data corruption Li RongQing (1): KVM: x86: fix sending PV IPI Liam Beguin (4): iio: afe: rescale: use s64 for temporary scale calculations iio: inkern: apply consumer scale on IIO_VAL_INT cases iio: inkern: apply consumer scale when no channel scale is available iio: inkern: make a best effort on offset calculation Libin Yang (1): soundwire: intel: fix wrong register name in intel_shim_wake Liguang Zhang (1): PCI: pciehp: Clear cmd_busy bit in polling mode Lina Wang (1): xfrm: fix tunnel model fragmentation behavior Lino Sanfilippo (1): tpm: fix reference counting for struct tpm_chip Linus Torvalds (2): fs: fd tables have to be multiples of BITS_PER_LONG fs: fix fd table size alignment properly Linus Walleij (1): Input: zinitix - do not report shadow fingers Liu Ying (1): phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure}) Lorenzo Bianconi (4): mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in sta mode mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update Luca Weiss (1): cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse Lucas Tanure (1): i2c: meson: Fix wrong speed use from probe Lucas Zampieri (1): HID: logitech-dj: add new lightspeed receiver id Lv Ruyi (1): proc: bootconfig: Add null pointer check Maciej W. Rozycki (1): DEC: Limit PMAX memory probing to R3k systems Manish Chopra (1): qed: display VF trust config Manish Rangankar (1): scsi: qla2xxx: Use correct feature type field during RFF_ID processing Maor Gottlieb (1): RDMA/core: Set MR type in ib_reg_user_mr Marc Kleine-Budde (1): can: m_can: m_can_tx_handler(): fix use after free of skb Marc Zyngier (4): PCI: xgene: Revert "PCI: xgene: Fix IB window setup" pinctrl: npcm: Fix broken references to chip->parent_device irqchip/qcom-pdc: Fix broken locking PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup" Marcel Ziswiler (1): arm64: defconfig: build imx-sdma as a module Marcelo Roberto Jimenez (1): gpio: Revert regression in sysfs-gpio (gpiolib.c) Marek Szyprowski (1): clocksource/drivers/exynos_mct: Refactor resources allocation Marek Vasut (1): ARM: dts: imx: Add missing LVDS decoder on M53Menlo Marijn Suijten (1): firmware: qcom: scm: Remove reassignment to desc following initializer Martin Blumenstingl (1): drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops Martin Varghese (1): openvswitch: Fixed nd target mask field in the flow dump. Mastan Katragadda (1): drm/i915/gem: add missing boundary check in vm_access Mathias Nyman (1): xhci: make xhci_handshake timeout for xhci_reset() adjustable Matt Kramer (1): ALSA: hda/realtek: Add alc256-samsung-headphone fixup Matthew Wilcox (Oracle) (2): XArray: Fix xas_create_range() when multi-order entry present XArray: Update the LRU list in xas_split() Maulik Shah (1): arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc Mauro Carvalho Chehab (1): media: atomisp: fix bad usage at error handling logic Max Filippov (2): xtensa: fix stop_machine_cpuslocked call in patch_text xtensa: fix xtensa_wsr always writing 0 Maxim Kiselev (1): powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch Maxime Ripard (2): drm/edid: Don't clear formats if using deep color clk: Initialize orphan req_rate Maíra Canal (1): drm/amd/display: Remove vupdate_int_entry definition Miaoqian Lin (31): spi: tegra114: Add missing IRQ check in tegra_spi_probe hwrng: nomadik - Change clk_disable to clk_disable_unprepare media: coda: Fix missing put_device() call in coda_get_vdoa_data soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in rockchip_i2s_probe ASoC: SOF: Add missing of_node_put() in imx8m_probe ASoC: mxs: Fix error handling in mxs_sgtl5000_probe ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digital_probe ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init drm/tegra: Fix reference leak in tegra_dsi_ganged_probe ath10k: Fix error handling in ath10k_setup_msa_resources mips: cdmm: Fix refcount leak in mips_cdmm_phys_base mfd: asic3: Add missing iounmap() on error asic3_mfd_probe remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function Michael Ellerman (1): powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit Michael S. Tsirkin (1): virtio_console: break out of buf poll on remove Michael Schmitz (1): video: fbdev: atari: Atari 2 bpp (STe) palette bugfix Mike Marciniszyn (1): IB/hfi1: Allow larger MTU without AIP Mikulas Patocka (1): dm integrity: set journal entry unused when shrinking device Minghao Chi (1): spi: tegra20: Use of_device_get_match_data() Minghao Chi (CGEL ZTE) (1): net:mcf8390: Use platform_get_irq() to get the interrupt Miquel Raynal (4): spi: mxic: Fix the transmit path dt-bindings: mtd: nand-controller: Fix the reg property description dt-bindings: mtd: nand-controller: Fix a comment in the examples dt-bindings: spi: mxic: The interrupt property is not mandatory Mohan Kumar (1): ALSA: hda: Avoid unsol event during RPM suspending Muhammad Usama Anjum (1): selftests/x86: Add validity check and allow field splitting Namhyung Kim (1): bpf: Adjust BPF stack helper functions to accommodate skip > 0 Neil Armstrong (1): drm/bridge: dw-hdmi: use safe format when first in bridge chain NeilBrown (1): SUNRPC: avoid race between mod_timer() and del_timer_sync() Niels Dossche (1): Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed Nikita Shubin (1): riscv: Fix fill_callchain return value Niklas Söderlund (1): samples/bpf, xdpsock: Fix race when running for fix duration of time Nilesh Javali (1): scsi: qla2xxx: Fix warning for missing error code Nishanth Menon (4): arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt Olga Kornievskaia (1): NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error Oliver Hartkopp (5): can: isotp: sanitize CAN ID checks in isotp_bind() vxcan: enable local echo for sent CAN frames can: isotp: return -EADDRNOTAVAIL when reading from unbound socket can: isotp: support MSG_TRUNC flag when reading from socket can: isotp: restore accidentally removed MSG_PEEK feature Ondrej Zary (1): media: bttv: fix WARNING regression on tunerless devices Pablo Neira Ayuso (1): netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options Pali Rohár (1): PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge Paolo Valente (1): Revert "Revert "block, bfq: honor already-setup queue merges"" Patrick Rudolph (1): hwmon: (pmbus) Add mutex to regulator ops Paul Kocialkowski (1): ARM: dts: sun8i: v3s: Move the csi1 block to follow address order Paul Menzel (1): lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3 Paulo Alcantara (2): cifs: prevent bad output lengths in smb2_ioctl_query_info() cifs: fix NULL ptr dereference in smb2_ioctl_query_info() Pavel Begunkov (1): io_uring: fix memory leak of uid in files registration Pavel Kubelun (1): ARM: dts: qcom: ipq4019: fix sleep clock Pavel Skripkin (6): udmabuf: validate ubuf->pagecount Bluetooth: hci_serdev: call init_rwsem() before p->open() ath9k_htc: fix uninit value bugs jfs: fix divide error in dbNextAG media: Revert "media: em28xx: add missing em28xx_close_extension" can: mcba_usb: properly check endpoint type Peiwei Hu (1): media: ir_toy: free before error exiting Pekka Pessi (1): mailbox: tegra-hsp: Flush whole channel Peng Liu (1): kunit: make kunit_test_timeout compatible with comment Peter Rosin (1): i2c: mux: demux-pinctrl: do not deactivate a master that is not active Petr Machata (1): af_netlink: Fix shift out of bounds in group mask calculation Petr Vorel (1): crypto: vmx - add missing dependencies Pierre-Louis Bossart (1): ASoC: generic: simple-card-utils: remove useless assignment Prashant Malani (1): platform/chrome: cros_ec_typec: Check for EC device Qais Yousef (1): sched/core: Export pelt_thermal_tp Quinn Tran (7): scsi: qla2xxx: Fix stuck session in gpdb scsi: qla2xxx: Fix scheduling while atomic scsi: qla2xxx: Fix disk failure to rediscover scsi: qla2xxx: Fix incorrect reporting of task management failure scsi: qla2xxx: Fix hang due to session stuck scsi: qla2xxx: Fix N2N inconsistent PLOGI scsi: qla2xxx: Reduce false trigger to login Rafael J. Wysocki (2): ACPICA: Avoid walking the ACPI Namespace if it is not there ACPI: CPPC: Avoid out of bounds access when parsing _CPC data Randy Dunlap (20): hv: utils: add PTP_1588_CLOCK to Kconfig to fix build EVM: fix the evm= __setup handler return value PM: hibernate: fix __setup handler error handling PM: suspend: fix return value of __setup handler ACPI: APEI: fix return value of __setup handlers clocksource: acpi_pm: fix return value of __setup handler printk: fix return value of printk.devkmsg __setup handler m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined TOMOYO: fix __setup handlers return values mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n MIPS: RB532: fix return value of __setup handler dma-debug: fix return value of __setup handlers tty: hvc: fix return value of __setup handler kgdboc: fix return value of __setup handler kgdbts: fix return value of __setup handler driver core: dd: fix return value of __setup handler mm/mmap: return 1 from stack_guard_gap __setup() handler ARM: 9187/1: JIVE: fix return value of __setup handler mm/memcontrol: return 1 from cgroup.memory __setup() handler mm/usercopy: return 1 from hardened_usercopy __setup() handler Richard Guy Briggs (1): audit: log AUDIT_TIME_* records only from rules Richard Haines (1): selinux: allow FIOCLEX and FIONCLEX with policy capability Richard Leitner (1): ARM: tegra: tamonten: Fix I2C3 pad setting Richard Schleich (2): ARM: dts: bcm2837: Add the missing L1/L2 cache information ARM: dts: bcm2711: Add the missing L1/L2 cache information Rik van Riel (2): mm: invalidate hwpoison page cache page in fault path mm,hwpoison: unmap poisoned page before invalidation Ritesh Harjani (3): ext4: fix ext4_fc_stats trace point ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit Rob Herring (1): arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly Robert Hancock (3): ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting i2c: xiic: Make bus names unique net: axienet: fix RX ring refill allocation failure handling Robert Marko (1): clk: qcom: ipq8074: fix PCI-E clock oops Robin Gong (1): mailbox: imx: fix wakeup failure from freeze mode Robin Murphy (1): iommu/iova: Improve 32-bit free space estimate Roman Li (1): drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug Sakari Ailus (1): ACPI: properties: Consistently return -ENOENT if there are no more references Sam Ravnborg (1): video: fbdev: controlfb: Fix set but not used warnings Saurav Kashyap (1): scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() Sean Christopherson (1): KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP MMU Sean Nyekjaer (1): mtd: rawnand: protect access to rawnand devices while in suspend Sean Young (1): media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC Shannon Nelson (1): ionic: fix type complaint in ionic_dev_cmd_clean() Shengjiu Wang (2): ASoC: fsl_spdif: Disable TX clock when stop ASoC: soc-core: skip zero num_dai component in searching dai name Shin'ichiro Kawasaki (1): block: limit request dispatch loop duration Si-Wei Liu (1): vdpa/mlx5: should verify CTRL_VQ feature exists for MQ Souptick Joarder (HPE) (1): irqchip/nvic: Release nvic_base upon failure Srinivas Kandagatla (1): ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put Srinivas Pandruvada (1): thermal: int340x: Increase bitmap size Stefano Garzarella (1): tools/virtio: fix virtio_test execution Sunil Goutham (1): hwrng: cavium - Check health status while reading random data Sven Eckelmann (1): batman-adv: Check ptr for NULL before reducing its refcnt Takashi Iwai (1): ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock Takashi Sakamoto (1): ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction Taniya Das (2): clk: qcom: clk-rcg2: Update logic to calculate D value for RCG clk: qcom: clk-rcg2: Update the frac table for pixel clock Theodore Ts'o (1): ext4: don't BUG if someone dirty pages without asking ext4 first Thomas Bracht Laumann Jespersen (1): scripts/dtc: Call pkg-config POSIXly correct Tim Gardner (1): video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow Tobias Waldekranz (1): net: dsa: mv88e6xxx: Enable port policy support on 6097 Tom Rix (5): media: video/hdmi: handle short reads of hdmi info frame. drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function qlcnic: dcb: default to returning -EOPNOTSUPP can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value rtc: check if __rtc_read_time was successful Tomas Paukrt (1): crypto: mxs-dcp - Fix scatterlist processing Tong Zhang (1): dax: make sure inodes are flushed before destroy cache Trond Myklebust (3): NFS: Use of mapping_set_error() results in spurious errors NFS: Return valid errors from nfs2/3_decode_dirent() NFSv4/pNFS: Fix another issue with a list iterator pointing to the head Tsuchiya Yuto (1): media: atomisp: fix dummy_ptr check to avoid duplicate active_bo Tudor Ambarus (1): ARM: dts: at91: sama5d2: Fix PMERRLOC resource size Ulf Hansson (1): mmc: host: Return an error when ->enable_sdio_irq() ops is missing Uwe Kleine-König (5): vfio: platform: simplify device removal amba: Make the remove callback return void pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add() serial: 8250: Fix race condition in RTS-after-send handling ARM: mmp: Fix failure to remove sram device Vitaly Kuznetsov (1): KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated Vladimir Oltean (1): net: enetc: report software timestamping via SO_TIMESTAMPING Waiman Long (2): locking/lockdep: Avoid potential access of invalid memory in lock_class locking/lockdep: Iterate lock_classes directly when reading lockdep files Wang Hai (2): video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() wireguard: socket: free skb in send6 when ipv6 is disabled Wang Wensheng (1): ASoC: imx-es8328: Fix error return code in imx_es8328_probe() Wang Yufen (3): bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full bpf, sockmap: Fix more uncharged while msg has more_data bpf, sockmap: Fix double uncharge the mem of sk_msg Wen Gong (1): ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern Xiang Chen (1): scsi: hisi_sas: Change permission of parameter prot_mask Xiaomeng Tong (2): ALSA: cs4236: fix an incorrect NULL check on list iterator net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator Xie Yongji (1): virtio-blk: Use blk_validate_block_size() to validate block size Xin Long (1): udp: call udp_encap_enable for v6 sockets when enabling encap Xin Xiong (1): mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init Xu Kuohai (1): libbpf: Skip forward declaration when counting duplicated type names Yafang Shao (1): libbpf: Fix possible NULL pointer dereference when destroying skeleton Yake Yang (1): Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt Yaliang Wang (1): MIPS: pgalloc: fix memory leak caused by pgd_free() Yang Guang (1): video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit Yang Yingliang (3): media: saa7134: convert list_for_each to entry variant ASoC: rockchip: i2s: Use devm_platform_get_and_ioremap_resource() ASoC: atmel: sam9x5_wm8731: use devm_snd_soc_register_card() Yangtao Li (1): fsi: aspeed: convert to devm_platform_ioremap_resource Ye Bin (1): ext4: fix fs corruption when tring to remove a non-empty directory with IO error Yi Wang (1): KVM: SVM: fix panic on out-of-bounds guest IRQ Yiqing Yao (1): drm/amd/pm: enable pm sysfs write for one VF mode Yongzhi Liu (1): RDMA/mlx5: Fix memory leak in error flow for subscribe event routine YueHaibing (1): video: fbdev: controlfb: Fix COMPILE_TEST build Z. Liu (1): video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen Zhang Yi (1): ext2: correct max file size computing Zhenzhong Duan (1): KVM: x86: Fix emulation in writing cr8 Zheyu Ma (2): ethernet: sun: Free the coherent when failing in probing video: fbdev: sm712fb: Fix crash in smtcfb_write() Zhou Qingyang (2): drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl() drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() kernel test robot (1): regulator: qcom_smd: fix for_each_child.cocci warnings lic121 (1): libbpf: Unmap rings when umem deleted Documentation/admin-guide/sysctl/kernel.rst | 1 + .../bindings/mtd/nand-controller.yaml | 4 +- .../devicetree/bindings/spi/spi-mxic.txt | 4 +- Documentation/process/stable-kernel-rules.rst | 11 +- Documentation/sound/hd-audio/models.rst | 4 + arch/arc/kernel/process.c | 2 +- arch/arm/boot/dts/bcm2711.dtsi | 50 +++++ arch/arm/boot/dts/bcm2837.dtsi | 49 ++++ arch/arm/boot/dts/dra7-l4.dtsi | 5 +- arch/arm/boot/dts/dra7.dtsi | 8 +- arch/arm/boot/dts/exynos5250-pinctrl.dtsi | 2 +- arch/arm/boot/dts/exynos5250-smdk5250.dts | 3 + arch/arm/boot/dts/exynos5420-smdk5420.dts | 3 + arch/arm/boot/dts/imx53-m53menlo.dts | 29 ++- arch/arm/boot/dts/imx7-colibri.dtsi | 4 +- arch/arm/boot/dts/imx7-mba7.dtsi | 2 +- arch/arm/boot/dts/imx7d-nitrogen7.dts | 2 +- arch/arm/boot/dts/imx7d-pico-hobbit.dts | 4 +- arch/arm/boot/dts/imx7d-pico-pi.dts | 4 +- arch/arm/boot/dts/imx7d-sdb.dts | 4 +- arch/arm/boot/dts/imx7s-warp.dts | 4 +- arch/arm/boot/dts/qcom-ipq4019.dtsi | 3 +- arch/arm/boot/dts/qcom-msm8960.dtsi | 8 +- arch/arm/boot/dts/sama5d2.dtsi | 2 +- arch/arm/boot/dts/spear1340.dtsi | 6 +- arch/arm/boot/dts/spear13xx.dtsi | 6 +- arch/arm/boot/dts/sun8i-v3s.dtsi | 22 +- arch/arm/boot/dts/tegra20-tamonten.dtsi | 6 +- arch/arm/configs/multi_v5_defconfig | 1 + arch/arm/crypto/Kconfig | 2 + arch/arm/kernel/entry-ftrace.S | 51 ++--- arch/arm/kernel/swp_emulate.c | 2 +- arch/arm/kernel/traps.c | 2 +- .../mach-iop32x/include/mach/entry-macro.S | 2 +- arch/arm/mach-iop32x/include/mach/irqs.h | 2 +- arch/arm/mach-iop32x/irq.c | 6 +- arch/arm/mach-iop32x/irqs.h | 60 ++--- arch/arm/mach-mmp/sram.c | 22 +- arch/arm/mach-mstar/Kconfig | 1 + arch/arm/mach-s3c/mach-jive.c | 6 +- .../boot/dts/broadcom/northstar2/ns2-svk.dts | 8 +- .../boot/dts/broadcom/northstar2/ns2.dtsi | 2 +- arch/arm64/boot/dts/qcom/sdm845.dtsi | 8 +- arch/arm64/boot/dts/qcom/sm8150.dtsi | 6 +- .../boot/dts/rockchip/rk3399-firefly.dts | 4 +- arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 5 +- arch/arm64/boot/dts/ti/k3-am65.dtsi | 1 + arch/arm64/boot/dts/ti/k3-j7200-main.dtsi | 5 +- arch/arm64/boot/dts/ti/k3-j7200.dtsi | 1 + arch/arm64/boot/dts/ti/k3-j721e-main.dtsi | 5 +- arch/arm64/boot/dts/ti/k3-j721e.dtsi | 1 + arch/arm64/configs/defconfig | 2 +- arch/arm64/kernel/signal.c | 10 +- arch/arm64/mm/mmu.c | 9 + arch/arm64/net/bpf_jit_comp.c | 18 +- arch/csky/kernel/perf_callchain.c | 2 +- arch/csky/kernel/signal.c | 2 +- arch/m68k/coldfire/device.c | 6 +- arch/microblaze/include/asm/uaccess.h | 18 +- arch/mips/dec/int-handler.S | 6 +- arch/mips/dec/prom/Makefile | 2 +- arch/mips/dec/setup.c | 3 +- arch/mips/include/asm/dec/prom.h | 15 +- arch/mips/include/asm/pgalloc.h | 6 + arch/mips/rb532/devices.c | 6 +- arch/nios2/include/asm/uaccess.h | 26 ++- arch/nios2/kernel/signal.c | 20 +- arch/parisc/include/asm/traps.h | 1 + arch/parisc/kernel/traps.c | 2 + arch/parisc/mm/fault.c | 89 ++++++++ arch/powerpc/Makefile | 2 +- arch/powerpc/boot/dts/fsl/t1040rdb-rev-a.dts | 30 +++ arch/powerpc/boot/dts/fsl/t1040rdb.dts | 8 +- arch/powerpc/include/asm/io.h | 40 +++- arch/powerpc/include/asm/uaccess.h | 3 + arch/powerpc/kernel/kvm.c | 2 +- arch/powerpc/kvm/book3s_hv.c | 5 +- arch/powerpc/kvm/powerpc.c | 4 +- arch/powerpc/lib/sstep.c | 12 +- arch/powerpc/mm/kasan/kasan_init_32.c | 3 +- arch/powerpc/mm/numa.c | 4 +- arch/powerpc/perf/imc-pmu.c | 6 +- arch/powerpc/platforms/8xx/pic.c | 1 + arch/powerpc/platforms/powernv/rng.c | 6 +- arch/powerpc/sysdev/fsl_gtm.c | 4 +- arch/riscv/include/asm/module.lds.h | 6 +- arch/riscv/include/asm/thread_info.h | 10 +- arch/riscv/kernel/perf_callchain.c | 6 +- arch/sparc/kernel/signal_32.c | 2 +- arch/um/drivers/mconsole_kern.c | 3 +- arch/x86/events/intel/pt.c | 2 +- arch/x86/kernel/kvm.c | 2 +- arch/x86/kvm/emulate.c | 14 +- arch/x86/kvm/hyperv.c | 9 +- arch/x86/kvm/lapic.c | 5 +- arch/x86/kvm/mmu/tdp_mmu.c | 3 + arch/x86/kvm/svm/avic.c | 10 +- arch/x86/xen/pmu.c | 10 +- arch/x86/xen/pmu.h | 3 +- arch/x86/xen/smp_pv.c | 2 +- arch/xtensa/include/asm/processor.h | 4 +- arch/xtensa/kernel/jump_label.c | 2 +- block/bfq-iosched.c | 16 +- block/blk-mq-sched.c | 9 +- block/blk-sysfs.c | 8 +- crypto/authenc.c | 2 +- crypto/rsa-pkcs1pad.c | 11 +- drivers/acpi/acpica/nswalk.c | 3 + drivers/acpi/apei/bert.c | 10 +- drivers/acpi/apei/erst.c | 2 +- drivers/acpi/apei/hest.c | 2 +- drivers/acpi/cppc_acpi.c | 5 + drivers/acpi/property.c | 2 +- drivers/amba/bus.c | 5 +- drivers/base/dd.c | 2 +- drivers/base/power/main.c | 6 +- drivers/block/drbd/drbd_req.c | 3 +- drivers/block/loop.c | 10 +- drivers/block/virtio_blk.c | 12 +- drivers/bluetooth/btmtksdio.c | 4 +- drivers/bluetooth/hci_serdev.c | 3 +- drivers/bus/mips_cdmm.c | 1 + drivers/char/hw_random/Kconfig | 2 +- drivers/char/hw_random/atmel-rng.c | 1 + drivers/char/hw_random/cavium-rng-vf.c | 194 +++++++++++++++- drivers/char/hw_random/cavium-rng.c | 11 +- drivers/char/hw_random/nomadik-rng.c | 7 +- drivers/char/tpm/tpm-chip.c | 46 +--- drivers/char/tpm/tpm.h | 2 + drivers/char/tpm/tpm2-space.c | 65 ++++++ drivers/char/virtio_console.c | 7 + drivers/clk/actions/owl-s700.c | 1 + drivers/clk/actions/owl-s900.c | 2 +- drivers/clk/at91/sama7g5.c | 8 +- drivers/clk/clk-clps711x.c | 2 + drivers/clk/clk.c | 13 ++ drivers/clk/imx/clk-imx7d.c | 1 - drivers/clk/loongson1/clk-loongson1c.c | 1 + drivers/clk/qcom/clk-rcg2.c | 14 +- drivers/clk/qcom/gcc-ipq8074.c | 21 +- drivers/clk/qcom/gcc-msm8994.c | 1 + drivers/clk/tegra/clk-tegra124-emc.c | 1 + .../clk/uniphier/clk-uniphier-fixed-rate.c | 1 + drivers/clocksource/acpi_pm.c | 6 +- drivers/clocksource/exynos_mct.c | 60 +++-- drivers/clocksource/timer-microchip-pit64b.c | 2 +- drivers/clocksource/timer-of.c | 6 +- drivers/clocksource/timer-ti-dm-systimer.c | 4 +- drivers/cpufreq/qcom-cpufreq-nvmem.c | 2 +- .../allwinner/sun8i-ce/sun8i-ce-cipher.c | 3 + .../crypto/allwinner/sun8i-ce/sun8i-ce-hash.c | 3 + .../allwinner/sun8i-ss/sun8i-ss-cipher.c | 3 + .../crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 2 + .../crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 3 + drivers/crypto/amlogic/amlogic-gxl-cipher.c | 2 + drivers/crypto/ccp/ccp-dmaengine.c | 16 ++ drivers/crypto/ccree/cc_buffer_mgr.c | 7 + drivers/crypto/ccree/cc_cipher.c | 2 +- drivers/crypto/mxs-dcp.c | 2 +- .../crypto/rockchip/rk3288_crypto_skcipher.c | 1 - drivers/crypto/vmx/Kconfig | 4 + drivers/dax/super.c | 1 + drivers/dma-buf/udmabuf.c | 4 + drivers/dma/hisi_dma.c | 2 +- drivers/dma/pl330.c | 3 +- drivers/firmware/efi/efi-pstore.c | 2 +- drivers/firmware/google/Kconfig | 2 +- drivers/firmware/qcom_scm.c | 6 - drivers/firmware/stratix10-svc.c | 2 +- drivers/fsi/fsi-master-aspeed.c | 21 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 +- .../display/dc/irq/dcn21/irq_service_dcn21.c | 14 -- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 4 +- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 2 +- drivers/gpu/drm/bridge/adv7511/adv7511.h | 1 + drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 29 ++- drivers/gpu/drm/bridge/cdns-dsi.c | 1 + drivers/gpu/drm/bridge/nwl-dsi.c | 1 + drivers/gpu/drm/bridge/sil-sii8620.c | 2 +- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 5 +- drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c | 1 + drivers/gpu/drm/drm_edid.c | 11 +- drivers/gpu/drm/i915/gem/i915_gem_mman.c | 2 +- drivers/gpu/drm/meson/meson_drv.c | 6 +- drivers/gpu/drm/meson/meson_osd_afbcd.c | 41 ++-- drivers/gpu/drm/meson/meson_osd_afbcd.h | 1 + drivers/gpu/drm/mgag200/mgag200_mode.c | 5 +- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 +- drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c | 8 + drivers/gpu/drm/msm/dp/dp_display.c | 5 + .../gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c | 9 +- drivers/gpu/drm/panfrost/panfrost_gpu.c | 5 +- drivers/gpu/drm/pl111/pl111_drv.c | 4 +- drivers/gpu/drm/tegra/dsi.c | 4 +- drivers/gpu/host1x/dev.c | 1 + drivers/greybus/svc.c | 8 +- drivers/hid/hid-logitech-dj.c | 1 + drivers/hid/i2c-hid/i2c-hid-core.c | 32 ++- drivers/hid/intel-ish-hid/ishtp-fw-loader.c | 29 +-- drivers/hv/Kconfig | 1 + drivers/hv/hv_balloon.c | 2 +- drivers/hwmon/pmbus/pmbus.h | 1 + drivers/hwmon/pmbus/pmbus_core.c | 18 +- drivers/hwmon/sch56xx-common.c | 2 +- drivers/hwtracing/coresight/coresight-catu.c | 3 +- .../hwtracing/coresight/coresight-cpu-debug.c | 4 +- .../hwtracing/coresight/coresight-cti-core.c | 4 +- drivers/hwtracing/coresight/coresight-etb10.c | 4 +- .../coresight/coresight-etm3x-core.c | 4 +- .../coresight/coresight-etm4x-core.c | 4 +- .../coresight/coresight-etm4x-sysfs.c | 8 +- .../hwtracing/coresight/coresight-funnel.c | 4 +- .../coresight/coresight-replicator.c | 4 +- drivers/hwtracing/coresight/coresight-stm.c | 4 +- .../hwtracing/coresight/coresight-tmc-core.c | 4 +- drivers/hwtracing/coresight/coresight-tpiu.c | 4 +- drivers/i2c/busses/i2c-meson.c | 12 +- drivers/i2c/busses/i2c-nomadik.c | 4 +- drivers/i2c/busses/i2c-xiic.c | 3 +- drivers/i2c/muxes/i2c-demux-pinctrl.c | 5 +- drivers/iio/accel/mma8452.c | 29 ++- drivers/iio/adc/twl6030-gpadc.c | 2 + drivers/iio/afe/iio-rescale.c | 8 +- drivers/iio/inkern.c | 40 +++- drivers/infiniband/core/cma.c | 2 +- drivers/infiniband/core/verbs.c | 1 + drivers/infiniband/hw/hfi1/verbs.c | 3 +- drivers/infiniband/hw/mlx5/devx.c | 4 +- drivers/infiniband/hw/mlx5/mr.c | 2 + drivers/input/input.c | 6 - drivers/input/serio/ambakmi.c | 3 +- drivers/input/touchscreen/zinitix.c | 44 +++- drivers/iommu/iova.c | 5 +- drivers/iommu/ipmmu-vmsa.c | 4 +- drivers/irqchip/irq-nvic.c | 2 + drivers/irqchip/qcom-pdc.c | 5 +- drivers/mailbox/imx-mailbox.c | 9 + drivers/mailbox/tegra-hsp.c | 5 + drivers/md/dm-crypt.c | 2 +- drivers/md/dm-integrity.c | 6 +- drivers/media/i2c/adv7511-v4l2.c | 2 +- drivers/media/i2c/adv7604.c | 2 +- drivers/media/i2c/adv7842.c | 2 +- drivers/media/pci/bt8xx/bttv-driver.c | 4 +- drivers/media/pci/cx88/cx88-mpeg.c | 3 + drivers/media/pci/ivtv/ivtv-driver.h | 1 - drivers/media/pci/ivtv/ivtv-ioctl.c | 10 +- drivers/media/pci/ivtv/ivtv-streams.c | 11 +- drivers/media/pci/saa7134/saa7134-alsa.c | 8 +- drivers/media/platform/aspeed-video.c | 9 +- drivers/media/platform/coda/coda-common.c | 1 + drivers/media/platform/davinci/vpif.c | 12 +- .../platform/mtk-vcodec/mtk_vcodec_fw_vpu.c | 2 + drivers/media/rc/gpio-ir-tx.c | 28 ++- drivers/media/rc/ir_toy.c | 2 +- .../media/test-drivers/vidtv/vidtv_s302m.c | 17 +- drivers/media/usb/em28xx/em28xx-cards.c | 13 +- drivers/media/usb/go7007/s2250-board.c | 10 +- drivers/media/usb/hdpvr/hdpvr-video.c | 4 +- drivers/media/usb/stk1160/stk1160-core.c | 2 +- drivers/media/usb/stk1160/stk1160-v4l.c | 10 +- drivers/media/usb/stk1160/stk1160.h | 2 +- drivers/media/v4l2-core/v4l2-mem2mem.c | 53 ++++- drivers/memory/emif.c | 8 +- drivers/memory/pl172.c | 4 +- drivers/memory/pl353-smc.c | 4 +- drivers/mfd/asic3.c | 10 +- drivers/mfd/mc13xxx-core.c | 4 +- drivers/misc/cardreader/alcor_pci.c | 9 +- drivers/misc/habanalabs/common/debugfs.c | 2 + drivers/misc/kgdbts.c | 4 +- drivers/misc/mei/hw-me-regs.h | 1 + drivers/misc/mei/interrupt.c | 35 ++- drivers/misc/mei/pci-me.c | 1 + drivers/mmc/core/host.c | 15 +- drivers/mmc/host/davinci_mmc.c | 6 +- drivers/mmc/host/mmci.c | 4 +- drivers/mtd/nand/onenand/generic.c | 7 +- drivers/mtd/nand/raw/atmel/nand-controller.c | 14 +- drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 3 + drivers/mtd/nand/raw/nand_base.c | 44 ++-- drivers/net/bareudp.c | 25 +-- drivers/net/can/m_can/m_can.c | 5 +- .../net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 +- drivers/net/can/usb/mcba_usb.c | 26 ++- drivers/net/can/vxcan.c | 2 +- drivers/net/dsa/bcm_sf2_cfp.c | 6 +- drivers/net/dsa/microchip/ksz8795_spi.c | 11 + drivers/net/dsa/microchip/ksz9477_spi.c | 12 + drivers/net/dsa/mv88e6xxx/chip.c | 1 + drivers/net/ethernet/8390/mcf8390.c | 10 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 4 +- .../ethernet/freescale/enetc/enetc_ethtool.c | 5 +- drivers/net/ethernet/intel/i40e/i40e_xsk.c | 16 +- .../net/ethernet/pensando/ionic/ionic_main.c | 6 +- drivers/net/ethernet/qlogic/qed/qed_sriov.c | 1 + .../net/ethernet/qlogic/qlcnic/qlcnic_dcb.h | 10 +- drivers/net/ethernet/sun/sunhme.c | 6 +- .../net/ethernet/xilinx/xilinx_axienet_main.c | 72 +++--- drivers/net/phy/broadcom.c | 21 ++ drivers/net/wireguard/queueing.c | 3 +- drivers/net/wireguard/socket.c | 5 +- drivers/net/wireless/ath/ath10k/snoc.c | 2 +- drivers/net/wireless/ath/ath10k/wow.c | 7 +- drivers/net/wireless/ath/ath9k/htc_hst.c | 5 + drivers/net/wireless/ath/carl9170/main.c | 2 +- .../broadcom/brcm80211/brcmfmac/firmware.c | 2 + .../broadcom/brcm80211/brcmfmac/pcie.c | 66 ++---- .../net/wireless/intel/iwlwifi/dvm/mac80211.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 4 +- .../net/wireless/mediatek/mt76/mt7603/main.c | 3 + .../net/wireless/mediatek/mt76/mt7615/main.c | 3 + .../net/wireless/mediatek/mt76/mt7915/mcu.c | 9 +- drivers/net/wireless/ray_cs.c | 6 + drivers/nvdimm/region_devs.c | 3 + drivers/nvme/host/core.c | 9 +- drivers/nvme/host/tcp.c | 40 ++++ drivers/pci/controller/pci-aardvark.c | 4 +- drivers/pci/controller/pci-xgene.c | 35 ++- drivers/pci/hotplug/pciehp_hpc.c | 2 + drivers/pci/quirks.c | 12 + drivers/phy/phy-core-mipi-dphy.c | 4 +- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 2 + drivers/pinctrl/mediatek/pinctrl-paris.c | 30 ++- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 4 +- drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 185 ++++++++-------- drivers/pinctrl/pinconf-generic.c | 6 +- drivers/pinctrl/pinctrl-rockchip.c | 2 + drivers/pinctrl/renesas/core.c | 5 +- drivers/pinctrl/renesas/pfc-r8a77470.c | 4 +- drivers/pinctrl/samsung/pinctrl-samsung.c | 30 ++- drivers/platform/chrome/Makefile | 3 +- .../platform/chrome/cros_ec_sensorhub_ring.c | 3 +- .../platform/chrome/cros_ec_sensorhub_trace.h | 123 +++++++++++ drivers/platform/chrome/cros_ec_trace.h | 95 -------- drivers/platform/chrome/cros_ec_typec.c | 6 + drivers/platform/x86/huawei-wmi.c | 13 +- drivers/power/reset/gemini-poweroff.c | 4 +- drivers/power/supply/ab8500_fg.c | 4 +- drivers/power/supply/bq24190_charger.c | 7 +- drivers/power/supply/wm8350_power.c | 97 ++++++-- drivers/pwm/pwm-lpc18xx-sct.c | 20 +- drivers/regulator/qcom_smd-regulator.c | 4 +- .../regulator/rpi-panel-attiny-regulator.c | 56 ++++- drivers/remoteproc/qcom_q6v5_adsp.c | 1 + drivers/remoteproc/qcom_q6v5_mss.c | 11 +- drivers/remoteproc/qcom_wcnss.c | 1 + drivers/remoteproc/remoteproc_debugfs.c | 2 +- drivers/rtc/interface.c | 7 +- drivers/rtc/rtc-pl030.c | 4 +- drivers/rtc/rtc-pl031.c | 4 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +- drivers/scsi/libsas/sas_ata.c | 2 +- drivers/scsi/pm8001/pm8001_hwi.c | 23 +- drivers/scsi/pm8001/pm80xx_hwi.c | 209 ++++++++++-------- drivers/scsi/qla2xxx/qla_attr.c | 7 +- drivers/scsi/qla2xxx/qla_def.h | 10 +- drivers/scsi/qla2xxx/qla_gs.c | 5 +- drivers/scsi/qla2xxx/qla_init.c | 73 ++++-- drivers/scsi/qla2xxx/qla_iocb.c | 8 +- drivers/scsi/qla2xxx/qla_isr.c | 1 + drivers/scsi/qla2xxx/qla_mbx.c | 14 +- drivers/scsi/qla2xxx/qla_nvme.c | 22 ++ drivers/scsi/qla2xxx/qla_os.c | 8 +- drivers/scsi/qla2xxx/qla_sup.c | 4 +- drivers/scsi/qla2xxx/qla_target.c | 4 +- drivers/soc/qcom/ocmem.c | 1 + drivers/soc/qcom/qcom_aoss.c | 2 +- drivers/soc/qcom/rpmpd.c | 3 + drivers/soc/ti/wkup_m3_ipc.c | 4 +- drivers/soundwire/intel.c | 4 +- drivers/spi/spi-mxic.c | 28 +-- drivers/spi/spi-pl022.c | 5 +- drivers/spi/spi-pxa2xx-pci.c | 17 +- drivers/spi/spi-tegra114.c | 4 + drivers/spi/spi-tegra20-slink.c | 8 +- drivers/spi/spi-zynqmp-gqspi.c | 5 +- drivers/spi/spi.c | 4 +- drivers/staging/iio/adc/ad7280a.c | 4 +- .../staging/media/atomisp/pci/atomisp_acc.c | 28 ++- .../media/atomisp/pci/atomisp_gmin_platform.c | 18 ++ drivers/staging/media/atomisp/pci/hmm/hmm.c | 7 +- .../staging/media/hantro/hantro_h1_jpeg_enc.c | 2 +- drivers/staging/media/hantro/hantro_h1_regs.h | 2 +- drivers/staging/media/meson/vdec/esparser.c | 7 +- .../staging/media/meson/vdec/vdec_helpers.c | 8 +- .../staging/media/meson/vdec/vdec_helpers.h | 4 +- .../staging/media/sunxi/cedrus/cedrus_h264.c | 2 +- .../staging/media/sunxi/cedrus/cedrus_h265.c | 2 +- drivers/staging/media/zoran/zoran.h | 2 +- drivers/staging/media/zoran/zoran_card.c | 86 ++++--- drivers/staging/media/zoran/zoran_device.c | 7 +- drivers/staging/media/zoran/zoran_driver.c | 18 +- drivers/staging/mt7621-dts/gbpc1.dts | 40 ++-- drivers/staging/mt7621-dts/gbpc2.dts | 116 +++++++++- drivers/staging/mt7621-dts/mt7621.dtsi | 26 ++- .../intel/int340x_thermal/int3400_thermal.c | 7 +- drivers/tty/hvc/hvc_iucv.c | 4 +- drivers/tty/mxser.c | 15 +- drivers/tty/serial/8250/8250_dma.c | 11 +- drivers/tty/serial/8250/8250_lpss.c | 28 ++- drivers/tty/serial/8250/8250_mid.c | 19 +- drivers/tty/serial/8250/8250_port.c | 16 +- drivers/tty/serial/amba-pl010.c | 4 +- drivers/tty/serial/amba-pl011.c | 3 +- drivers/tty/serial/kgdboc.c | 6 +- drivers/tty/serial/serial_core.c | 14 ++ drivers/usb/host/xhci-hub.c | 5 +- drivers/usb/host/xhci-mem.c | 2 +- drivers/usb/host/xhci.c | 20 +- drivers/usb/host/xhci.h | 14 +- drivers/usb/serial/Kconfig | 1 + drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 3 + drivers/usb/serial/usb-serial-simple.c | 7 + drivers/usb/storage/ene_ub6250.c | 155 +++++++------ drivers/usb/storage/realtek_cr.c | 2 +- drivers/vdpa/mlx5/net/mlx5_vnet.c | 18 +- drivers/vfio/platform/vfio_amba.c | 15 +- drivers/video/fbdev/amba-clcd.c | 4 +- drivers/video/fbdev/atafb.c | 12 +- drivers/video/fbdev/atmel_lcdfb.c | 11 +- drivers/video/fbdev/cirrusfb.c | 16 +- drivers/video/fbdev/controlfb.c | 6 +- drivers/video/fbdev/core/fbcvt.c | 53 ++--- drivers/video/fbdev/matrox/matroxfb_base.c | 2 +- drivers/video/fbdev/nvidia/nv_i2c.c | 2 +- .../omap2/omapfb/displays/connector-dvi.c | 1 + .../omap2/omapfb/displays/panel-dsi-cm.c | 8 +- .../omapfb/displays/panel-sony-acx565akm.c | 2 +- .../omapfb/displays/panel-tpo-td043mtea1.c | 4 +- drivers/video/fbdev/sm712fb.c | 46 +--- drivers/video/fbdev/smscufx.c | 3 +- drivers/video/fbdev/udlfb.c | 8 +- drivers/video/fbdev/w100fb.c | 15 +- drivers/watchdog/rti_wdt.c | 1 + drivers/watchdog/sp805_wdt.c | 4 +- fs/binfmt_elf.c | 24 +- fs/btrfs/reflink.c | 7 +- fs/cifs/smb2ops.c | 130 ++++++----- fs/coredump.c | 39 +++- fs/exec.c | 26 ++- fs/ext2/super.c | 6 +- fs/ext4/inline.c | 9 +- fs/ext4/inode.c | 25 +++ fs/ext4/mballoc.c | 126 ++++++----- fs/ext4/namei.c | 10 +- fs/f2fs/checkpoint.c | 8 +- fs/f2fs/compress.c | 5 +- fs/f2fs/data.c | 9 +- fs/f2fs/file.c | 5 +- fs/f2fs/gc.c | 4 +- fs/f2fs/inode.c | 1 + fs/f2fs/node.c | 6 +- fs/f2fs/segment.c | 7 + fs/f2fs/super.c | 6 +- fs/f2fs/sysfs.c | 2 +- fs/file.c | 31 ++- fs/gfs2/rgrp.c | 3 +- fs/io_uring.c | 7 +- fs/jfs/jfs_dmap.c | 7 + fs/nfs/callback_proc.c | 27 +-- fs/nfs/callback_xdr.c | 4 - fs/nfs/nfs2xdr.c | 2 +- fs/nfs/nfs3xdr.c | 21 +- fs/nfs/nfs4proc.c | 1 + fs/nfs/pnfs.c | 11 + fs/nfs/pnfs.h | 2 + fs/nfs/write.c | 5 +- fs/nfsd/filecache.c | 6 +- fs/nfsd/nfs4state.c | 12 +- fs/nfsd/nfsproc.c | 2 +- fs/nfsd/xdr.h | 2 +- fs/ntfs/inode.c | 4 + fs/proc/bootconfig.c | 2 + fs/pstore/platform.c | 38 ++-- include/linux/amba/bus.h | 2 +- include/linux/mtd/rawnand.h | 2 + include/linux/pstore.h | 6 +- include/linux/serial_core.h | 2 + include/linux/soc/ti/ti_sci_protocol.h | 2 +- include/linux/sunrpc/xdr.h | 2 + include/net/udp.h | 1 + include/net/udp_tunnel.h | 3 +- include/sound/pcm.h | 1 + include/trace/events/ext4.h | 78 ++++--- include/trace/events/rxrpc.h | 8 +- include/uapi/linux/bpf.h | 12 +- kernel/audit.h | 4 + kernel/auditsc.c | 87 ++++++-- kernel/bpf/stackmap.c | 56 ++--- kernel/debug/kdb/kdb_support.c | 2 +- kernel/dma/debug.c | 4 +- kernel/events/core.c | 3 + kernel/locking/lockdep.c | 38 ++-- kernel/locking/lockdep_internals.h | 6 +- kernel/locking/lockdep_proc.c | 51 ++++- kernel/power/hibernate.c | 2 +- kernel/power/suspend_test.c | 8 +- kernel/printk/printk.c | 6 +- kernel/rseq.c | 9 + kernel/sched/core.c | 1 + kernel/sched/debug.c | 10 - kernel/watch_queue.c | 4 +- lib/kunit/try-catch.c | 2 +- lib/raid6/test/Makefile | 4 +- lib/raid6/test/test.c | 1 - lib/test_kmod.c | 1 + lib/test_lockup.c | 11 +- lib/test_xarray.c | 22 ++ lib/xarray.c | 4 + mm/kmemleak.c | 9 +- mm/madvise.c | 3 +- mm/memcontrol.c | 2 +- mm/memory.c | 17 +- mm/mempolicy.c | 8 +- mm/mmap.c | 2 +- mm/page_alloc.c | 9 +- mm/usercopy.c | 5 +- net/batman-adv/bridge_loop_avoidance.c | 6 + net/batman-adv/distributed-arp-table.c | 3 + net/batman-adv/gateway_client.c | 12 +- net/batman-adv/gateway_client.h | 16 +- net/batman-adv/hard-interface.h | 3 + net/batman-adv/network-coding.c | 6 + net/batman-adv/originator.c | 72 +----- net/batman-adv/originator.h | 96 +++++++- net/batman-adv/soft-interface.c | 15 +- net/batman-adv/soft-interface.h | 16 +- net/batman-adv/tp_meter.c | 3 + net/batman-adv/translation-table.c | 22 +- net/batman-adv/translation-table.h | 18 +- net/batman-adv/tvlv.c | 6 + net/bluetooth/hci_conn.c | 2 + net/can/isotp.c | 69 +++--- net/core/skmsg.c | 17 +- net/ipv4/route.c | 18 +- net/ipv4/tcp_bpf.c | 14 +- net/ipv4/tcp_output.c | 5 +- net/ipv4/udp.c | 6 + net/ipv6/udp.c | 4 +- net/ipv6/xfrm6_output.c | 16 ++ net/netfilter/nf_conntrack_proto_tcp.c | 17 +- net/netlink/af_netlink.c | 2 + net/openvswitch/conntrack.c | 118 +++++----- net/openvswitch/flow_netlink.c | 4 +- net/rxrpc/ar-internal.h | 15 +- net/rxrpc/call_event.c | 2 +- net/rxrpc/call_object.c | 40 +++- net/sunrpc/xprt.c | 7 + net/tipc/socket.c | 3 +- net/xfrm/xfrm_interface.c | 5 +- samples/bpf/xdpsock_user.c | 5 +- scripts/dtc/Makefile | 2 +- scripts/gcc-plugins/stackleak_plugin.c | 25 ++- security/integrity/evm/evm_main.c | 2 +- security/keys/keyctl_pkey.c | 14 +- security/security.c | 17 +- security/selinux/hooks.c | 11 +- security/selinux/include/policycap.h | 1 + security/selinux/include/policycap_names.h | 3 +- security/selinux/include/security.h | 7 + security/selinux/selinuxfs.c | 2 + security/selinux/xfrm.c | 2 +- security/smack/smack_lsm.c | 2 +- security/tomoyo/load_policy.c | 4 +- sound/arm/aaci.c | 4 +- sound/core/pcm.c | 1 + sound/core/pcm_lib.c | 9 +- sound/core/pcm_native.c | 39 +++- sound/firewire/fcp.c | 4 +- sound/isa/cs423x/cs4236.c | 8 +- sound/pci/hda/patch_hdmi.c | 8 +- sound/pci/hda/patch_realtek.c | 15 +- sound/soc/atmel/atmel_ssc_dai.c | 5 +- sound/soc/atmel/sam9g20_wm8731.c | 1 + sound/soc/atmel/sam9x5_wm8731.c | 16 +- sound/soc/codecs/Kconfig | 5 + sound/soc/codecs/msm8916-wcd-analog.c | 22 +- sound/soc/codecs/msm8916-wcd-digital.c | 5 +- sound/soc/codecs/mt6358.c | 4 + sound/soc/codecs/rt5663.c | 2 + sound/soc/codecs/wcd934x.c | 6 +- sound/soc/codecs/wm8350.c | 28 ++- sound/soc/dwc/dwc-i2s.c | 17 +- sound/soc/fsl/fsl_spdif.c | 2 + sound/soc/fsl/imx-es8328.c | 1 + sound/soc/generic/simple-card-utils.c | 2 +- sound/soc/mxs/mxs-saif.c | 5 +- sound/soc/mxs/mxs-sgtl5000.c | 3 + sound/soc/rockchip/rockchip_i2s.c | 18 +- sound/soc/sh/fsi.c | 19 +- sound/soc/soc-compress.c | 5 + sound/soc/soc-core.c | 2 +- sound/soc/soc-generic-dmaengine-pcm.c | 6 +- sound/soc/soc-topology.c | 3 +- sound/soc/sof/imx/imx8m.c | 1 + sound/soc/sof/intel/hda-loader.c | 11 +- sound/soc/ti/davinci-i2s.c | 5 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 25 +++ sound/spi/at73c213.c | 27 ++- tools/include/uapi/linux/bpf.h | 4 +- tools/lib/bpf/btf_dump.c | 5 + tools/lib/bpf/libbpf.c | 3 + tools/lib/bpf/xsk.c | 11 + .../selftests/bpf/progs/test_sock_fields.c | 2 +- .../testing/selftests/bpf/test_lirc_mode2.sh | 5 +- .../selftests/bpf/test_lwt_ip_encap.sh | 10 +- .../selftests/net/test_vxlan_under_vrf.sh | 8 +- tools/testing/selftests/vm/Makefile | 6 +- tools/testing/selftests/x86/Makefile | 6 +- tools/testing/selftests/x86/check_cc.sh | 2 +- tools/virtio/virtio_test.c | 1 + virt/kvm/kvm_main.c | 13 ++ 614 files changed, 4953 insertions(+), 2507 deletions(-) create mode 100644 arch/powerpc/boot/dts/fsl/t1040rdb-rev-a.dts create mode 100644 drivers/platform/chrome/cros_ec_sensorhub_trace.h -- 2.20.1

1 559

[PATCH] vfio: framework supporting vfio device hot migration
by RongWang 05 Jul '22

05 Jul '22

From: Rong Wang <w_angrong(a)163.com> kunpeng inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5CO9A CVE: NA --------------------------------- As pass through devices, hypervisor can`t control the status of device, and can`t track dirty memory DMA from device, during migration. The goal of this framework is to combine hardware to accomplish the task above. qemu |status control and dirty memory report vfio |ops to hardware hardware Signed-off-by: Rong Wang <w_angrong(a)163.com> Signed-off-by: HuHua Li <18245010845(a)163.com> Signed-off-by: Ripeng Qiu <965412048(a)qq.com> --- drivers/vfio/pci/Makefile | 2 +- drivers/vfio/pci/vfio_pci.c | 54 +++ drivers/vfio/pci/vfio_pci_migration.c | 755 ++++++++++++++++++++++++++++++++++ drivers/vfio/pci/vfio_pci_private.h | 14 +- drivers/vfio/vfio.c | 411 +++++++++++++++++- include/linux/vfio_pci_migration.h | 136 ++++++ 6 files changed, 1367 insertions(+), 5 deletions(-) create mode 100644 drivers/vfio/pci/vfio_pci_migration.c create mode 100644 include/linux/vfio_pci_migration.h diff --git a/drivers/vfio/pci/Makefile b/drivers/vfio/pci/Makefile index 76d8ec0..80a777d 100644 --- a/drivers/vfio/pci/Makefile +++ b/drivers/vfio/pci/Makefile @@ -1,5 +1,5 @@ -vfio-pci-y := vfio_pci.o vfio_pci_intrs.o vfio_pci_rdwr.o vfio_pci_config.o +vfio-pci-y := vfio_pci.o vfio_pci_intrs.o vfio_pci_rdwr.o vfio_pci_config.o vfio_pci_migration.o vfio-pci-$(CONFIG_VFIO_PCI_IGD) += vfio_pci_igd.o obj-$(CONFIG_VFIO_PCI) += vfio-pci.o diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c index 51b791c..59d8280 100644 --- a/drivers/vfio/pci/vfio_pci.c +++ b/drivers/vfio/pci/vfio_pci.c @@ -30,6 +30,7 @@ #include <linux/vgaarb.h> #include <linux/nospec.h> #include <linux/sched/mm.h> +#include <linux/vfio_pci_migration.h> #include "vfio_pci_private.h" @@ -296,6 +297,14 @@ static int vfio_pci_enable(struct vfio_pci_device *vdev) vfio_pci_probe_mmaps(vdev); + if (vfio_dev_migration_is_supported(pdev)) { + ret = vfio_pci_migration_init(vdev); + if (ret) { + dev_warn(&vdev->pdev->dev, "Failed to init vfio_pci_migration\n"); + vfio_pci_disable(vdev); + return ret; + } + } return 0; } @@ -392,6 +401,7 @@ static void vfio_pci_disable(struct vfio_pci_device *vdev) out: pci_disable_device(pdev); + vfio_pci_migration_exit(vdev); vfio_pci_try_bus_reset(vdev); if (!disable_idle_d3) @@ -642,6 +652,41 @@ struct vfio_devices { int max_index; }; +static long vfio_pci_handle_log_buf_ctl(struct vfio_pci_device *vdev, + const unsigned long arg) +{ + struct vfio_log_buf_ctl *log_buf_ctl = NULL; + struct vfio_log_buf_info *log_buf_info = NULL; + struct vf_migration_log_info migration_log_info; + long ret = 0; + + log_buf_ctl = (struct vfio_log_buf_ctl *)arg; + log_buf_info = (struct vfio_log_buf_info *)log_buf_ctl->data; + + switch (log_buf_ctl->flags) { + case VFIO_DEVICE_LOG_BUF_FLAG_START: + migration_log_info.dom_uuid = log_buf_info->uuid; + migration_log_info.buffer_size = + log_buf_info->buffer_size; + migration_log_info.sge_num = log_buf_info->addrs_size; + migration_log_info.sge_len = log_buf_info->frag_size; + migration_log_info.sgevec = log_buf_info->sgevec; + ret = vfio_pci_device_log_start(vdev, + &migration_log_info); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STOP: + ret = vfio_pci_device_log_stop(vdev, + log_buf_info->uuid); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY: + ret = vfio_pci_device_log_status_query(vdev); + break; + default: + ret = -EINVAL; + break; + } + return ret; +} static long vfio_pci_ioctl(void *device_data, unsigned int cmd, unsigned long arg) { @@ -1142,6 +1187,8 @@ static long vfio_pci_ioctl(void *device_data, return vfio_pci_ioeventfd(vdev, ioeventfd.offset, ioeventfd.data, count, ioeventfd.fd); + } else if (cmd == VFIO_DEVICE_LOG_BUF_CTL) { + return vfio_pci_handle_log_buf_ctl(vdev, arg); } return -ENOTTY; @@ -1566,6 +1613,9 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) pci_set_power_state(pdev, PCI_D3hot); } + if (vfio_dev_migration_is_supported(pdev)) + ret = vfio_pci_device_init(pdev); + return ret; } @@ -1591,6 +1641,10 @@ static void vfio_pci_remove(struct pci_dev *pdev) if (!disable_idle_d3) pci_set_power_state(pdev, PCI_D0); + + if (vfio_dev_migration_is_supported(pdev)) { + vfio_pci_device_uninit(pdev); + } } static pci_ers_result_t vfio_pci_aer_err_detected(struct pci_dev *pdev, diff --git a/drivers/vfio/pci/vfio_pci_migration.c b/drivers/vfio/pci/vfio_pci_migration.c new file mode 100644 index 0000000..f69cd13 --- /dev/null +++ b/drivers/vfio/pci/vfio_pci_migration.c @@ -0,0 +1,755 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (c) 2022 Huawei Technologies Co., Ltd. All rights reserved. + */ + +#include <linux/module.h> +#include <linux/io.h> +#include <linux/pci.h> +#include <linux/uaccess.h> +#include <linux/vfio.h> +#include <linux/vfio_pci_migration.h> + +#include "vfio_pci_private.h" + +static LIST_HEAD(vfio_pci_mig_drivers_list); +static DEFINE_MUTEX(vfio_pci_mig_drivers_mutex); + +static void vfio_pci_add_mig_drv(struct vfio_pci_vendor_mig_driver *mig_drv) +{ + mutex_lock(&vfio_pci_mig_drivers_mutex); + atomic_set(&mig_drv->count, 1); + list_add_tail(&mig_drv->list, &vfio_pci_mig_drivers_list); + mutex_unlock(&vfio_pci_mig_drivers_mutex); +} + +static void vfio_pci_remove_mig_drv(struct vfio_pci_vendor_mig_driver *mig_drv) +{ + mutex_lock(&vfio_pci_mig_drivers_mutex); + list_del(&mig_drv->list); + mutex_unlock(&vfio_pci_mig_drivers_mutex); +} + +static struct vfio_pci_vendor_mig_driver * + vfio_pci_find_mig_drv(struct pci_dev *pdev, struct module *module) +{ + struct vfio_pci_vendor_mig_driver *mig_drv = NULL; + + mutex_lock(&vfio_pci_mig_drivers_mutex); + list_for_each_entry(mig_drv, &vfio_pci_mig_drivers_list, list) { + if (mig_drv->owner == module) { + if (mig_drv->bus_num == pdev->bus->number) + goto out; + } + } + mig_drv = NULL; +out: + mutex_unlock(&vfio_pci_mig_drivers_mutex); + return mig_drv; +} + +static struct vfio_pci_vendor_mig_driver * + vfio_pci_get_mig_driver(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_drv = NULL; + struct pci_dev *pf_dev = pci_physfn(pdev); + + mutex_lock(&vfio_pci_mig_drivers_mutex); + list_for_each_entry(mig_drv, &vfio_pci_mig_drivers_list, list) { + if (mig_drv->bus_num == pf_dev->bus->number) + goto out; + } + mig_drv = NULL; +out: + mutex_unlock(&vfio_pci_mig_drivers_mutex); + return mig_drv; +} + +bool vfio_dev_migration_is_supported(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + mig_driver = vfio_pci_get_mig_driver(pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_warn(&pdev->dev, "unable to find a mig_drv module\n"); + return false; + } + + return true; +} + +int vfio_pci_device_log_start(struct vfio_pci_device *vdev, + struct vf_migration_log_info *log_info) +{ + struct vfio_pci_vendor_mig_driver *mig_driver; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&vdev->pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (!mig_driver->dev_mig_ops->log_start || + (mig_driver->dev_mig_ops->log_start(vdev->pdev, + log_info) != 0)) { + dev_err(&vdev->pdev->dev, "failed to set log start\n"); + return -EFAULT; + } + + return 0; +} + +int vfio_pci_device_log_stop(struct vfio_pci_device *vdev, uint32_t uuid) +{ + struct vfio_pci_vendor_mig_driver *mig_driver; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&vdev->pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (!mig_driver->dev_mig_ops->log_stop || + (mig_driver->dev_mig_ops->log_stop(vdev->pdev, uuid) != 0)) { + dev_err(&vdev->pdev->dev, "failed to set log stop\n"); + return -EFAULT; + } + + return 0; +} + +int vfio_pci_device_log_status_query(struct vfio_pci_device *vdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&vdev->pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (!mig_driver->dev_mig_ops->get_log_status || + (mig_driver->dev_mig_ops->get_log_status(vdev->pdev) != 0)) { + dev_err(&vdev->pdev->dev, "failed to get log status\n"); + return -EFAULT; + } + + return 0; +} + +int vfio_pci_device_init(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_drv; + + mig_drv = vfio_pci_get_mig_driver(pdev); + if (!mig_drv || !mig_drv->dev_mig_ops) { + dev_err(&pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (mig_drv->dev_mig_ops->init) + return mig_drv->dev_mig_ops->init(pdev); + + return -EFAULT; +} + +void vfio_pci_device_uninit(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_drv; + + mig_drv = vfio_pci_get_mig_driver(pdev); + if (!mig_drv || !mig_drv->dev_mig_ops) { + dev_err(&pdev->dev, "unable to find a mig_drv module\n"); + return; + } + + if (mig_drv->dev_mig_ops->uninit) + mig_drv->dev_mig_ops->uninit(pdev); +} + +static void vfio_pci_device_release(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (mig_drv->dev_mig_ops->release) + mig_drv->dev_mig_ops->release(pdev); +} + +static int vfio_pci_device_get_info(struct pci_dev *pdev, + struct vfio_device_migration_info *mig_info, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (mig_drv->dev_mig_ops->get_info) + return mig_drv->dev_mig_ops->get_info(pdev, mig_info); + return -EFAULT; +} + +static int vfio_pci_device_enable(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (!mig_drv->dev_mig_ops->enable || + (mig_drv->dev_mig_ops->enable(pdev) != 0)) { + return -EINVAL; + } + + return 0; +} + +static int vfio_pci_device_disable(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (!mig_drv->dev_mig_ops->disable || + (mig_drv->dev_mig_ops->disable(pdev) != 0)) + return -EINVAL; + + return 0; +} + +static int vfio_pci_device_pre_enable(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (!mig_drv->dev_mig_ops->pre_enable || + (mig_drv->dev_mig_ops->pre_enable(pdev) != 0)) + return -EINVAL; + + return 0; +} + +static int vfio_pci_device_state_save(struct pci_dev *pdev, + struct vfio_pci_migration_data *data) +{ + struct vfio_device_migration_info *mig_info = data->mig_ctl; + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + void *base = (void *)mig_info; + int ret = 0; + + if ((mig_info->device_state & VFIO_DEVICE_STATE_RUNNING) != 0) { + ret = vfio_pci_device_disable(pdev, mig_drv); + if (ret) { + dev_err(&pdev->dev, "failed to stop VF function!\n"); + return ret; + } + mig_info->device_state &= ~VFIO_DEVICE_STATE_RUNNING; + } + + if (mig_drv->dev_mig_ops && mig_drv->dev_mig_ops->save) { + ret = mig_drv->dev_mig_ops->save(pdev, base, + mig_info->data_offset, data->state_size); + if (ret) { + dev_err(&pdev->dev, "failed to save device state!\n"); + return -EINVAL; + } + } else { + return -EFAULT; + } + + mig_info->data_size = data->state_size; + mig_info->pending_bytes = mig_info->data_size; + return ret; +} + +static int vfio_pci_device_state_restore(struct vfio_pci_migration_data *data) +{ + struct vfio_device_migration_info *mig_info = data->mig_ctl; + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + struct pci_dev *pdev = data->vf_dev; + void *base = (void *)mig_info; + int ret; + + if (mig_drv->dev_mig_ops && mig_drv->dev_mig_ops->restore) { + ret = mig_drv->dev_mig_ops->restore(pdev, base, + mig_info->data_offset, mig_info->data_size); + if (ret) { + dev_err(&pdev->dev, "failed to restore device state!\n"); + return -EINVAL; + } + return 0; + } + + return -EFAULT; +} + +static int vfio_pci_set_device_state(struct vfio_pci_migration_data *data, + u32 state) +{ + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + struct pci_dev *pdev = data->vf_dev; + int ret = 0; + + if (state == mig_ctl->device_state) + return 0; + + if (!mig_drv->dev_mig_ops) + return -EINVAL; + + switch (state) { + case VFIO_DEVICE_STATE_RUNNING: + if (!(mig_ctl->device_state & + VFIO_DEVICE_STATE_RUNNING)) + ret = vfio_pci_device_enable(pdev, mig_drv); + break; + case VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RUNNING: + /* + * (pre-copy) - device should start logging data. + */ + ret = 0; + break; + case VFIO_DEVICE_STATE_SAVING: + /* stop the vf function, save state */ + ret = vfio_pci_device_state_save(pdev, data); + break; + case VFIO_DEVICE_STATE_STOP: + if (mig_ctl->device_state & VFIO_DEVICE_STATE_RUNNING) + ret = vfio_pci_device_disable(pdev, mig_drv); + break; + case VFIO_DEVICE_STATE_RESUMING: + ret = vfio_pci_device_pre_enable(pdev, mig_drv); + break; + default: + ret = -EFAULT; + break; + } + + if (ret) + return ret; + + mig_ctl->device_state = state; + return 0; +} + +static ssize_t vfio_pci_handle_mig_dev_state( + struct vfio_pci_migration_data *data, + char __user *buf, size_t count, bool iswrite) +{ + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + u32 device_state; + int ret; + + if (count != sizeof(device_state)) + return -EINVAL; + + if (iswrite) { + if (copy_from_user(&device_state, buf, count)) + return -EFAULT; + + ret = vfio_pci_set_device_state(data, device_state); + if (ret) + return ret; + } else { + if (copy_to_user(buf, &mig_ctl->device_state, count)) + return -EFAULT; + } + + return count; +} + +static ssize_t vfio_pci_handle_mig_pending_bytes( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u64 pending_bytes; + + if (count != sizeof(pending_bytes) || iswrite) + return -EINVAL; + + if (mig_info->device_state == + (VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RUNNING)) { + /* In pre-copy state we have no data to return for now, + * return 0 pending bytes + */ + pending_bytes = 0; + } else { + pending_bytes = mig_info->pending_bytes; + } + + if (copy_to_user(buf, &pending_bytes, count)) + return -EFAULT; + + return count; +} + +static ssize_t vfio_pci_handle_mig_data_offset( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u64 data_offset = mig_info->data_offset; + + if (count != sizeof(data_offset) || iswrite) + return -EINVAL; + + if (copy_to_user(buf, &data_offset, count)) + return -EFAULT; + + return count; +} + +static ssize_t vfio_pci_handle_mig_data_size( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u64 data_size; + + if (count != sizeof(data_size)) + return -EINVAL; + + if (iswrite) { + /* data_size is writable only during resuming state */ + if (mig_info->device_state != VFIO_DEVICE_STATE_RESUMING) + return -EINVAL; + + if (copy_from_user(&data_size, buf, sizeof(data_size))) + return -EFAULT; + + mig_info->data_size = data_size; + } else { + if (mig_info->device_state != VFIO_DEVICE_STATE_SAVING) + return -EINVAL; + + if (copy_to_user(buf, &mig_info->data_size, + sizeof(data_size))) + return -EFAULT; + } + + return count; +} + +static ssize_t vfio_pci_handle_mig_dev_cmd(struct vfio_pci_migration_data *data, + char __user *buf, size_t count, bool iswrite) +{ + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + struct pci_dev *pdev = data->vf_dev; + u32 device_cmd; + int ret = -EFAULT; + + if (count != sizeof(device_cmd) || !iswrite || !mig_drv->dev_mig_ops) + return -EINVAL; + + if (copy_from_user(&device_cmd, buf, count)) + return -EFAULT; + + switch (device_cmd) { + case VFIO_DEVICE_MIGRATION_CANCEL: + if (mig_drv->dev_mig_ops->cancel) + ret = mig_drv->dev_mig_ops->cancel(pdev); + break; + default: + dev_err(&pdev->dev, "cmd is invaild\n"); + return -EINVAL; + } + + if (ret != 0) + return ret; + + return count; +} + +static ssize_t vfio_pci_handle_mig_drv_version( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u32 version_id = mig_info->version_id; + + if (count != sizeof(version_id) || iswrite) + return -EINVAL; + + if (copy_to_user(buf, &version_id, count)) + return -EFAULT; + + return count; +} + +static ssize_t vfio_pci_handle_mig_data_rw( + struct vfio_pci_migration_data *data, + char __user *buf, size_t count, u64 pos, bool iswrite) +{ + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + void *data_addr = data->vf_data; + + if (count == 0) { + dev_err(&data->vf_dev->dev, "qemu operation data size error!\n"); + return -EINVAL; + } + + data_addr += pos - mig_ctl->data_offset; + if (iswrite) { + if (copy_from_user(data_addr, buf, count)) + return -EFAULT; + + mig_ctl->pending_bytes += count; + if (mig_ctl->pending_bytes > data->state_size) + return -EINVAL; + } else { + if (copy_to_user(buf, data_addr, count)) + return -EFAULT; + + if (mig_ctl->pending_bytes < count) + return -EINVAL; + + mig_ctl->pending_bytes -= count; + } + + return count; +} + +static ssize_t vfio_pci_dev_migrn_rw(struct vfio_pci_device *vdev, + char __user *buf, size_t count, loff_t *ppos, bool iswrite) +{ + unsigned int index = + VFIO_PCI_OFFSET_TO_INDEX(*ppos) - VFIO_PCI_NUM_REGIONS; + struct vfio_pci_migration_data *data = + (struct vfio_pci_migration_data *)vdev->region[index].data; + loff_t pos = *ppos & VFIO_PCI_OFFSET_MASK; + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + int ret; + + if (pos >= vdev->region[index].size) + return -EINVAL; + + count = min(count, (size_t)(vdev->region[index].size - pos)); + if (pos >= VFIO_MIGRATION_REGION_DATA_OFFSET) + return vfio_pci_handle_mig_data_rw(data, + buf, count, pos, iswrite); + + switch (pos) { + case VFIO_DEVICE_MIGRATION_OFFSET(device_state): + ret = vfio_pci_handle_mig_dev_state(data, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(pending_bytes): + ret = vfio_pci_handle_mig_pending_bytes(mig_ctl, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(data_offset): + ret = vfio_pci_handle_mig_data_offset(mig_ctl, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(data_size): + ret = vfio_pci_handle_mig_data_size(mig_ctl, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(device_cmd): + ret = vfio_pci_handle_mig_dev_cmd(data, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(version_id): + ret = vfio_pci_handle_mig_drv_version(mig_ctl, + buf, count, iswrite); + break; + default: + dev_err(&vdev->pdev->dev, "invalid pos offset\n"); + ret = -EFAULT; + break; + } + + if (mig_ctl->device_state == VFIO_DEVICE_STATE_RESUMING && + mig_ctl->pending_bytes == data->state_size && + mig_ctl->data_size == data->state_size) { + if (vfio_pci_device_state_restore(data) != 0) { + dev_err(&vdev->pdev->dev, "Failed to restore device state!\n"); + return -EFAULT; + } + mig_ctl->pending_bytes = 0; + mig_ctl->data_size = 0; + } + + return ret; +} + +static void vfio_pci_dev_migrn_release(struct vfio_pci_device *vdev, + struct vfio_pci_region *region) +{ + struct vfio_pci_migration_data *data = region->data; + + if (data) { + kfree(data->mig_ctl); + kfree(data); + } +} + +static const struct vfio_pci_regops vfio_pci_migration_regops = { + .rw = vfio_pci_dev_migrn_rw, + .release = vfio_pci_dev_migrn_release, +}; + +static int vfio_pci_migration_info_init(struct pci_dev *pdev, + struct vfio_device_migration_info *mig_info, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + int ret; + + ret = vfio_pci_device_get_info(pdev, mig_info, mig_drv); + if (ret) { + dev_err(&pdev->dev, "failed to get device info\n"); + return ret; + } + + if (mig_info->data_size > VFIO_MIGRATION_BUFFER_MAX_SIZE) { + dev_err(&pdev->dev, "mig_info->data_size %llu is invalid\n", + mig_info->data_size); + return -EINVAL; + } + + mig_info->data_offset = VFIO_MIGRATION_REGION_DATA_OFFSET; + return ret; +} + +static int vfio_device_mig_data_init(struct vfio_pci_device *vdev, + struct vfio_pci_migration_data *data) +{ + struct vfio_device_migration_info *mig_ctl; + u64 mig_offset; + int ret; + + mig_ctl = kzalloc(sizeof(*mig_ctl), GFP_KERNEL); + if (!mig_ctl) + return -ENOMEM; + + ret = vfio_pci_migration_info_init(vdev->pdev, mig_ctl, + data->mig_driver); + if (ret) { + dev_err(&vdev->pdev->dev, "get device info error!\n"); + goto err; + } + + mig_offset = sizeof(struct vfio_device_migration_info); + data->state_size = mig_ctl->data_size; + data->mig_ctl = krealloc(mig_ctl, mig_offset + data->state_size, + GFP_KERNEL); + if (!data->mig_ctl) { + ret = -ENOMEM; + goto err; + } + + data->vf_data = (void *)((char *)data->mig_ctl + mig_offset); + memset(data->vf_data, 0, data->state_size); + data->mig_ctl->data_size = 0; + + ret = vfio_pci_register_dev_region(vdev, VFIO_REGION_TYPE_MIGRATION, + VFIO_REGION_SUBTYPE_MIGRATION, + &vfio_pci_migration_regops, mig_offset + data->state_size, + VFIO_REGION_INFO_FLAG_READ | VFIO_REGION_INFO_FLAG_WRITE, data); + if (ret) { + kfree(data->mig_ctl); + return ret; + } + + return 0; +err: + kfree(mig_ctl); + return ret; +} + +int vfio_pci_migration_init(struct vfio_pci_device *vdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + struct vfio_pci_migration_data *data = NULL; + struct pci_dev *pdev = vdev->pdev; + int ret; + + mig_driver = vfio_pci_get_mig_driver(pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&pdev->dev, "unable to find a mig_driver module\n"); + return -EINVAL; + } + + if (!try_module_get(mig_driver->owner)) { + pr_err("module %s is not live\n", mig_driver->owner->name); + return -ENODEV; + } + + data = kzalloc(sizeof(*data), GFP_KERNEL); + if (!data) { + module_put(mig_driver->owner); + return -ENOMEM; + } + + data->mig_driver = mig_driver; + data->vf_dev = pdev; + + ret = vfio_device_mig_data_init(vdev, data); + if (ret) { + dev_err(&pdev->dev, "failed to init vfio device migration data!\n"); + goto err; + } + + return ret; +err: + kfree(data); + module_put(mig_driver->owner); + return ret; +} + +void vfio_pci_migration_exit(struct vfio_pci_device *vdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_warn(&vdev->pdev->dev, "mig_driver is not found\n"); + return; + } + + if (module_refcount(mig_driver->owner) > 0) { + vfio_pci_device_release(vdev->pdev, mig_driver); + module_put(mig_driver->owner); + } +} + +int vfio_pci_register_migration_ops(struct vfio_device_migration_ops *ops, + struct module *mod, struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + if (!ops || !mod || !pdev) + return -EINVAL; + + mig_driver = vfio_pci_find_mig_drv(pdev, mod); + if (mig_driver) { + pr_info("%s migration ops has already been registered\n", + mod->name); + atomic_add(1, &mig_driver->count); + return 0; + } + + if (!try_module_get(THIS_MODULE)) + return -ENODEV; + + mig_driver = kzalloc(sizeof(*mig_driver), GFP_KERNEL); + if (!mig_driver) { + module_put(THIS_MODULE); + return -ENOMEM; + } + + mig_driver->pdev = pdev; + mig_driver->bus_num = pdev->bus->number; + mig_driver->owner = mod; + mig_driver->dev_mig_ops = ops; + + vfio_pci_add_mig_drv(mig_driver); + + return 0; +} +EXPORT_SYMBOL_GPL(vfio_pci_register_migration_ops); + +void vfio_pci_unregister_migration_ops(struct module *mod, struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + if (!mod || !pdev) + return; + + mig_driver = vfio_pci_find_mig_drv(pdev, mod); + if (!mig_driver) { + pr_err("mig_driver is not found\n"); + return; + } + + if (atomic_sub_and_test(1, &mig_driver->count)) { + vfio_pci_remove_mig_drv(mig_driver); + kfree(mig_driver); + module_put(THIS_MODULE); + pr_info("%s succeed to unregister migration ops\n", + THIS_MODULE->name); + } +} +EXPORT_SYMBOL_GPL(vfio_pci_unregister_migration_ops); diff --git a/drivers/vfio/pci/vfio_pci_private.h b/drivers/vfio/pci/vfio_pci_private.h index 17d2bae..03af269 100644 --- a/drivers/vfio/pci/vfio_pci_private.h +++ b/drivers/vfio/pci/vfio_pci_private.h @@ -15,6 +15,7 @@ #include <linux/pci.h> #include <linux/irqbypass.h> #include <linux/types.h> +#include <linux/vfio_pci_migration.h> #ifndef VFIO_PCI_PRIVATE_H #define VFIO_PCI_PRIVATE_H @@ -55,7 +56,7 @@ struct vfio_pci_irq_ctx { struct vfio_pci_region; struct vfio_pci_regops { - size_t (*rw)(struct vfio_pci_device *vdev, char __user *buf, + ssize_t (*rw)(struct vfio_pci_device *vdev, char __user *buf, size_t count, loff_t *ppos, bool iswrite); void (*release)(struct vfio_pci_device *vdev, struct vfio_pci_region *region); @@ -173,4 +174,15 @@ static inline int vfio_pci_igd_init(struct vfio_pci_device *vdev) return -ENODEV; } #endif + +extern bool vfio_dev_migration_is_supported(struct pci_dev *pdev); +extern int vfio_pci_migration_init(struct vfio_pci_device *vdev); +extern void vfio_pci_migration_exit(struct vfio_pci_device *vdev); +extern int vfio_pci_device_log_start(struct vfio_pci_device *vdev, + struct vf_migration_log_info *log_info); +extern int vfio_pci_device_log_stop(struct vfio_pci_device *vdev, + uint32_t uuid); +extern int vfio_pci_device_log_status_query(struct vfio_pci_device *vdev); +extern int vfio_pci_device_init(struct pci_dev *pdev); +extern void vfio_pci_device_uninit(struct pci_dev *pdev); #endif /* VFIO_PCI_PRIVATE_H */ diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c index 7a386fb..35f2a29 100644 --- a/drivers/vfio/vfio.c +++ b/drivers/vfio/vfio.c @@ -33,6 +33,7 @@ #include <linux/string.h> #include <linux/uaccess.h> #include <linux/vfio.h> +#include <linux/vfio_pci_migration.h> #include <linux/wait.h> #include <linux/sched/signal.h> @@ -40,6 +41,9 @@ #define DRIVER_AUTHOR "Alex Williamson <alex.williamson(a)redhat.com>" #define DRIVER_DESC "VFIO - User Level meta-driver" +#define LOG_BUF_FRAG_SIZE (2 * 1024 * 1024) // fix to 2M +#define LOG_BUF_MAX_ADDRS_SIZE 128 // max vm ram size is 1T + static struct vfio { struct class *class; struct list_head iommu_drivers_list; @@ -57,6 +61,14 @@ struct vfio_iommu_driver { struct list_head vfio_next; }; +struct vfio_log_buf { + struct vfio_log_buf_info info; + int fd; + int buffer_state; + int device_state; + unsigned long *cpu_addrs; +}; + struct vfio_container { struct kref kref; struct list_head group_list; @@ -64,6 +76,7 @@ struct vfio_container { struct vfio_iommu_driver *iommu_driver; void *iommu_data; bool noiommu; + struct vfio_log_buf log_buf; }; struct vfio_unbound_dev { @@ -1158,8 +1171,398 @@ static long vfio_ioctl_set_iommu(struct vfio_container *container, return ret; } +static long vfio_dispatch_cmd_to_devices(const struct vfio_container *container, + unsigned int cmd, unsigned long arg) +{ + struct vfio_group *group = NULL; + struct vfio_device *device = NULL; + long ret = -ENXIO; + + list_for_each_entry(group, &container->group_list, container_next) { + list_for_each_entry(device, &group->device_list, group_next) { + ret = device->ops->ioctl(device->device_data, cmd, arg); + if (ret) { + pr_err("dispatch cmd to devices failed\n"); + return ret; + } + } + } + return ret; +} + +static long vfio_log_buf_start(struct vfio_container *container) +{ + struct vfio_log_buf_ctl log_buf_ctl; + long ret; + + log_buf_ctl.argsz = sizeof(struct vfio_log_buf_info); + log_buf_ctl.flags = VFIO_DEVICE_LOG_BUF_FLAG_START; + log_buf_ctl.data = (void *)&container->log_buf.info; + ret = vfio_dispatch_cmd_to_devices(container, VFIO_DEVICE_LOG_BUF_CTL, + (unsigned long)&log_buf_ctl); + if (ret) + return ret; + + container->log_buf.device_state = 1; + return 0; +} + +static long vfio_log_buf_stop(struct vfio_container *container) +{ + struct vfio_log_buf_ctl log_buf_ctl; + long ret; + + if (container->log_buf.device_state == 0) { + pr_warn("device already stopped\n"); + return 0; + } + + log_buf_ctl.argsz = sizeof(struct vfio_log_buf_info); + log_buf_ctl.flags = VFIO_DEVICE_LOG_BUF_FLAG_STOP; + log_buf_ctl.data = (void *)&container->log_buf.info; + ret = vfio_dispatch_cmd_to_devices(container, VFIO_DEVICE_LOG_BUF_CTL, + (unsigned long)&log_buf_ctl); + if (ret) + return ret; + + container->log_buf.device_state = 0; + return 0; +} + +static long vfio_log_buf_query(struct vfio_container *container) +{ + struct vfio_log_buf_ctl log_buf_ctl; + + log_buf_ctl.argsz = sizeof(struct vfio_log_buf_info); + log_buf_ctl.flags = VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY; + log_buf_ctl.data = (void *)&container->log_buf.info; + + return vfio_dispatch_cmd_to_devices(container, + VFIO_DEVICE_LOG_BUF_CTL, (unsigned long)&log_buf_ctl); +} + +static int vfio_log_buf_fops_mmap(struct file *filep, + struct vm_area_struct *vma) +{ + struct vfio_container *container = filep->private_data; + struct vfio_log_buf *log_buf = &container->log_buf; + unsigned long frag_pg_size; + unsigned long frag_offset; + phys_addr_t pa; + int ret = -EINVAL; + + if (!log_buf->cpu_addrs) { + pr_err("mmap before setup, please setup log buf first\n"); + return ret; + } + + if (log_buf->info.frag_size < PAGE_SIZE) { + pr_err("mmap frag size should not less than page size!\n"); + return ret; + } + + frag_pg_size = log_buf->info.frag_size / PAGE_SIZE; + frag_offset = vma->vm_pgoff / frag_pg_size; + + if (frag_offset >= log_buf->info.addrs_size) { + pr_err("mmap offset out of range!\n"); + return ret; + } + + if (vma->vm_end - vma->vm_start != log_buf->info.frag_size) { + pr_err("mmap size error, should be aligned with frag size!\n"); + return ret; + } + + pa = virt_to_phys((void *)log_buf->cpu_addrs[frag_offset]); + ret = remap_pfn_range(vma, vma->vm_start, + pa >> PAGE_SHIFT, + vma->vm_end - vma->vm_start, + vma->vm_page_prot); + if (ret) + pr_err("remap_pfn_range error!\n"); + return ret; +} + +static struct device *vfio_get_dev(struct vfio_container *container) +{ + struct vfio_group *group = NULL; + struct vfio_device *device = NULL; + + list_for_each_entry(group, &container->group_list, container_next) { + list_for_each_entry(device, &group->device_list, group_next) { + return device->dev; + } + } + return NULL; +} + +static void vfio_log_buf_release_dma(struct device *dev, + struct vfio_log_buf *log_buf) +{ + int i; + + for (i = 0; i < log_buf->info.addrs_size; i++) { + if ((log_buf->cpu_addrs && log_buf->cpu_addrs[i] != 0) && + (log_buf->info.sgevec && + log_buf->info.sgevec[i].addr != 0)) { + dma_free_coherent(dev, log_buf->info.frag_size, + (void *)log_buf->cpu_addrs[i], + log_buf->info.sgevec[i].addr); + log_buf->cpu_addrs[i] = 0; + log_buf->info.sgevec[i].addr = 0; + } + } +} + +static long vfio_log_buf_alloc_dma(struct vfio_log_buf_info *info, + struct vfio_log_buf *log_buf, struct device *dev) +{ + int i; + + for (i = 0; i < info->addrs_size; i++) { + log_buf->cpu_addrs[i] = (unsigned long)dma_alloc_coherent(dev, + info->frag_size, &log_buf->info.sgevec[i].addr, + GFP_KERNEL); + log_buf->info.sgevec[i].len = info->frag_size; + if (log_buf->cpu_addrs[i] == 0 || + log_buf->info.sgevec[i].addr == 0) { + return -ENOMEM; + } + } + return 0; +} + +static long vfio_log_buf_alloc_addrs(struct vfio_log_buf_info *info, + struct vfio_log_buf *log_buf) +{ + log_buf->info.sgevec = kcalloc(info->addrs_size, + sizeof(struct vfio_log_buf_sge), GFP_KERNEL); + if (!log_buf->info.sgevec) + return -ENOMEM; + + log_buf->cpu_addrs = kcalloc(info->addrs_size, + sizeof(unsigned long), GFP_KERNEL); + if (!log_buf->cpu_addrs) { + kfree(log_buf->info.sgevec); + log_buf->info.sgevec = NULL; + return -ENOMEM; + } + + return 0; +} + +static long vfio_log_buf_info_valid(struct vfio_log_buf_info *info) +{ + if (info->addrs_size > LOG_BUF_MAX_ADDRS_SIZE || + info->addrs_size == 0) { + pr_err("can`t support vm ram size larger than 1T or equal to 0\n"); + return -EINVAL; + } + if (info->frag_size != LOG_BUF_FRAG_SIZE) { + pr_err("only support %d frag size\n", LOG_BUF_FRAG_SIZE); + return -EINVAL; + } + return 0; +} + +static long vfio_log_buf_setup(struct vfio_container *container, + unsigned long data) +{ + struct vfio_log_buf_info info; + struct vfio_log_buf *log_buf = &container->log_buf; + struct device *dev = NULL; + long ret; + + if (log_buf->info.sgevec) { + pr_warn("log buf already setup\n"); + return 0; + } + + if (copy_from_user(&info, (void __user *)data, + sizeof(struct vfio_log_buf_info))) + return -EFAULT; + + ret = vfio_log_buf_info_valid(&info); + if (ret) + return ret; + + ret = vfio_log_buf_alloc_addrs(&info, log_buf); + if (ret) + goto err_out; + + dev = vfio_get_dev(container); + if (!dev) { + pr_err("can`t get dev\n"); + goto err_free_addrs; + } + + ret = vfio_log_buf_alloc_dma(&info, log_buf, dev); + if (ret) + goto err_free_dma_array; + + log_buf->info.uuid = info.uuid; + log_buf->info.buffer_size = info.buffer_size; + log_buf->info.frag_size = info.frag_size; + log_buf->info.addrs_size = info.addrs_size; + log_buf->buffer_state = 1; + return 0; + +err_free_dma_array: + vfio_log_buf_release_dma(dev, log_buf); +err_free_addrs: + kfree(log_buf->cpu_addrs); + log_buf->cpu_addrs = NULL; + kfree(log_buf->info.sgevec); + log_buf->info.sgevec = NULL; +err_out: + return -ENOMEM; +} + +static long vfio_log_buf_release_buffer(struct vfio_container *container) +{ + struct vfio_log_buf *log_buf = &container->log_buf; + struct device *dev = NULL; + + if (log_buf->buffer_state == 0) { + pr_warn("buffer already released\n"); + return 0; + } + + dev = vfio_get_dev(container); + if (!dev) { + pr_err("can`t get dev\n"); + return -EFAULT; + } + + vfio_log_buf_release_dma(dev, log_buf); + + kfree(log_buf->cpu_addrs); + log_buf->cpu_addrs = NULL; + + kfree(log_buf->info.sgevec); + log_buf->info.sgevec = NULL; + + log_buf->buffer_state = 0; + return 0; +} + +static int vfio_log_buf_release(struct inode *inode, struct file *filep) +{ + struct vfio_container *container = filep->private_data; + + vfio_log_buf_stop(container); + vfio_log_buf_release_buffer(container); + memset(&container->log_buf, 0, sizeof(struct vfio_log_buf)); + return 0; +} + +static long vfio_ioctl_handle_log_buf_ctl(struct vfio_container *container, + unsigned long arg) +{ + struct vfio_log_buf_ctl log_buf_ctl; + long ret = 0; + + if (copy_from_user(&log_buf_ctl, (void __user *)arg, + sizeof(struct vfio_log_buf_ctl))) + return -EFAULT; + + switch (log_buf_ctl.flags) { + case VFIO_DEVICE_LOG_BUF_FLAG_SETUP: + ret = vfio_log_buf_setup(container, + (unsigned long)log_buf_ctl.data); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_RELEASE: + ret = vfio_log_buf_release_buffer(container); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_START: + ret = vfio_log_buf_start(container); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STOP: + ret = vfio_log_buf_stop(container); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY: + ret = vfio_log_buf_query(container); + break; + default: + pr_err("log buf control flag incorrect\n"); + ret = -EINVAL; + break; + } + return ret; +} + +static long vfio_log_buf_fops_unl_ioctl(struct file *filep, + unsigned int cmd, unsigned long arg) +{ + struct vfio_container *container = filep->private_data; + long ret = -EINVAL; + + switch (cmd) { + case VFIO_LOG_BUF_CTL: + ret = vfio_ioctl_handle_log_buf_ctl(container, arg); + break; + default: + pr_err("log buf control cmd incorrect\n"); + break; + } + + return ret; +} + +#ifdef CONFIG_COMPAT +static long vfio_log_buf_fops_compat_ioctl(struct file *filep, + unsigned int cmd, unsigned long arg) +{ + arg = (unsigned long)compat_ptr(arg); + return vfio_log_buf_fops_unl_ioctl(filep, cmd, arg); +} +#endif /* CONFIG_COMPAT */ + +static const struct file_operations vfio_log_buf_fops = { + .owner = THIS_MODULE, + .mmap = vfio_log_buf_fops_mmap, + .unlocked_ioctl = vfio_log_buf_fops_unl_ioctl, + .release = vfio_log_buf_release, +#ifdef CONFIG_COMPAT + .compat_ioctl = vfio_log_buf_fops_compat_ioctl, +#endif +}; + +static int vfio_get_log_buf_fd(struct vfio_container *container, + unsigned long arg) +{ + struct file *filep = NULL; + int ret; + + if (container->log_buf.fd > 0) + return container->log_buf.fd; + + ret = get_unused_fd_flags(O_CLOEXEC); + if (ret < 0) { + pr_err("get_unused_fd_flags get fd failed\n"); + return ret; + } + + filep = anon_inode_getfile("[vfio-log-buf]", &vfio_log_buf_fops, + container, O_RDWR); + if (IS_ERR(filep)) { + pr_err("anon_inode_getfile failed\n"); + put_unused_fd(ret); + ret = PTR_ERR(filep); + return ret; + } + + filep->f_mode |= (FMODE_READ | FMODE_WRITE | FMODE_LSEEK); + + fd_install(ret, filep); + + container->log_buf.fd = ret; + return ret; +} + static long vfio_fops_unl_ioctl(struct file *filep, - unsigned int cmd, unsigned long arg) + unsigned int cmd, unsigned long arg) { struct vfio_container *container = filep->private_data; struct vfio_iommu_driver *driver; @@ -1179,6 +1582,9 @@ static long vfio_fops_unl_ioctl(struct file *filep, case VFIO_SET_IOMMU: ret = vfio_ioctl_set_iommu(container, arg); break; + case VFIO_GET_LOG_BUF_FD: + ret = vfio_get_log_buf_fd(container, arg); + break; default: driver = container->iommu_driver; data = container->iommu_data; @@ -1210,6 +1616,7 @@ static int vfio_fops_open(struct inode *inode, struct file *filep) INIT_LIST_HEAD(&container->group_list); init_rwsem(&container->group_lock); kref_init(&container->kref); + memset(&container->log_buf, 0, sizeof(struct vfio_log_buf)); filep->private_data = container; @@ -1219,9 +1626,7 @@ static int vfio_fops_open(struct inode *inode, struct file *filep) static int vfio_fops_release(struct inode *inode, struct file *filep) { struct vfio_container *container = filep->private_data; - filep->private_data = NULL; - vfio_container_put(container); return 0; diff --git a/include/linux/vfio_pci_migration.h b/include/linux/vfio_pci_migration.h new file mode 100644 index 0000000..464ffb4 --- /dev/null +++ b/include/linux/vfio_pci_migration.h @@ -0,0 +1,136 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (c) 2022 Huawei Technologies Co., Ltd. All rights reserved. + */ + +#ifndef VFIO_PCI_MIGRATION_H +#define VFIO_PCI_MIGRATION_H + +#include <linux/types.h> +#include <linux/pci.h> + +#define VFIO_REGION_TYPE_MIGRATION (3) +/* sub-types for VFIO_REGION_TYPE_MIGRATION */ +#define VFIO_REGION_SUBTYPE_MIGRATION (1) + +#define VFIO_MIGRATION_BUFFER_MAX_SIZE SZ_256K +#define VFIO_MIGRATION_REGION_DATA_OFFSET \ + (sizeof(struct vfio_device_migration_info)) +#define VFIO_DEVICE_MIGRATION_OFFSET(x) \ + offsetof(struct vfio_device_migration_info, x) + +struct vfio_device_migration_info { + __u32 device_state; /* VFIO device state */ +#define VFIO_DEVICE_STATE_STOP (0) +#define VFIO_DEVICE_STATE_RUNNING (1 << 0) +#define VFIO_DEVICE_STATE_SAVING (1 << 1) +#define VFIO_DEVICE_STATE_RESUMING (1 << 2) +#define VFIO_DEVICE_STATE_MASK (VFIO_DEVICE_STATE_RUNNING | \ + VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RESUMING) + __u32 reserved; + + __u32 device_cmd; + __u32 version_id; + + __u64 pending_bytes; + __u64 data_offset; + __u64 data_size; +}; + +enum { + VFIO_DEVICE_STOP = 0xffff0001, + VFIO_DEVICE_CONTINUE, + VFIO_DEVICE_MIGRATION_CANCEL, +}; + +struct vfio_log_buf_sge { + __u64 len; + __u64 addr; +}; + +struct vfio_log_buf_info { + __u32 uuid; + __u64 buffer_size; + __u64 addrs_size; + __u64 frag_size; + struct vfio_log_buf_sge *sgevec; +}; + +struct vfio_log_buf_ctl { + __u32 argsz; + __u32 flags; + #define VFIO_DEVICE_LOG_BUF_FLAG_SETUP (1 << 0) + #define VFIO_DEVICE_LOG_BUF_FLAG_RELEASE (1 << 1) + #define VFIO_DEVICE_LOG_BUF_FLAG_START (1 << 2) + #define VFIO_DEVICE_LOG_BUF_FLAG_STOP (1 << 3) + #define VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY (1 << 4) + void *data; +}; +#define VFIO_LOG_BUF_CTL _IO(VFIO_TYPE, VFIO_BASE + 21) +#define VFIO_GET_LOG_BUF_FD _IO(VFIO_TYPE, VFIO_BASE + 22) +#define VFIO_DEVICE_LOG_BUF_CTL _IO(VFIO_TYPE, VFIO_BASE + 23) + +struct vf_migration_log_info { + __u32 dom_uuid; + __u64 buffer_size; + __u64 sge_len; + __u64 sge_num; + struct vfio_log_buf_sge *sgevec; +}; + +struct vfio_device_migration_ops { + /* Get device information */ + int (*get_info)(struct pci_dev *pdev, + struct vfio_device_migration_info *info); + /* Enable a vf device */ + int (*enable)(struct pci_dev *pdev); + /* Disable a vf device */ + int (*disable)(struct pci_dev *pdev); + /* Save a vf device */ + int (*save)(struct pci_dev *pdev, void *base, + uint64_t off, uint64_t count); + /* Resuming a vf device */ + int (*restore)(struct pci_dev *pdev, void *base, + uint64_t off, uint64_t count); + /* Log start a vf device */ + int (*log_start)(struct pci_dev *pdev, + struct vf_migration_log_info *log_info); + /* Log stop a vf device */ + int (*log_stop)(struct pci_dev *pdev, uint32_t uuid); + /* Get vf device log status */ + int (*get_log_status)(struct pci_dev *pdev); + /* Pre enable a vf device(load_setup, before restore a vf) */ + int (*pre_enable)(struct pci_dev *pdev); + /* Cancel a vf device when live migration failed (rollback) */ + int (*cancel)(struct pci_dev *pdev); + /* Init a vf device */ + int (*init)(struct pci_dev *pdev); + /* Uninit a vf device */ + void (*uninit)(struct pci_dev *pdev); + /* Release a vf device */ + void (*release)(struct pci_dev *pdev); +}; + +struct vfio_pci_vendor_mig_driver { + struct pci_dev *pdev; + unsigned char bus_num; + struct vfio_device_migration_ops *dev_mig_ops; + struct module *owner; + atomic_t count; + struct list_head list; +}; + +struct vfio_pci_migration_data { + u64 state_size; + struct pci_dev *vf_dev; + struct vfio_pci_vendor_mig_driver *mig_driver; + struct vfio_device_migration_info *mig_ctl; + void *vf_data; +}; + +int vfio_pci_register_migration_ops(struct vfio_device_migration_ops *ops, + struct module *mod, struct pci_dev *pdev); +void vfio_pci_unregister_migration_ops(struct module *mod, + struct pci_dev *pdev); + +#endif /* VFIO_PCI_MIGRATION_H */ -- 1.8.3.1

3 2

[PATCH OLK-5.10 0/7] eulerfs: Add extended attributes support
by gouhao＠uniontech.com 05 Jul '22

05 Jul '22

From: Gou Hao <gouhao(a)uniontech.com> Patch series "Add extended attributes support for EulerFS". I refer to the extended attribute implementation code of ext2 file system. At first, I implemented it completely according to the extended attribute of ext file system. But later, I changed the disk layout of entries. About layout of entry: The layout of ext2's extended attribute is that name and value are stored separately,with name growing from top to bottom and value growing from bottom to top. I think the layout of ext2 wastes space, because, Name and value are aligned with 4 bytes, In the worst case, the name and value of entry need 3 bytes of padding respectively, and a total of 6 bytes are wasted. I store the name and value together. In the worst case, only need 3 bytes of padding.Use xattr-test.c selftests, with the same block size, my method can store 112 entries, while using ext2 layout can only store 102 entries. In ext4 file system, value can be stored in different blocks, which increases the scalability. In my method, it can add a pointer to the next block in the header to achieve the same function, and it is simpler. The performance of my method is the same as that of ext2, or even better. About block share: In ext2, if the extended attributes of two files are exactly the same, they can share the same disk block. Its implementation process is: 1. When accessing the extended attribute of a file, add this extended attribute block to a specific cache. 2. When setting the extended attribute of a file, if there is a block with exactly the same content as this extended attribute in the cache, share that block directly. There is a problem here. If the block of a file is not added to the cache, the extended attribute block will not be shared.So in this patch set, I didn't realize the shared disk block. I'll implement it later when there is a good method or when there is a need. At present, only user. prefix xattr is implemented. Trusted, ACL and security will be implemented later. Gou Hao (7): eulerfs: add EULER_FS_XATTR config eulerfs: add related fields of extended attributes eulerfs: add alloc xattr block interface eulerfs: implement extended attribute core functions eulerfs: add callback interface of extended attribute eulerfs: add implementation of user. prefix extended attribute eulerfs: add selftests for eulerfs extended attribute fs/eulerfs/Kconfig | 9 + fs/eulerfs/Makefile | 1 + fs/eulerfs/alloc_interface.h | 4 + fs/eulerfs/const.h | 1 + fs/eulerfs/euler.h | 1 + fs/eulerfs/euler_def.h | 3 + fs/eulerfs/file.c | 1 + fs/eulerfs/inode.c | 3 + fs/eulerfs/namei.c | 2 + fs/eulerfs/nvalloc.c | 1 + fs/eulerfs/nvalloc.h | 1 + fs/eulerfs/nvm_struct.h | 12 + fs/eulerfs/super.c | 36 +- fs/eulerfs/symlink.c | 1 + fs/eulerfs/xattr.c | 422 ++++++++++++++ fs/eulerfs/xattr.h | 99 ++++ fs/eulerfs/xattr_user.c | 43 ++ tools/testing/selftests/eulerfs/Makefile | 6 + tools/testing/selftests/eulerfs/xattr-test.c | 565 +++++++++++++++++++ 19 files changed, 1209 insertions(+), 2 deletions(-) create mode 100644 fs/eulerfs/xattr.c create mode 100644 fs/eulerfs/xattr.h create mode 100644 fs/eulerfs/xattr_user.c create mode 100644 tools/testing/selftests/eulerfs/Makefile create mode 100644 tools/testing/selftests/eulerfs/xattr-test.c -- 2.20.1

1 7

openEuler kernel SIG例会
by openEuler conference 05 Jul '22

05 Jul '22

您好！ Kernel SIG 邀请您参加 2022-07-08 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler kernel SIG例会会议内容：美团贡献富容器隔离及内部自研混部特性到openEuler kernel的讨论会议链接：https://us06web.zoom.us/j/89123664797?pwd=S1BKR3BHTTBOZUd0TTg2VE9FRUVMQT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-07-08 14:00, The subject of the conference is openEuler kernel SIG例会, Summary: 美团贡献富容器隔离及内部自研混部特性到openEuler kernel的讨论 You can join the meeting at https://us06web.zoom.us/j/89123664797?pwd=S1BKR3BHTTBOZUd0TTg2VE9FRUVMQT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

请问咱们的内核有对飞腾的的设备的支持吗？
by sireg 04 Jul '22

04 Jul '22

我运行咱们的系统在一台分腾d2000的机器上，发现网卡是驱动不起来的。网卡型号是PHYT0004，走的MDIO的总线，使用stmmac的驱动。以上是我了解的相关技术，目前网卡驱动不起来，所以没有相关dmesg日志。正在着手解决该问题，所以提请咨询。                                                                    王铭 sireg firerun(a)qq.com  

2 1

请问咱们的内核有对飞腾的的设备的支持吗？
by sireg 04 Jul '22

04 Jul '22

我运行咱们的系统在一台飞腾d2000的机器上，发现网卡驱动不起来。以上是我了解的相关技术，目前网卡驱动不起来，所以没有相关dmesg日志。网卡型号是PHYT0004，如果驱动起来，应该是走的MDIO的总线，使用stmmac的驱动。正在着手解决该问题，所以提请咨询。                                                                    王铭 sireg firerun(a)qq.com  

1 0

[PATCH openEuler-1.0-LTS 1/4] ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
by Yongqiang Liu 02 Jul '22

02 Jul '22

From: Baokun Li <libaokun1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186866, https://gitee.com/openeuler/kernel/issues/I5DTBL CVE: NA -------------------------------- When adding an xattr to an inode, we must ensure that the inode_size is not less than EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad. Otherwise, the end position may be greater than the start position, resulting in UAF. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/xattr.h | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h index f39cad2abe2a..990084e00374 100644 --- a/fs/ext4/xattr.h +++ b/fs/ext4/xattr.h @@ -95,6 +95,19 @@ struct ext4_xattr_entry { #define EXT4_ZERO_XATTR_VALUE ((void *)-1) +/* + * If we want to add an xattr to the inode, we should make sure that + * i_extra_isize is not 0 and that the inode size is not less than + * EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad. + * EXT4_GOOD_OLD_INODE_SIZE extra_isize header entry pad data + * |--------------------------|------------|------|---------|---|-------| + */ +#define EXT4_INODE_HAS_XATTR_SPACE(inode) \ + ((EXT4_I(inode)->i_extra_isize != 0) && \ + (EXT4_GOOD_OLD_INODE_SIZE + EXT4_I(inode)->i_extra_isize + \ + sizeof(struct ext4_xattr_ibody_header) + EXT4_XATTR_PAD <= \ + EXT4_INODE_SIZE((inode)->i_sb))) + struct ext4_xattr_info { const char *name; const void *value; -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS 1/4] mm/sharepool: Fix using uninitialized sp_flag
by Yongqiang Liu 01 Jul '22

01 Jul '22

From: Wang Wensheng <wangwensheng4(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I578LV CVE: NA ------------------------------------------------- Add the missing initialization for kc.sp_flag in sp_make_share_kva_to_spg(). Or a random value would be used in sp_remap_kva_to_vma(). Fixes: da51b55eeff9 ("mm/share_pool: Support read-only memory allocation") Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/share_pool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/share_pool.c b/mm/share_pool.c index ec889155b0ff..893e5352bf01 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -3023,7 +3023,7 @@ static void *sp_make_share_kva_to_spg(unsigned long kva, unsigned long size, } spa->kva = kva; - + kc.sp_flags = sp_flags; list_for_each_entry(spg_node, &spg->procs, proc_node) { mm = spg_node->master->mm; kc.state = K2U_NORMAL; -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS 1/4] alinux: sched: Defend cfs and rt bandwidth against overflow
by liuzhengyuan＠kylinos.cn 30 Jun '22

30 Jun '22

From: Huaixin Chang <changhuaixin(a)linux.alibaba.com> anolis inclusion from anolis_master commit 9d168f216486333f24aa1b33706eddf3b13d7228 category: performance bugzilla: NA CVE: NA --------------------------- Kernel limitation on cpu.cfs_quota_us is insufficient. Some large numbers might cause overflow in to_ratio() calculation and produce unexpected results. For example, if we make two cpu cgroups and then write a reasonable value and a large value into child's and parent's cpu.cfs_quota_us. This will cause a write error. cd /sys/fs/cgroup/cpu mkdir parent; mkdir parent/child echo 8000 > parent/child/cpu.cfs_quota_us # 17592186044416 is (1UL << 44) echo 17592186044416 > parent/cpu.cfs_quota_us In this case, quota will overflow and thus fail the __cfs_schedulable check. Similar overflow also affects rt bandwidth. Burstable CFS bandwidth controller will also benefit from limiting quota. Change-Id: I0f89d1f26b168c5cfa041e886395c7f3068114ae Reviewed-by: Shanpei Chen <shanpeic(a)linux.alibaba.com> Signed-off-by: Huaixin Chang <changhuaixin(a)linux.alibaba.com> Signed-off-by: Zhengyuan Liu <liuzhengyuan(a)kylinos.cn> --- kernel/sched/core.c | 8 ++++++++ kernel/sched/rt.c | 9 +++++++++ kernel/sched/sched.h | 2 ++ 3 files changed, 19 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 36d7422da0ac..51fdd30f188a 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -6679,6 +6679,8 @@ static DEFINE_MUTEX(cfs_constraints_mutex); const u64 max_cfs_quota_period = 1 * NSEC_PER_SEC; /* 1s */ const u64 min_cfs_quota_period = 1 * NSEC_PER_MSEC; /* 1ms */ +/* More than 203 days if BW_SHIFT equals 20. */ +const u64 max_cfs_runtime = MAX_BW_USEC * NSEC_PER_USEC; static int __cfs_schedulable(struct task_group *tg, u64 period, u64 runtime); @@ -6706,6 +6708,12 @@ static int tg_set_cfs_bandwidth(struct task_group *tg, u64 period, u64 quota) if (period > max_cfs_quota_period) return -EINVAL; + /* + * Bound quota to defend quota against overflow during bandwidth shift. + */ + if (quota != RUNTIME_INF && quota > max_cfs_runtime) + return -EINVAL; + /* * Prevent race between setting of cfs_rq->runtime_enabled and * unthrottle_offline_cfs_rqs(). diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c index 301ba04d9130..f31e0aaf1f43 100644 --- a/kernel/sched/rt.c +++ b/kernel/sched/rt.c @@ -2518,6 +2518,9 @@ static int __rt_schedulable(struct task_group *tg, u64 period, u64 runtime) return ret; } +/* More than 203 days if BW_SHIFT equals 20. */ +static const u64 max_rt_runtime = MAX_BW_USEC * NSEC_PER_USEC; + static int tg_set_rt_bandwidth(struct task_group *tg, u64 rt_period, u64 rt_runtime) { @@ -2534,6 +2537,12 @@ static int tg_set_rt_bandwidth(struct task_group *tg, if (rt_period == 0) return -EINVAL; + /* + * Bound quota to defend quota against overflow during bandwidth shift. + */ + if (rt_runtime != RUNTIME_INF && rt_runtime > max_rt_runtime) + return -EINVAL; + mutex_lock(&rt_constraints_mutex); read_lock(&tasklist_lock); err = __rt_schedulable(tg, rt_period, rt_runtime); diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index ae3068153093..f3808a49ce48 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -1732,6 +1732,8 @@ extern void init_dl_rq_bw_ratio(struct dl_rq *dl_rq); #define BW_SHIFT 20 #define BW_UNIT (1 << BW_SHIFT) #define RATIO_SHIFT 8 +#define MAX_BW_BITS (64 - BW_SHIFT) +#define MAX_BW_USEC ((1UL << MAX_BW_BITS) - 1) unsigned long to_ratio(u64 period, u64 runtime); extern void init_entity_runnable_average(struct sched_entity *se); -- 2.25.1

3 6

[PATCH openEuler-1.0-LTS 01/14] mm/sharepool: Delete single-group mode
by Yongqiang Liu 29 Jun '22

29 Jun '22

From: Zhou Guanghui <zhouguanghui1(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5EORS CVE: NA -------------------------------- The single-group mode has no application scenario. Therefore, the related branch is deleted. The boot option "enable_sp_multi_group_mode" does not take effect. Signed-off-by: Zhou Guanghui <zhouguanghui1(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/share_pool.c | 137 +++++++++--------------------------------------- 1 file changed, 25 insertions(+), 112 deletions(-) diff --git a/mm/share_pool.c b/mm/share_pool.c index 5ba353ddfabd..48e309e3ddd3 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -65,9 +65,6 @@ #define byte2mb(size) ((size) >> 20) #define page2kb(page_num) ((page_num) << (PAGE_SHIFT - 10)) -#define SINGLE_GROUP_MODE 1 -#define MULTI_GROUP_MODE 2 - #define MAX_GROUP_FOR_SYSTEM 50000 #define MAX_GROUP_FOR_TASK 3000 #define MAX_PROC_PER_GROUP 1024 @@ -98,8 +95,6 @@ int sysctl_sp_perf_alloc; int sysctl_sp_perf_k2u; -static int share_pool_group_mode = SINGLE_GROUP_MODE; - static int system_group_count; static unsigned int sp_device_number; @@ -1088,12 +1083,6 @@ static int mm_add_group_init(struct mm_struct *mm, struct sp_group *spg) struct sp_group_master *master = mm->sp_group_master; bool exist = false; - if (share_pool_group_mode == SINGLE_GROUP_MODE && master && - master->count == 1) { - pr_err_ratelimited("at most one sp group for a task is allowed in single mode\n"); - return -EEXIST; - } - master = sp_init_group_master_locked(mm, &exist); if (IS_ERR(master)) return PTR_ERR(master); @@ -2235,72 +2224,30 @@ static int sp_alloc_prepare(unsigned long size, unsigned long sp_flags, if (sp_flags & SP_HUGEPAGE_ONLY) sp_flags |= SP_HUGEPAGE; - if (share_pool_group_mode == SINGLE_GROUP_MODE) { - spg = __sp_find_spg(current->pid, SPG_ID_DEFAULT); - if (spg) { - if (spg_id != SPG_ID_DEFAULT && spg->id != spg_id) { - sp_group_drop(spg); - return -ENODEV; - } - - /* up_read will be at the end of sp_alloc */ - down_read(&spg->rw_lock); - if (!spg_valid(spg)) { - up_read(&spg->rw_lock); - sp_group_drop(spg); - pr_err_ratelimited("allocation failed, spg is dead\n"); - return -ENODEV; - } - } else { /* alocation pass through scene */ - if (enable_mdc_default_group) { - int ret = 0; - - ret = sp_group_add_task(current->tgid, spg_id); - if (ret < 0) { - pr_err_ratelimited("add group failed in pass through\n"); - return ret; - } - - spg = __sp_find_spg(current->pid, SPG_ID_DEFAULT); - - /* up_read will be at the end of sp_alloc */ - down_read(&spg->rw_lock); - if (!spg_valid(spg)) { - up_read(&spg->rw_lock); - sp_group_drop(spg); - pr_err_ratelimited("pass through allocation failed, spg is dead\n"); - return -ENODEV; - } - } else { - spg = spg_none; - } + if (spg_id != SPG_ID_DEFAULT) { + spg = __sp_find_spg(current->pid, spg_id); + if (!spg) { + pr_err_ratelimited("allocation failed, can't find group\n"); + return -ENODEV; } - } else { - if (spg_id != SPG_ID_DEFAULT) { - spg = __sp_find_spg(current->pid, spg_id); - if (!spg) { - pr_err_ratelimited("allocation failed, can't find group\n"); - return -ENODEV; - } - /* up_read will be at the end of sp_alloc */ - down_read(&spg->rw_lock); - if (!spg_valid(spg)) { - up_read(&spg->rw_lock); - sp_group_drop(spg); - pr_err_ratelimited("allocation failed, spg is dead\n"); - return -ENODEV; - } + /* up_read will be at the end of sp_alloc */ + down_read(&spg->rw_lock); + if (!spg_valid(spg)) { + up_read(&spg->rw_lock); + sp_group_drop(spg); + pr_err_ratelimited("allocation failed, spg is dead\n"); + return -ENODEV; + } - if (!is_process_in_group(spg, current->mm)) { - up_read(&spg->rw_lock); - sp_group_drop(spg); - pr_err_ratelimited("allocation failed, task not in group\n"); - return -ENODEV; - } - } else { /* alocation pass through scene */ - spg = spg_none; + if (!is_process_in_group(spg, current->mm)) { + up_read(&spg->rw_lock); + sp_group_drop(spg); + pr_err_ratelimited("allocation failed, task not in group\n"); + return -ENODEV; } + } else { /* alocation pass through scene */ + spg = spg_none; } if (sp_flags & SP_HUGEPAGE) { @@ -2914,33 +2861,12 @@ static int sp_k2u_prepare(unsigned long kva, unsigned long size, kc->size_aligned = size_aligned; kc->sp_flags = sp_flags; kc->spg_id = spg_id; - kc->to_task = false; - return 0; -} - -static int sp_check_k2task(struct sp_k2u_context *kc) -{ - int ret = 0; - int spg_id = kc->spg_id; - - if (share_pool_group_mode == SINGLE_GROUP_MODE) { - struct sp_group *spg = get_first_group(current->mm); + if (spg_id == SPG_ID_DEFAULT || spg_id == SPG_ID_NONE) + kc->to_task = true; + else + kc->to_task = false; - if (!spg) { - if (spg_id != SPG_ID_NONE && spg_id != SPG_ID_DEFAULT) - ret = -EINVAL; - else - kc->to_task = true; - } else { - if (spg_id != SPG_ID_DEFAULT && spg_id != spg->id) - ret = -EINVAL; - sp_group_drop(spg); - } - } else { - if (spg_id == SPG_ID_DEFAULT || spg_id == SPG_ID_NONE) - kc->to_task = true; - } - return ret; + return 0; } static void *sp_k2u_finish(void *uva, struct sp_k2u_context *kc) @@ -2985,12 +2911,6 @@ void *sp_make_share_k2u(unsigned long kva, unsigned long size, if (ret) return ERR_PTR(ret); - ret = sp_check_k2task(&kc); - if (ret) { - uva = ERR_PTR(ret); - goto out; - } - if (kc.to_task) uva = sp_make_share_kva_to_task(kc.kva_aligned, kc.size_aligned, kc.sp_flags); else { @@ -3738,13 +3658,6 @@ static int __init enable_share_k2u_to_group(char *s) } __setup("enable_sp_share_k2u_spg", enable_share_k2u_to_group); -static int __init enable_sp_multi_group_mode(char *s) -{ - share_pool_group_mode = MULTI_GROUP_MODE; - return 1; -} -__setup("enable_sp_multi_group_mode", enable_sp_multi_group_mode); - /*** Statistical and maintenance functions ***/ static void free_process_spg_proc_stat(struct sp_proc_stat *proc_stat) -- 2.25.1

1 13

[PATCH openEuler-22.03-LTS 1/2] ipmi/watchdog: replace atomic_add() and atomic_sub()
by Miaohe Lin 29 Jun '22

29 Jun '22

From: Yejune Deng <yejune.deng(a)gmail.com> mainline inclusion from v5.11-rc1 commit a01a89b1db1066a6af23ae08b9a0c345b7966f0b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5DVR9 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- atomic_inc() and atomic_dec() looks better Signed-off-by: Yejune Deng <yejune.deng(a)gmail.com> Message-Id: <1605511807-7135-1-git-send-email-yejune.deng(a)gmail.com> Signed-off-by: Corey Minyard <cminyard(a)mvista.com> Signed-off-by: Miaohe Lin <linmiaohe(a)huawei.com> --- drivers/char/ipmi/ipmi_watchdog.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c index f78156d93c3f..32c334e34d55 100644 --- a/drivers/char/ipmi/ipmi_watchdog.c +++ b/drivers/char/ipmi/ipmi_watchdog.c @@ -495,7 +495,7 @@ static void panic_halt_ipmi_heartbeat(void) msg.cmd = IPMI_WDOG_RESET_TIMER; msg.data = NULL; msg.data_len = 0; - atomic_add(1, &panic_done_count); + atomic_inc(&panic_done_count); rv = ipmi_request_supply_msgs(watchdog_user, (struct ipmi_addr *) &addr, 0, @@ -505,7 +505,7 @@ static void panic_halt_ipmi_heartbeat(void) &panic_halt_heartbeat_recv_msg, 1); if (rv) - atomic_sub(1, &panic_done_count); + atomic_dec(&panic_done_count); } static struct ipmi_smi_msg panic_halt_smi_msg = { @@ -529,12 +529,12 @@ static void panic_halt_ipmi_set_timeout(void) /* Wait for the messages to be free. */ while (atomic_read(&panic_done_count) != 0) ipmi_poll_interface(watchdog_user); - atomic_add(1, &panic_done_count); + atomic_inc(&panic_done_count); rv = __ipmi_set_timeout(&panic_halt_smi_msg, &panic_halt_recv_msg, &send_heartbeat_now); if (rv) { - atomic_sub(1, &panic_done_count); + atomic_dec(&panic_done_count); pr_warn("Unable to extend the watchdog timeout\n"); } else { if (send_heartbeat_now) -- 2.23.0

1 1

[PATCH openEuler-5.10-LTS 1/8] net: hns3: set port base vlan tbl_sta to false before removing old vlan
by Zheng Zengkai 28 Jun '22

28 Jun '22

From: Guangbin Huang <huangguangbin2(a)huawei.com> mainline inclusion from mainline-v5.19-rc1 commit 9eda7d8bcbdb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5DGNU CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- When modify port base vlan, the port base vlan tbl_sta needs to set to false before removing old vlan, to indicate this operation is not finish. Fixes: c0f46de30c96 ("net: hns3: fix port base vlan add fail when concurrent with reset") Signed-off-by: Guangbin Huang <huangguangbin2(a)huawei.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Jiantao Xiao <xiaojiantao1(a)h-partners.com> Reviewed-by: Jian Shen <shenjian15(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c index 3e0d8388ad3f..57aaa2f1536f 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c @@ -10117,6 +10117,7 @@ static int hclge_modify_port_base_vlan_tag(struct hclge_vport *vport, if (ret) return ret; + vport->port_base_vlan_cfg.tbl_sta = false; /* remove old VLAN tag */ if (old_info->vlan_tag == 0) ret = hclge_set_vf_vlan_common(hdev, vport->vport_id, -- 2.20.1

1 7

[PATCH OLK-5.10 v3 1/2] ipmi/watchdog: replace atomic_add() and atomic_sub()
by Miaohe Lin 28 Jun '22

28 Jun '22

From: Yejune Deng <yejune.deng(a)gmail.com> mainline inclusion from v5.11-rc1 commit a01a89b1db1066a6af23ae08b9a0c345b7966f0b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5DVR9 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- atomic_inc() and atomic_dec() looks better Signed-off-by: Yejune Deng <yejune.deng(a)gmail.com> Message-Id: <1605511807-7135-1-git-send-email-yejune.deng(a)gmail.com> Signed-off-by: Corey Minyard <cminyard(a)mvista.com> Signed-off-by: Miaohe Lin <linmiaohe(a)huawei.com> --- drivers/char/ipmi/ipmi_watchdog.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c index f78156d93c3f..32c334e34d55 100644 --- a/drivers/char/ipmi/ipmi_watchdog.c +++ b/drivers/char/ipmi/ipmi_watchdog.c @@ -495,7 +495,7 @@ static void panic_halt_ipmi_heartbeat(void) msg.cmd = IPMI_WDOG_RESET_TIMER; msg.data = NULL; msg.data_len = 0; - atomic_add(1, &panic_done_count); + atomic_inc(&panic_done_count); rv = ipmi_request_supply_msgs(watchdog_user, (struct ipmi_addr *) &addr, 0, @@ -505,7 +505,7 @@ static void panic_halt_ipmi_heartbeat(void) &panic_halt_heartbeat_recv_msg, 1); if (rv) - atomic_sub(1, &panic_done_count); + atomic_dec(&panic_done_count); } static struct ipmi_smi_msg panic_halt_smi_msg = { @@ -529,12 +529,12 @@ static void panic_halt_ipmi_set_timeout(void) /* Wait for the messages to be free. */ while (atomic_read(&panic_done_count) != 0) ipmi_poll_interface(watchdog_user); - atomic_add(1, &panic_done_count); + atomic_inc(&panic_done_count); rv = __ipmi_set_timeout(&panic_halt_smi_msg, &panic_halt_recv_msg, &send_heartbeat_now); if (rv) { - atomic_sub(1, &panic_done_count); + atomic_dec(&panic_done_count); pr_warn("Unable to extend the watchdog timeout\n"); } else { if (send_heartbeat_now) -- 2.23.0

1 1

[PATCH openEuler-5.10 1/5] lockdown: also lock down previous kgdb use
by Zheng Zengkai 28 Jun '22

28 Jun '22

From: Daniel Thompson <daniel.thompson(a)linaro.org> from stable-v5.10.119 commit a8f4d63142f947cd22fa615b8b3b8921cdaf4991 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5A5YP CVE: CVE-2022-21499 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… commit eadb2f47a3ced5c64b23b90fd2a3463f63726066 upstream. KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port (for example, via a hypervisor console, which some cloud vendors provide over the network) could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. Fix this by integrating lockdown into kdb's existing permissions mechanism. Unfortunately kgdb does not have any permissions mechanism (although it certainly could be added later) so, for now, kgdb is simply and brutally disabled by immediately exiting the gdb stub without taking any action. For lockdowns established early in the boot (e.g. the normal case) then this should be fine but on systems where kgdb has set breakpoints before the lockdown is enacted than "bad things" will happen. CVE: CVE-2022-21499 Co-developed-by: Stephen Brennan <stephen.s.brennan(a)oracle.com> Signed-off-by: Stephen Brennan <stephen.s.brennan(a)oracle.com> Reviewed-by: Douglas Anderson <dianders(a)chromium.org> Signed-off-by: Daniel Thompson <daniel.thompson(a)linaro.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/security.h | 2 ++ kernel/debug/debug_core.c | 24 ++++++++++++++ kernel/debug/kdb/kdb_main.c | 62 +++++++++++++++++++++++++++++++++++-- security/security.c | 2 ++ 4 files changed, 87 insertions(+), 3 deletions(-) diff --git a/include/linux/security.h b/include/linux/security.h index 35355429648e..330029ef7e89 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -121,10 +121,12 @@ enum lockdown_reason { LOCKDOWN_DEBUGFS, LOCKDOWN_XMON_WR, LOCKDOWN_BPF_WRITE_USER, + LOCKDOWN_DBG_WRITE_KERNEL, LOCKDOWN_INTEGRITY_MAX, LOCKDOWN_KCORE, LOCKDOWN_KPROBES, LOCKDOWN_BPF_READ, + LOCKDOWN_DBG_READ_KERNEL, LOCKDOWN_PERF, LOCKDOWN_TRACEFS, LOCKDOWN_XMON_RW, diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c index be5b6b97adbf..363f781b56ca 100644 --- a/kernel/debug/debug_core.c +++ b/kernel/debug/debug_core.c @@ -56,6 +56,7 @@ #include <linux/vmacache.h> #include <linux/rcupdate.h> #include <linux/irq.h> +#include <linux/security.h> #include <asm/cacheflush.h> #include <asm/byteorder.h> @@ -762,6 +763,29 @@ static int kgdb_cpu_enter(struct kgdb_state *ks, struct pt_regs *regs, continue; kgdb_connected = 0; } else { + /* + * This is a brutal way to interfere with the debugger + * and prevent gdb being used to poke at kernel memory. + * This could cause trouble if lockdown is applied when + * there is already an active gdb session. For now the + * answer is simply "don't do that". Typically lockdown + * *will* be applied before the debug core gets started + * so only developers using kgdb for fairly advanced + * early kernel debug can be biten by this. Hopefully + * they are sophisticated enough to take care of + * themselves, especially with help from the lockdown + * message printed on the console! + */ + if (security_locked_down(LOCKDOWN_DBG_WRITE_KERNEL)) { + if (IS_ENABLED(CONFIG_KGDB_KDB)) { + /* Switch back to kdb if possible... */ + dbg_kdb_mode = 1; + continue; + } else { + /* ... otherwise just bail */ + break; + } + } error = gdb_serial_stub(ks); } diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c index 930ac1b25ec7..4e09fab52faf 100644 --- a/kernel/debug/kdb/kdb_main.c +++ b/kernel/debug/kdb/kdb_main.c @@ -45,6 +45,7 @@ #include <linux/proc_fs.h> #include <linux/uaccess.h> #include <linux/slab.h> +#include <linux/security.h> #include "kdb_private.h" #undef MODULE_PARAM_PREFIX @@ -197,10 +198,62 @@ struct task_struct *kdb_curr_task(int cpu) } /* - * Check whether the flags of the current command and the permissions - * of the kdb console has allow a command to be run. + * Update the permissions flags (kdb_cmd_enabled) to match the + * current lockdown state. + * + * Within this function the calls to security_locked_down() are "lazy". We + * avoid calling them if the current value of kdb_cmd_enabled already excludes + * flags that might be subject to lockdown. Additionally we deliberately check + * the lockdown flags independently (even though read lockdown implies write + * lockdown) since that results in both simpler code and clearer messages to + * the user on first-time debugger entry. + * + * The permission masks during a read+write lockdown permits the following + * flags: INSPECT, SIGNAL, REBOOT (and ALWAYS_SAFE). + * + * The INSPECT commands are not blocked during lockdown because they are + * not arbitrary memory reads. INSPECT covers the backtrace family (sometimes + * forcing them to have no arguments) and lsmod. These commands do expose + * some kernel state but do not allow the developer seated at the console to + * choose what state is reported. SIGNAL and REBOOT should not be controversial, + * given these are allowed for root during lockdown already. + */ +static void kdb_check_for_lockdown(void) +{ + const int write_flags = KDB_ENABLE_MEM_WRITE | + KDB_ENABLE_REG_WRITE | + KDB_ENABLE_FLOW_CTRL; + const int read_flags = KDB_ENABLE_MEM_READ | + KDB_ENABLE_REG_READ; + + bool need_to_lockdown_write = false; + bool need_to_lockdown_read = false; + + if (kdb_cmd_enabled & (KDB_ENABLE_ALL | write_flags)) + need_to_lockdown_write = + security_locked_down(LOCKDOWN_DBG_WRITE_KERNEL); + + if (kdb_cmd_enabled & (KDB_ENABLE_ALL | read_flags)) + need_to_lockdown_read = + security_locked_down(LOCKDOWN_DBG_READ_KERNEL); + + /* De-compose KDB_ENABLE_ALL if required */ + if (need_to_lockdown_write || need_to_lockdown_read) + if (kdb_cmd_enabled & KDB_ENABLE_ALL) + kdb_cmd_enabled = KDB_ENABLE_MASK & ~KDB_ENABLE_ALL; + + if (need_to_lockdown_write) + kdb_cmd_enabled &= ~write_flags; + + if (need_to_lockdown_read) + kdb_cmd_enabled &= ~read_flags; +} + +/* + * Check whether the flags of the current command, the permissions of the kdb + * console and the lockdown state allow a command to be run. */ -static inline bool kdb_check_flags(kdb_cmdflags_t flags, int permissions, +static bool kdb_check_flags(kdb_cmdflags_t flags, int permissions, bool no_args) { /* permissions comes from userspace so needs massaging slightly */ @@ -1194,6 +1247,9 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs, kdb_curr_task(raw_smp_processor_id()); KDB_DEBUG_STATE("kdb_local 1", reason); + + kdb_check_for_lockdown(); + kdb_go_count = 0; if (reason == KDB_REASON_DEBUG) { /* special case below */ diff --git a/security/security.c b/security/security.c index 4fb58543eeb9..2fc40217d49d 100644 --- a/security/security.c +++ b/security/security.c @@ -59,10 +59,12 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { [LOCKDOWN_DEBUGFS] = "debugfs access", [LOCKDOWN_XMON_WR] = "xmon write access", [LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM", + [LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM", [LOCKDOWN_INTEGRITY_MAX] = "integrity", [LOCKDOWN_KCORE] = "/proc/kcore access", [LOCKDOWN_KPROBES] = "use of kprobes", [LOCKDOWN_BPF_READ] = "use of bpf to read kernel RAM", + [LOCKDOWN_DBG_READ_KERNEL] = "use of kgdb/kdb to read kernel RAM", [LOCKDOWN_PERF] = "unsafe use of perf", [LOCKDOWN_TRACEFS] = "use of tracefs", [LOCKDOWN_XMON_RW] = "xmon read and write access", -- 2.20.1

1 4

[PATCH openEuler-5.10 00/31] Backport 5.10.109 LTS
by Zheng Zengkai 28 Jun '22

28 Jun '22

Backport 5.10.109 LTS patches from upstream nds32: fix access_ok() checks in get/put_user wcn36xx: Differentiate wcn3660 from wcn3620 tpm: use try_get_ops() in tpm-space.c mac80211: fix potential double free on mesh join rcu: Don't deboost before reporting expedited quiescent state Revert "ath: add support for special 0x0 regulatory domain" crypto: qat - disable registration of algorithms ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board drivers: net: xgene: Fix regression in CRC stripping ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec ALSA: cmipci: Restore aux vol on suspend/resume ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB ALSA: pcm: Add stream lock during PCM reset ioctl operations ALSA: pcm: Fix races among concurrent prealloc proc writes ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls ALSA: pcm: Fix races among concurrent read/write and buffer changes ALSA: pcm: Fix races among concurrent hw_params and hw_free calls ALSA: hda/realtek: Add quirk for ASUS GA402 ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 ALSA: hda/realtek: Add quirk for Clevo NP50PNJ ALSA: hda/realtek: Add quirk for Clevo NP70PNJ ALSA: usb-audio: add mapping for new Corsair Virtuoso SE ALSA: oss: Fix PCM OSS buffer allocation overflow ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call staging: fbtft: fb_st7789v: reset display before initialization tpm: Fix error handling in async work cgroup-v1: Correct privileges check in release_agent writes exfat: avoid incorrectly releasing for root inode net: ipv6: fix skb_over_panic in __ip6_append_data Already merged: llc: only change llc->dev when bind() succeeds netfilter: nf_tables: initialize registers in nft_do_chain() llc: fix netdevice reference leaks in llc_ui_bind() cgroup: Use open-time cgroup namespace for process migration perm checks cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION Total patches: 37 - 6 = 31 Arnd Bergmann (1): nds32: fix access_ok() checks in get/put_user Brian Norris (1): Revert "ath: add support for special 0x0 regulatory domain" Bryan O'Donoghue (1): wcn36xx: Differentiate wcn3660 from wcn3620 Chen Li (1): exfat: avoid incorrectly releasing for root inode Giacomo Guiduzzi (1): ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec Giovanni Cabiddu (1): crypto: qat - disable registration of algorithms James Bottomley (1): tpm: use try_get_ops() in tpm-space.c Jason Zheng (1): ALSA: hda/realtek: Add quirk for ASUS GA402 Jonathan Teh (1): ALSA: cmipci: Restore aux vol on suspend/resume Lars-Peter Clausen (1): ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB Linus Lüssing (1): mac80211: fix potential double free on mesh join Mark Cilissen (1): ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board Maximilian Luz (1): ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 Michal Koutný (1): cgroup-v1: Correct privileges check in release_agent writes Oliver Graute (1): staging: fbtft: fb_st7789v: reset display before initialization Paul E. McKenney (1): rcu: Don't deboost before reporting expedited quiescent state Reza Jahanbakhshi (1): ALSA: usb-audio: add mapping for new Corsair Virtuoso SE Stephane Graber (1): drivers: net: xgene: Fix regression in CRC stripping Tadeusz Struk (2): net: ipv6: fix skb_over_panic in __ip6_append_data tpm: Fix error handling in async work Takashi Iwai (7): ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call ALSA: oss: Fix PCM OSS buffer allocation overflow ALSA: pcm: Fix races among concurrent hw_params and hw_free calls ALSA: pcm: Fix races among concurrent read/write and buffer changes ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls ALSA: pcm: Fix races among concurrent prealloc proc writes ALSA: pcm: Add stream lock during PCM reset ioctl operations Tim Crawford (2): ALSA: hda/realtek: Add quirk for Clevo NP70PNJ ALSA: hda/realtek: Add quirk for Clevo NP50PNJ Werner Sembach (1): ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU huangwenhui (1): ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 arch/nds32/include/asm/uaccess.h | 22 ++++- arch/x86/kernel/acpi/boot.c | 24 +++++ drivers/acpi/battery.c | 12 +++ drivers/acpi/video_detect.c | 75 ++++++++++++++ drivers/char/tpm/tpm-dev-common.c | 8 +- drivers/char/tpm/tpm2-space.c | 8 +- drivers/crypto/qat/qat_common/qat_crypto.c | 8 ++ .../net/ethernet/apm/xgene/xgene_enet_main.c | 12 ++- drivers/net/wireless/ath/regd.c | 10 +- drivers/net/wireless/ath/wcn36xx/main.c | 3 + drivers/net/wireless/ath/wcn36xx/wcn36xx.h | 1 + drivers/staging/fbtft/fb_st7789v.c | 2 + fs/exfat/super.c | 2 +- include/sound/pcm.h | 1 + kernel/cgroup/cgroup-v1.c | 6 +- kernel/rcu/tree_plugin.h | 9 +- net/ipv6/ip6_output.c | 4 +- net/mac80211/cfg.c | 3 - sound/core/oss/pcm_oss.c | 12 ++- sound/core/oss/pcm_plugin.c | 5 +- sound/core/pcm.c | 2 + sound/core/pcm_lib.c | 4 + sound/core/pcm_memory.c | 11 ++- sound/core/pcm_native.c | 97 ++++++++++++------- sound/pci/ac97/ac97_codec.c | 4 +- sound/pci/cmipci.c | 3 +- sound/pci/hda/patch_realtek.c | 4 + sound/soc/sti/uniperif_player.c | 6 +- sound/soc/sti/uniperif_reader.c | 2 +- sound/usb/mixer_maps.c | 10 ++ sound/usb/mixer_quirks.c | 7 +- 31 files changed, 289 insertions(+), 88 deletions(-) -- 2.20.1

1 31

[PATCH openEuler-1.0-LTS] io_uring: io_close: Set owner as current->files if req->work.files uninitialized
by Yongqiang Liu 28 Jun '22

28 Jun '22

From: Zhihao Cheng <chengzhihao1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186543, https://gitee.com/openeuler/kernel/issues/I5BGFA CVE: NA -------------------------------- Following process will trigger an use-after-free problem: 1. open /proc/sysvipc/msg and lock it by file lock fcntl_setlk do_lock_file_wait vfs_lock_file posix_lock_file locks_insert_lock_ctx locks_insert_global_locks // Added to lock list 2. Close /proc/sysvipc/msg by io_uring filp_close(close->put_file, req->work.files) // req->work.files equals NULL，io_grab_files() initialize it, non-async operations won't invokes the function. locks_remove_posix(filp, NULL) lock.fl_owner = NULL vfs_lock_file posix_lock_file posix_same_owner // Return false according to fl_owner. locks_delete_lock_ctx(fl, &dispose) and locks_dispose_list won't be executed, flock is not removed from lock list fput(filp) // release filp 3. Read /proc/locks seq_read locks_start // Get flock from lock list locks_show lock_get_status file_inode(f->file) // Access released file, UAF occurs! Fix it by passing current->files when req->work.files is uninitialized, because io-sq thread shares same files with uring_fd task, so it still works in SQPOLL mode. Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/io_uring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index c104425b2557..7ae8ba98e73b 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -3903,7 +3903,7 @@ static int io_close(struct io_kiocb *req, bool force_nonblock, } /* No ->flush() or already async, safely close from here */ - ret = filp_close(close->put_file, req->work.files); + ret = filp_close(close->put_file, req->work.files ? : current->files); if (ret < 0) req_set_fail_links(req); fput(close->put_file); -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS 1/5] lockdown: also lock down previous kgdb use
by Zheng Zengkai 27 Jun '22

27 Jun '22

From: Daniel Thompson <daniel.thompson(a)linaro.org> from stable-v5.10.119 commit a8f4d63142f947cd22fa615b8b3b8921cdaf4991 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5A5YP CVE: CVE-2022-21499 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… commit eadb2f47a3ced5c64b23b90fd2a3463f63726066 upstream. KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port (for example, via a hypervisor console, which some cloud vendors provide over the network) could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. Fix this by integrating lockdown into kdb's existing permissions mechanism. Unfortunately kgdb does not have any permissions mechanism (although it certainly could be added later) so, for now, kgdb is simply and brutally disabled by immediately exiting the gdb stub without taking any action. For lockdowns established early in the boot (e.g. the normal case) then this should be fine but on systems where kgdb has set breakpoints before the lockdown is enacted than "bad things" will happen. CVE: CVE-2022-21499 Co-developed-by: Stephen Brennan <stephen.s.brennan(a)oracle.com> Signed-off-by: Stephen Brennan <stephen.s.brennan(a)oracle.com> Reviewed-by: Douglas Anderson <dianders(a)chromium.org> Signed-off-by: Daniel Thompson <daniel.thompson(a)linaro.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/security.h | 2 ++ kernel/debug/debug_core.c | 24 ++++++++++++++ kernel/debug/kdb/kdb_main.c | 62 +++++++++++++++++++++++++++++++++++-- security/security.c | 2 ++ 4 files changed, 87 insertions(+), 3 deletions(-) diff --git a/include/linux/security.h b/include/linux/security.h index 35355429648e..330029ef7e89 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -121,10 +121,12 @@ enum lockdown_reason { LOCKDOWN_DEBUGFS, LOCKDOWN_XMON_WR, LOCKDOWN_BPF_WRITE_USER, + LOCKDOWN_DBG_WRITE_KERNEL, LOCKDOWN_INTEGRITY_MAX, LOCKDOWN_KCORE, LOCKDOWN_KPROBES, LOCKDOWN_BPF_READ, + LOCKDOWN_DBG_READ_KERNEL, LOCKDOWN_PERF, LOCKDOWN_TRACEFS, LOCKDOWN_XMON_RW, diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c index be5b6b97adbf..363f781b56ca 100644 --- a/kernel/debug/debug_core.c +++ b/kernel/debug/debug_core.c @@ -56,6 +56,7 @@ #include <linux/vmacache.h> #include <linux/rcupdate.h> #include <linux/irq.h> +#include <linux/security.h> #include <asm/cacheflush.h> #include <asm/byteorder.h> @@ -762,6 +763,29 @@ static int kgdb_cpu_enter(struct kgdb_state *ks, struct pt_regs *regs, continue; kgdb_connected = 0; } else { + /* + * This is a brutal way to interfere with the debugger + * and prevent gdb being used to poke at kernel memory. + * This could cause trouble if lockdown is applied when + * there is already an active gdb session. For now the + * answer is simply "don't do that". Typically lockdown + * *will* be applied before the debug core gets started + * so only developers using kgdb for fairly advanced + * early kernel debug can be biten by this. Hopefully + * they are sophisticated enough to take care of + * themselves, especially with help from the lockdown + * message printed on the console! + */ + if (security_locked_down(LOCKDOWN_DBG_WRITE_KERNEL)) { + if (IS_ENABLED(CONFIG_KGDB_KDB)) { + /* Switch back to kdb if possible... */ + dbg_kdb_mode = 1; + continue; + } else { + /* ... otherwise just bail */ + break; + } + } error = gdb_serial_stub(ks); } diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c index 930ac1b25ec7..4e09fab52faf 100644 --- a/kernel/debug/kdb/kdb_main.c +++ b/kernel/debug/kdb/kdb_main.c @@ -45,6 +45,7 @@ #include <linux/proc_fs.h> #include <linux/uaccess.h> #include <linux/slab.h> +#include <linux/security.h> #include "kdb_private.h" #undef MODULE_PARAM_PREFIX @@ -197,10 +198,62 @@ struct task_struct *kdb_curr_task(int cpu) } /* - * Check whether the flags of the current command and the permissions - * of the kdb console has allow a command to be run. + * Update the permissions flags (kdb_cmd_enabled) to match the + * current lockdown state. + * + * Within this function the calls to security_locked_down() are "lazy". We + * avoid calling them if the current value of kdb_cmd_enabled already excludes + * flags that might be subject to lockdown. Additionally we deliberately check + * the lockdown flags independently (even though read lockdown implies write + * lockdown) since that results in both simpler code and clearer messages to + * the user on first-time debugger entry. + * + * The permission masks during a read+write lockdown permits the following + * flags: INSPECT, SIGNAL, REBOOT (and ALWAYS_SAFE). + * + * The INSPECT commands are not blocked during lockdown because they are + * not arbitrary memory reads. INSPECT covers the backtrace family (sometimes + * forcing them to have no arguments) and lsmod. These commands do expose + * some kernel state but do not allow the developer seated at the console to + * choose what state is reported. SIGNAL and REBOOT should not be controversial, + * given these are allowed for root during lockdown already. + */ +static void kdb_check_for_lockdown(void) +{ + const int write_flags = KDB_ENABLE_MEM_WRITE | + KDB_ENABLE_REG_WRITE | + KDB_ENABLE_FLOW_CTRL; + const int read_flags = KDB_ENABLE_MEM_READ | + KDB_ENABLE_REG_READ; + + bool need_to_lockdown_write = false; + bool need_to_lockdown_read = false; + + if (kdb_cmd_enabled & (KDB_ENABLE_ALL | write_flags)) + need_to_lockdown_write = + security_locked_down(LOCKDOWN_DBG_WRITE_KERNEL); + + if (kdb_cmd_enabled & (KDB_ENABLE_ALL | read_flags)) + need_to_lockdown_read = + security_locked_down(LOCKDOWN_DBG_READ_KERNEL); + + /* De-compose KDB_ENABLE_ALL if required */ + if (need_to_lockdown_write || need_to_lockdown_read) + if (kdb_cmd_enabled & KDB_ENABLE_ALL) + kdb_cmd_enabled = KDB_ENABLE_MASK & ~KDB_ENABLE_ALL; + + if (need_to_lockdown_write) + kdb_cmd_enabled &= ~write_flags; + + if (need_to_lockdown_read) + kdb_cmd_enabled &= ~read_flags; +} + +/* + * Check whether the flags of the current command, the permissions of the kdb + * console and the lockdown state allow a command to be run. */ -static inline bool kdb_check_flags(kdb_cmdflags_t flags, int permissions, +static bool kdb_check_flags(kdb_cmdflags_t flags, int permissions, bool no_args) { /* permissions comes from userspace so needs massaging slightly */ @@ -1194,6 +1247,9 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs, kdb_curr_task(raw_smp_processor_id()); KDB_DEBUG_STATE("kdb_local 1", reason); + + kdb_check_for_lockdown(); + kdb_go_count = 0; if (reason == KDB_REASON_DEBUG) { /* special case below */ diff --git a/security/security.c b/security/security.c index 4fb58543eeb9..2fc40217d49d 100644 --- a/security/security.c +++ b/security/security.c @@ -59,10 +59,12 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { [LOCKDOWN_DEBUGFS] = "debugfs access", [LOCKDOWN_XMON_WR] = "xmon write access", [LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM", + [LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM", [LOCKDOWN_INTEGRITY_MAX] = "integrity", [LOCKDOWN_KCORE] = "/proc/kcore access", [LOCKDOWN_KPROBES] = "use of kprobes", [LOCKDOWN_BPF_READ] = "use of bpf to read kernel RAM", + [LOCKDOWN_DBG_READ_KERNEL] = "use of kgdb/kdb to read kernel RAM", [LOCKDOWN_PERF] = "unsafe use of perf", [LOCKDOWN_TRACEFS] = "use of tracefs", [LOCKDOWN_XMON_RW] = "xmon read and write access", -- 2.20.1

1 4

[PATCH openEuler-5.10-LTS 00/31] Backport 5.10.109 LTS
by Zheng Zengkai 27 Jun '22

27 Jun '22

Backport 5.10.109 LTS patches from upstream nds32: fix access_ok() checks in get/put_user wcn36xx: Differentiate wcn3660 from wcn3620 tpm: use try_get_ops() in tpm-space.c mac80211: fix potential double free on mesh join rcu: Don't deboost before reporting expedited quiescent state Revert "ath: add support for special 0x0 regulatory domain" crypto: qat - disable registration of algorithms ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board drivers: net: xgene: Fix regression in CRC stripping ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec ALSA: cmipci: Restore aux vol on suspend/resume ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB ALSA: pcm: Add stream lock during PCM reset ioctl operations ALSA: pcm: Fix races among concurrent prealloc proc writes ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls ALSA: pcm: Fix races among concurrent read/write and buffer changes ALSA: pcm: Fix races among concurrent hw_params and hw_free calls ALSA: hda/realtek: Add quirk for ASUS GA402 ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 ALSA: hda/realtek: Add quirk for Clevo NP50PNJ ALSA: hda/realtek: Add quirk for Clevo NP70PNJ ALSA: usb-audio: add mapping for new Corsair Virtuoso SE ALSA: oss: Fix PCM OSS buffer allocation overflow ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call staging: fbtft: fb_st7789v: reset display before initialization tpm: Fix error handling in async work cgroup-v1: Correct privileges check in release_agent writes exfat: avoid incorrectly releasing for root inode net: ipv6: fix skb_over_panic in __ip6_append_data Already merged: llc: only change llc->dev when bind() succeeds netfilter: nf_tables: initialize registers in nft_do_chain() llc: fix netdevice reference leaks in llc_ui_bind() cgroup: Use open-time cgroup namespace for process migration perm checks cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION Total patches: 37 - 6 = 31 Arnd Bergmann (1): nds32: fix access_ok() checks in get/put_user Brian Norris (1): Revert "ath: add support for special 0x0 regulatory domain" Bryan O'Donoghue (1): wcn36xx: Differentiate wcn3660 from wcn3620 Chen Li (1): exfat: avoid incorrectly releasing for root inode Giacomo Guiduzzi (1): ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec Giovanni Cabiddu (1): crypto: qat - disable registration of algorithms James Bottomley (1): tpm: use try_get_ops() in tpm-space.c Jason Zheng (1): ALSA: hda/realtek: Add quirk for ASUS GA402 Jonathan Teh (1): ALSA: cmipci: Restore aux vol on suspend/resume Lars-Peter Clausen (1): ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB Linus Lüssing (1): mac80211: fix potential double free on mesh join Mark Cilissen (1): ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board Maximilian Luz (1): ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 Michal Koutný (1): cgroup-v1: Correct privileges check in release_agent writes Oliver Graute (1): staging: fbtft: fb_st7789v: reset display before initialization Paul E. McKenney (1): rcu: Don't deboost before reporting expedited quiescent state Reza Jahanbakhshi (1): ALSA: usb-audio: add mapping for new Corsair Virtuoso SE Stephane Graber (1): drivers: net: xgene: Fix regression in CRC stripping Tadeusz Struk (2): net: ipv6: fix skb_over_panic in __ip6_append_data tpm: Fix error handling in async work Takashi Iwai (7): ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call ALSA: oss: Fix PCM OSS buffer allocation overflow ALSA: pcm: Fix races among concurrent hw_params and hw_free calls ALSA: pcm: Fix races among concurrent read/write and buffer changes ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls ALSA: pcm: Fix races among concurrent prealloc proc writes ALSA: pcm: Add stream lock during PCM reset ioctl operations Tim Crawford (2): ALSA: hda/realtek: Add quirk for Clevo NP70PNJ ALSA: hda/realtek: Add quirk for Clevo NP50PNJ Werner Sembach (1): ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU huangwenhui (1): ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 arch/nds32/include/asm/uaccess.h | 22 ++++- arch/x86/kernel/acpi/boot.c | 24 +++++ drivers/acpi/battery.c | 12 +++ drivers/acpi/video_detect.c | 75 ++++++++++++++ drivers/char/tpm/tpm-dev-common.c | 8 +- drivers/char/tpm/tpm2-space.c | 8 +- drivers/crypto/qat/qat_common/qat_crypto.c | 8 ++ .../net/ethernet/apm/xgene/xgene_enet_main.c | 12 ++- drivers/net/wireless/ath/regd.c | 10 +- drivers/net/wireless/ath/wcn36xx/main.c | 3 + drivers/net/wireless/ath/wcn36xx/wcn36xx.h | 1 + drivers/staging/fbtft/fb_st7789v.c | 2 + fs/exfat/super.c | 2 +- include/sound/pcm.h | 1 + kernel/cgroup/cgroup-v1.c | 6 +- kernel/rcu/tree_plugin.h | 9 +- net/ipv6/ip6_output.c | 4 +- net/mac80211/cfg.c | 3 - sound/core/oss/pcm_oss.c | 12 ++- sound/core/oss/pcm_plugin.c | 5 +- sound/core/pcm.c | 2 + sound/core/pcm_lib.c | 4 + sound/core/pcm_memory.c | 11 ++- sound/core/pcm_native.c | 97 ++++++++++++------- sound/pci/ac97/ac97_codec.c | 4 +- sound/pci/cmipci.c | 3 +- sound/pci/hda/patch_realtek.c | 4 + sound/soc/sti/uniperif_player.c | 6 +- sound/soc/sti/uniperif_reader.c | 2 +- sound/usb/mixer_maps.c | 10 ++ sound/usb/mixer_quirks.c | 7 +- 31 files changed, 289 insertions(+), 88 deletions(-) -- 2.20.1

1 31

[PATCH openEuler-1.0-LTS] mm/memcontrol: fix wrong vmstats for dying memcg
by Yongqiang Liu 27 Jun '22

27 Jun '22

From: Lu Jialin <lujialin4(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5E8LA CVE: NA -------------------------------- At present, only when the absolute value of stat_cpu->count exceeds MEMCG_CHARGE_BATCH will it be updated to stat, so there will always be a certain lag difference between stat and the correct value. In addition, since the partially deleted memcg is still referenced, it will not be freed immediately after it is offline. Although the remaining memcg has released the page, it and the parent's stat will still be not 0 or too large due to the update lag, which leads to the abnormality of the total_<count> parameter in the memory.stat file. This patch mainly solves the problem of synchronization between memcg's stat and the correct value during the destruction process from two aspects: 1) Perform a flush synchronization operation when memcg is offline 2) For memcg in the process of being destroyed, bypass the threshold judgment when updating vmstats Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/memcontrol.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 2983baf910f4..345a9d159ad8 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -697,7 +697,8 @@ void __mod_memcg_state(struct mem_cgroup *memcg, int idx, int val) return; x = val + __this_cpu_read(memcg->stat_cpu->count[idx]); - if (unlikely(abs(x) > MEMCG_CHARGE_BATCH)) { + if (unlikely(abs(x) > MEMCG_CHARGE_BATCH || + memcg->css.flags & CSS_DYING)) { struct mem_cgroup *mi; struct mem_cgroup_extension *memcg_ext; @@ -3244,8 +3245,10 @@ static void memcg_flush_percpu_vmstats(struct mem_cgroup *memcg) stat[i] = 0; for_each_online_cpu(cpu) - for (i = 0; i < MEMCG_NR_STAT; i++) + for (i = 0; i < MEMCG_NR_STAT; i++) { stat[i] += per_cpu(memcg->stat_cpu->count[i], cpu); + per_cpu(memcg->stat_cpu->count[i], cpu) = 0; + } for (mi = memcg; mi; mi = parent_mem_cgroup(mi)) for (i = 0; i < MEMCG_NR_STAT; i++) @@ -3259,9 +3262,11 @@ static void memcg_flush_percpu_vmstats(struct mem_cgroup *memcg) stat[i] = 0; for_each_online_cpu(cpu) - for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++) + for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++) { stat[i] += per_cpu( pn->lruvec_stat_cpu->count[i], cpu); + per_cpu(pn->lruvec_stat_cpu->count[i], cpu) = 0; + } for (pi = pn; pi; pi = parent_nodeinfo(pi, node)) for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++) @@ -3279,9 +3284,11 @@ static void memcg_flush_percpu_vmevents(struct mem_cgroup *memcg) events[i] = 0; for_each_online_cpu(cpu) - for (i = 0; i < NR_VM_EVENT_ITEMS; i++) + for (i = 0; i < NR_VM_EVENT_ITEMS; i++) { events[i] += per_cpu(memcg->stat_cpu->events[i], cpu); + per_cpu(memcg->stat_cpu->events[i], cpu) = 0; + } for (mi = memcg; mi; mi = parent_mem_cgroup(mi)) for (i = 0; i < NR_VM_EVENT_ITEMS; i++) @@ -5106,6 +5113,9 @@ static void mem_cgroup_css_offline(struct cgroup_subsys_state *css) memcg_offline_kmem(memcg); wb_memcg_offline(memcg); + memcg_flush_percpu_vmstats(memcg); + memcg_flush_percpu_vmevents(memcg); + mem_cgroup_id_put(memcg); } -- 2.25.1

1 0

sig-Intel-Arch 例会
by Tian, Jun J 27 Jun '22

27 Jun '22

大家好，本次Intel Arch例会定于本周二6/28 10:00-11:00AM进行, 欢迎大家提出更多需求或议题和参与讨论。本次初步议题： Agenda: *Status update *SPR feature PRs merge into intel-kernel & OLK-5.10 kernel *Compiler support for new instructions *Support 22.09 release for SPR fundamental features -----Original Appointment----- From: openEuler conference <public(a)openeuler.org> Sent: Monday, June 20, 2022 3:10 PM To: openEuler conference; jun.j.tian@intel.com,kai.liu@suse.com Subject: sig-Intel-Arch When: Tuesday, June 28, 2022 10:00 AM-11:00 AM (UTC+08:00) Beijing, Chongqing, Hong Kong, Urumqi. Where: 您好！ sig-Intel-Arch SIG 邀请您参加 2022-06-28 10:00 召开的Zoom会议会议主题：sig-Intel-Arch 会议链接：https://us06web.zoom.us/j/81976528831?pwd=cVIxUkRhUXFGcldFV0ZtNkpvUFpxZz09 会议纪要：https://etherpad.openeuler.org/p/sig-Intel-Arch-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler sig-Intel-Arch SIG invites you to attend the Zoom conference will be held at 2022-06-28 10:00, The subject of the conference is sig-Intel-Arch, You can join the meeting at https://us06web.zoom.us/j/81976528831?pwd=cVIxUkRhUXFGcldFV0ZtNkpvUFpxZz09. Add topics at https://etherpad.openeuler.org/p/sig-Intel-Arch-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] ext4: recover csum seed of tmp_inode after migrating to extents
by Yongqiang Liu 25 Jun '22

25 Jun '22

From: Li Lingfeng <lilingfeng3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186944, https://gitee.com/openeuler/kernel/issues/I5DAJY CVE: NA -------------------------------- When migrating to extents, the checksum seed of temporary inode need to be replaced by inode's, otherwise the inode checksums will be incorrect when swapping the inodes data. However, the temporary inode can not match it's checksum to itself since it has lost it's own checksum seed. mkfs.ext4 -F /dev/sdc mount /dev/sdc /mnt/sdc xfs_io -fc "pwrite 4k 4k" -c "fsync" /mnt/sdc/testfile chattr -e /mnt/sdc/testfile chattr +e /mnt/sdc/testfile fsck -fn /dev/sdc ======== ... Pass 1: Checking inodes, blocks, and sizes Inode 13 passes checks, but checksum does not match inode. Fix? no ... ======== The fix is simple, save the checksum seed of temporary inode, and recover it after migrating to extents. Fixes: e81c9302a6c3 ("ext4: set csum seed in tmp inode while migrating to extents") Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/migrate.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c index 75a769634b2b..ed9e7816efbb 100644 --- a/fs/ext4/migrate.c +++ b/fs/ext4/migrate.c @@ -415,7 +415,7 @@ int ext4_ext_migrate(struct inode *inode) struct inode *tmp_inode = NULL; struct migrate_struct lb; unsigned long max_entries; - __u32 goal; + __u32 goal, tmp_csum_seed; uid_t owner[2]; /* @@ -463,6 +463,7 @@ int ext4_ext_migrate(struct inode *inode) * the migration. */ ei = EXT4_I(inode); + tmp_csum_seed = EXT4_I(tmp_inode)->i_csum_seed; EXT4_I(tmp_inode)->i_csum_seed = ei->i_csum_seed; i_size_write(tmp_inode, i_size_read(inode)); /* @@ -573,6 +574,7 @@ int ext4_ext_migrate(struct inode *inode) * the inode is not visible to user space. */ tmp_inode->i_blocks = 0; + EXT4_I(tmp_inode)->i_csum_seed = tmp_csum_seed; /* Reset the extent details */ ext4_ext_tree_init(handle, tmp_inode); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] vfio: framework supporting vfio device hot migration
by RongWang 24 Jun '22

24 Jun '22

From: Rong Wang <w_angrong(a)163.com> kunpeng inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5CO9A CVE: NA --------------------------------- As pass through devices, hypervisor can`t control the status of device, and can`t track dirty memory DMA from device, during migration. The goal of this framework is to combine hardware to accomplish the task above. qemu |status control and dirty memory report vfio |ops to hardware hardware Signed-off-by: Rong Wang <w_angrong(a)163.com> Signed-off-by: HuHua Li <18245010845(a)163.com> Signed-off-by: Ripeng Qiu <965412048(a)qq.com> --- drivers/vfio/pci/Makefile | 2 +- drivers/vfio/pci/vfio_pci.c | 54 +++ drivers/vfio/pci/vfio_pci_migration.c | 755 ++++++++++++++++++++++++++++++++++ drivers/vfio/pci/vfio_pci_private.h | 14 +- drivers/vfio/vfio.c | 411 +++++++++++++++++- include/linux/vfio_pci_migration.h | 136 ++++++ 6 files changed, 1367 insertions(+), 5 deletions(-) create mode 100644 drivers/vfio/pci/vfio_pci_migration.c create mode 100644 include/linux/vfio_pci_migration.h diff --git a/drivers/vfio/pci/Makefile b/drivers/vfio/pci/Makefile index 76d8ec0..80a777d 100644 --- a/drivers/vfio/pci/Makefile +++ b/drivers/vfio/pci/Makefile @@ -1,5 +1,5 @@ -vfio-pci-y := vfio_pci.o vfio_pci_intrs.o vfio_pci_rdwr.o vfio_pci_config.o +vfio-pci-y := vfio_pci.o vfio_pci_intrs.o vfio_pci_rdwr.o vfio_pci_config.o vfio_pci_migration.o vfio-pci-$(CONFIG_VFIO_PCI_IGD) += vfio_pci_igd.o obj-$(CONFIG_VFIO_PCI) += vfio-pci.o diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c index 51b791c..59d8280 100644 --- a/drivers/vfio/pci/vfio_pci.c +++ b/drivers/vfio/pci/vfio_pci.c @@ -30,6 +30,7 @@ #include <linux/vgaarb.h> #include <linux/nospec.h> #include <linux/sched/mm.h> +#include <linux/vfio_pci_migration.h> #include "vfio_pci_private.h" @@ -296,6 +297,14 @@ static int vfio_pci_enable(struct vfio_pci_device *vdev) vfio_pci_probe_mmaps(vdev); + if (vfio_dev_migration_is_supported(pdev)) { + ret = vfio_pci_migration_init(vdev); + if (ret) { + dev_warn(&vdev->pdev->dev, "Failed to init vfio_pci_migration\n"); + vfio_pci_disable(vdev); + return ret; + } + } return 0; } @@ -392,6 +401,7 @@ static void vfio_pci_disable(struct vfio_pci_device *vdev) out: pci_disable_device(pdev); + vfio_pci_migration_exit(vdev); vfio_pci_try_bus_reset(vdev); if (!disable_idle_d3) @@ -642,6 +652,41 @@ struct vfio_devices { int max_index; }; +static long vfio_pci_handle_log_buf_ctl(struct vfio_pci_device *vdev, + const unsigned long arg) +{ + struct vfio_log_buf_ctl *log_buf_ctl = NULL; + struct vfio_log_buf_info *log_buf_info = NULL; + struct vf_migration_log_info migration_log_info; + long ret = 0; + + log_buf_ctl = (struct vfio_log_buf_ctl *)arg; + log_buf_info = (struct vfio_log_buf_info *)log_buf_ctl->data; + + switch (log_buf_ctl->flags) { + case VFIO_DEVICE_LOG_BUF_FLAG_START: + migration_log_info.dom_uuid = log_buf_info->uuid; + migration_log_info.buffer_size = + log_buf_info->buffer_size; + migration_log_info.sge_num = log_buf_info->addrs_size; + migration_log_info.sge_len = log_buf_info->frag_size; + migration_log_info.sgevec = log_buf_info->sgevec; + ret = vfio_pci_device_log_start(vdev, + &migration_log_info); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STOP: + ret = vfio_pci_device_log_stop(vdev, + log_buf_info->uuid); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY: + ret = vfio_pci_device_log_status_query(vdev); + break; + default: + ret = -EINVAL; + break; + } + return ret; +} static long vfio_pci_ioctl(void *device_data, unsigned int cmd, unsigned long arg) { @@ -1142,6 +1187,8 @@ static long vfio_pci_ioctl(void *device_data, return vfio_pci_ioeventfd(vdev, ioeventfd.offset, ioeventfd.data, count, ioeventfd.fd); + } else if (cmd == VFIO_DEVICE_LOG_BUF_CTL) { + return vfio_pci_handle_log_buf_ctl(vdev, arg); } return -ENOTTY; @@ -1566,6 +1613,9 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) pci_set_power_state(pdev, PCI_D3hot); } + if (vfio_dev_migration_is_supported(pdev)) + ret = vfio_pci_device_init(pdev); + return ret; } @@ -1591,6 +1641,10 @@ static void vfio_pci_remove(struct pci_dev *pdev) if (!disable_idle_d3) pci_set_power_state(pdev, PCI_D0); + + if (vfio_dev_migration_is_supported(pdev)) { + vfio_pci_device_uninit(pdev); + } } static pci_ers_result_t vfio_pci_aer_err_detected(struct pci_dev *pdev, diff --git a/drivers/vfio/pci/vfio_pci_migration.c b/drivers/vfio/pci/vfio_pci_migration.c new file mode 100644 index 0000000..f69cd13 --- /dev/null +++ b/drivers/vfio/pci/vfio_pci_migration.c @@ -0,0 +1,755 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (c) 2022 Huawei Technologies Co., Ltd. All rights reserved. + */ + +#include <linux/module.h> +#include <linux/io.h> +#include <linux/pci.h> +#include <linux/uaccess.h> +#include <linux/vfio.h> +#include <linux/vfio_pci_migration.h> + +#include "vfio_pci_private.h" + +static LIST_HEAD(vfio_pci_mig_drivers_list); +static DEFINE_MUTEX(vfio_pci_mig_drivers_mutex); + +static void vfio_pci_add_mig_drv(struct vfio_pci_vendor_mig_driver *mig_drv) +{ + mutex_lock(&vfio_pci_mig_drivers_mutex); + atomic_set(&mig_drv->count, 1); + list_add_tail(&mig_drv->list, &vfio_pci_mig_drivers_list); + mutex_unlock(&vfio_pci_mig_drivers_mutex); +} + +static void vfio_pci_remove_mig_drv(struct vfio_pci_vendor_mig_driver *mig_drv) +{ + mutex_lock(&vfio_pci_mig_drivers_mutex); + list_del(&mig_drv->list); + mutex_unlock(&vfio_pci_mig_drivers_mutex); +} + +static struct vfio_pci_vendor_mig_driver * + vfio_pci_find_mig_drv(struct pci_dev *pdev, struct module *module) +{ + struct vfio_pci_vendor_mig_driver *mig_drv = NULL; + + mutex_lock(&vfio_pci_mig_drivers_mutex); + list_for_each_entry(mig_drv, &vfio_pci_mig_drivers_list, list) { + if (mig_drv->owner == module) { + if (mig_drv->bus_num == pdev->bus->number) + goto out; + } + } + mig_drv = NULL; +out: + mutex_unlock(&vfio_pci_mig_drivers_mutex); + return mig_drv; +} + +static struct vfio_pci_vendor_mig_driver * + vfio_pci_get_mig_driver(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_drv = NULL; + struct pci_dev *pf_dev = pci_physfn(pdev); + + mutex_lock(&vfio_pci_mig_drivers_mutex); + list_for_each_entry(mig_drv, &vfio_pci_mig_drivers_list, list) { + if (mig_drv->bus_num == pf_dev->bus->number) + goto out; + } + mig_drv = NULL; +out: + mutex_unlock(&vfio_pci_mig_drivers_mutex); + return mig_drv; +} + +bool vfio_dev_migration_is_supported(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + mig_driver = vfio_pci_get_mig_driver(pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_warn(&pdev->dev, "unable to find a mig_drv module\n"); + return false; + } + + return true; +} + +int vfio_pci_device_log_start(struct vfio_pci_device *vdev, + struct vf_migration_log_info *log_info) +{ + struct vfio_pci_vendor_mig_driver *mig_driver; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&vdev->pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (!mig_driver->dev_mig_ops->log_start || + (mig_driver->dev_mig_ops->log_start(vdev->pdev, + log_info) != 0)) { + dev_err(&vdev->pdev->dev, "failed to set log start\n"); + return -EFAULT; + } + + return 0; +} + +int vfio_pci_device_log_stop(struct vfio_pci_device *vdev, uint32_t uuid) +{ + struct vfio_pci_vendor_mig_driver *mig_driver; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&vdev->pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (!mig_driver->dev_mig_ops->log_stop || + (mig_driver->dev_mig_ops->log_stop(vdev->pdev, uuid) != 0)) { + dev_err(&vdev->pdev->dev, "failed to set log stop\n"); + return -EFAULT; + } + + return 0; +} + +int vfio_pci_device_log_status_query(struct vfio_pci_device *vdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&vdev->pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (!mig_driver->dev_mig_ops->get_log_status || + (mig_driver->dev_mig_ops->get_log_status(vdev->pdev) != 0)) { + dev_err(&vdev->pdev->dev, "failed to get log status\n"); + return -EFAULT; + } + + return 0; +} + +int vfio_pci_device_init(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_drv; + + mig_drv = vfio_pci_get_mig_driver(pdev); + if (!mig_drv || !mig_drv->dev_mig_ops) { + dev_err(&pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (mig_drv->dev_mig_ops->init) + return mig_drv->dev_mig_ops->init(pdev); + + return -EFAULT; +} + +void vfio_pci_device_uninit(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_drv; + + mig_drv = vfio_pci_get_mig_driver(pdev); + if (!mig_drv || !mig_drv->dev_mig_ops) { + dev_err(&pdev->dev, "unable to find a mig_drv module\n"); + return; + } + + if (mig_drv->dev_mig_ops->uninit) + mig_drv->dev_mig_ops->uninit(pdev); +} + +static void vfio_pci_device_release(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (mig_drv->dev_mig_ops->release) + mig_drv->dev_mig_ops->release(pdev); +} + +static int vfio_pci_device_get_info(struct pci_dev *pdev, + struct vfio_device_migration_info *mig_info, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (mig_drv->dev_mig_ops->get_info) + return mig_drv->dev_mig_ops->get_info(pdev, mig_info); + return -EFAULT; +} + +static int vfio_pci_device_enable(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (!mig_drv->dev_mig_ops->enable || + (mig_drv->dev_mig_ops->enable(pdev) != 0)) { + return -EINVAL; + } + + return 0; +} + +static int vfio_pci_device_disable(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (!mig_drv->dev_mig_ops->disable || + (mig_drv->dev_mig_ops->disable(pdev) != 0)) + return -EINVAL; + + return 0; +} + +static int vfio_pci_device_pre_enable(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (!mig_drv->dev_mig_ops->pre_enable || + (mig_drv->dev_mig_ops->pre_enable(pdev) != 0)) + return -EINVAL; + + return 0; +} + +static int vfio_pci_device_state_save(struct pci_dev *pdev, + struct vfio_pci_migration_data *data) +{ + struct vfio_device_migration_info *mig_info = data->mig_ctl; + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + void *base = (void *)mig_info; + int ret = 0; + + if ((mig_info->device_state & VFIO_DEVICE_STATE_RUNNING) != 0) { + ret = vfio_pci_device_disable(pdev, mig_drv); + if (ret) { + dev_err(&pdev->dev, "failed to stop VF function!\n"); + return ret; + } + mig_info->device_state &= ~VFIO_DEVICE_STATE_RUNNING; + } + + if (mig_drv->dev_mig_ops && mig_drv->dev_mig_ops->save) { + ret = mig_drv->dev_mig_ops->save(pdev, base, + mig_info->data_offset, data->state_size); + if (ret) { + dev_err(&pdev->dev, "failed to save device state!\n"); + return -EINVAL; + } + } else { + return -EFAULT; + } + + mig_info->data_size = data->state_size; + mig_info->pending_bytes = mig_info->data_size; + return ret; +} + +static int vfio_pci_device_state_restore(struct vfio_pci_migration_data *data) +{ + struct vfio_device_migration_info *mig_info = data->mig_ctl; + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + struct pci_dev *pdev = data->vf_dev; + void *base = (void *)mig_info; + int ret; + + if (mig_drv->dev_mig_ops && mig_drv->dev_mig_ops->restore) { + ret = mig_drv->dev_mig_ops->restore(pdev, base, + mig_info->data_offset, mig_info->data_size); + if (ret) { + dev_err(&pdev->dev, "failed to restore device state!\n"); + return -EINVAL; + } + return 0; + } + + return -EFAULT; +} + +static int vfio_pci_set_device_state(struct vfio_pci_migration_data *data, + u32 state) +{ + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + struct pci_dev *pdev = data->vf_dev; + int ret = 0; + + if (state == mig_ctl->device_state) + return 0; + + if (!mig_drv->dev_mig_ops) + return -EINVAL; + + switch (state) { + case VFIO_DEVICE_STATE_RUNNING: + if (!(mig_ctl->device_state & + VFIO_DEVICE_STATE_RUNNING)) + ret = vfio_pci_device_enable(pdev, mig_drv); + break; + case VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RUNNING: + /* + * (pre-copy) - device should start logging data. + */ + ret = 0; + break; + case VFIO_DEVICE_STATE_SAVING: + /* stop the vf function, save state */ + ret = vfio_pci_device_state_save(pdev, data); + break; + case VFIO_DEVICE_STATE_STOP: + if (mig_ctl->device_state & VFIO_DEVICE_STATE_RUNNING) + ret = vfio_pci_device_disable(pdev, mig_drv); + break; + case VFIO_DEVICE_STATE_RESUMING: + ret = vfio_pci_device_pre_enable(pdev, mig_drv); + break; + default: + ret = -EFAULT; + break; + } + + if (ret) + return ret; + + mig_ctl->device_state = state; + return 0; +} + +static ssize_t vfio_pci_handle_mig_dev_state( + struct vfio_pci_migration_data *data, + char __user *buf, size_t count, bool iswrite) +{ + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + u32 device_state; + int ret; + + if (count != sizeof(device_state)) + return -EINVAL; + + if (iswrite) { + if (copy_from_user(&device_state, buf, count)) + return -EFAULT; + + ret = vfio_pci_set_device_state(data, device_state); + if (ret) + return ret; + } else { + if (copy_to_user(buf, &mig_ctl->device_state, count)) + return -EFAULT; + } + + return count; +} + +static ssize_t vfio_pci_handle_mig_pending_bytes( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u64 pending_bytes; + + if (count != sizeof(pending_bytes) || iswrite) + return -EINVAL; + + if (mig_info->device_state == + (VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RUNNING)) { + /* In pre-copy state we have no data to return for now, + * return 0 pending bytes + */ + pending_bytes = 0; + } else { + pending_bytes = mig_info->pending_bytes; + } + + if (copy_to_user(buf, &pending_bytes, count)) + return -EFAULT; + + return count; +} + +static ssize_t vfio_pci_handle_mig_data_offset( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u64 data_offset = mig_info->data_offset; + + if (count != sizeof(data_offset) || iswrite) + return -EINVAL; + + if (copy_to_user(buf, &data_offset, count)) + return -EFAULT; + + return count; +} + +static ssize_t vfio_pci_handle_mig_data_size( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u64 data_size; + + if (count != sizeof(data_size)) + return -EINVAL; + + if (iswrite) { + /* data_size is writable only during resuming state */ + if (mig_info->device_state != VFIO_DEVICE_STATE_RESUMING) + return -EINVAL; + + if (copy_from_user(&data_size, buf, sizeof(data_size))) + return -EFAULT; + + mig_info->data_size = data_size; + } else { + if (mig_info->device_state != VFIO_DEVICE_STATE_SAVING) + return -EINVAL; + + if (copy_to_user(buf, &mig_info->data_size, + sizeof(data_size))) + return -EFAULT; + } + + return count; +} + +static ssize_t vfio_pci_handle_mig_dev_cmd(struct vfio_pci_migration_data *data, + char __user *buf, size_t count, bool iswrite) +{ + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + struct pci_dev *pdev = data->vf_dev; + u32 device_cmd; + int ret = -EFAULT; + + if (count != sizeof(device_cmd) || !iswrite || !mig_drv->dev_mig_ops) + return -EINVAL; + + if (copy_from_user(&device_cmd, buf, count)) + return -EFAULT; + + switch (device_cmd) { + case VFIO_DEVICE_MIGRATION_CANCEL: + if (mig_drv->dev_mig_ops->cancel) + ret = mig_drv->dev_mig_ops->cancel(pdev); + break; + default: + dev_err(&pdev->dev, "cmd is invaild\n"); + return -EINVAL; + } + + if (ret != 0) + return ret; + + return count; +} + +static ssize_t vfio_pci_handle_mig_drv_version( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u32 version_id = mig_info->version_id; + + if (count != sizeof(version_id) || iswrite) + return -EINVAL; + + if (copy_to_user(buf, &version_id, count)) + return -EFAULT; + + return count; +} + +static ssize_t vfio_pci_handle_mig_data_rw( + struct vfio_pci_migration_data *data, + char __user *buf, size_t count, u64 pos, bool iswrite) +{ + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + void *data_addr = data->vf_data; + + if (count == 0) { + dev_err(&data->vf_dev->dev, "qemu operation data size error!\n"); + return -EINVAL; + } + + data_addr += pos - mig_ctl->data_offset; + if (iswrite) { + if (copy_from_user(data_addr, buf, count)) + return -EFAULT; + + mig_ctl->pending_bytes += count; + if (mig_ctl->pending_bytes > data->state_size) + return -EINVAL; + } else { + if (copy_to_user(buf, data_addr, count)) + return -EFAULT; + + if (mig_ctl->pending_bytes < count) + return -EINVAL; + + mig_ctl->pending_bytes -= count; + } + + return count; +} + +static ssize_t vfio_pci_dev_migrn_rw(struct vfio_pci_device *vdev, + char __user *buf, size_t count, loff_t *ppos, bool iswrite) +{ + unsigned int index = + VFIO_PCI_OFFSET_TO_INDEX(*ppos) - VFIO_PCI_NUM_REGIONS; + struct vfio_pci_migration_data *data = + (struct vfio_pci_migration_data *)vdev->region[index].data; + loff_t pos = *ppos & VFIO_PCI_OFFSET_MASK; + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + int ret; + + if (pos >= vdev->region[index].size) + return -EINVAL; + + count = min(count, (size_t)(vdev->region[index].size - pos)); + if (pos >= VFIO_MIGRATION_REGION_DATA_OFFSET) + return vfio_pci_handle_mig_data_rw(data, + buf, count, pos, iswrite); + + switch (pos) { + case VFIO_DEVICE_MIGRATION_OFFSET(device_state): + ret = vfio_pci_handle_mig_dev_state(data, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(pending_bytes): + ret = vfio_pci_handle_mig_pending_bytes(mig_ctl, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(data_offset): + ret = vfio_pci_handle_mig_data_offset(mig_ctl, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(data_size): + ret = vfio_pci_handle_mig_data_size(mig_ctl, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(device_cmd): + ret = vfio_pci_handle_mig_dev_cmd(data, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(version_id): + ret = vfio_pci_handle_mig_drv_version(mig_ctl, + buf, count, iswrite); + break; + default: + dev_err(&vdev->pdev->dev, "invalid pos offset\n"); + ret = -EFAULT; + break; + } + + if (mig_ctl->device_state == VFIO_DEVICE_STATE_RESUMING && + mig_ctl->pending_bytes == data->state_size && + mig_ctl->data_size == data->state_size) { + if (vfio_pci_device_state_restore(data) != 0) { + dev_err(&vdev->pdev->dev, "Failed to restore device state!\n"); + return -EFAULT; + } + mig_ctl->pending_bytes = 0; + mig_ctl->data_size = 0; + } + + return ret; +} + +static void vfio_pci_dev_migrn_release(struct vfio_pci_device *vdev, + struct vfio_pci_region *region) +{ + struct vfio_pci_migration_data *data = region->data; + + if (data) { + kfree(data->mig_ctl); + kfree(data); + } +} + +static const struct vfio_pci_regops vfio_pci_migration_regops = { + .rw = vfio_pci_dev_migrn_rw, + .release = vfio_pci_dev_migrn_release, +}; + +static int vfio_pci_migration_info_init(struct pci_dev *pdev, + struct vfio_device_migration_info *mig_info, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + int ret; + + ret = vfio_pci_device_get_info(pdev, mig_info, mig_drv); + if (ret) { + dev_err(&pdev->dev, "failed to get device info\n"); + return ret; + } + + if (mig_info->data_size > VFIO_MIGRATION_BUFFER_MAX_SIZE) { + dev_err(&pdev->dev, "mig_info->data_size %llu is invalid\n", + mig_info->data_size); + return -EINVAL; + } + + mig_info->data_offset = VFIO_MIGRATION_REGION_DATA_OFFSET; + return ret; +} + +static int vfio_device_mig_data_init(struct vfio_pci_device *vdev, + struct vfio_pci_migration_data *data) +{ + struct vfio_device_migration_info *mig_ctl; + u64 mig_offset; + int ret; + + mig_ctl = kzalloc(sizeof(*mig_ctl), GFP_KERNEL); + if (!mig_ctl) + return -ENOMEM; + + ret = vfio_pci_migration_info_init(vdev->pdev, mig_ctl, + data->mig_driver); + if (ret) { + dev_err(&vdev->pdev->dev, "get device info error!\n"); + goto err; + } + + mig_offset = sizeof(struct vfio_device_migration_info); + data->state_size = mig_ctl->data_size; + data->mig_ctl = krealloc(mig_ctl, mig_offset + data->state_size, + GFP_KERNEL); + if (!data->mig_ctl) { + ret = -ENOMEM; + goto err; + } + + data->vf_data = (void *)((char *)data->mig_ctl + mig_offset); + memset(data->vf_data, 0, data->state_size); + data->mig_ctl->data_size = 0; + + ret = vfio_pci_register_dev_region(vdev, VFIO_REGION_TYPE_MIGRATION, + VFIO_REGION_SUBTYPE_MIGRATION, + &vfio_pci_migration_regops, mig_offset + data->state_size, + VFIO_REGION_INFO_FLAG_READ | VFIO_REGION_INFO_FLAG_WRITE, data); + if (ret) { + kfree(data->mig_ctl); + return ret; + } + + return 0; +err: + kfree(mig_ctl); + return ret; +} + +int vfio_pci_migration_init(struct vfio_pci_device *vdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + struct vfio_pci_migration_data *data = NULL; + struct pci_dev *pdev = vdev->pdev; + int ret; + + mig_driver = vfio_pci_get_mig_driver(pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&pdev->dev, "unable to find a mig_driver module\n"); + return -EINVAL; + } + + if (!try_module_get(mig_driver->owner)) { + pr_err("module %s is not live\n", mig_driver->owner->name); + return -ENODEV; + } + + data = kzalloc(sizeof(*data), GFP_KERNEL); + if (!data) { + module_put(mig_driver->owner); + return -ENOMEM; + } + + data->mig_driver = mig_driver; + data->vf_dev = pdev; + + ret = vfio_device_mig_data_init(vdev, data); + if (ret) { + dev_err(&pdev->dev, "failed to init vfio device migration data!\n"); + goto err; + } + + return ret; +err: + kfree(data); + module_put(mig_driver->owner); + return ret; +} + +void vfio_pci_migration_exit(struct vfio_pci_device *vdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_warn(&vdev->pdev->dev, "mig_driver is not found\n"); + return; + } + + if (module_refcount(mig_driver->owner) > 0) { + vfio_pci_device_release(vdev->pdev, mig_driver); + module_put(mig_driver->owner); + } +} + +int vfio_pci_register_migration_ops(struct vfio_device_migration_ops *ops, + struct module *mod, struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + if (!ops || !mod || !pdev) + return -EINVAL; + + mig_driver = vfio_pci_find_mig_drv(pdev, mod); + if (mig_driver) { + pr_info("%s migration ops has already been registered\n", + mod->name); + atomic_add(1, &mig_driver->count); + return 0; + } + + if (!try_module_get(THIS_MODULE)) + return -ENODEV; + + mig_driver = kzalloc(sizeof(*mig_driver), GFP_KERNEL); + if (!mig_driver) { + module_put(THIS_MODULE); + return -ENOMEM; + } + + mig_driver->pdev = pdev; + mig_driver->bus_num = pdev->bus->number; + mig_driver->owner = mod; + mig_driver->dev_mig_ops = ops; + + vfio_pci_add_mig_drv(mig_driver); + + return 0; +} +EXPORT_SYMBOL_GPL(vfio_pci_register_migration_ops); + +void vfio_pci_unregister_migration_ops(struct module *mod, struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + if (!mod || !pdev) + return; + + mig_driver = vfio_pci_find_mig_drv(pdev, mod); + if (!mig_driver) { + pr_err("mig_driver is not found\n"); + return; + } + + if (atomic_sub_and_test(1, &mig_driver->count)) { + vfio_pci_remove_mig_drv(mig_driver); + kfree(mig_driver); + module_put(THIS_MODULE); + pr_info("%s succeed to unregister migration ops\n", + THIS_MODULE->name); + } +} +EXPORT_SYMBOL_GPL(vfio_pci_unregister_migration_ops); diff --git a/drivers/vfio/pci/vfio_pci_private.h b/drivers/vfio/pci/vfio_pci_private.h index 17d2bae..03af269 100644 --- a/drivers/vfio/pci/vfio_pci_private.h +++ b/drivers/vfio/pci/vfio_pci_private.h @@ -15,6 +15,7 @@ #include <linux/pci.h> #include <linux/irqbypass.h> #include <linux/types.h> +#include <linux/vfio_pci_migration.h> #ifndef VFIO_PCI_PRIVATE_H #define VFIO_PCI_PRIVATE_H @@ -55,7 +56,7 @@ struct vfio_pci_irq_ctx { struct vfio_pci_region; struct vfio_pci_regops { - size_t (*rw)(struct vfio_pci_device *vdev, char __user *buf, + ssize_t (*rw)(struct vfio_pci_device *vdev, char __user *buf, size_t count, loff_t *ppos, bool iswrite); void (*release)(struct vfio_pci_device *vdev, struct vfio_pci_region *region); @@ -173,4 +174,15 @@ static inline int vfio_pci_igd_init(struct vfio_pci_device *vdev) return -ENODEV; } #endif + +extern bool vfio_dev_migration_is_supported(struct pci_dev *pdev); +extern int vfio_pci_migration_init(struct vfio_pci_device *vdev); +extern void vfio_pci_migration_exit(struct vfio_pci_device *vdev); +extern int vfio_pci_device_log_start(struct vfio_pci_device *vdev, + struct vf_migration_log_info *log_info); +extern int vfio_pci_device_log_stop(struct vfio_pci_device *vdev, + uint32_t uuid); +extern int vfio_pci_device_log_status_query(struct vfio_pci_device *vdev); +extern int vfio_pci_device_init(struct pci_dev *pdev); +extern void vfio_pci_device_uninit(struct pci_dev *pdev); #endif /* VFIO_PCI_PRIVATE_H */ diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c index 7a386fb..35f2a29 100644 --- a/drivers/vfio/vfio.c +++ b/drivers/vfio/vfio.c @@ -33,6 +33,7 @@ #include <linux/string.h> #include <linux/uaccess.h> #include <linux/vfio.h> +#include <linux/vfio_pci_migration.h> #include <linux/wait.h> #include <linux/sched/signal.h> @@ -40,6 +41,9 @@ #define DRIVER_AUTHOR "Alex Williamson <alex.williamson(a)redhat.com>" #define DRIVER_DESC "VFIO - User Level meta-driver" +#define LOG_BUF_FRAG_SIZE (2 * 1024 * 1024) // fix to 2M +#define LOG_BUF_MAX_ADDRS_SIZE 128 // max vm ram size is 1T + static struct vfio { struct class *class; struct list_head iommu_drivers_list; @@ -57,6 +61,14 @@ struct vfio_iommu_driver { struct list_head vfio_next; }; +struct vfio_log_buf { + struct vfio_log_buf_info info; + int fd; + int buffer_state; + int device_state; + unsigned long *cpu_addrs; +}; + struct vfio_container { struct kref kref; struct list_head group_list; @@ -64,6 +76,7 @@ struct vfio_container { struct vfio_iommu_driver *iommu_driver; void *iommu_data; bool noiommu; + struct vfio_log_buf log_buf; }; struct vfio_unbound_dev { @@ -1158,8 +1171,398 @@ static long vfio_ioctl_set_iommu(struct vfio_container *container, return ret; } +static long vfio_dispatch_cmd_to_devices(const struct vfio_container *container, + unsigned int cmd, unsigned long arg) +{ + struct vfio_group *group = NULL; + struct vfio_device *device = NULL; + long ret = -ENXIO; + + list_for_each_entry(group, &container->group_list, container_next) { + list_for_each_entry(device, &group->device_list, group_next) { + ret = device->ops->ioctl(device->device_data, cmd, arg); + if (ret) { + pr_err("dispatch cmd to devices failed\n"); + return ret; + } + } + } + return ret; +} + +static long vfio_log_buf_start(struct vfio_container *container) +{ + struct vfio_log_buf_ctl log_buf_ctl; + long ret; + + log_buf_ctl.argsz = sizeof(struct vfio_log_buf_info); + log_buf_ctl.flags = VFIO_DEVICE_LOG_BUF_FLAG_START; + log_buf_ctl.data = (void *)&container->log_buf.info; + ret = vfio_dispatch_cmd_to_devices(container, VFIO_DEVICE_LOG_BUF_CTL, + (unsigned long)&log_buf_ctl); + if (ret) + return ret; + + container->log_buf.device_state = 1; + return 0; +} + +static long vfio_log_buf_stop(struct vfio_container *container) +{ + struct vfio_log_buf_ctl log_buf_ctl; + long ret; + + if (container->log_buf.device_state == 0) { + pr_warn("device already stopped\n"); + return 0; + } + + log_buf_ctl.argsz = sizeof(struct vfio_log_buf_info); + log_buf_ctl.flags = VFIO_DEVICE_LOG_BUF_FLAG_STOP; + log_buf_ctl.data = (void *)&container->log_buf.info; + ret = vfio_dispatch_cmd_to_devices(container, VFIO_DEVICE_LOG_BUF_CTL, + (unsigned long)&log_buf_ctl); + if (ret) + return ret; + + container->log_buf.device_state = 0; + return 0; +} + +static long vfio_log_buf_query(struct vfio_container *container) +{ + struct vfio_log_buf_ctl log_buf_ctl; + + log_buf_ctl.argsz = sizeof(struct vfio_log_buf_info); + log_buf_ctl.flags = VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY; + log_buf_ctl.data = (void *)&container->log_buf.info; + + return vfio_dispatch_cmd_to_devices(container, + VFIO_DEVICE_LOG_BUF_CTL, (unsigned long)&log_buf_ctl); +} + +static int vfio_log_buf_fops_mmap(struct file *filep, + struct vm_area_struct *vma) +{ + struct vfio_container *container = filep->private_data; + struct vfio_log_buf *log_buf = &container->log_buf; + unsigned long frag_pg_size; + unsigned long frag_offset; + phys_addr_t pa; + int ret = -EINVAL; + + if (!log_buf->cpu_addrs) { + pr_err("mmap before setup, please setup log buf first\n"); + return ret; + } + + if (log_buf->info.frag_size < PAGE_SIZE) { + pr_err("mmap frag size should not less than page size!\n"); + return ret; + } + + frag_pg_size = log_buf->info.frag_size / PAGE_SIZE; + frag_offset = vma->vm_pgoff / frag_pg_size; + + if (frag_offset >= log_buf->info.addrs_size) { + pr_err("mmap offset out of range!\n"); + return ret; + } + + if (vma->vm_end - vma->vm_start != log_buf->info.frag_size) { + pr_err("mmap size error, should be aligned with frag size!\n"); + return ret; + } + + pa = virt_to_phys((void *)log_buf->cpu_addrs[frag_offset]); + ret = remap_pfn_range(vma, vma->vm_start, + pa >> PAGE_SHIFT, + vma->vm_end - vma->vm_start, + vma->vm_page_prot); + if (ret) + pr_err("remap_pfn_range error!\n"); + return ret; +} + +static struct device *vfio_get_dev(struct vfio_container *container) +{ + struct vfio_group *group = NULL; + struct vfio_device *device = NULL; + + list_for_each_entry(group, &container->group_list, container_next) { + list_for_each_entry(device, &group->device_list, group_next) { + return device->dev; + } + } + return NULL; +} + +static void vfio_log_buf_release_dma(struct device *dev, + struct vfio_log_buf *log_buf) +{ + int i; + + for (i = 0; i < log_buf->info.addrs_size; i++) { + if ((log_buf->cpu_addrs && log_buf->cpu_addrs[i] != 0) && + (log_buf->info.sgevec && + log_buf->info.sgevec[i].addr != 0)) { + dma_free_coherent(dev, log_buf->info.frag_size, + (void *)log_buf->cpu_addrs[i], + log_buf->info.sgevec[i].addr); + log_buf->cpu_addrs[i] = 0; + log_buf->info.sgevec[i].addr = 0; + } + } +} + +static long vfio_log_buf_alloc_dma(struct vfio_log_buf_info *info, + struct vfio_log_buf *log_buf, struct device *dev) +{ + int i; + + for (i = 0; i < info->addrs_size; i++) { + log_buf->cpu_addrs[i] = (unsigned long)dma_alloc_coherent(dev, + info->frag_size, &log_buf->info.sgevec[i].addr, + GFP_KERNEL); + log_buf->info.sgevec[i].len = info->frag_size; + if (log_buf->cpu_addrs[i] == 0 || + log_buf->info.sgevec[i].addr == 0) { + return -ENOMEM; + } + } + return 0; +} + +static long vfio_log_buf_alloc_addrs(struct vfio_log_buf_info *info, + struct vfio_log_buf *log_buf) +{ + log_buf->info.sgevec = kcalloc(info->addrs_size, + sizeof(struct vfio_log_buf_sge), GFP_KERNEL); + if (!log_buf->info.sgevec) + return -ENOMEM; + + log_buf->cpu_addrs = kcalloc(info->addrs_size, + sizeof(unsigned long), GFP_KERNEL); + if (!log_buf->cpu_addrs) { + kfree(log_buf->info.sgevec); + log_buf->info.sgevec = NULL; + return -ENOMEM; + } + + return 0; +} + +static long vfio_log_buf_info_valid(struct vfio_log_buf_info *info) +{ + if (info->addrs_size > LOG_BUF_MAX_ADDRS_SIZE || + info->addrs_size == 0) { + pr_err("can`t support vm ram size larger than 1T or equal to 0\n"); + return -EINVAL; + } + if (info->frag_size != LOG_BUF_FRAG_SIZE) { + pr_err("only support %d frag size\n", LOG_BUF_FRAG_SIZE); + return -EINVAL; + } + return 0; +} + +static long vfio_log_buf_setup(struct vfio_container *container, + unsigned long data) +{ + struct vfio_log_buf_info info; + struct vfio_log_buf *log_buf = &container->log_buf; + struct device *dev = NULL; + long ret; + + if (log_buf->info.sgevec) { + pr_warn("log buf already setup\n"); + return 0; + } + + if (copy_from_user(&info, (void __user *)data, + sizeof(struct vfio_log_buf_info))) + return -EFAULT; + + ret = vfio_log_buf_info_valid(&info); + if (ret) + return ret; + + ret = vfio_log_buf_alloc_addrs(&info, log_buf); + if (ret) + goto err_out; + + dev = vfio_get_dev(container); + if (!dev) { + pr_err("can`t get dev\n"); + goto err_free_addrs; + } + + ret = vfio_log_buf_alloc_dma(&info, log_buf, dev); + if (ret) + goto err_free_dma_array; + + log_buf->info.uuid = info.uuid; + log_buf->info.buffer_size = info.buffer_size; + log_buf->info.frag_size = info.frag_size; + log_buf->info.addrs_size = info.addrs_size; + log_buf->buffer_state = 1; + return 0; + +err_free_dma_array: + vfio_log_buf_release_dma(dev, log_buf); +err_free_addrs: + kfree(log_buf->cpu_addrs); + log_buf->cpu_addrs = NULL; + kfree(log_buf->info.sgevec); + log_buf->info.sgevec = NULL; +err_out: + return -ENOMEM; +} + +static long vfio_log_buf_release_buffer(struct vfio_container *container) +{ + struct vfio_log_buf *log_buf = &container->log_buf; + struct device *dev = NULL; + + if (log_buf->buffer_state == 0) { + pr_warn("buffer already released\n"); + return 0; + } + + dev = vfio_get_dev(container); + if (!dev) { + pr_err("can`t get dev\n"); + return -EFAULT; + } + + vfio_log_buf_release_dma(dev, log_buf); + + kfree(log_buf->cpu_addrs); + log_buf->cpu_addrs = NULL; + + kfree(log_buf->info.sgevec); + log_buf->info.sgevec = NULL; + + log_buf->buffer_state = 0; + return 0; +} + +static int vfio_log_buf_release(struct inode *inode, struct file *filep) +{ + struct vfio_container *container = filep->private_data; + + vfio_log_buf_stop(container); + vfio_log_buf_release_buffer(container); + memset(&container->log_buf, 0, sizeof(struct vfio_log_buf)); + return 0; +} + +static long vfio_ioctl_handle_log_buf_ctl(struct vfio_container *container, + unsigned long arg) +{ + struct vfio_log_buf_ctl log_buf_ctl; + long ret = 0; + + if (copy_from_user(&log_buf_ctl, (void __user *)arg, + sizeof(struct vfio_log_buf_ctl))) + return -EFAULT; + + switch (log_buf_ctl.flags) { + case VFIO_DEVICE_LOG_BUF_FLAG_SETUP: + ret = vfio_log_buf_setup(container, + (unsigned long)log_buf_ctl.data); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_RELEASE: + ret = vfio_log_buf_release_buffer(container); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_START: + ret = vfio_log_buf_start(container); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STOP: + ret = vfio_log_buf_stop(container); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY: + ret = vfio_log_buf_query(container); + break; + default: + pr_err("log buf control flag incorrect\n"); + ret = -EINVAL; + break; + } + return ret; +} + +static long vfio_log_buf_fops_unl_ioctl(struct file *filep, + unsigned int cmd, unsigned long arg) +{ + struct vfio_container *container = filep->private_data; + long ret = -EINVAL; + + switch (cmd) { + case VFIO_LOG_BUF_CTL: + ret = vfio_ioctl_handle_log_buf_ctl(container, arg); + break; + default: + pr_err("log buf control cmd incorrect\n"); + break; + } + + return ret; +} + +#ifdef CONFIG_COMPAT +static long vfio_log_buf_fops_compat_ioctl(struct file *filep, + unsigned int cmd, unsigned long arg) +{ + arg = (unsigned long)compat_ptr(arg); + return vfio_log_buf_fops_unl_ioctl(filep, cmd, arg); +} +#endif /* CONFIG_COMPAT */ + +static const struct file_operations vfio_log_buf_fops = { + .owner = THIS_MODULE, + .mmap = vfio_log_buf_fops_mmap, + .unlocked_ioctl = vfio_log_buf_fops_unl_ioctl, + .release = vfio_log_buf_release, +#ifdef CONFIG_COMPAT + .compat_ioctl = vfio_log_buf_fops_compat_ioctl, +#endif +}; + +static int vfio_get_log_buf_fd(struct vfio_container *container, + unsigned long arg) +{ + struct file *filep = NULL; + int ret; + + if (container->log_buf.fd > 0) + return container->log_buf.fd; + + ret = get_unused_fd_flags(O_CLOEXEC); + if (ret < 0) { + pr_err("get_unused_fd_flags get fd failed\n"); + return ret; + } + + filep = anon_inode_getfile("[vfio-log-buf]", &vfio_log_buf_fops, + container, O_RDWR); + if (IS_ERR(filep)) { + pr_err("anon_inode_getfile failed\n"); + put_unused_fd(ret); + ret = PTR_ERR(filep); + return ret; + } + + filep->f_mode |= (FMODE_READ | FMODE_WRITE | FMODE_LSEEK); + + fd_install(ret, filep); + + container->log_buf.fd = ret; + return ret; +} + static long vfio_fops_unl_ioctl(struct file *filep, - unsigned int cmd, unsigned long arg) + unsigned int cmd, unsigned long arg) { struct vfio_container *container = filep->private_data; struct vfio_iommu_driver *driver; @@ -1179,6 +1582,9 @@ static long vfio_fops_unl_ioctl(struct file *filep, case VFIO_SET_IOMMU: ret = vfio_ioctl_set_iommu(container, arg); break; + case VFIO_GET_LOG_BUF_FD: + ret = vfio_get_log_buf_fd(container, arg); + break; default: driver = container->iommu_driver; data = container->iommu_data; @@ -1210,6 +1616,7 @@ static int vfio_fops_open(struct inode *inode, struct file *filep) INIT_LIST_HEAD(&container->group_list); init_rwsem(&container->group_lock); kref_init(&container->kref); + memset(&container->log_buf, 0, sizeof(struct vfio_log_buf)); filep->private_data = container; @@ -1219,9 +1626,7 @@ static int vfio_fops_open(struct inode *inode, struct file *filep) static int vfio_fops_release(struct inode *inode, struct file *filep) { struct vfio_container *container = filep->private_data; - filep->private_data = NULL; - vfio_container_put(container); return 0; diff --git a/include/linux/vfio_pci_migration.h b/include/linux/vfio_pci_migration.h new file mode 100644 index 0000000..464ffb4 --- /dev/null +++ b/include/linux/vfio_pci_migration.h @@ -0,0 +1,136 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (c) 2022 Huawei Technologies Co., Ltd. All rights reserved. + */ + +#ifndef VFIO_PCI_MIGRATION_H +#define VFIO_PCI_MIGRATION_H + +#include <linux/types.h> +#include <linux/pci.h> + +#define VFIO_REGION_TYPE_MIGRATION (3) +/* sub-types for VFIO_REGION_TYPE_MIGRATION */ +#define VFIO_REGION_SUBTYPE_MIGRATION (1) + +#define VFIO_MIGRATION_BUFFER_MAX_SIZE SZ_256K +#define VFIO_MIGRATION_REGION_DATA_OFFSET \ + (sizeof(struct vfio_device_migration_info)) +#define VFIO_DEVICE_MIGRATION_OFFSET(x) \ + offsetof(struct vfio_device_migration_info, x) + +struct vfio_device_migration_info { + __u32 device_state; /* VFIO device state */ +#define VFIO_DEVICE_STATE_STOP (0) +#define VFIO_DEVICE_STATE_RUNNING (1 << 0) +#define VFIO_DEVICE_STATE_SAVING (1 << 1) +#define VFIO_DEVICE_STATE_RESUMING (1 << 2) +#define VFIO_DEVICE_STATE_MASK (VFIO_DEVICE_STATE_RUNNING | \ + VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RESUMING) + __u32 reserved; + + __u32 device_cmd; + __u32 version_id; + + __u64 pending_bytes; + __u64 data_offset; + __u64 data_size; +}; + +enum { + VFIO_DEVICE_STOP = 0xffff0001, + VFIO_DEVICE_CONTINUE, + VFIO_DEVICE_MIGRATION_CANCEL, +}; + +struct vfio_log_buf_sge { + __u64 len; + __u64 addr; +}; + +struct vfio_log_buf_info { + __u32 uuid; + __u64 buffer_size; + __u64 addrs_size; + __u64 frag_size; + struct vfio_log_buf_sge *sgevec; +}; + +struct vfio_log_buf_ctl { + __u32 argsz; + __u32 flags; + #define VFIO_DEVICE_LOG_BUF_FLAG_SETUP (1 << 0) + #define VFIO_DEVICE_LOG_BUF_FLAG_RELEASE (1 << 1) + #define VFIO_DEVICE_LOG_BUF_FLAG_START (1 << 2) + #define VFIO_DEVICE_LOG_BUF_FLAG_STOP (1 << 3) + #define VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY (1 << 4) + void *data; +}; +#define VFIO_LOG_BUF_CTL _IO(VFIO_TYPE, VFIO_BASE + 21) +#define VFIO_GET_LOG_BUF_FD _IO(VFIO_TYPE, VFIO_BASE + 22) +#define VFIO_DEVICE_LOG_BUF_CTL _IO(VFIO_TYPE, VFIO_BASE + 23) + +struct vf_migration_log_info { + __u32 dom_uuid; + __u64 buffer_size; + __u64 sge_len; + __u64 sge_num; + struct vfio_log_buf_sge *sgevec; +}; + +struct vfio_device_migration_ops { + /* Get device information */ + int (*get_info)(struct pci_dev *pdev, + struct vfio_device_migration_info *info); + /* Enable a vf device */ + int (*enable)(struct pci_dev *pdev); + /* Disable a vf device */ + int (*disable)(struct pci_dev *pdev); + /* Save a vf device */ + int (*save)(struct pci_dev *pdev, void *base, + uint64_t off, uint64_t count); + /* Resuming a vf device */ + int (*restore)(struct pci_dev *pdev, void *base, + uint64_t off, uint64_t count); + /* Log start a vf device */ + int (*log_start)(struct pci_dev *pdev, + struct vf_migration_log_info *log_info); + /* Log stop a vf device */ + int (*log_stop)(struct pci_dev *pdev, uint32_t uuid); + /* Get vf device log status */ + int (*get_log_status)(struct pci_dev *pdev); + /* Pre enable a vf device(load_setup, before restore a vf) */ + int (*pre_enable)(struct pci_dev *pdev); + /* Cancel a vf device when live migration failed (rollback) */ + int (*cancel)(struct pci_dev *pdev); + /* Init a vf device */ + int (*init)(struct pci_dev *pdev); + /* Uninit a vf device */ + void (*uninit)(struct pci_dev *pdev); + /* Release a vf device */ + void (*release)(struct pci_dev *pdev); +}; + +struct vfio_pci_vendor_mig_driver { + struct pci_dev *pdev; + unsigned char bus_num; + struct vfio_device_migration_ops *dev_mig_ops; + struct module *owner; + atomic_t count; + struct list_head list; +}; + +struct vfio_pci_migration_data { + u64 state_size; + struct pci_dev *vf_dev; + struct vfio_pci_vendor_mig_driver *mig_driver; + struct vfio_device_migration_info *mig_ctl; + void *vf_data; +}; + +int vfio_pci_register_migration_ops(struct vfio_device_migration_ops *ops, + struct module *mod, struct pci_dev *pdev); +void vfio_pci_unregister_migration_ops(struct module *mod, + struct pci_dev *pdev); + +#endif /* VFIO_PCI_MIGRATION_H */ -- 1.8.3.1

2 1

[PATCH] vfio: framework supporting vfio device hot migration
by RongWang 24 Jun '22

24 Jun '22

From: Rong Wang <w_angrong(a)163.com> kunpeng inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5CO9A CVE: NA --------------------------------- As pass through devices, hypervisor can`t control the status of device, and can`t track dirty memory DMA from device, during migration. The goal of this framework is to combine hardware to accomplish the task above. qemu |status control and dirty memory report vfio |ops to hardware hardware Signed-off-by: Rong Wang <w_angrong(a)163.com> Signed-off-by: HuHua Li <18245010845(a)163.com> Signed-off-by: Ripeng Qiu <965412048(a)qq.com> --- drivers/vfio/pci/Makefile | 2 +- drivers/vfio/pci/vfio_pci.c | 54 +++ drivers/vfio/pci/vfio_pci_migration.c | 755 ++++++++++++++++++++++++++++++++++ drivers/vfio/pci/vfio_pci_private.h | 14 +- drivers/vfio/vfio.c | 411 +++++++++++++++++- include/linux/vfio_pci_migration.h | 136 ++++++ 6 files changed, 1367 insertions(+), 5 deletions(-) create mode 100644 drivers/vfio/pci/vfio_pci_migration.c create mode 100644 include/linux/vfio_pci_migration.h diff --git a/drivers/vfio/pci/Makefile b/drivers/vfio/pci/Makefile index 76d8ec0..80a777d 100644 --- a/drivers/vfio/pci/Makefile +++ b/drivers/vfio/pci/Makefile @@ -1,5 +1,5 @@ -vfio-pci-y := vfio_pci.o vfio_pci_intrs.o vfio_pci_rdwr.o vfio_pci_config.o +vfio-pci-y := vfio_pci.o vfio_pci_intrs.o vfio_pci_rdwr.o vfio_pci_config.o vfio_pci_migration.o vfio-pci-$(CONFIG_VFIO_PCI_IGD) += vfio_pci_igd.o obj-$(CONFIG_VFIO_PCI) += vfio-pci.o diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c index 51b791c..59d8280 100644 --- a/drivers/vfio/pci/vfio_pci.c +++ b/drivers/vfio/pci/vfio_pci.c @@ -30,6 +30,7 @@ #include <linux/vgaarb.h> #include <linux/nospec.h> #include <linux/sched/mm.h> +#include <linux/vfio_pci_migration.h> #include "vfio_pci_private.h" @@ -296,6 +297,14 @@ static int vfio_pci_enable(struct vfio_pci_device *vdev) vfio_pci_probe_mmaps(vdev); + if (vfio_dev_migration_is_supported(pdev)) { + ret = vfio_pci_migration_init(vdev); + if (ret) { + dev_warn(&vdev->pdev->dev, "Failed to init vfio_pci_migration\n"); + vfio_pci_disable(vdev); + return ret; + } + } return 0; } @@ -392,6 +401,7 @@ static void vfio_pci_disable(struct vfio_pci_device *vdev) out: pci_disable_device(pdev); + vfio_pci_migration_exit(vdev); vfio_pci_try_bus_reset(vdev); if (!disable_idle_d3) @@ -642,6 +652,41 @@ struct vfio_devices { int max_index; }; +static long vfio_pci_handle_log_buf_ctl(struct vfio_pci_device *vdev, + const unsigned long arg) +{ + struct vfio_log_buf_ctl *log_buf_ctl = NULL; + struct vfio_log_buf_info *log_buf_info = NULL; + struct vf_migration_log_info migration_log_info; + long ret = 0; + + log_buf_ctl = (struct vfio_log_buf_ctl *)arg; + log_buf_info = (struct vfio_log_buf_info *)log_buf_ctl->data; + + switch (log_buf_ctl->flags) { + case VFIO_DEVICE_LOG_BUF_FLAG_START: + migration_log_info.dom_uuid = log_buf_info->uuid; + migration_log_info.buffer_size = + log_buf_info->buffer_size; + migration_log_info.sge_num = log_buf_info->addrs_size; + migration_log_info.sge_len = log_buf_info->frag_size; + migration_log_info.sgevec = log_buf_info->sgevec; + ret = vfio_pci_device_log_start(vdev, + &migration_log_info); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STOP: + ret = vfio_pci_device_log_stop(vdev, + log_buf_info->uuid); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY: + ret = vfio_pci_device_log_status_query(vdev); + break; + default: + ret = -EINVAL; + break; + } + return ret; +} static long vfio_pci_ioctl(void *device_data, unsigned int cmd, unsigned long arg) { @@ -1142,6 +1187,8 @@ static long vfio_pci_ioctl(void *device_data, return vfio_pci_ioeventfd(vdev, ioeventfd.offset, ioeventfd.data, count, ioeventfd.fd); + } else if (cmd == VFIO_DEVICE_LOG_BUF_CTL) { + return vfio_pci_handle_log_buf_ctl(vdev, arg); } return -ENOTTY; @@ -1566,6 +1613,9 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) pci_set_power_state(pdev, PCI_D3hot); } + if (vfio_dev_migration_is_supported(pdev)) + ret = vfio_pci_device_init(pdev); + return ret; } @@ -1591,6 +1641,10 @@ static void vfio_pci_remove(struct pci_dev *pdev) if (!disable_idle_d3) pci_set_power_state(pdev, PCI_D0); + + if (vfio_dev_migration_is_supported(pdev)) { + vfio_pci_device_uninit(pdev); + } } static pci_ers_result_t vfio_pci_aer_err_detected(struct pci_dev *pdev, diff --git a/drivers/vfio/pci/vfio_pci_migration.c b/drivers/vfio/pci/vfio_pci_migration.c new file mode 100644 index 0000000..f69cd13 --- /dev/null +++ b/drivers/vfio/pci/vfio_pci_migration.c @@ -0,0 +1,755 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (c) 2022 Huawei Technologies Co., Ltd. All rights reserved. + */ + +#include <linux/module.h> +#include <linux/io.h> +#include <linux/pci.h> +#include <linux/uaccess.h> +#include <linux/vfio.h> +#include <linux/vfio_pci_migration.h> + +#include "vfio_pci_private.h" + +static LIST_HEAD(vfio_pci_mig_drivers_list); +static DEFINE_MUTEX(vfio_pci_mig_drivers_mutex); + +static void vfio_pci_add_mig_drv(struct vfio_pci_vendor_mig_driver *mig_drv) +{ + mutex_lock(&vfio_pci_mig_drivers_mutex); + atomic_set(&mig_drv->count, 1); + list_add_tail(&mig_drv->list, &vfio_pci_mig_drivers_list); + mutex_unlock(&vfio_pci_mig_drivers_mutex); +} + +static void vfio_pci_remove_mig_drv(struct vfio_pci_vendor_mig_driver *mig_drv) +{ + mutex_lock(&vfio_pci_mig_drivers_mutex); + list_del(&mig_drv->list); + mutex_unlock(&vfio_pci_mig_drivers_mutex); +} + +static struct vfio_pci_vendor_mig_driver * + vfio_pci_find_mig_drv(struct pci_dev *pdev, struct module *module) +{ + struct vfio_pci_vendor_mig_driver *mig_drv = NULL; + + mutex_lock(&vfio_pci_mig_drivers_mutex); + list_for_each_entry(mig_drv, &vfio_pci_mig_drivers_list, list) { + if (mig_drv->owner == module) { + if (mig_drv->bus_num == pdev->bus->number) + goto out; + } + } + mig_drv = NULL; +out: + mutex_unlock(&vfio_pci_mig_drivers_mutex); + return mig_drv; +} + +static struct vfio_pci_vendor_mig_driver * + vfio_pci_get_mig_driver(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_drv = NULL; + struct pci_dev *pf_dev = pci_physfn(pdev); + + mutex_lock(&vfio_pci_mig_drivers_mutex); + list_for_each_entry(mig_drv, &vfio_pci_mig_drivers_list, list) { + if (mig_drv->bus_num == pf_dev->bus->number) + goto out; + } + mig_drv = NULL; +out: + mutex_unlock(&vfio_pci_mig_drivers_mutex); + return mig_drv; +} + +bool vfio_dev_migration_is_supported(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + mig_driver = vfio_pci_get_mig_driver(pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_warn(&pdev->dev, "unable to find a mig_drv module\n"); + return false; + } + + return true; +} + +int vfio_pci_device_log_start(struct vfio_pci_device *vdev, + struct vf_migration_log_info *log_info) +{ + struct vfio_pci_vendor_mig_driver *mig_driver; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&vdev->pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (!mig_driver->dev_mig_ops->log_start || + (mig_driver->dev_mig_ops->log_start(vdev->pdev, + log_info) != 0)) { + dev_err(&vdev->pdev->dev, "failed to set log start\n"); + return -EFAULT; + } + + return 0; +} + +int vfio_pci_device_log_stop(struct vfio_pci_device *vdev, uint32_t uuid) +{ + struct vfio_pci_vendor_mig_driver *mig_driver; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&vdev->pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (!mig_driver->dev_mig_ops->log_stop || + (mig_driver->dev_mig_ops->log_stop(vdev->pdev, uuid) != 0)) { + dev_err(&vdev->pdev->dev, "failed to set log stop\n"); + return -EFAULT; + } + + return 0; +} + +int vfio_pci_device_log_status_query(struct vfio_pci_device *vdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&vdev->pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (!mig_driver->dev_mig_ops->get_log_status || + (mig_driver->dev_mig_ops->get_log_status(vdev->pdev) != 0)) { + dev_err(&vdev->pdev->dev, "failed to get log status\n"); + return -EFAULT; + } + + return 0; +} + +int vfio_pci_device_init(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_drv; + + mig_drv = vfio_pci_get_mig_driver(pdev); + if (!mig_drv || !mig_drv->dev_mig_ops) { + dev_err(&pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (mig_drv->dev_mig_ops->init) + return mig_drv->dev_mig_ops->init(pdev); + + return -EFAULT; +} + +void vfio_pci_device_uninit(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_drv; + + mig_drv = vfio_pci_get_mig_driver(pdev); + if (!mig_drv || !mig_drv->dev_mig_ops) { + dev_err(&pdev->dev, "unable to find a mig_drv module\n"); + return; + } + + if (mig_drv->dev_mig_ops->uninit) + mig_drv->dev_mig_ops->uninit(pdev); +} + +static void vfio_pci_device_release(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (mig_drv->dev_mig_ops->release) + mig_drv->dev_mig_ops->release(pdev); +} + +static int vfio_pci_device_get_info(struct pci_dev *pdev, + struct vfio_device_migration_info *mig_info, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (mig_drv->dev_mig_ops->get_info) + return mig_drv->dev_mig_ops->get_info(pdev, mig_info); + return -EFAULT; +} + +static int vfio_pci_device_enable(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (!mig_drv->dev_mig_ops->enable || + (mig_drv->dev_mig_ops->enable(pdev) != 0)) { + return -EINVAL; + } + + return 0; +} + +static int vfio_pci_device_disable(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (!mig_drv->dev_mig_ops->disable || + (mig_drv->dev_mig_ops->disable(pdev) != 0)) + return -EINVAL; + + return 0; +} + +static int vfio_pci_device_pre_enable(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (!mig_drv->dev_mig_ops->pre_enable || + (mig_drv->dev_mig_ops->pre_enable(pdev) != 0)) + return -EINVAL; + + return 0; +} + +static int vfio_pci_device_state_save(struct pci_dev *pdev, + struct vfio_pci_migration_data *data) +{ + struct vfio_device_migration_info *mig_info = data->mig_ctl; + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + void *base = (void *)mig_info; + int ret = 0; + + if ((mig_info->device_state & VFIO_DEVICE_STATE_RUNNING) != 0) { + ret = vfio_pci_device_disable(pdev, mig_drv); + if (ret) { + dev_err(&pdev->dev, "failed to stop VF function!\n"); + return ret; + } + mig_info->device_state &= ~VFIO_DEVICE_STATE_RUNNING; + } + + if (mig_drv->dev_mig_ops && mig_drv->dev_mig_ops->save) { + ret = mig_drv->dev_mig_ops->save(pdev, base, + mig_info->data_offset, data->state_size); + if (ret) { + dev_err(&pdev->dev, "failed to save device state!\n"); + return -EINVAL; + } + } else { + return -EFAULT; + } + + mig_info->data_size = data->state_size; + mig_info->pending_bytes = mig_info->data_size; + return ret; +} + +static int vfio_pci_device_state_restore(struct vfio_pci_migration_data *data) +{ + struct vfio_device_migration_info *mig_info = data->mig_ctl; + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + struct pci_dev *pdev = data->vf_dev; + void *base = (void *)mig_info; + int ret; + + if (mig_drv->dev_mig_ops && mig_drv->dev_mig_ops->restore) { + ret = mig_drv->dev_mig_ops->restore(pdev, base, + mig_info->data_offset, mig_info->data_size); + if (ret) { + dev_err(&pdev->dev, "failed to restore device state!\n"); + return -EINVAL; + } + return 0; + } + + return -EFAULT; +} + +static int vfio_pci_set_device_state(struct vfio_pci_migration_data *data, + u32 state) +{ + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + struct pci_dev *pdev = data->vf_dev; + int ret = 0; + + if (state == mig_ctl->device_state) + return 0; + + if (!mig_drv->dev_mig_ops) + return -EINVAL; + + switch (state) { + case VFIO_DEVICE_STATE_RUNNING: + if (!(mig_ctl->device_state & + VFIO_DEVICE_STATE_RUNNING)) + ret = vfio_pci_device_enable(pdev, mig_drv); + break; + case VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RUNNING: + /* + * (pre-copy) - device should start logging data. + */ + ret = 0; + break; + case VFIO_DEVICE_STATE_SAVING: + /* stop the vf function, save state */ + ret = vfio_pci_device_state_save(pdev, data); + break; + case VFIO_DEVICE_STATE_STOP: + if (mig_ctl->device_state & VFIO_DEVICE_STATE_RUNNING) + ret = vfio_pci_device_disable(pdev, mig_drv); + break; + case VFIO_DEVICE_STATE_RESUMING: + ret = vfio_pci_device_pre_enable(pdev, mig_drv); + break; + default: + ret = -EFAULT; + break; + } + + if (ret) + return ret; + + mig_ctl->device_state = state; + return 0; +} + +static ssize_t vfio_pci_handle_mig_dev_state( + struct vfio_pci_migration_data *data, + char __user *buf, size_t count, bool iswrite) +{ + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + u32 device_state; + int ret; + + if (count != sizeof(device_state)) + return -EINVAL; + + if (iswrite) { + if (copy_from_user(&device_state, buf, count)) + return -EFAULT; + + ret = vfio_pci_set_device_state(data, device_state); + if (ret) + return ret; + } else { + if (copy_to_user(buf, &mig_ctl->device_state, count)) + return -EFAULT; + } + + return count; +} + +static ssize_t vfio_pci_handle_mig_pending_bytes( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u64 pending_bytes; + + if (count != sizeof(pending_bytes) || iswrite) + return -EINVAL; + + if (mig_info->device_state == + (VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RUNNING)) { + /* In pre-copy state we have no data to return for now, + * return 0 pending bytes + */ + pending_bytes = 0; + } else { + pending_bytes = mig_info->pending_bytes; + } + + if (copy_to_user(buf, &pending_bytes, count)) + return -EFAULT; + + return count; +} + +static ssize_t vfio_pci_handle_mig_data_offset( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u64 data_offset = mig_info->data_offset; + + if (count != sizeof(data_offset) || iswrite) + return -EINVAL; + + if (copy_to_user(buf, &data_offset, count)) + return -EFAULT; + + return count; +} + +static ssize_t vfio_pci_handle_mig_data_size( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u64 data_size; + + if (count != sizeof(data_size)) + return -EINVAL; + + if (iswrite) { + /* data_size is writable only during resuming state */ + if (mig_info->device_state != VFIO_DEVICE_STATE_RESUMING) + return -EINVAL; + + if (copy_from_user(&data_size, buf, sizeof(data_size))) + return -EFAULT; + + mig_info->data_size = data_size; + } else { + if (mig_info->device_state != VFIO_DEVICE_STATE_SAVING) + return -EINVAL; + + if (copy_to_user(buf, &mig_info->data_size, + sizeof(data_size))) + return -EFAULT; + } + + return count; +} + +static ssize_t vfio_pci_handle_mig_dev_cmd(struct vfio_pci_migration_data *data, + char __user *buf, size_t count, bool iswrite) +{ + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + struct pci_dev *pdev = data->vf_dev; + u32 device_cmd; + int ret = -EFAULT; + + if (count != sizeof(device_cmd) || !iswrite || !mig_drv->dev_mig_ops) + return -EINVAL; + + if (copy_from_user(&device_cmd, buf, count)) + return -EFAULT; + + switch (device_cmd) { + case VFIO_DEVICE_MIGRATION_CANCEL: + if (mig_drv->dev_mig_ops->cancel) + ret = mig_drv->dev_mig_ops->cancel(pdev); + break; + default: + dev_err(&pdev->dev, "cmd is invaild\n"); + return -EINVAL; + } + + if (ret != 0) + return ret; + + return count; +} + +static ssize_t vfio_pci_handle_mig_drv_version( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u32 version_id = mig_info->version_id; + + if (count != sizeof(version_id) || iswrite) + return -EINVAL; + + if (copy_to_user(buf, &version_id, count)) + return -EFAULT; + + return count; +} + +static ssize_t vfio_pci_handle_mig_data_rw( + struct vfio_pci_migration_data *data, + char __user *buf, size_t count, u64 pos, bool iswrite) +{ + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + void *data_addr = data->vf_data; + + if (count == 0) { + dev_err(&data->vf_dev->dev, "qemu operation data size error!\n"); + return -EINVAL; + } + + data_addr += pos - mig_ctl->data_offset; + if (iswrite) { + if (copy_from_user(data_addr, buf, count)) + return -EFAULT; + + mig_ctl->pending_bytes += count; + if (mig_ctl->pending_bytes > data->state_size) + return -EINVAL; + } else { + if (copy_to_user(buf, data_addr, count)) + return -EFAULT; + + if (mig_ctl->pending_bytes < count) + return -EINVAL; + + mig_ctl->pending_bytes -= count; + } + + return count; +} + +static ssize_t vfio_pci_dev_migrn_rw(struct vfio_pci_device *vdev, + char __user *buf, size_t count, loff_t *ppos, bool iswrite) +{ + unsigned int index = + VFIO_PCI_OFFSET_TO_INDEX(*ppos) - VFIO_PCI_NUM_REGIONS; + struct vfio_pci_migration_data *data = + (struct vfio_pci_migration_data *)vdev->region[index].data; + loff_t pos = *ppos & VFIO_PCI_OFFSET_MASK; + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + int ret; + + if (pos >= vdev->region[index].size) + return -EINVAL; + + count = min(count, (size_t)(vdev->region[index].size - pos)); + if (pos >= VFIO_MIGRATION_REGION_DATA_OFFSET) + return vfio_pci_handle_mig_data_rw(data, + buf, count, pos, iswrite); + + switch (pos) { + case VFIO_DEVICE_MIGRATION_OFFSET(device_state): + ret = vfio_pci_handle_mig_dev_state(data, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(pending_bytes): + ret = vfio_pci_handle_mig_pending_bytes(mig_ctl, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(data_offset): + ret = vfio_pci_handle_mig_data_offset(mig_ctl, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(data_size): + ret = vfio_pci_handle_mig_data_size(mig_ctl, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(device_cmd): + ret = vfio_pci_handle_mig_dev_cmd(data, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(version_id): + ret = vfio_pci_handle_mig_drv_version(mig_ctl, + buf, count, iswrite); + break; + default: + dev_err(&vdev->pdev->dev, "invalid pos offset\n"); + ret = -EFAULT; + break; + } + + if (mig_ctl->device_state == VFIO_DEVICE_STATE_RESUMING && + mig_ctl->pending_bytes == data->state_size && + mig_ctl->data_size == data->state_size) { + if (vfio_pci_device_state_restore(data) != 0) { + dev_err(&vdev->pdev->dev, "Failed to restore device state!\n"); + return -EFAULT; + } + mig_ctl->pending_bytes = 0; + mig_ctl->data_size = 0; + } + + return ret; +} + +static void vfio_pci_dev_migrn_release(struct vfio_pci_device *vdev, + struct vfio_pci_region *region) +{ + struct vfio_pci_migration_data *data = region->data; + + if (data) { + kfree(data->mig_ctl); + kfree(data); + } +} + +static const struct vfio_pci_regops vfio_pci_migration_regops = { + .rw = vfio_pci_dev_migrn_rw, + .release = vfio_pci_dev_migrn_release, +}; + +static int vfio_pci_migration_info_init(struct pci_dev *pdev, + struct vfio_device_migration_info *mig_info, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + int ret; + + ret = vfio_pci_device_get_info(pdev, mig_info, mig_drv); + if (ret) { + dev_err(&pdev->dev, "failed to get device info\n"); + return ret; + } + + if (mig_info->data_size > VFIO_MIGRATION_BUFFER_MAX_SIZE) { + dev_err(&pdev->dev, "mig_info->data_size %llu is invalid\n", + mig_info->data_size); + return -EINVAL; + } + + mig_info->data_offset = VFIO_MIGRATION_REGION_DATA_OFFSET; + return ret; +} + +static int vfio_device_mig_data_init(struct vfio_pci_device *vdev, + struct vfio_pci_migration_data *data) +{ + struct vfio_device_migration_info *mig_ctl; + u64 mig_offset; + int ret; + + mig_ctl = kzalloc(sizeof(*mig_ctl), GFP_KERNEL); + if (!mig_ctl) + return -ENOMEM; + + ret = vfio_pci_migration_info_init(vdev->pdev, mig_ctl, + data->mig_driver); + if (ret) { + dev_err(&vdev->pdev->dev, "get device info error!\n"); + goto err; + } + + mig_offset = sizeof(struct vfio_device_migration_info); + data->state_size = mig_ctl->data_size; + data->mig_ctl = krealloc(mig_ctl, mig_offset + data->state_size, + GFP_KERNEL); + if (!data->mig_ctl) { + ret = -ENOMEM; + goto err; + } + + data->vf_data = (void *)((char *)data->mig_ctl + mig_offset); + memset(data->vf_data, 0, data->state_size); + data->mig_ctl->data_size = 0; + + ret = vfio_pci_register_dev_region(vdev, VFIO_REGION_TYPE_MIGRATION, + VFIO_REGION_SUBTYPE_MIGRATION, + &vfio_pci_migration_regops, mig_offset + data->state_size, + VFIO_REGION_INFO_FLAG_READ | VFIO_REGION_INFO_FLAG_WRITE, data); + if (ret) { + kfree(data->mig_ctl); + return ret; + } + + return 0; +err: + kfree(mig_ctl); + return ret; +} + +int vfio_pci_migration_init(struct vfio_pci_device *vdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + struct vfio_pci_migration_data *data = NULL; + struct pci_dev *pdev = vdev->pdev; + int ret; + + mig_driver = vfio_pci_get_mig_driver(pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&pdev->dev, "unable to find a mig_driver module\n"); + return -EINVAL; + } + + if (!try_module_get(mig_driver->owner)) { + pr_err("module %s is not live\n", mig_driver->owner->name); + return -ENODEV; + } + + data = kzalloc(sizeof(*data), GFP_KERNEL); + if (!data) { + module_put(mig_driver->owner); + return -ENOMEM; + } + + data->mig_driver = mig_driver; + data->vf_dev = pdev; + + ret = vfio_device_mig_data_init(vdev, data); + if (ret) { + dev_err(&pdev->dev, "failed to init vfio device migration data!\n"); + goto err; + } + + return ret; +err: + kfree(data); + module_put(mig_driver->owner); + return ret; +} + +void vfio_pci_migration_exit(struct vfio_pci_device *vdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_warn(&vdev->pdev->dev, "mig_driver is not found\n"); + return; + } + + if (module_refcount(mig_driver->owner) > 0) { + vfio_pci_device_release(vdev->pdev, mig_driver); + module_put(mig_driver->owner); + } +} + +int vfio_pci_register_migration_ops(struct vfio_device_migration_ops *ops, + struct module *mod, struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + if (!ops || !mod || !pdev) + return -EINVAL; + + mig_driver = vfio_pci_find_mig_drv(pdev, mod); + if (mig_driver) { + pr_info("%s migration ops has already been registered\n", + mod->name); + atomic_add(1, &mig_driver->count); + return 0; + } + + if (!try_module_get(THIS_MODULE)) + return -ENODEV; + + mig_driver = kzalloc(sizeof(*mig_driver), GFP_KERNEL); + if (!mig_driver) { + module_put(THIS_MODULE); + return -ENOMEM; + } + + mig_driver->pdev = pdev; + mig_driver->bus_num = pdev->bus->number; + mig_driver->owner = mod; + mig_driver->dev_mig_ops = ops; + + vfio_pci_add_mig_drv(mig_driver); + + return 0; +} +EXPORT_SYMBOL_GPL(vfio_pci_register_migration_ops); + +void vfio_pci_unregister_migration_ops(struct module *mod, struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + if (!mod || !pdev) + return; + + mig_driver = vfio_pci_find_mig_drv(pdev, mod); + if (!mig_driver) { + pr_err("mig_driver is not found\n"); + return; + } + + if (atomic_sub_and_test(1, &mig_driver->count)) { + vfio_pci_remove_mig_drv(mig_driver); + kfree(mig_driver); + module_put(THIS_MODULE); + pr_info("%s succeed to unregister migration ops\n", + THIS_MODULE->name); + } +} +EXPORT_SYMBOL_GPL(vfio_pci_unregister_migration_ops); diff --git a/drivers/vfio/pci/vfio_pci_private.h b/drivers/vfio/pci/vfio_pci_private.h index 17d2bae..03af269 100644 --- a/drivers/vfio/pci/vfio_pci_private.h +++ b/drivers/vfio/pci/vfio_pci_private.h @@ -15,6 +15,7 @@ #include <linux/pci.h> #include <linux/irqbypass.h> #include <linux/types.h> +#include <linux/vfio_pci_migration.h> #ifndef VFIO_PCI_PRIVATE_H #define VFIO_PCI_PRIVATE_H @@ -55,7 +56,7 @@ struct vfio_pci_irq_ctx { struct vfio_pci_region; struct vfio_pci_regops { - size_t (*rw)(struct vfio_pci_device *vdev, char __user *buf, + ssize_t (*rw)(struct vfio_pci_device *vdev, char __user *buf, size_t count, loff_t *ppos, bool iswrite); void (*release)(struct vfio_pci_device *vdev, struct vfio_pci_region *region); @@ -173,4 +174,15 @@ static inline int vfio_pci_igd_init(struct vfio_pci_device *vdev) return -ENODEV; } #endif + +extern bool vfio_dev_migration_is_supported(struct pci_dev *pdev); +extern int vfio_pci_migration_init(struct vfio_pci_device *vdev); +extern void vfio_pci_migration_exit(struct vfio_pci_device *vdev); +extern int vfio_pci_device_log_start(struct vfio_pci_device *vdev, + struct vf_migration_log_info *log_info); +extern int vfio_pci_device_log_stop(struct vfio_pci_device *vdev, + uint32_t uuid); +extern int vfio_pci_device_log_status_query(struct vfio_pci_device *vdev); +extern int vfio_pci_device_init(struct pci_dev *pdev); +extern void vfio_pci_device_uninit(struct pci_dev *pdev); #endif /* VFIO_PCI_PRIVATE_H */ diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c index 7a386fb..35f2a29 100644 --- a/drivers/vfio/vfio.c +++ b/drivers/vfio/vfio.c @@ -33,6 +33,7 @@ #include <linux/string.h> #include <linux/uaccess.h> #include <linux/vfio.h> +#include <linux/vfio_pci_migration.h> #include <linux/wait.h> #include <linux/sched/signal.h> @@ -40,6 +41,9 @@ #define DRIVER_AUTHOR "Alex Williamson <alex.williamson(a)redhat.com>" #define DRIVER_DESC "VFIO - User Level meta-driver" +#define LOG_BUF_FRAG_SIZE (2 * 1024 * 1024) // fix to 2M +#define LOG_BUF_MAX_ADDRS_SIZE 128 // max vm ram size is 1T + static struct vfio { struct class *class; struct list_head iommu_drivers_list; @@ -57,6 +61,14 @@ struct vfio_iommu_driver { struct list_head vfio_next; }; +struct vfio_log_buf { + struct vfio_log_buf_info info; + int fd; + int buffer_state; + int device_state; + unsigned long *cpu_addrs; +}; + struct vfio_container { struct kref kref; struct list_head group_list; @@ -64,6 +76,7 @@ struct vfio_container { struct vfio_iommu_driver *iommu_driver; void *iommu_data; bool noiommu; + struct vfio_log_buf log_buf; }; struct vfio_unbound_dev { @@ -1158,8 +1171,398 @@ static long vfio_ioctl_set_iommu(struct vfio_container *container, return ret; } +static long vfio_dispatch_cmd_to_devices(const struct vfio_container *container, + unsigned int cmd, unsigned long arg) +{ + struct vfio_group *group = NULL; + struct vfio_device *device = NULL; + long ret = -ENXIO; + + list_for_each_entry(group, &container->group_list, container_next) { + list_for_each_entry(device, &group->device_list, group_next) { + ret = device->ops->ioctl(device->device_data, cmd, arg); + if (ret) { + pr_err("dispatch cmd to devices failed\n"); + return ret; + } + } + } + return ret; +} + +static long vfio_log_buf_start(struct vfio_container *container) +{ + struct vfio_log_buf_ctl log_buf_ctl; + long ret; + + log_buf_ctl.argsz = sizeof(struct vfio_log_buf_info); + log_buf_ctl.flags = VFIO_DEVICE_LOG_BUF_FLAG_START; + log_buf_ctl.data = (void *)&container->log_buf.info; + ret = vfio_dispatch_cmd_to_devices(container, VFIO_DEVICE_LOG_BUF_CTL, + (unsigned long)&log_buf_ctl); + if (ret) + return ret; + + container->log_buf.device_state = 1; + return 0; +} + +static long vfio_log_buf_stop(struct vfio_container *container) +{ + struct vfio_log_buf_ctl log_buf_ctl; + long ret; + + if (container->log_buf.device_state == 0) { + pr_warn("device already stopped\n"); + return 0; + } + + log_buf_ctl.argsz = sizeof(struct vfio_log_buf_info); + log_buf_ctl.flags = VFIO_DEVICE_LOG_BUF_FLAG_STOP; + log_buf_ctl.data = (void *)&container->log_buf.info; + ret = vfio_dispatch_cmd_to_devices(container, VFIO_DEVICE_LOG_BUF_CTL, + (unsigned long)&log_buf_ctl); + if (ret) + return ret; + + container->log_buf.device_state = 0; + return 0; +} + +static long vfio_log_buf_query(struct vfio_container *container) +{ + struct vfio_log_buf_ctl log_buf_ctl; + + log_buf_ctl.argsz = sizeof(struct vfio_log_buf_info); + log_buf_ctl.flags = VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY; + log_buf_ctl.data = (void *)&container->log_buf.info; + + return vfio_dispatch_cmd_to_devices(container, + VFIO_DEVICE_LOG_BUF_CTL, (unsigned long)&log_buf_ctl); +} + +static int vfio_log_buf_fops_mmap(struct file *filep, + struct vm_area_struct *vma) +{ + struct vfio_container *container = filep->private_data; + struct vfio_log_buf *log_buf = &container->log_buf; + unsigned long frag_pg_size; + unsigned long frag_offset; + phys_addr_t pa; + int ret = -EINVAL; + + if (!log_buf->cpu_addrs) { + pr_err("mmap before setup, please setup log buf first\n"); + return ret; + } + + if (log_buf->info.frag_size < PAGE_SIZE) { + pr_err("mmap frag size should not less than page size!\n"); + return ret; + } + + frag_pg_size = log_buf->info.frag_size / PAGE_SIZE; + frag_offset = vma->vm_pgoff / frag_pg_size; + + if (frag_offset >= log_buf->info.addrs_size) { + pr_err("mmap offset out of range!\n"); + return ret; + } + + if (vma->vm_end - vma->vm_start != log_buf->info.frag_size) { + pr_err("mmap size error, should be aligned with frag size!\n"); + return ret; + } + + pa = virt_to_phys((void *)log_buf->cpu_addrs[frag_offset]); + ret = remap_pfn_range(vma, vma->vm_start, + pa >> PAGE_SHIFT, + vma->vm_end - vma->vm_start, + vma->vm_page_prot); + if (ret) + pr_err("remap_pfn_range error!\n"); + return ret; +} + +static struct device *vfio_get_dev(struct vfio_container *container) +{ + struct vfio_group *group = NULL; + struct vfio_device *device = NULL; + + list_for_each_entry(group, &container->group_list, container_next) { + list_for_each_entry(device, &group->device_list, group_next) { + return device->dev; + } + } + return NULL; +} + +static void vfio_log_buf_release_dma(struct device *dev, + struct vfio_log_buf *log_buf) +{ + int i; + + for (i = 0; i < log_buf->info.addrs_size; i++) { + if ((log_buf->cpu_addrs && log_buf->cpu_addrs[i] != 0) && + (log_buf->info.sgevec && + log_buf->info.sgevec[i].addr != 0)) { + dma_free_coherent(dev, log_buf->info.frag_size, + (void *)log_buf->cpu_addrs[i], + log_buf->info.sgevec[i].addr); + log_buf->cpu_addrs[i] = 0; + log_buf->info.sgevec[i].addr = 0; + } + } +} + +static long vfio_log_buf_alloc_dma(struct vfio_log_buf_info *info, + struct vfio_log_buf *log_buf, struct device *dev) +{ + int i; + + for (i = 0; i < info->addrs_size; i++) { + log_buf->cpu_addrs[i] = (unsigned long)dma_alloc_coherent(dev, + info->frag_size, &log_buf->info.sgevec[i].addr, + GFP_KERNEL); + log_buf->info.sgevec[i].len = info->frag_size; + if (log_buf->cpu_addrs[i] == 0 || + log_buf->info.sgevec[i].addr == 0) { + return -ENOMEM; + } + } + return 0; +} + +static long vfio_log_buf_alloc_addrs(struct vfio_log_buf_info *info, + struct vfio_log_buf *log_buf) +{ + log_buf->info.sgevec = kcalloc(info->addrs_size, + sizeof(struct vfio_log_buf_sge), GFP_KERNEL); + if (!log_buf->info.sgevec) + return -ENOMEM; + + log_buf->cpu_addrs = kcalloc(info->addrs_size, + sizeof(unsigned long), GFP_KERNEL); + if (!log_buf->cpu_addrs) { + kfree(log_buf->info.sgevec); + log_buf->info.sgevec = NULL; + return -ENOMEM; + } + + return 0; +} + +static long vfio_log_buf_info_valid(struct vfio_log_buf_info *info) +{ + if (info->addrs_size > LOG_BUF_MAX_ADDRS_SIZE || + info->addrs_size == 0) { + pr_err("can`t support vm ram size larger than 1T or equal to 0\n"); + return -EINVAL; + } + if (info->frag_size != LOG_BUF_FRAG_SIZE) { + pr_err("only support %d frag size\n", LOG_BUF_FRAG_SIZE); + return -EINVAL; + } + return 0; +} + +static long vfio_log_buf_setup(struct vfio_container *container, + unsigned long data) +{ + struct vfio_log_buf_info info; + struct vfio_log_buf *log_buf = &container->log_buf; + struct device *dev = NULL; + long ret; + + if (log_buf->info.sgevec) { + pr_warn("log buf already setup\n"); + return 0; + } + + if (copy_from_user(&info, (void __user *)data, + sizeof(struct vfio_log_buf_info))) + return -EFAULT; + + ret = vfio_log_buf_info_valid(&info); + if (ret) + return ret; + + ret = vfio_log_buf_alloc_addrs(&info, log_buf); + if (ret) + goto err_out; + + dev = vfio_get_dev(container); + if (!dev) { + pr_err("can`t get dev\n"); + goto err_free_addrs; + } + + ret = vfio_log_buf_alloc_dma(&info, log_buf, dev); + if (ret) + goto err_free_dma_array; + + log_buf->info.uuid = info.uuid; + log_buf->info.buffer_size = info.buffer_size; + log_buf->info.frag_size = info.frag_size; + log_buf->info.addrs_size = info.addrs_size; + log_buf->buffer_state = 1; + return 0; + +err_free_dma_array: + vfio_log_buf_release_dma(dev, log_buf); +err_free_addrs: + kfree(log_buf->cpu_addrs); + log_buf->cpu_addrs = NULL; + kfree(log_buf->info.sgevec); + log_buf->info.sgevec = NULL; +err_out: + return -ENOMEM; +} + +static long vfio_log_buf_release_buffer(struct vfio_container *container) +{ + struct vfio_log_buf *log_buf = &container->log_buf; + struct device *dev = NULL; + + if (log_buf->buffer_state == 0) { + pr_warn("buffer already released\n"); + return 0; + } + + dev = vfio_get_dev(container); + if (!dev) { + pr_err("can`t get dev\n"); + return -EFAULT; + } + + vfio_log_buf_release_dma(dev, log_buf); + + kfree(log_buf->cpu_addrs); + log_buf->cpu_addrs = NULL; + + kfree(log_buf->info.sgevec); + log_buf->info.sgevec = NULL; + + log_buf->buffer_state = 0; + return 0; +} + +static int vfio_log_buf_release(struct inode *inode, struct file *filep) +{ + struct vfio_container *container = filep->private_data; + + vfio_log_buf_stop(container); + vfio_log_buf_release_buffer(container); + memset(&container->log_buf, 0, sizeof(struct vfio_log_buf)); + return 0; +} + +static long vfio_ioctl_handle_log_buf_ctl(struct vfio_container *container, + unsigned long arg) +{ + struct vfio_log_buf_ctl log_buf_ctl; + long ret = 0; + + if (copy_from_user(&log_buf_ctl, (void __user *)arg, + sizeof(struct vfio_log_buf_ctl))) + return -EFAULT; + + switch (log_buf_ctl.flags) { + case VFIO_DEVICE_LOG_BUF_FLAG_SETUP: + ret = vfio_log_buf_setup(container, + (unsigned long)log_buf_ctl.data); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_RELEASE: + ret = vfio_log_buf_release_buffer(container); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_START: + ret = vfio_log_buf_start(container); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STOP: + ret = vfio_log_buf_stop(container); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY: + ret = vfio_log_buf_query(container); + break; + default: + pr_err("log buf control flag incorrect\n"); + ret = -EINVAL; + break; + } + return ret; +} + +static long vfio_log_buf_fops_unl_ioctl(struct file *filep, + unsigned int cmd, unsigned long arg) +{ + struct vfio_container *container = filep->private_data; + long ret = -EINVAL; + + switch (cmd) { + case VFIO_LOG_BUF_CTL: + ret = vfio_ioctl_handle_log_buf_ctl(container, arg); + break; + default: + pr_err("log buf control cmd incorrect\n"); + break; + } + + return ret; +} + +#ifdef CONFIG_COMPAT +static long vfio_log_buf_fops_compat_ioctl(struct file *filep, + unsigned int cmd, unsigned long arg) +{ + arg = (unsigned long)compat_ptr(arg); + return vfio_log_buf_fops_unl_ioctl(filep, cmd, arg); +} +#endif /* CONFIG_COMPAT */ + +static const struct file_operations vfio_log_buf_fops = { + .owner = THIS_MODULE, + .mmap = vfio_log_buf_fops_mmap, + .unlocked_ioctl = vfio_log_buf_fops_unl_ioctl, + .release = vfio_log_buf_release, +#ifdef CONFIG_COMPAT + .compat_ioctl = vfio_log_buf_fops_compat_ioctl, +#endif +}; + +static int vfio_get_log_buf_fd(struct vfio_container *container, + unsigned long arg) +{ + struct file *filep = NULL; + int ret; + + if (container->log_buf.fd > 0) + return container->log_buf.fd; + + ret = get_unused_fd_flags(O_CLOEXEC); + if (ret < 0) { + pr_err("get_unused_fd_flags get fd failed\n"); + return ret; + } + + filep = anon_inode_getfile("[vfio-log-buf]", &vfio_log_buf_fops, + container, O_RDWR); + if (IS_ERR(filep)) { + pr_err("anon_inode_getfile failed\n"); + put_unused_fd(ret); + ret = PTR_ERR(filep); + return ret; + } + + filep->f_mode |= (FMODE_READ | FMODE_WRITE | FMODE_LSEEK); + + fd_install(ret, filep); + + container->log_buf.fd = ret; + return ret; +} + static long vfio_fops_unl_ioctl(struct file *filep, - unsigned int cmd, unsigned long arg) + unsigned int cmd, unsigned long arg) { struct vfio_container *container = filep->private_data; struct vfio_iommu_driver *driver; @@ -1179,6 +1582,9 @@ static long vfio_fops_unl_ioctl(struct file *filep, case VFIO_SET_IOMMU: ret = vfio_ioctl_set_iommu(container, arg); break; + case VFIO_GET_LOG_BUF_FD: + ret = vfio_get_log_buf_fd(container, arg); + break; default: driver = container->iommu_driver; data = container->iommu_data; @@ -1210,6 +1616,7 @@ static int vfio_fops_open(struct inode *inode, struct file *filep) INIT_LIST_HEAD(&container->group_list); init_rwsem(&container->group_lock); kref_init(&container->kref); + memset(&container->log_buf, 0, sizeof(struct vfio_log_buf)); filep->private_data = container; @@ -1219,9 +1626,7 @@ static int vfio_fops_open(struct inode *inode, struct file *filep) static int vfio_fops_release(struct inode *inode, struct file *filep) { struct vfio_container *container = filep->private_data; - filep->private_data = NULL; - vfio_container_put(container); return 0; diff --git a/include/linux/vfio_pci_migration.h b/include/linux/vfio_pci_migration.h new file mode 100644 index 0000000..464ffb4 --- /dev/null +++ b/include/linux/vfio_pci_migration.h @@ -0,0 +1,136 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (c) 2022 Huawei Technologies Co., Ltd. All rights reserved. + */ + +#ifndef VFIO_PCI_MIGRATION_H +#define VFIO_PCI_MIGRATION_H + +#include <linux/types.h> +#include <linux/pci.h> + +#define VFIO_REGION_TYPE_MIGRATION (3) +/* sub-types for VFIO_REGION_TYPE_MIGRATION */ +#define VFIO_REGION_SUBTYPE_MIGRATION (1) + +#define VFIO_MIGRATION_BUFFER_MAX_SIZE SZ_256K +#define VFIO_MIGRATION_REGION_DATA_OFFSET \ + (sizeof(struct vfio_device_migration_info)) +#define VFIO_DEVICE_MIGRATION_OFFSET(x) \ + offsetof(struct vfio_device_migration_info, x) + +struct vfio_device_migration_info { + __u32 device_state; /* VFIO device state */ +#define VFIO_DEVICE_STATE_STOP (0) +#define VFIO_DEVICE_STATE_RUNNING (1 << 0) +#define VFIO_DEVICE_STATE_SAVING (1 << 1) +#define VFIO_DEVICE_STATE_RESUMING (1 << 2) +#define VFIO_DEVICE_STATE_MASK (VFIO_DEVICE_STATE_RUNNING | \ + VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RESUMING) + __u32 reserved; + + __u32 device_cmd; + __u32 version_id; + + __u64 pending_bytes; + __u64 data_offset; + __u64 data_size; +}; + +enum { + VFIO_DEVICE_STOP = 0xffff0001, + VFIO_DEVICE_CONTINUE, + VFIO_DEVICE_MIGRATION_CANCEL, +}; + +struct vfio_log_buf_sge { + __u64 len; + __u64 addr; +}; + +struct vfio_log_buf_info { + __u32 uuid; + __u64 buffer_size; + __u64 addrs_size; + __u64 frag_size; + struct vfio_log_buf_sge *sgevec; +}; + +struct vfio_log_buf_ctl { + __u32 argsz; + __u32 flags; + #define VFIO_DEVICE_LOG_BUF_FLAG_SETUP (1 << 0) + #define VFIO_DEVICE_LOG_BUF_FLAG_RELEASE (1 << 1) + #define VFIO_DEVICE_LOG_BUF_FLAG_START (1 << 2) + #define VFIO_DEVICE_LOG_BUF_FLAG_STOP (1 << 3) + #define VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY (1 << 4) + void *data; +}; +#define VFIO_LOG_BUF_CTL _IO(VFIO_TYPE, VFIO_BASE + 21) +#define VFIO_GET_LOG_BUF_FD _IO(VFIO_TYPE, VFIO_BASE + 22) +#define VFIO_DEVICE_LOG_BUF_CTL _IO(VFIO_TYPE, VFIO_BASE + 23) + +struct vf_migration_log_info { + __u32 dom_uuid; + __u64 buffer_size; + __u64 sge_len; + __u64 sge_num; + struct vfio_log_buf_sge *sgevec; +}; + +struct vfio_device_migration_ops { + /* Get device information */ + int (*get_info)(struct pci_dev *pdev, + struct vfio_device_migration_info *info); + /* Enable a vf device */ + int (*enable)(struct pci_dev *pdev); + /* Disable a vf device */ + int (*disable)(struct pci_dev *pdev); + /* Save a vf device */ + int (*save)(struct pci_dev *pdev, void *base, + uint64_t off, uint64_t count); + /* Resuming a vf device */ + int (*restore)(struct pci_dev *pdev, void *base, + uint64_t off, uint64_t count); + /* Log start a vf device */ + int (*log_start)(struct pci_dev *pdev, + struct vf_migration_log_info *log_info); + /* Log stop a vf device */ + int (*log_stop)(struct pci_dev *pdev, uint32_t uuid); + /* Get vf device log status */ + int (*get_log_status)(struct pci_dev *pdev); + /* Pre enable a vf device(load_setup, before restore a vf) */ + int (*pre_enable)(struct pci_dev *pdev); + /* Cancel a vf device when live migration failed (rollback) */ + int (*cancel)(struct pci_dev *pdev); + /* Init a vf device */ + int (*init)(struct pci_dev *pdev); + /* Uninit a vf device */ + void (*uninit)(struct pci_dev *pdev); + /* Release a vf device */ + void (*release)(struct pci_dev *pdev); +}; + +struct vfio_pci_vendor_mig_driver { + struct pci_dev *pdev; + unsigned char bus_num; + struct vfio_device_migration_ops *dev_mig_ops; + struct module *owner; + atomic_t count; + struct list_head list; +}; + +struct vfio_pci_migration_data { + u64 state_size; + struct pci_dev *vf_dev; + struct vfio_pci_vendor_mig_driver *mig_driver; + struct vfio_device_migration_info *mig_ctl; + void *vf_data; +}; + +int vfio_pci_register_migration_ops(struct vfio_device_migration_ops *ops, + struct module *mod, struct pci_dev *pdev); +void vfio_pci_unregister_migration_ops(struct module *mod, + struct pci_dev *pdev); + +#endif /* VFIO_PCI_MIGRATION_H */ -- 1.8.3.1

1 0

[PATCH OLK-5.10 v2 1/2] ipmi/watchdog: replace atomic_add() and atomic_sub()
by Miaohe Lin 24 Jun '22

24 Jun '22

From: Yejune Deng <yejune.deng(a)gmail.com> mainline inclusion from v5.11-rc1 commit a01a89b1db1066a6af23ae08b9a0c345b7966f0b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5DVR9 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- atomic_inc() and atomic_dec() looks better Signed-off-by: Yejune Deng <yejune.deng(a)gmail.com> Message-Id: <1605511807-7135-1-git-send-email-yejune.deng(a)gmail.com> Signed-off-by: Corey Minyard <cminyard(a)mvista.com> --- drivers/char/ipmi/ipmi_watchdog.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c index f78156d93c3f..32c334e34d55 100644 --- a/drivers/char/ipmi/ipmi_watchdog.c +++ b/drivers/char/ipmi/ipmi_watchdog.c @@ -495,7 +495,7 @@ static void panic_halt_ipmi_heartbeat(void) msg.cmd = IPMI_WDOG_RESET_TIMER; msg.data = NULL; msg.data_len = 0; - atomic_add(1, &panic_done_count); + atomic_inc(&panic_done_count); rv = ipmi_request_supply_msgs(watchdog_user, (struct ipmi_addr *) &addr, 0, @@ -505,7 +505,7 @@ static void panic_halt_ipmi_heartbeat(void) &panic_halt_heartbeat_recv_msg, 1); if (rv) - atomic_sub(1, &panic_done_count); + atomic_dec(&panic_done_count); } static struct ipmi_smi_msg panic_halt_smi_msg = { @@ -529,12 +529,12 @@ static void panic_halt_ipmi_set_timeout(void) /* Wait for the messages to be free. */ while (atomic_read(&panic_done_count) != 0) ipmi_poll_interface(watchdog_user); - atomic_add(1, &panic_done_count); + atomic_inc(&panic_done_count); rv = __ipmi_set_timeout(&panic_halt_smi_msg, &panic_halt_recv_msg, &send_heartbeat_now); if (rv) { - atomic_sub(1, &panic_done_count); + atomic_dec(&panic_done_count); pr_warn("Unable to extend the watchdog timeout\n"); } else { if (send_heartbeat_now) -- 2.23.0

1 1

[PATCH OLK-5.10 1/2] ipmi/watchdog: replace atomic_add() and atomic_sub()
by Miaohe Lin 23 Jun '22

23 Jun '22

From: Yejune Deng <yejune.deng(a)gmail.com> mainline inclusion from v5.11-rc1 commit a01a89b1db1066a6af23ae08b9a0c345b7966f0b category: bugfix bugzilla: NA CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- atomic_inc() and atomic_dec() looks better Signed-off-by: Yejune Deng <yejune.deng(a)gmail.com> Message-Id: <1605511807-7135-1-git-send-email-yejune.deng(a)gmail.com> Signed-off-by: Corey Minyard <cminyard(a)mvista.com> --- drivers/char/ipmi/ipmi_watchdog.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c index f78156d93c3f..32c334e34d55 100644 --- a/drivers/char/ipmi/ipmi_watchdog.c +++ b/drivers/char/ipmi/ipmi_watchdog.c @@ -495,7 +495,7 @@ static void panic_halt_ipmi_heartbeat(void) msg.cmd = IPMI_WDOG_RESET_TIMER; msg.data = NULL; msg.data_len = 0; - atomic_add(1, &panic_done_count); + atomic_inc(&panic_done_count); rv = ipmi_request_supply_msgs(watchdog_user, (struct ipmi_addr *) &addr, 0, @@ -505,7 +505,7 @@ static void panic_halt_ipmi_heartbeat(void) &panic_halt_heartbeat_recv_msg, 1); if (rv) - atomic_sub(1, &panic_done_count); + atomic_dec(&panic_done_count); } static struct ipmi_smi_msg panic_halt_smi_msg = { @@ -529,12 +529,12 @@ static void panic_halt_ipmi_set_timeout(void) /* Wait for the messages to be free. */ while (atomic_read(&panic_done_count) != 0) ipmi_poll_interface(watchdog_user); - atomic_add(1, &panic_done_count); + atomic_inc(&panic_done_count); rv = __ipmi_set_timeout(&panic_halt_smi_msg, &panic_halt_recv_msg, &send_heartbeat_now); if (rv) { - atomic_sub(1, &panic_done_count); + atomic_dec(&panic_done_count); pr_warn("Unable to extend the watchdog timeout\n"); } else { if (send_heartbeat_now) -- 2.23.0

2 2

[PATCH openEuler-5.10 01/59] bcache: fix race between setting bdev state to none and new write request direct to backing
by Zheng Zengkai 22 Jun '22

22 Jun '22

From: Dongsheng Yang <dongsheng.yang(a)easystack.cn> mainline inclusion from v5.11-rc1 commit df4ad53242158f9f1f97daf4feddbb4f8b77f080 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I59A5L?from=project-issue CVE: N/A ----------------------------------------------- There is a race condition in detaching as below: A. detaching B. Write request (1) writing back (2) write back done, set bdev state to clean. (3) cached_dev_put() and schedule_work(&dc->detach); (4) write data [0 - 4K] directly into backing and ack to user. (5) power-failure... When we restart this bcache device, this bdev is clean but not detached, and read [0 - 4K], we will get unexpected old data from cache device. To fix this problem, set the bdev state to none when we writeback done in detaching, and then if power-failure happened as above, the data in cache will not be used in next bcache device starting, it's detached, we will read the correct data from backing derectly. Signed-off-by: Dongsheng Yang <dongsheng.yang(a)easystack.cn> Signed-off-by: Coly Li <colyli(a)suse.de> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/md/bcache/super.c | 9 --------- drivers/md/bcache/writeback.c | 9 +++++++++ 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c index 81f1cc5b3499..b7d9d1b79ac2 100644 --- a/drivers/md/bcache/super.c +++ b/drivers/md/bcache/super.c @@ -1151,9 +1151,6 @@ static void cancel_writeback_rate_update_dwork(struct cached_dev *dc) static void cached_dev_detach_finish(struct work_struct *w) { struct cached_dev *dc = container_of(w, struct cached_dev, detach); - struct closure cl; - - closure_init_stack(&cl); BUG_ON(!test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags)); BUG_ON(refcount_read(&dc->count)); @@ -1167,12 +1164,6 @@ static void cached_dev_detach_finish(struct work_struct *w) dc->writeback_thread = NULL; } - memset(&dc->sb.set_uuid, 0, 16); - SET_BDEV_STATE(&dc->sb, BDEV_STATE_NONE); - - bch_write_bdev_super(dc, &cl); - closure_sync(&cl); - mutex_lock(&bch_register_lock); calc_cached_dev_sectors(dc->disk.c); diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c index 3c74996978da..a129e4d2707c 100644 --- a/drivers/md/bcache/writeback.c +++ b/drivers/md/bcache/writeback.c @@ -705,6 +705,15 @@ static int bch_writeback_thread(void *arg) * bch_cached_dev_detach(). */ if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags)) { + struct closure cl; + + closure_init_stack(&cl); + memset(&dc->sb.set_uuid, 0, 16); + SET_BDEV_STATE(&dc->sb, BDEV_STATE_NONE); + + bch_write_bdev_super(dc, &cl); + closure_sync(&cl); + up_write(&dc->writeback_lock); break; } -- 2.20.1

1 58

[PATCH openEuler-5.10 00/28] Backport 5.10.108 LTS
by Zheng Zengkai 22 Jun '22

22 Jun '22

Backport 5.10.108 LTS patches from upstream Revert "selftests/bpf: Add test for bpf_timer overwriting crash" smsc95xx: Ignore -ENODEV errors when device is unplugged net: usb: Correct reset handling of smsc95xx net: usb: Correct PHY handling of smsc95xx perf symbols: Fix symbol size calculation condition Input: aiptek - properly check endpoint type scsi: mpt3sas: Page fault in reply q processing usb: usbtmc: Fix bug in pipe direction for control transfers usb: gadget: Fix use-after-free bug by not setting udc->dev.driver net: mscc: ocelot: fix backwards compatibility with single-chain tc-flower offload net: bcmgenet: skip invalid partial checksums bnx2x: fix built-in kernel driver load failure net: phy: mscc: Add MODULE_FIRMWARE macros net: dsa: Add missing of_node_put() in dsa_port_parse_of net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit() drm/panel: simple: Fix Innolux G070Y2-L01 BPP settings drm/imx: parallel-display: Remove bus flags check in imx_pd_bridge_atomic_check() hv_netvsc: Add check for kvmalloc_array atm: eni: Add check for dma_map_single net/packet: fix slab-out-of-bounds access in packet_recvmsg() net: phy: marvell: Fix invalid comparison in the resume and suspend functions esp6: fix check on ipv6_skip_exthdr's return value vsock: each transport cycles only on its own sockets efi: fix return value of __setup handlers mm: swap: get rid of livelock in swapin readahead ocfs2: fix crash when initialize filecheck kobj fails crypto: qcom-rng - ensure buffer for generate is completely filled already merged (2) esp: Fix possible buffer overflow in ESP transformation arm64: fix clang warning about TRAMP_VALIAS Total patches = 30 - 2 = 28 Alan Stern (2): usb: gadget: Fix use-after-free bug by not setting udc->dev.driver usb: usbtmc: Fix bug in pipe direction for control transfers Brian Masney (1): crypto: qcom-rng - ensure buffer for generate is completely filled Christoph Niedermaier (1): drm/imx: parallel-display: Remove bus flags check in imx_pd_bridge_atomic_check() Dan Carpenter (1): usb: gadget: rndis: prevent integer overflow in rndis_set_response() Doug Berger (1): net: bcmgenet: skip invalid partial checksums Eric Dumazet (1): net/packet: fix slab-out-of-bounds access in packet_recvmsg() Fabio Estevam (1): smsc95xx: Ignore -ENODEV errors when device is unplugged Greg Kroah-Hartman (1): Revert "selftests/bpf: Add test for bpf_timer overwriting crash" Guo Ziliang (1): mm: swap: get rid of livelock in swapin readahead Jiasheng Jiang (2): atm: eni: Add check for dma_map_single hv_netvsc: Add check for kvmalloc_array Jiyong Park (1): vsock: each transport cycles only on its own sockets Joseph Qi (1): ocfs2: fix crash when initialize filecheck kobj fails Juerg Haefliger (1): net: phy: mscc: Add MODULE_FIRMWARE macros Kurt Cancemi (1): net: phy: marvell: Fix invalid comparison in the resume and suspend functions Manish Chopra (1): bnx2x: fix built-in kernel driver load failure Marek Vasut (1): drm/panel: simple: Fix Innolux G070Y2-L01 BPP settings Markus Reichl (1): net: usb: Correct reset handling of smsc95xx Martyn Welch (1): net: usb: Correct PHY handling of smsc95xx Matt Lupfer (1): scsi: mpt3sas: Page fault in reply q processing Miaoqian Lin (1): net: dsa: Add missing of_node_put() in dsa_port_parse_of Michael Petlan (1): perf symbols: Fix symbol size calculation condition Nicolas Dichtel (1): net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit() Pavel Skripkin (1): Input: aiptek - properly check endpoint type Randy Dunlap (1): efi: fix return value of __setup handlers Sabrina Dubroca (1): esp6: fix check on ipv6_skip_exthdr's return value Vladimir Oltean (1): net: mscc: ocelot: fix backwards compatibility with single-chain tc-flower offload drivers/atm/eni.c | 2 + drivers/crypto/qcom-rng.c | 17 ++-- drivers/firmware/efi/apple-properties.c | 2 +- drivers/firmware/efi/efi.c | 2 +- drivers/gpu/drm/imx/parallel-display.c | 8 -- drivers/gpu/drm/panel/panel-simple.c | 2 +- drivers/input/tablet/aiptek.c | 10 +-- drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 2 - .../net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 28 +++--- .../net/ethernet/broadcom/bnx2x/bnx2x_main.c | 15 +--- .../net/ethernet/broadcom/genet/bcmgenet.c | 6 +- drivers/net/ethernet/mscc/ocelot_flower.c | 16 +++- drivers/net/hyperv/netvsc_drv.c | 3 + drivers/net/phy/marvell.c | 8 +- drivers/net/phy/mscc/mscc_main.c | 3 + drivers/net/usb/smsc95xx.c | 86 +++++++++++-------- drivers/scsi/mpt3sas/mpt3sas_base.c | 5 +- drivers/usb/class/usbtmc.c | 13 ++- drivers/usb/gadget/function/rndis.c | 1 + drivers/usb/gadget/udc/core.c | 3 - drivers/vhost/vsock.c | 3 +- fs/ocfs2/super.c | 22 ++--- include/linux/if_arp.h | 1 + include/net/af_vsock.h | 3 +- mm/swap_state.c | 2 +- net/dsa/dsa2.c | 1 + net/ipv6/esp6.c | 3 +- net/packet/af_packet.c | 11 ++- net/vmw_vsock/af_vsock.c | 9 +- net/vmw_vsock/virtio_transport.c | 7 +- net/vmw_vsock/vmci_transport.c | 5 +- tools/perf/util/symbol.c | 2 +- .../selftests/bpf/prog_tests/timer_crash.c | 32 ------- .../testing/selftests/bpf/progs/timer_crash.c | 54 ------------ 34 files changed, 175 insertions(+), 212 deletions(-) delete mode 100644 tools/testing/selftests/bpf/prog_tests/timer_crash.c delete mode 100644 tools/testing/selftests/bpf/progs/timer_crash.c -- 2.20.1

1 28

[PATCH openEuler-1.0-LTS] xfs: show the proper user quota options
by Laibin Qiu 22 Jun '22

22 Jun '22

From: Kaixu Xia <kaixuxia(a)tencent.com> mainline inclusion from mainline-v5.11-rc6 commit 237d7887ae723af7d978e8b9a385fdff416f357b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5AG18 CVE: NA -------------------------------- The quota option 'usrquota' should be shown if both the XFS_UQUOTA_ACCT and XFS_UQUOTA_ENFD flags are set. The option 'uqnoenforce' should be shown when only the XFS_UQUOTA_ACCT flag is set. The current code logic seems wrong, Fix it and show proper options. Signed-off-by: Kaixu Xia <kaixuxia(a)tencent.com> Reviewed-by: Darrick J. Wong <darrick.wong(a)oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong(a)oracle.com> Signed-off-by: tangbin <tangbin(a)cmss.chinamobile.com> Reviewed-by: Xuenan Guo <guoxuenan(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- fs/xfs/xfs_super.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c index e126bc6cdeb8..5d8e3a4d2671 100644 --- a/fs/xfs/xfs_super.c +++ b/fs/xfs/xfs_super.c @@ -505,10 +505,12 @@ xfs_showargs( seq_printf(m, ",swidth=%d", (int)XFS_FSB_TO_BB(mp, mp->m_swidth)); - if (mp->m_qflags & (XFS_UQUOTA_ACCT|XFS_UQUOTA_ENFD)) - seq_puts(m, ",usrquota"); - else if (mp->m_qflags & XFS_UQUOTA_ACCT) - seq_puts(m, ",uqnoenforce"); + if (mp->m_qflags & XFS_UQUOTA_ACCT) { + if (mp->m_qflags & XFS_UQUOTA_ENFD) + seq_puts(m, ",usrquota"); + else + seq_puts(m, ",uqnoenforce"); + } if (mp->m_qflags & XFS_PQUOTA_ACCT) { if (mp->m_qflags & XFS_PQUOTA_ENFD) -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS 01/55] bcache: fix race between setting bdev state to none and new write request direct to backing
by Zheng Zengkai 21 Jun '22

21 Jun '22

From: Dongsheng Yang <dongsheng.yang(a)easystack.cn> mainline inclusion from v5.11-rc1 commit df4ad53242158f9f1f97daf4feddbb4f8b77f080 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I59A5L?from=project-issue CVE: N/A ----------------------------------------------- There is a race condition in detaching as below: A. detaching B. Write request (1) writing back (2) write back done, set bdev state to clean. (3) cached_dev_put() and schedule_work(&dc->detach); (4) write data [0 - 4K] directly into backing and ack to user. (5) power-failure... When we restart this bcache device, this bdev is clean but not detached, and read [0 - 4K], we will get unexpected old data from cache device. To fix this problem, set the bdev state to none when we writeback done in detaching, and then if power-failure happened as above, the data in cache will not be used in next bcache device starting, it's detached, we will read the correct data from backing derectly. Signed-off-by: Dongsheng Yang <dongsheng.yang(a)easystack.cn> Signed-off-by: Coly Li <colyli(a)suse.de> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/md/bcache/super.c | 9 --------- drivers/md/bcache/writeback.c | 9 +++++++++ 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c index 81f1cc5b3499..b7d9d1b79ac2 100644 --- a/drivers/md/bcache/super.c +++ b/drivers/md/bcache/super.c @@ -1151,9 +1151,6 @@ static void cancel_writeback_rate_update_dwork(struct cached_dev *dc) static void cached_dev_detach_finish(struct work_struct *w) { struct cached_dev *dc = container_of(w, struct cached_dev, detach); - struct closure cl; - - closure_init_stack(&cl); BUG_ON(!test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags)); BUG_ON(refcount_read(&dc->count)); @@ -1167,12 +1164,6 @@ static void cached_dev_detach_finish(struct work_struct *w) dc->writeback_thread = NULL; } - memset(&dc->sb.set_uuid, 0, 16); - SET_BDEV_STATE(&dc->sb, BDEV_STATE_NONE); - - bch_write_bdev_super(dc, &cl); - closure_sync(&cl); - mutex_lock(&bch_register_lock); calc_cached_dev_sectors(dc->disk.c); diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c index 3c74996978da..a129e4d2707c 100644 --- a/drivers/md/bcache/writeback.c +++ b/drivers/md/bcache/writeback.c @@ -705,6 +705,15 @@ static int bch_writeback_thread(void *arg) * bch_cached_dev_detach(). */ if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags)) { + struct closure cl; + + closure_init_stack(&cl); + memset(&dc->sb.set_uuid, 0, 16); + SET_BDEV_STATE(&dc->sb, BDEV_STATE_NONE); + + bch_write_bdev_super(dc, &cl); + closure_sync(&cl); + up_write(&dc->writeback_lock); break; } -- 2.20.1

1 54

[PATCH openEuler-5.10-LTS 00/28] Backport 5.10.108 LTS
by Zheng Zengkai 21 Jun '22

21 Jun '22

Backport 5.10.108 LTS patches from upstream Revert "selftests/bpf: Add test for bpf_timer overwriting crash" smsc95xx: Ignore -ENODEV errors when device is unplugged net: usb: Correct reset handling of smsc95xx net: usb: Correct PHY handling of smsc95xx perf symbols: Fix symbol size calculation condition Input: aiptek - properly check endpoint type scsi: mpt3sas: Page fault in reply q processing usb: usbtmc: Fix bug in pipe direction for control transfers usb: gadget: Fix use-after-free bug by not setting udc->dev.driver net: mscc: ocelot: fix backwards compatibility with single-chain tc-flower offload net: bcmgenet: skip invalid partial checksums bnx2x: fix built-in kernel driver load failure net: phy: mscc: Add MODULE_FIRMWARE macros net: dsa: Add missing of_node_put() in dsa_port_parse_of net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit() drm/panel: simple: Fix Innolux G070Y2-L01 BPP settings drm/imx: parallel-display: Remove bus flags check in imx_pd_bridge_atomic_check() hv_netvsc: Add check for kvmalloc_array atm: eni: Add check for dma_map_single net/packet: fix slab-out-of-bounds access in packet_recvmsg() net: phy: marvell: Fix invalid comparison in the resume and suspend functions esp6: fix check on ipv6_skip_exthdr's return value vsock: each transport cycles only on its own sockets efi: fix return value of __setup handlers mm: swap: get rid of livelock in swapin readahead ocfs2: fix crash when initialize filecheck kobj fails crypto: qcom-rng - ensure buffer for generate is completely filled already merged (2) esp: Fix possible buffer overflow in ESP transformation arm64: fix clang warning about TRAMP_VALIAS Total patches = 30 - 2 = 28 Alan Stern (2): usb: gadget: Fix use-after-free bug by not setting udc->dev.driver usb: usbtmc: Fix bug in pipe direction for control transfers Brian Masney (1): crypto: qcom-rng - ensure buffer for generate is completely filled Christoph Niedermaier (1): drm/imx: parallel-display: Remove bus flags check in imx_pd_bridge_atomic_check() Dan Carpenter (1): usb: gadget: rndis: prevent integer overflow in rndis_set_response() Doug Berger (1): net: bcmgenet: skip invalid partial checksums Eric Dumazet (1): net/packet: fix slab-out-of-bounds access in packet_recvmsg() Fabio Estevam (1): smsc95xx: Ignore -ENODEV errors when device is unplugged Greg Kroah-Hartman (1): Revert "selftests/bpf: Add test for bpf_timer overwriting crash" Guo Ziliang (1): mm: swap: get rid of livelock in swapin readahead Jiasheng Jiang (2): atm: eni: Add check for dma_map_single hv_netvsc: Add check for kvmalloc_array Jiyong Park (1): vsock: each transport cycles only on its own sockets Joseph Qi (1): ocfs2: fix crash when initialize filecheck kobj fails Juerg Haefliger (1): net: phy: mscc: Add MODULE_FIRMWARE macros Kurt Cancemi (1): net: phy: marvell: Fix invalid comparison in the resume and suspend functions Manish Chopra (1): bnx2x: fix built-in kernel driver load failure Marek Vasut (1): drm/panel: simple: Fix Innolux G070Y2-L01 BPP settings Markus Reichl (1): net: usb: Correct reset handling of smsc95xx Martyn Welch (1): net: usb: Correct PHY handling of smsc95xx Matt Lupfer (1): scsi: mpt3sas: Page fault in reply q processing Miaoqian Lin (1): net: dsa: Add missing of_node_put() in dsa_port_parse_of Michael Petlan (1): perf symbols: Fix symbol size calculation condition Nicolas Dichtel (1): net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit() Pavel Skripkin (1): Input: aiptek - properly check endpoint type Randy Dunlap (1): efi: fix return value of __setup handlers Sabrina Dubroca (1): esp6: fix check on ipv6_skip_exthdr's return value Vladimir Oltean (1): net: mscc: ocelot: fix backwards compatibility with single-chain tc-flower offload drivers/atm/eni.c | 2 + drivers/crypto/qcom-rng.c | 17 ++-- drivers/firmware/efi/apple-properties.c | 2 +- drivers/firmware/efi/efi.c | 2 +- drivers/gpu/drm/imx/parallel-display.c | 8 -- drivers/gpu/drm/panel/panel-simple.c | 2 +- drivers/input/tablet/aiptek.c | 10 +-- drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 2 - .../net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 28 +++--- .../net/ethernet/broadcom/bnx2x/bnx2x_main.c | 15 +--- .../net/ethernet/broadcom/genet/bcmgenet.c | 6 +- drivers/net/ethernet/mscc/ocelot_flower.c | 16 +++- drivers/net/hyperv/netvsc_drv.c | 3 + drivers/net/phy/marvell.c | 8 +- drivers/net/phy/mscc/mscc_main.c | 3 + drivers/net/usb/smsc95xx.c | 86 +++++++++++-------- drivers/scsi/mpt3sas/mpt3sas_base.c | 5 +- drivers/usb/class/usbtmc.c | 13 ++- drivers/usb/gadget/function/rndis.c | 1 + drivers/usb/gadget/udc/core.c | 3 - drivers/vhost/vsock.c | 3 +- fs/ocfs2/super.c | 22 ++--- include/linux/if_arp.h | 1 + include/net/af_vsock.h | 3 +- mm/swap_state.c | 2 +- net/dsa/dsa2.c | 1 + net/ipv6/esp6.c | 3 +- net/packet/af_packet.c | 11 ++- net/vmw_vsock/af_vsock.c | 9 +- net/vmw_vsock/virtio_transport.c | 7 +- net/vmw_vsock/vmci_transport.c | 5 +- tools/perf/util/symbol.c | 2 +- .../selftests/bpf/prog_tests/timer_crash.c | 32 ------- .../testing/selftests/bpf/progs/timer_crash.c | 54 ------------ 34 files changed, 175 insertions(+), 212 deletions(-) delete mode 100644 tools/testing/selftests/bpf/prog_tests/timer_crash.c delete mode 100644 tools/testing/selftests/bpf/progs/timer_crash.c -- 2.20.1

1 28

[PATCH openEuler-1.0-LTS 1/4] sched: Introduce qos smt expeller for co-location
by liuzhengyuan＠kylinos.cn 21 Jun '22

21 Jun '22

From: Guan Jing <guanjing6(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I52611 CVE: NA -------------------------------- We introduce the qos smt expeller, which lets online tasks to expel offline tasks on the smt sibling cpus, and exclusively occupy CPU resources.In this way we are able to improve QOS of online tasks in co-location. Change-Id: I1860d20d5e78467773e67cc47b4fa2d1f0110783 Signed-off-by: Guan Jing <guanjing6(a)huawei.com> Reviewed-by: Chen Hui <judy.chenhui(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Zhengyuan Liu <liuzhengyuan(a)kylinos.cn> --- init/Kconfig | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/init/Kconfig b/init/Kconfig index ac1c864524ac..dd81d19e2fcb 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -794,6 +794,15 @@ config QOS_SCHED default n +config QOS_SCHED_SMT_EXPELLER + bool "Qos smt expeller" + depends on SCHED_SMT + depends on QOS_SCHED + default n + help + This feature enable online tasks to expel offline tasks + on the smt sibling cpus, and exclusively occupy CPU resources. + config FAIR_GROUP_SCHED bool "Group scheduling for SCHED_OTHER" depends on CGROUP_SCHED -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS 1/6] drivers core: Use sysfs_emit and sysfs_emit_at for show(device *...) functions
by Yongqiang Liu 21 Jun '22

21 Jun '22

From: Joe Perches <joe(a)perches.com> mainline inclusion from mainline-v5.10-rc1 commit aa838896d87af561a33ecefea1caa4c15a68bc47 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5C32F CVE: CVE-2022-20166 ---------------------------------------------- Convert the various sprintf fmaily calls in sysfs device show functions to sysfs_emit and sysfs_emit_at for PAGE_SIZE buffer safety. Done with: $ spatch -sp-file sysfs_emit_dev.cocci --in-place --max-width=80 . And cocci script: $ cat sysfs_emit_dev.cocci @@ identifier d_show; identifier dev, attr, buf; @@ ssize_t d_show(struct device *dev, struct device_attribute *attr, char *buf) { <... return - sprintf(buf, + sysfs_emit(buf, ...); ...> } @@ identifier d_show; identifier dev, attr, buf; @@ ssize_t d_show(struct device *dev, struct device_attribute *attr, char *buf) { <... return - snprintf(buf, PAGE_SIZE, + sysfs_emit(buf, ...); ...> } @@ identifier d_show; identifier dev, attr, buf; @@ ssize_t d_show(struct device *dev, struct device_attribute *attr, char *buf) { <... return - scnprintf(buf, PAGE_SIZE, + sysfs_emit(buf, ...); ...> } @@ identifier d_show; identifier dev, attr, buf; expression chr; @@ ssize_t d_show(struct device *dev, struct device_attribute *attr, char *buf) { <... return - strcpy(buf, chr); + sysfs_emit(buf, chr); ...> } @@ identifier d_show; identifier dev, attr, buf; identifier len; @@ ssize_t d_show(struct device *dev, struct device_attribute *attr, char *buf) { <... len = - sprintf(buf, + sysfs_emit(buf, ...); ...> return len; } @@ identifier d_show; identifier dev, attr, buf; identifier len; @@ ssize_t d_show(struct device *dev, struct device_attribute *attr, char *buf) { <... len = - snprintf(buf, PAGE_SIZE, + sysfs_emit(buf, ...); ...> return len; } @@ identifier d_show; identifier dev, attr, buf; identifier len; @@ ssize_t d_show(struct device *dev, struct device_attribute *attr, char *buf) { <... len = - scnprintf(buf, PAGE_SIZE, + sysfs_emit(buf, ...); ...> return len; } @@ identifier d_show; identifier dev, attr, buf; identifier len; @@ ssize_t d_show(struct device *dev, struct device_attribute *attr, char *buf) { <... - len += scnprintf(buf + len, PAGE_SIZE - len, + len += sysfs_emit_at(buf, len, ...); ...> return len; } @@ identifier d_show; identifier dev, attr, buf; expression chr; @@ ssize_t d_show(struct device *dev, struct device_attribute *attr, char *buf) { ... - strcpy(buf, chr); - return strlen(buf); + return sysfs_emit(buf, chr); } Signed-off-by: Joe Perches <joe(a)perches.com> Link: https://lore.kernel.org/r/3d033c33056d88bbe34d4ddb62afd05ee166ab9a.16002859… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/base/node.c Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/base/arch_topology.c | 3 +- drivers/base/cacheinfo.c | 18 ++++----- drivers/base/core.c | 8 ++-- drivers/base/cpu.c | 26 ++++++------ drivers/base/firmware_loader/fallback.c | 2 +- drivers/base/memory.c | 24 +++++------ drivers/base/node.c | 26 ++++++------ drivers/base/platform.c | 2 +- drivers/base/power/sysfs.c | 53 +++++++++++++------------ drivers/base/soc.c | 8 ++-- 10 files changed, 86 insertions(+), 84 deletions(-) diff --git a/drivers/base/arch_topology.c b/drivers/base/arch_topology.c index 7157e4039b4c..729dded51e7b 100644 --- a/drivers/base/arch_topology.c +++ b/drivers/base/arch_topology.c @@ -42,7 +42,8 @@ static ssize_t cpu_capacity_show(struct device *dev, { struct cpu *cpu = container_of(dev, struct cpu, dev); - return sprintf(buf, "%lu\n", topology_get_cpu_scale(NULL, cpu->dev.id)); + return sysfs_emit(buf, "%lu\n", + topology_get_cpu_scale(NULL, cpu->dev.id)); } static DEVICE_ATTR_RO(cpu_capacity); diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c index aee69d78c2e7..f7d107ca1a66 100644 --- a/drivers/base/cacheinfo.c +++ b/drivers/base/cacheinfo.c @@ -415,7 +415,7 @@ static ssize_t size_show(struct device *dev, { struct cacheinfo *this_leaf = dev_get_drvdata(dev); - return sprintf(buf, "%uK\n", this_leaf->size >> 10); + return sysfs_emit(buf, "%uK\n", this_leaf->size >> 10); } static ssize_t shared_cpumap_show_func(struct device *dev, bool list, char *buf) @@ -445,11 +445,11 @@ static ssize_t type_show(struct device *dev, switch (this_leaf->type) { case CACHE_TYPE_DATA: - return sprintf(buf, "Data\n"); + return sysfs_emit(buf, "Data\n"); case CACHE_TYPE_INST: - return sprintf(buf, "Instruction\n"); + return sysfs_emit(buf, "Instruction\n"); case CACHE_TYPE_UNIFIED: - return sprintf(buf, "Unified\n"); + return sysfs_emit(buf, "Unified\n"); default: return -EINVAL; } @@ -463,11 +463,11 @@ static ssize_t allocation_policy_show(struct device *dev, int n = 0; if ((ci_attr & CACHE_READ_ALLOCATE) && (ci_attr & CACHE_WRITE_ALLOCATE)) - n = sprintf(buf, "ReadWriteAllocate\n"); + n = sysfs_emit(buf, "ReadWriteAllocate\n"); else if (ci_attr & CACHE_READ_ALLOCATE) - n = sprintf(buf, "ReadAllocate\n"); + n = sysfs_emit(buf, "ReadAllocate\n"); else if (ci_attr & CACHE_WRITE_ALLOCATE) - n = sprintf(buf, "WriteAllocate\n"); + n = sysfs_emit(buf, "WriteAllocate\n"); return n; } @@ -479,9 +479,9 @@ static ssize_t write_policy_show(struct device *dev, int n = 0; if (ci_attr & CACHE_WRITE_THROUGH) - n = sprintf(buf, "WriteThrough\n"); + n = sysfs_emit(buf, "WriteThrough\n"); else if (ci_attr & CACHE_WRITE_BACK) - n = sprintf(buf, "WriteBack\n"); + n = sysfs_emit(buf, "WriteBack\n"); return n; } diff --git a/drivers/base/core.c b/drivers/base/core.c index f6d8a4246adf..b4f80e82a91f 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -994,7 +994,7 @@ ssize_t device_show_ulong(struct device *dev, char *buf) { struct dev_ext_attribute *ea = to_ext_attr(attr); - return snprintf(buf, PAGE_SIZE, "%lx\n", *(unsigned long *)(ea->var)); + return sysfs_emit(buf, "%lx\n", *(unsigned long *)(ea->var)); } EXPORT_SYMBOL_GPL(device_show_ulong); @@ -1019,7 +1019,7 @@ ssize_t device_show_int(struct device *dev, { struct dev_ext_attribute *ea = to_ext_attr(attr); - return snprintf(buf, PAGE_SIZE, "%d\n", *(int *)(ea->var)); + return sysfs_emit(buf, "%d\n", *(int *)(ea->var)); } EXPORT_SYMBOL_GPL(device_show_int); @@ -1040,7 +1040,7 @@ ssize_t device_show_bool(struct device *dev, struct device_attribute *attr, { struct dev_ext_attribute *ea = to_ext_attr(attr); - return snprintf(buf, PAGE_SIZE, "%d\n", *(bool *)(ea->var)); + return sysfs_emit(buf, "%d\n", *(bool *)(ea->var)); } EXPORT_SYMBOL_GPL(device_show_bool); @@ -1273,7 +1273,7 @@ static ssize_t online_show(struct device *dev, struct device_attribute *attr, device_lock(dev); val = !dev->offline; device_unlock(dev); - return sprintf(buf, "%u\n", val); + return sysfs_emit(buf, "%u\n", val); } static ssize_t online_store(struct device *dev, struct device_attribute *attr, diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c index 1df057486176..128e5867c35d 100644 --- a/drivers/base/cpu.c +++ b/drivers/base/cpu.c @@ -156,7 +156,7 @@ static ssize_t show_crash_notes(struct device *dev, struct device_attribute *att * operation should be safe. No locking required. */ addr = per_cpu_ptr_to_phys(per_cpu_ptr(crash_notes, cpunum)); - rc = sprintf(buf, "%Lx\n", addr); + rc = sysfs_emit(buf, "%Lx\n", addr); return rc; } static DEVICE_ATTR(crash_notes, 0400, show_crash_notes, NULL); @@ -167,7 +167,7 @@ static ssize_t show_crash_notes_size(struct device *dev, { ssize_t rc; - rc = sprintf(buf, "%zu\n", sizeof(note_buf_t)); + rc = sysfs_emit(buf, "%zu\n", sizeof(note_buf_t)); return rc; } static DEVICE_ATTR(crash_notes_size, 0400, show_crash_notes_size, NULL); @@ -328,8 +328,8 @@ static ssize_t print_cpu_modalias(struct device *dev, ssize_t n; u32 i; - n = sprintf(buf, "cpu:type:" CPU_FEATURE_TYPEFMT ":feature:", - CPU_FEATURE_TYPEVAL); + n = sysfs_emit(buf, "cpu:type:" CPU_FEATURE_TYPEFMT ":feature:", + CPU_FEATURE_TYPEVAL); for (i = 0; i < MAX_CPU_FEATURES; i++) if (cpu_have_feature(i)) { @@ -519,56 +519,56 @@ static void __init cpu_dev_register_generic(void) ssize_t __weak cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "Not affected\n"); + return sysfs_emit(buf, "Not affected\n"); } ssize_t __weak cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "Not affected\n"); + return sysfs_emit(buf, "Not affected\n"); } ssize_t __weak cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "Not affected\n"); + return sysfs_emit(buf, "Not affected\n"); } ssize_t __weak cpu_show_spec_store_bypass(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "Not affected\n"); + return sysfs_emit(buf, "Not affected\n"); } ssize_t __weak cpu_show_l1tf(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "Not affected\n"); + return sysfs_emit(buf, "Not affected\n"); } ssize_t __weak cpu_show_mds(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "Not affected\n"); + return sysfs_emit(buf, "Not affected\n"); } ssize_t __weak cpu_show_tsx_async_abort(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "Not affected\n"); + return sysfs_emit(buf, "Not affected\n"); } ssize_t __weak cpu_show_itlb_multihit(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "Not affected\n"); + return sysfs_emit(buf, "Not affected\n"); } ssize_t __weak cpu_show_srbds(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "Not affected\n"); + return sysfs_emit(buf, "Not affected\n"); } static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmware_loader/fallback.c index 818d8c37d70a..ab619da92734 100644 --- a/drivers/base/firmware_loader/fallback.c +++ b/drivers/base/firmware_loader/fallback.c @@ -216,7 +216,7 @@ static ssize_t firmware_loading_show(struct device *dev, loading = fw_sysfs_loading(fw_sysfs->fw_priv); mutex_unlock(&fw_lock); - return sprintf(buf, "%d\n", loading); + return sysfs_emit(buf, "%d\n", loading); } /* one pages buffer should be mapped/unmapped only once */ diff --git a/drivers/base/memory.c b/drivers/base/memory.c index 1b97f305173f..54225b812cd7 100644 --- a/drivers/base/memory.c +++ b/drivers/base/memory.c @@ -140,7 +140,7 @@ static ssize_t phys_index_show(struct device *dev, unsigned long phys_index; phys_index = mem->start_section_nr / sections_per_block; - return sprintf(buf, "%08lx\n", phys_index); + return sysfs_emit(buf, "%08lx\n", phys_index); } /* @@ -164,7 +164,7 @@ static ssize_t removable_show(struct device *dev, struct device_attribute *attr, } out: - return sprintf(buf, "%d\n", ret); + return sysfs_emit(buf, "%d\n", ret); } /* @@ -182,17 +182,17 @@ static ssize_t state_show(struct device *dev, struct device_attribute *attr, */ switch (mem->state) { case MEM_ONLINE: - len = sprintf(buf, "online\n"); + len = sysfs_emit(buf, "online\n"); break; case MEM_OFFLINE: - len = sprintf(buf, "offline\n"); + len = sysfs_emit(buf, "offline\n"); break; case MEM_GOING_OFFLINE: - len = sprintf(buf, "going-offline\n"); + len = sysfs_emit(buf, "going-offline\n"); break; default: - len = sprintf(buf, "ERROR-UNKNOWN-%ld\n", - mem->state); + len = sysfs_emit(buf, "ERROR-UNKNOWN-%ld\n", + mem->state); WARN_ON(1); break; } @@ -389,7 +389,7 @@ static ssize_t phys_device_show(struct device *dev, struct device_attribute *attr, char *buf) { struct memory_block *mem = to_memory_block(dev); - return sprintf(buf, "%d\n", mem->phys_device); + return sysfs_emit(buf, "%d\n", mem->phys_device); } #ifdef CONFIG_MEMORY_HOTREMOVE @@ -427,7 +427,7 @@ static ssize_t valid_zones_show(struct device *dev, */ if (!test_pages_in_a_zone(start_pfn, start_pfn + nr_pages, &valid_start_pfn, &valid_end_pfn)) - return sprintf(buf, "none\n"); + return sysfs_emit(buf, "none\n"); start_pfn = valid_start_pfn; strcat(buf, page_zone(pfn_to_page(start_pfn))->name); goto out; @@ -461,7 +461,7 @@ static DEVICE_ATTR_RO(removable); static ssize_t block_size_bytes_show(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "%lx\n", get_memory_block_size()); + return sysfs_emit(buf, "%lx\n", get_memory_block_size()); } static DEVICE_ATTR_RO(block_size_bytes); @@ -473,8 +473,8 @@ static DEVICE_ATTR_RO(block_size_bytes); static ssize_t auto_online_blocks_show(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "%s\n", - online_type_to_str[memhp_default_online_type]); + return sysfs_emit(buf, "%s\n", + online_type_to_str[memhp_default_online_type]); } static ssize_t auto_online_blocks_store(struct device *dev, diff --git a/drivers/base/node.c b/drivers/base/node.c index ac44db3f63c7..7a807e471fbf 100644 --- a/drivers/base/node.c +++ b/drivers/base/node.c @@ -457,19 +457,19 @@ static DEVICE_ATTR(meminfo, S_IRUGO, node_read_meminfo, NULL); static ssize_t node_read_numastat(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, - "numa_hit %lu\n" - "numa_miss %lu\n" - "numa_foreign %lu\n" - "interleave_hit %lu\n" - "local_node %lu\n" - "other_node %lu\n", - sum_zone_numa_state(dev->id, NUMA_HIT), - sum_zone_numa_state(dev->id, NUMA_MISS), - sum_zone_numa_state(dev->id, NUMA_FOREIGN), - sum_zone_numa_state(dev->id, NUMA_INTERLEAVE_HIT), - sum_zone_numa_state(dev->id, NUMA_LOCAL), - sum_zone_numa_state(dev->id, NUMA_OTHER)); + return sysfs_emit(buf, + "numa_hit %lu\n" + "numa_miss %lu\n" + "numa_foreign %lu\n" + "interleave_hit %lu\n" + "local_node %lu\n" + "other_node %lu\n", + sum_zone_numa_state(dev->id, NUMA_HIT), + sum_zone_numa_state(dev->id, NUMA_MISS), + sum_zone_numa_state(dev->id, NUMA_FOREIGN), + sum_zone_numa_state(dev->id, NUMA_INTERLEAVE_HIT), + sum_zone_numa_state(dev->id, NUMA_LOCAL), + sum_zone_numa_state(dev->id, NUMA_OTHER)); } static DEVICE_ATTR(numastat, S_IRUGO, node_read_numastat, NULL); diff --git a/drivers/base/platform.c b/drivers/base/platform.c index 349c2754eed7..fe3f4225d80a 100644 --- a/drivers/base/platform.c +++ b/drivers/base/platform.c @@ -907,7 +907,7 @@ static ssize_t driver_override_show(struct device *dev, ssize_t len; device_lock(dev); - len = sprintf(buf, "%s\n", pdev->driver_override); + len = sysfs_emit(buf, "%s\n", pdev->driver_override); device_unlock(dev); return len; } diff --git a/drivers/base/power/sysfs.c b/drivers/base/power/sysfs.c index d713738ce796..d071d5d1a6d7 100644 --- a/drivers/base/power/sysfs.c +++ b/drivers/base/power/sysfs.c @@ -101,7 +101,7 @@ static const char ctrl_on[] = "on"; static ssize_t control_show(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "%s\n", + return sysfs_emit(buf, "%s\n", dev->power.runtime_auto ? ctrl_auto : ctrl_on); } @@ -127,7 +127,8 @@ static ssize_t runtime_active_time_show(struct device *dev, int ret; spin_lock_irq(&dev->power.lock); update_pm_runtime_accounting(dev); - ret = sprintf(buf, "%i\n", jiffies_to_msecs(dev->power.active_jiffies)); + ret = sysfs_emit(buf, "%i\n", + jiffies_to_msecs(dev->power.active_jiffies)); spin_unlock_irq(&dev->power.lock); return ret; } @@ -140,8 +141,8 @@ static ssize_t runtime_suspended_time_show(struct device *dev, int ret; spin_lock_irq(&dev->power.lock); update_pm_runtime_accounting(dev); - ret = sprintf(buf, "%i\n", - jiffies_to_msecs(dev->power.suspended_jiffies)); + ret = sysfs_emit(buf, "%i\n", + jiffies_to_msecs(dev->power.suspended_jiffies)); spin_unlock_irq(&dev->power.lock); return ret; } @@ -175,7 +176,7 @@ static ssize_t runtime_status_show(struct device *dev, return -EIO; } } - return sprintf(buf, p); + return sysfs_emit(buf, p); } static DEVICE_ATTR_RO(runtime_status); @@ -185,7 +186,7 @@ static ssize_t autosuspend_delay_ms_show(struct device *dev, { if (!dev->power.use_autosuspend) return -EIO; - return sprintf(buf, "%d\n", dev->power.autosuspend_delay); + return sysfs_emit(buf, "%d\n", dev->power.autosuspend_delay); } static ssize_t autosuspend_delay_ms_store(struct device *dev, @@ -214,11 +215,11 @@ static ssize_t pm_qos_resume_latency_us_show(struct device *dev, s32 value = dev_pm_qos_requested_resume_latency(dev); if (value == 0) - return sprintf(buf, "n/a\n"); + return sysfs_emit(buf, "n/a\n"); if (value == PM_QOS_RESUME_LATENCY_NO_CONSTRAINT) value = 0; - return sprintf(buf, "%d\n", value); + return sysfs_emit(buf, "%d\n", value); } static ssize_t pm_qos_resume_latency_us_store(struct device *dev, @@ -258,11 +259,11 @@ static ssize_t pm_qos_latency_tolerance_us_show(struct device *dev, s32 value = dev_pm_qos_get_user_latency_tolerance(dev); if (value < 0) - return sprintf(buf, "auto\n"); + return sysfs_emit(buf, "auto\n"); if (value == PM_QOS_LATENCY_ANY) - return sprintf(buf, "any\n"); + return sysfs_emit(buf, "any\n"); - return sprintf(buf, "%d\n", value); + return sysfs_emit(buf, "%d\n", value); } static ssize_t pm_qos_latency_tolerance_us_store(struct device *dev, @@ -294,8 +295,8 @@ static ssize_t pm_qos_no_power_off_show(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "%d\n", !!(dev_pm_qos_requested_flags(dev) - & PM_QOS_FLAG_NO_POWER_OFF)); + return sysfs_emit(buf, "%d\n", !!(dev_pm_qos_requested_flags(dev) + & PM_QOS_FLAG_NO_POWER_OFF)); } static ssize_t pm_qos_no_power_off_store(struct device *dev, @@ -323,9 +324,9 @@ static const char _disabled[] = "disabled"; static ssize_t wakeup_show(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "%s\n", device_can_wakeup(dev) - ? (device_may_wakeup(dev) ? _enabled : _disabled) - : ""); + return sysfs_emit(buf, "%s\n", device_can_wakeup(dev) + ? (device_may_wakeup(dev) ? _enabled : _disabled) + : ""); } static ssize_t wakeup_store(struct device *dev, struct device_attribute *attr, @@ -511,7 +512,7 @@ static DEVICE_ATTR_RO(wakeup_prevent_sleep_time_ms); static ssize_t runtime_usage_show(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "%d\n", atomic_read(&dev->power.usage_count)); + return sysfs_emit(buf, "%d\n", atomic_read(&dev->power.usage_count)); } static DEVICE_ATTR_RO(runtime_usage); @@ -519,8 +520,8 @@ static ssize_t runtime_active_kids_show(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "%d\n", dev->power.ignore_children ? - 0 : atomic_read(&dev->power.child_count)); + return sysfs_emit(buf, "%d\n", dev->power.ignore_children ? + 0 : atomic_read(&dev->power.child_count)); } static DEVICE_ATTR_RO(runtime_active_kids); @@ -528,12 +529,12 @@ static ssize_t runtime_enabled_show(struct device *dev, struct device_attribute *attr, char *buf) { if (dev->power.disable_depth && (dev->power.runtime_auto == false)) - return sprintf(buf, "disabled & forbidden\n"); + return sysfs_emit(buf, "disabled & forbidden\n"); if (dev->power.disable_depth) - return sprintf(buf, "disabled\n"); + return sysfs_emit(buf, "disabled\n"); if (dev->power.runtime_auto == false) - return sprintf(buf, "forbidden\n"); - return sprintf(buf, "enabled\n"); + return sysfs_emit(buf, "forbidden\n"); + return sysfs_emit(buf, "enabled\n"); } static DEVICE_ATTR_RO(runtime_enabled); @@ -541,9 +542,9 @@ static DEVICE_ATTR_RO(runtime_enabled); static ssize_t async_show(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "%s\n", - device_async_suspend_enabled(dev) ? - _enabled : _disabled); + return sysfs_emit(buf, "%s\n", + device_async_suspend_enabled(dev) ? + _enabled : _disabled); } static ssize_t async_store(struct device *dev, struct device_attribute *attr, diff --git a/drivers/base/soc.c b/drivers/base/soc.c index 7e91894a380b..23bc9eb794a2 100644 --- a/drivers/base/soc.c +++ b/drivers/base/soc.c @@ -72,13 +72,13 @@ static ssize_t soc_info_get(struct device *dev, struct soc_device *soc_dev = container_of(dev, struct soc_device, dev); if (attr == &dev_attr_machine) - return sprintf(buf, "%s\n", soc_dev->attr->machine); + return sysfs_emit(buf, "%s\n", soc_dev->attr->machine); if (attr == &dev_attr_family) - return sprintf(buf, "%s\n", soc_dev->attr->family); + return sysfs_emit(buf, "%s\n", soc_dev->attr->family); if (attr == &dev_attr_revision) - return sprintf(buf, "%s\n", soc_dev->attr->revision); + return sysfs_emit(buf, "%s\n", soc_dev->attr->revision); if (attr == &dev_attr_soc_id) - return sprintf(buf, "%s\n", soc_dev->attr->soc_id); + return sysfs_emit(buf, "%s\n", soc_dev->attr->soc_id); return -EINVAL; -- 2.25.1

1 5

[PATCH] drm/atomic-helper: Bump vblank timeout to 100 ms
by jiazhenyuan＠uniontech.com 21 Jun '22

21 Jun '22

From: jiazhenyuan <jiazhenyuan(a)uniontech.com> mainline inclusion from mainline-v5.1.0-rc2 commit b3198c38f02d54a5e964258a2180d502abe6eaf0 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5D0PL CVE: NA -------------------------------- The 50 ms default timeout waiting for vblanks is too small for the first vblank from the ST-Ericsson MCDE display controller over DSI. Presumably this is because the DSI display is command-mode only and the state machine will take some time setting up its state for the first display update, and we hit a timeout. 100 ms makes it pass without problems. Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Reviewed-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com> Reviewed-by: Daniel Vetter <daniel.vetter(a)ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20190430093746.26485-1-linus.… Signed-off-by: jiazhenyuan <jiazhenyuan(a)uniontech.com> --- drivers/gpu/drm/drm_atomic_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c index c22062cc9992..f9306c3e9bab 100644 --- a/drivers/gpu/drm/drm_atomic_helper.c +++ b/drivers/gpu/drm/drm_atomic_helper.c @@ -1380,7 +1380,7 @@ drm_atomic_helper_wait_for_vblanks(struct drm_device *dev, ret = wait_event_timeout(dev->vblank[i].queue, old_state->crtcs[i].last_vblank_count != drm_crtc_vblank_count(crtc), - msecs_to_jiffies(50)); + msecs_to_jiffies(100)); WARN(!ret, "[CRTC:%d:%s] vblank wait timed out\n", crtc->base.id, crtc->name); -- 2.27.0

1 0

[PATCH openEuler-1.0-LTS] RDMA/cma: Do not change route.addr.src_addr.ss_family
by tangbin 21 Jun '22

21 Jun '22

From: Jason Gunthorpe <jgg(a)nvidia.com> mainline inclusion from mainline-v5.15-rc4 commit bc0bdc5afaa740d782fbf936aaeebd65e5c2921d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I59840 CVE: CVE-2021-4028 -------------------------------- Conflicts: The conditional statement to verify RDMA_CM_IDLE state is a little bit different from the upstream to 4.19. The commit 732d41c545bb (RDMA/cma: Make the locking for automatic state transition more clear) is missing from 4.19. So, the context has been modified. If the state is not idle then rdma_bind_addr() will immediately fail and no change to global state should happen. For instance if the state is already RDMA_CM_LISTEN then this will corrupt the src_addr and would cause the test in cma_cancel_operation(): if (cma_any_addr(cma_src_addr(id_priv)) && !id_priv->cma_dev) To view a mangled src_addr, eg with a IPv6 loopback address but an IPv4 family, failing the test. This would manifest as this trace from syzkaller: BUG: KASAN: use-after-free in __list_add_valid+0x93/0xa0 lib/list_debug.c:26 Read of size 8 at addr ffff8881546491e0 by task syz-executor.1/32204 CPU: 1 PID: 32204 Comm: syz-executor.1 Not tainted 5.12.0-rc8-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x141/0x1d7 lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:232 __kasan_report mm/kasan/report.c:399 [inline] kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416 __list_add_valid+0x93/0xa0 lib/list_debug.c:26 __list_add include/linux/list.h:67 [inline] list_add_tail include/linux/list.h:100 [inline] cma_listen_on_all drivers/infiniband/core/cma.c:2557 [inline] rdma_listen+0x787/0xe00 drivers/infiniband/core/cma.c:3751 ucma_listen+0x16a/0x210 drivers/infiniband/core/ucma.c:1102 ucma_write+0x259/0x350 drivers/infiniband/core/ucma.c:1732 vfs_write+0x28e/0xa30 fs/read_write.c:603 ksys_write+0x1ee/0x250 fs/read_write.c:658 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae Which is indicating that an rdma_id_private was destroyed without doing cma_cancel_listens(). Instead of trying to re-use the src_addr memory to indirectly create an any address build one explicitly on the stack and bind to that as any other normal flow would do. Link: https://lore.kernel.org/r/0-v1-9fbb33f5e201+2a-cma_listen_jgg@nvidia.com Cc: stable(a)vger.kernel.org Fixes: 732d41c545bb ("RDMA/cma: Make the locking for automatic state transition more clear") Reported-by: syzbot+6bb0528b13611047209c(a)syzkaller.appspotmail.com Tested-by: Hao Sun <sunhao.th(a)gmail.com> Reviewed-by: Leon Romanovsky <leonro(a)nvidia.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: tangbin <tangbin(a)cmss.chinamobile.com> --- drivers/infiniband/core/cma.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c index 319bfef00a4a..7444df92e7cf 100644 --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -3375,8 +3375,13 @@ int rdma_listen(struct rdma_cm_id *id, int backlog) id_priv = container_of(id, struct rdma_id_private, id); if (id_priv->state == RDMA_CM_IDLE) { - id->route.addr.src_addr.ss_family = AF_INET; - ret = rdma_bind_addr(id, cma_src_addr(id_priv)); + struct sockaddr_in any_in = { + .sin_family = AF_INET, + .sin_addr.s_addr = htonl(INADDR_ANY), + }; + + /* For a well behaved ULP state will be RDMA_CM_IDLE */ + ret = rdma_bind_addr(id, (struct sockaddr *)&any_in); if (ret) return ret; } -- 2.18.4

1 0

[PATCH openEuler-1.0-LTS] arm64: fix out-of-range error when adapting for ARM64_SPECTRE_BHB
by Yongqiang Liu 20 Jun '22

20 Jun '22

From: Chen Jiahao <chenjiahao16(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186460, https://gitee.com/src-openeuler/kernel/issues/I53MHA CVE: CVE-2022-23960 -------------------------------- In cpufeature.c, when num is set to ARM64_SPECTRE_BHB, it should not be passed to cpu_hwcap_keys, otherwise the out-of-range error would happen as below: UBSAN: Undefined behaviour in arch/arm64/kernel/cpufeature.c:1742:3 index 40 is out of range for type 'static_key_false [39]' CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.90+ #1 Call trace: dump_backtrace+0x0/0x390 show_stack+0x24/0x30 dump_stack+0x130/0x188 ubsan_epilogue+0x14/0xa4 __ubsan_handle_out_of_bounds+0x144/0x184 __enable_cpu_capabilities+0x158/0x1d4 setup_cpu_features+0x34/0xc8 smp_cpus_done+0x44/0x13c smp_init+0x188/0x1a4 kernel_init_freeable+0x454/0x974 kernel_init+0x18/0x150 ret_from_fork+0x10/0x18 Because KABI cpu_hwcap_keys is consistent and defined with length ARM64_NCAPS, which is smaller than ARM64_SPECTRE_BHB. Fixes: 2df7cf898c5b ("arm64: fix extra cpucaps setup problem") Signed-off-by: Chen Jiahao <chenjiahao16(a)huawei.com> Reviewed-by: Liao Chang <liaochang1(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/arm64/kernel/cpufeature.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index 996d3476f3c8..d7d8a4ab94b4 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -1732,8 +1732,10 @@ __enable_cpu_capabilities(const struct arm64_cpu_capabilities *caps, for (; caps->matches; caps++) { unsigned int num = caps->capability; - if (num == ARM64_SPECTRE_BHB) + if (num == ARM64_SPECTRE_BHB) { set_cap_spectre_bhb = true; + continue; + } if (!(caps->type & scope_mask) || !cpus_have_cap(num)) continue; -- 2.25.1

1 0

[Cancel] openEuler kernel SIG例会&技术分享
by openEuler conference 20 Jun '22

20 Jun '22

Sorry! The Zoom meeting will be held at 2022-06-24 14:00 scheduled by openEuler Kernel SIG has been cancelled.

1 0

openEuler kernel SIG例会&技术分享
by openEuler conference 20 Jun '22

20 Jun '22

您好！ Kernel SIG 邀请您参加 2022-06-24 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler kernel SIG例会&技术分享会议内容： openEuler kernel 技术分享：执行实体创建与切换会议链接：https://us06web.zoom.us/j/83567640355?pwd=OHVRQ2VKcFNka0FhVjg2emQybG1Edz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-06-24 14:00, The subject of the conference is openEuler kernel SIG例会&技术分享, Summary: openEuler kernel 技术分享：执行实体创建与切换 You can join the meeting at https://us06web.zoom.us/j/83567640355?pwd=OHVRQ2VKcFNka0FhVjg2emQybG1Edz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

openEuler kernel SIG例会&技术分享
by openEuler conference 20 Jun '22

20 Jun '22

您好！ Kernel SIG 邀请您参加 2022-06-24 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler kernel SIG例会&技术分享会议内容： openEuler kernel 技术分享：执行实体创建与切换会议链接：https://us06web.zoom.us/j/81671713618?pwd=eWIxeGowd1hvNTNZQUlRRmplNlZydz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-06-24 14:00, The subject of the conference is openEuler kernel SIG例会&技术分享, Summary: openEuler kernel 技术分享：执行实体创建与切换 You can join the meeting at https://us06web.zoom.us/j/81671713618?pwd=eWIxeGowd1hvNTNZQUlRRmplNlZydz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS 1/8] xfs: abort xattr scrub if fatal signals are pending
by Laibin Qiu 18 Jun '22

18 Jun '22

From: "Darrick J. Wong" <darrick.wong(a)oracle.com> mainline inclusion from mainline-v5.1-rc1 commit 3258cb208caba74258ffdd8bd59972bbda9bfee1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5BDCU CVE: NA -------------------------------- The extended attribute scrubber should abort the "read all attrs" loop if there's a fatal signal pending on the process. Signed-off-by: Darrick J. Wong <darrick.wong(a)oracle.com> Reviewed-by: Brian Foster <bfoster(a)redhat.com> Signed-off-by: tangbin <tangbin(a)cmss.chinamobile.com> Reviewed-by: Lihong Kou <koulihong(a)huawei.com> Reviewed-by: Xuenan Guo <guoxuenan(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- fs/xfs/scrub/attr.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/xfs/scrub/attr.c b/fs/xfs/scrub/attr.c index 81d5e90547a1..9960bc5b5d76 100644 --- a/fs/xfs/scrub/attr.c +++ b/fs/xfs/scrub/attr.c @@ -82,6 +82,11 @@ xchk_xattr_listent( sx = container_of(context, struct xchk_xattr, context); + if (xchk_should_terminate(sx->sc, &error)) { + context->seen_enough = 1; + return; + } + if (flags & XFS_ATTR_INCOMPLETE) { /* Incomplete attr key, just mark the inode for preening. */ xchk_ino_set_preen(sx->sc, context->dp->i_ino); -- 2.25.1

1 7

[PATCH openEuler-1.0-LTS 0/8] xfs: fix the xfstests problem
by tangbin 18 Jun '22

18 Jun '22

Hi all: These patches are used to resolve the xfs problem when perform xfstests. For details about how to fix the problem, we can see the link below: https://lore.kernel.org/linux-xfs/154697976479.2839.3584921201780682011.stg… https://lore.kernel.org/linux-xfs/157232182246.593721.4902116478429075171.s… Thanks --- Darrick J. Wong (8): xfs: abort xattr scrub if fatal signals are pending xfs: scrub should flag dir/attr offsets that aren't mappable with xfs_dablk_t xfs: check directory name validity xfs: check attribute name validity xfs: check attribute leaf block structure xfs: namecheck attribute names before listing them xfs: namecheck directory entry names before listing them xfs: replace -EIO with -EFSCORRUPTED for corrupt metadata fs/xfs/libxfs/xfs_attr.c | 17 +++++++++ fs/xfs/libxfs/xfs_attr.h | 2 +- fs/xfs/libxfs/xfs_attr_leaf.c | 68 +++++++++++++++++++++++++++++++++-- fs/xfs/libxfs/xfs_attr_leaf.h | 4 +-- fs/xfs/libxfs/xfs_bmap.c | 6 ++-- fs/xfs/libxfs/xfs_dir2.c | 17 +++++++++ fs/xfs/libxfs/xfs_dir2.h | 1 + fs/xfs/libxfs/xfs_types.c | 11 ++++++ fs/xfs/libxfs/xfs_types.h | 1 + fs/xfs/scrub/attr.c | 11 ++++++ fs/xfs/scrub/bmap.c | 27 ++++++++++++++ fs/xfs/scrub/dir.c | 6 ++++ fs/xfs/xfs_attr_inactive.c | 6 ++-- fs/xfs/xfs_attr_list.c | 60 ++++++++++++++++++++----------- fs/xfs/xfs_dir2_readdir.c | 27 +++++++++++--- fs/xfs/xfs_dquot.c | 2 +- 16 files changed, 228 insertions(+), 38 deletions(-) -- 2.18.4

2 9

[PATCH OLK_5.10] update via-cputemp driver
by LeoLiuoc 17 Jun '22

17 Jun '22

zhaoxin inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I52DS7 CVE: NA -------------------------------- Optimize driver code and add support for Zhaoxin CPU. Signed-off-by: LeoLiuoc <LeoLiu-oc(a)zhaoxin.com> --- drivers/hwmon/Makefile | 3 +- drivers/hwmon/via-cputemp.c | 69 ++++++++++++++++++++----------------- 2 files changed, 39 insertions(+), 33 deletions(-) diff --git a/drivers/hwmon/Makefile b/drivers/hwmon/Makefile index c22a5316bd91..115c0e002718 100644 --- a/drivers/hwmon/Makefile +++ b/drivers/hwmon/Makefile @@ -183,7 +183,8 @@ obj-$(CONFIG_SENSORS_TMP401) += tmp401.o obj-$(CONFIG_SENSORS_TMP421) += tmp421.o obj-$(CONFIG_SENSORS_TMP513) += tmp513.o obj-$(CONFIG_SENSORS_VEXPRESS) += vexpress-hwmon.o -obj-$(CONFIG_SENSORS_VIA_CPUTEMP)+= via-cputemp.o +obj-$(CONFIG_SENSORS_VIA_CPUTEMP) += cputemp-hwmon.o +cputemp-hwmon-objs := via-cputemp.o obj-$(CONFIG_SENSORS_VIA686A) += via686a.o obj-$(CONFIG_SENSORS_VT1211) += vt1211.o obj-$(CONFIG_SENSORS_VT8231) += vt8231.o diff --git a/drivers/hwmon/via-cputemp.c b/drivers/hwmon/via-cputemp.c index e5d18dac8ee7..1599440cc451 100644 --- a/drivers/hwmon/via-cputemp.c +++ b/drivers/hwmon/via-cputemp.c @@ -26,7 +26,8 @@ #include <asm/processor.h> #include <asm/cpu_device_id.h> -#define DRVNAME "via_cputemp" +#define VIA_DRVNAME "via_cputemp" +#define ZHAOXIN_DRVNAME "zhaoxin_cputemp" enum { SHOW_TEMP, SHOW_LABEL, SHOW_NAME }; @@ -114,17 +115,17 @@ static int via_cputemp_probe(struct platform_device *pdev) int err; u32 eax, edx; - data = devm_kzalloc(&pdev->dev, sizeof(struct via_cputemp_data), - GFP_KERNEL); + data = devm_kzalloc(&pdev->dev, sizeof(struct via_cputemp_data), GFP_KERNEL); if (!data) return -ENOMEM; data->id = pdev->id; - data->name = "via_cputemp"; if (c->x86 == 7) { + data->name = ZHAOXIN_DRVNAME; data->msr_temp = 0x1423; } else { + data->name = VIA_DRVNAME; switch (c->x86_model) { case 0xA: /* C7 A */ @@ -145,8 +146,7 @@ static int via_cputemp_probe(struct platform_device *pdev) /* test if we can access the TEMPERATURE MSR */ err = rdmsr_safe_on_cpu(data->id, data->msr_temp, &eax, &edx); if (err) { - dev_err(&pdev->dev, - "Unable to access TEMPERATURE MSR, giving up\n"); + dev_err(&pdev->dev, "Unable to access TEMPERATURE MSR, giving up\n"); return err; } @@ -165,11 +165,10 @@ static int via_cputemp_probe(struct platform_device *pdev) goto exit_remove; } - data->hwmon_dev = hwmon_device_register(&pdev->dev); + data->hwmon_dev = hwmon_device_register_with_info(&pdev->dev, data->name, NULL, NULL, NULL); if (IS_ERR(data->hwmon_dev)) { err = PTR_ERR(data->hwmon_dev); - dev_err(&pdev->dev, "Class registration failed (%d)\n", - err); + dev_err(&pdev->dev, "Class registration failed (%d)\n", err); goto exit_remove; } @@ -194,13 +193,12 @@ static int via_cputemp_remove(struct platform_device *pdev) } static struct platform_driver via_cputemp_driver = { - .driver = { - .name = DRVNAME, - }, .probe = via_cputemp_probe, .remove = via_cputemp_remove, }; +static struct platform_device_info cputemp_device_info; + struct pdev_entry { struct list_head list; struct platform_device *pdev; @@ -216,23 +214,20 @@ static int via_cputemp_online(unsigned int cpu) struct platform_device *pdev; struct pdev_entry *pdev_entry; - pdev = platform_device_alloc(DRVNAME, cpu); - if (!pdev) { - err = -ENOMEM; - pr_err("Device allocation failed\n"); + cputemp_device_info.id = cpu; + + pdev = platform_device_register_full(&cputemp_device_info); + if (IS_ERR(pdev)) { + err = PTR_ERR(pdev); + pr_err("Device registration failed (%d)\n", err); goto exit; } pdev_entry = kzalloc(sizeof(struct pdev_entry), GFP_KERNEL); if (!pdev_entry) { err = -ENOMEM; - goto exit_device_put; - } - - err = platform_device_add(pdev); - if (err) { - pr_err("Device addition failed (%d)\n", err); - goto exit_device_free; + pr_err("Pdev_entry alloc failed (%d)\n", err); + goto exit_device_unregister; } pdev_entry->pdev = pdev; @@ -243,10 +238,8 @@ static int via_cputemp_online(unsigned int cpu) return 0; -exit_device_free: - kfree(pdev_entry); -exit_device_put: - platform_device_put(pdev); +exit_device_unregister: + platform_device_unregister(pdev); exit: return err; } @@ -270,10 +263,11 @@ static int via_cputemp_down_prep(unsigned int cpu) } static const struct x86_cpu_id __initconst cputemp_ids[] = { - X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_C7_A, NULL), - X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_C7_D, NULL), - X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_NANO, NULL), - X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 7, X86_MODEL_ANY, NULL), + X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_C7_A, NULL), + X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_C7_D, NULL), + X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_NANO, NULL), + X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 7, X86_MODEL_ANY, NULL), + X86_MATCH_VENDOR_FAM_MODEL(ZHAOXIN, 7, X86_MODEL_ANY, NULL), {} }; MODULE_DEVICE_TABLE(x86cpu, cputemp_ids); @@ -283,15 +277,26 @@ static enum cpuhp_state via_temp_online; static int __init via_cputemp_init(void) { int err; + char *cpuhp_name; if (!x86_match_cpu(cputemp_ids)) return -ENODEV; + if (boot_cpu_data.x86 == 0x7) { + via_cputemp_driver.driver.name = ZHAOXIN_DRVNAME; + cputemp_device_info.name = ZHAOXIN_DRVNAME; + cpuhp_name = "hwmon/zhaoxin:online"; + } else { + via_cputemp_driver.driver.name = VIA_DRVNAME; + cputemp_device_info.name = VIA_DRVNAME; + cpuhp_name = "hwmon/via:online"; + } + err = platform_driver_register(&via_cputemp_driver); if (err) goto exit; - err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "hwmon/via:online", + err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, cpuhp_name, via_cputemp_online, via_cputemp_down_prep); if (err < 0) goto exit_driver_unreg; -- 2.20.1

1 0

[PATCH openEuler-1.0-LTS 1/2] tcp: change source port randomizarion at connect() time
by Yongqiang Liu 17 Jun '22

17 Jun '22

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v4.19.246 commit ddec440133913a6b8880e53b896d521a4b7ff24f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5C3A9 CVE: CVE-2022-32296 -------------------------------- commit 190cc82489f46f9d88e73c81a47e14f80a791e1a upstream. RFC 6056 (Recommendations for Transport-Protocol Port Randomization) provides good summary of why source selection needs extra care. David Dworken reminded us that linux implements Algorithm 3 as described in RFC 6056 3.3.3 Quoting David : In the context of the web, this creates an interesting info leak where websites can count how many TCP connections a user's computer is establishing over time. For example, this allows a website to count exactly how many subresources a third party website loaded. This also allows: - Distinguishing between different users behind a VPN based on distinct source port ranges. - Tracking users over time across multiple networks. - Covert communication channels between different browsers/browser profiles running on the same computer - Tracking what applications are running on a computer based on the pattern of how fast source ports are getting incremented. Section 3.3.4 describes an enhancement, that reduces attackers ability to use the basic information currently stored into the shared 'u32 hint'. This change also decreases collision rate when multiple applications need to connect() to different destinations. Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reported-by: David Dworken <ddworken(a)google.com> Cc: Willem de Bruijn <willemb(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> [SG: Adjusted context] Signed-off-by: Stefan Ghinea <stefan.ghinea(a)windriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: net/ipv4/inet_hashtables.c Signed-off-by: Baisong Zhong <zhongbaisong(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/ipv4/inet_hashtables.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c index bd0108aaa45b..72b8b6f44add 100644 --- a/net/ipv4/inet_hashtables.c +++ b/net/ipv4/inet_hashtables.c @@ -666,6 +666,17 @@ void inet_unhash(struct sock *sk) } EXPORT_SYMBOL_GPL(inet_unhash); +/* RFC 6056 3.3.4. Algorithm 4: Double-Hash Port Selection Algorithm + * Note that we use 32bit integers (vs RFC 'short integers') + * because 2^16 is not a multiple of num_ephemeral and this + * property might be used by clever attacker. + * RFC claims using TABLE_LENGTH=10 buckets gives an improvement, + * we use 256 instead to really give more isolation and + * privacy, this only consumes 1 KB of kernel memory. + */ +#define INET_TABLE_PERTURB_SHIFT 8 +static u32 table_perturb[1 << INET_TABLE_PERTURB_SHIFT]; + int __inet_hash_connect(struct inet_timewait_death_row *death_row, struct sock *sk, u64 port_offset, int (*check_established)(struct inet_timewait_death_row *, @@ -679,8 +690,8 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, struct inet_bind_bucket *tb; u32 remaining, offset; int ret, i, low, high; - static u32 hint; int l3mdev; + u32 index; if (port) { head = &hinfo->bhash[inet_bhashfn(net, port, @@ -707,7 +718,10 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, if (likely(remaining > 1)) remaining &= ~1U; - offset = hint + port_offset; + net_get_random_once(table_perturb, sizeof(table_perturb)); + index = hash_32(port_offset, INET_TABLE_PERTURB_SHIFT); + + offset = READ_ONCE(table_perturb[index]) + port_offset; offset %= remaining; /* In first pass we try ports of @low parity. * inet_csk_get_port() does the opposite choice. @@ -762,7 +776,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, return -EADDRNOTAVAIL; ok: - hint += i + 2; + WRITE_ONCE(table_perturb[index], READ_ONCE(table_perturb[index]) + i + 2); /* Head lock still held and bh's disabled */ inet_bind_hash(sk, tb, port); -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] arm64: fix extra cpucaps setup problem
by Yongqiang Liu 16 Jun '22

16 Jun '22

From: Chen Jiahao <chenjiahao16(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186460, https://gitee.com/src-openeuler/kernel/issues/I53MHA CVE: CVE-2022-23960 -------------------------------- When introducing a new cpucaps macro ARM64_SPECTRE_BHB, ARM64_NCAPS was not able to modified easily due to KABI consistency. Here introduce a workaround to properly setup ARM64_SPECTRE_BHB beyond ARM64_NCAPS range. Fixes: def2df575d30 ("KVM: arm64: Add templates for BHB mitigation sequences") Signed-off-by: Chen Jiahao <chenjiahao16(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Reviewed-by: Liao Chang <liaochang1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/arm64/include/asm/cpufeature.h | 15 +++++++++++++++ arch/arm64/kernel/alternative.c | 5 +++++ arch/arm64/kernel/cpufeature.c | 3 +++ 3 files changed, 23 insertions(+) diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h index bfb699957880..ffb0a1ec0088 100644 --- a/arch/arm64/include/asm/cpufeature.h +++ b/arch/arm64/include/asm/cpufeature.h @@ -368,6 +368,8 @@ extern struct static_key_false arm64_const_caps_ready; #define ARM64_NPATCHABLE (ARM64_NCAPS + 1) extern DECLARE_BITMAP(boot_capabilities, ARM64_NPATCHABLE); +extern bool set_cap_spectre_bhb; + bool this_cpu_has_cap(unsigned int cap); static inline bool cpu_have_feature(unsigned int num) @@ -378,15 +380,23 @@ static inline bool cpu_have_feature(unsigned int num) /* System capability check for constant caps */ static __always_inline bool __cpus_have_const_cap(int num) { + if (num == ARM64_SPECTRE_BHB) + return set_cap_spectre_bhb; + if (num >= ARM64_NCAPS) return false; + return static_branch_unlikely(&cpu_hwcap_keys[num]); } static inline bool cpus_have_cap(unsigned int num) { + if (num == ARM64_SPECTRE_BHB) + return set_cap_spectre_bhb; + if (num >= ARM64_NCAPS) return false; + return test_bit(num, cpu_hwcaps); } @@ -400,6 +410,11 @@ static __always_inline bool cpus_have_const_cap(int num) static inline void cpus_set_cap(unsigned int num) { + if (num == ARM64_SPECTRE_BHB) { + set_cap_spectre_bhb = true; + return; + } + if (num >= ARM64_NCAPS) { pr_warn("Attempt to set an illegal CPU capability (%d >= %d)\n", num, ARM64_NCAPS); diff --git a/arch/arm64/kernel/alternative.c b/arch/arm64/kernel/alternative.c index 8511fc3b94bb..ce5a26080b46 100644 --- a/arch/arm64/kernel/alternative.c +++ b/arch/arm64/kernel/alternative.c @@ -41,8 +41,13 @@ struct alt_region { struct alt_instr *end; }; +bool set_cap_spectre_bhb; + bool alternative_is_applied(u16 cpufeature) { + if (cpufeature == ARM64_SPECTRE_BHB) + return set_cap_spectre_bhb; + if (WARN_ON(cpufeature >= ARM64_NCAPS)) return false; diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index aa9178e9acc6..996d3476f3c8 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -1732,6 +1732,9 @@ __enable_cpu_capabilities(const struct arm64_cpu_capabilities *caps, for (; caps->matches; caps++) { unsigned int num = caps->capability; + if (num == ARM64_SPECTRE_BHB) + set_cap_spectre_bhb = true; + if (!(caps->type & scope_mask) || !cpus_have_cap(num)) continue; -- 2.25.1

1 0

[Cancel] openEuler kernel SIG例会&技术分享
by openEuler conference 16 Jun '22

16 Jun '22

Sorry! The Zoom meeting will be held at 2022-06-17 14:00 scheduled by openEuler Kernel SIG has been cancelled.

1 0

[PATCH openEuler-1.0-LTS 1/3] powerpc/32: Fix overread/overwrite of thread_struct via ptrace
by Yongqiang Liu 15 Jun '22

15 Jun '22

From: Michael Ellerman <mpe(a)ellerman.id.au> mainline inclusion from mainline-v5.19-rc2 commit 8e1278444446fc97778a5e5c99bca1ce0bbc5ec9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5C43D CVE: CVE-2022-32981 -------------------------------- The ptrace PEEKUSR/POKEUSR (aka PEEKUSER/POKEUSER) API allows a process to read/write registers of another process. To get/set a register, the API takes an index into an imaginary address space called the "USER area", where the registers of the process are laid out in some fashion. The kernel then maps that index to a particular register in its own data structures and gets/sets the value. The API only allows a single machine-word to be read/written at a time. So 4 bytes on 32-bit kernels and 8 bytes on 64-bit kernels. The way floating point registers (FPRs) are addressed is somewhat complicated, because double precision float values are 64-bit even on 32-bit CPUs. That means on 32-bit kernels each FPR occupies two word-sized locations in the USER area. On 64-bit kernels each FPR occupies one word-sized location in the USER area. Internally the kernel stores the FPRs in an array of u64s, or if VSX is enabled, an array of pairs of u64s where one half of each pair stores the FPR. Which half of the pair stores the FPR depends on the kernel's endianness. To handle the different layouts of the FPRs depending on VSX/no-VSX and big/little endian, the TS_FPR() macro was introduced. Unfortunately the TS_FPR() macro does not take into account the fact that the addressing of each FPR differs between 32-bit and 64-bit kernels. It just takes the index into the "USER area" passed from userspace and indexes into the fp_state.fpr array. On 32-bit there are 64 indexes that address FPRs, but only 32 entries in the fp_state.fpr array, meaning the user can read/write 256 bytes past the end of the array. Because the fp_state sits in the middle of the thread_struct there are various fields than can be overwritten, including some pointers. As such it may be exploitable. It has also been observed to cause systems to hang or otherwise misbehave when using gdbserver, and is probably the root cause of this report which could not be easily reproduced: https://lore.kernel.org/linuxppc-dev/dc38afe9-6b78-f3f5-666b-986939e40fc6@k… Rather than trying to make the TS_FPR() macro even more complicated to fix the bug, or add more macros, instead add a special-case for 32-bit kernels. This is more obvious and hopefully avoids a similar bug happening again in future. Note that because 32-bit kernels never have VSX enabled the code doesn't need to consider TS_FPRWIDTH/OFFSET at all. Add a BUILD_BUG_ON() to ensure that 32-bit && VSX is never enabled. Fixes: 87fec0514f61 ("powerpc: PTRACE_PEEKUSR/PTRACE_POKEUSER of FPR registers in little endian builds") Cc: stable(a)vger.kernel.org # v3.13+ Reported-by: Ariel Miculas <ariel.miculas(a)belden.com> Tested-by: Christophe Leroy <christophe.leroy(a)csgroup.eu> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://lore.kernel.org/r/20220609133245.573565-1-mpe@ellerman.id.au Conflicts: arch/powerpc/kernel/ptrace/ptrace-fpu.c arch/powerpc/kernel/ptrace/ptrace.c Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Reviewed-by: Liao Chang <liaochang1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/powerpc/kernel/ptrace.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c index e08b32ccf1d9..d245f0af412a 100644 --- a/arch/powerpc/kernel/ptrace.c +++ b/arch/powerpc/kernel/ptrace.c @@ -2980,6 +2980,9 @@ long arch_ptrace(struct task_struct *child, long request, void __user *datavp = (void __user *) data; unsigned long __user *datalp = datavp; + // ptrace_get/put_fpr() rely on PPC32 and VSX being incompatible + BUILD_BUG_ON(IS_ENABLED(CONFIG_PPC32) && IS_ENABLED(CONFIG_VSX)); + switch (request) { /* read the word at location addr in the USER area. */ case PTRACE_PEEKUSR: { @@ -3006,10 +3009,13 @@ long arch_ptrace(struct task_struct *child, long request, unsigned int fpidx = index - PT_FPR0; flush_fp_to_thread(child); - if (fpidx < (PT_FPSCR - PT_FPR0)) - memcpy(&tmp, &child->thread.TS_FPR(fpidx), - sizeof(long)); - else + if (fpidx < (PT_FPSCR - PT_FPR0)) { + if (IS_ENABLED(CONFIG_PPC32)) + // On 32-bit the index we are passed refers to 32-bit words + tmp = ((u32 *)child->thread.fp_state.fpr)[fpidx]; + else + memcpy(&tmp, &child->thread.TS_FPR(fpidx), sizeof(long)); + } else tmp = child->thread.fp_state.fpscr; } ret = put_user(tmp, datalp); @@ -3039,10 +3045,13 @@ long arch_ptrace(struct task_struct *child, long request, unsigned int fpidx = index - PT_FPR0; flush_fp_to_thread(child); - if (fpidx < (PT_FPSCR - PT_FPR0)) - memcpy(&child->thread.TS_FPR(fpidx), &data, - sizeof(long)); - else + if (fpidx < (PT_FPSCR - PT_FPR0)) { + if (IS_ENABLED(CONFIG_PPC32)) + // On 32-bit the index we are passed refers to 32-bit words + ((u32 *)child->thread.fp_state.fpr)[fpidx] = data; + else + memcpy(&child->thread.TS_FPR(fpidx), &data, sizeof(long)); + } else child->thread.fp_state.fpscr = data; ret = 0; } -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS] sctp: use call_rcu to free endpoint
by Yongqiang Liu 14 Jun '22

14 Jun '22

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v4.19.224 commit af6e6e58f7ebf86b4e7201694b1e4f3a62cbc3ec category: bugfix bugzilla: 186701, https://gitee.com/src-openeuler/kernel/issues/I5CAM2 CVE: CVE-2022-20154 -------------------------------- [ Upstream commit 5ec7d18d1813a5bead0b495045606c93873aecbb ] This patch is to delay the endpoint free by calling call_rcu() to fix another use-after-free issue in sctp_sock_dump(): BUG: KASAN: use-after-free in __lock_acquire+0x36d9/0x4c20 Call Trace: __lock_acquire+0x36d9/0x4c20 kernel/locking/lockdep.c:3218 lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3844 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168 spin_lock_bh include/linux/spinlock.h:334 [inline] __lock_sock+0x203/0x350 net/core/sock.c:2253 lock_sock_nested+0xfe/0x120 net/core/sock.c:2774 lock_sock include/net/sock.h:1492 [inline] sctp_sock_dump+0x122/0xb20 net/sctp/diag.c:324 sctp_for_each_transport+0x2b5/0x370 net/sctp/socket.c:5091 sctp_diag_dump+0x3ac/0x660 net/sctp/diag.c:527 __inet_diag_dump+0xa8/0x140 net/ipv4/inet_diag.c:1049 inet_diag_dump+0x9b/0x110 net/ipv4/inet_diag.c:1065 netlink_dump+0x606/0x1080 net/netlink/af_netlink.c:2244 __netlink_dump_start+0x59a/0x7c0 net/netlink/af_netlink.c:2352 netlink_dump_start include/linux/netlink.h:216 [inline] inet_diag_handler_cmd+0x2ce/0x3f0 net/ipv4/inet_diag.c:1170 __sock_diag_cmd net/core/sock_diag.c:232 [inline] sock_diag_rcv_msg+0x31d/0x410 net/core/sock_diag.c:263 netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2477 sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:274 This issue occurs when asoc is peeled off and the old sk is freed after getting it by asoc->base.sk and before calling lock_sock(sk). To prevent the sk free, as a holder of the sk, ep should be alive when calling lock_sock(). This patch uses call_rcu() and moves sock_put and ep free into sctp_endpoint_destroy_rcu(), so that it's safe to try to hold the ep under rcu_read_lock in sctp_transport_traverse_process(). If sctp_endpoint_hold() returns true, it means this ep is still alive and we have held it and can continue to dump it; If it returns false, it means this ep is dead and can be freed after rcu_read_unlock, and we should skip it. In sctp_sock_dump(), after locking the sk, if this ep is different from tsp->asoc->ep, it means during this dumping, this asoc was peeled off before calling lock_sock(), and the sk should be skipped; If this ep is the same with tsp->asoc->ep, it means no peeloff happens on this asoc, and due to lock_sock, no peeloff will happen either until release_sock. Note that delaying endpoint free won't delay the port release, as the port release happens in sctp_endpoint_destroy() before calling call_rcu(). Also, freeing endpoint by call_rcu() makes it safe to access the sk by asoc->base.sk in sctp_assocs_seq_show() and sctp_rcv(). Thanks Jones to bring this issue up. v1->v2: - improve the changelog. - add kfree(ep) into sctp_endpoint_destroy_rcu(), as Jakub noticed. Reported-by: syzbot+9276d76e83e3bcde6c99(a)syzkaller.appspotmail.com Reported-by: Lee Jones <lee.jones(a)linaro.org> Fixes: d25adbeb0cdb ("sctp: fix an use-after-free issue in sctp_sock_dump") Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Huang Guobin <huangguobin4(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- include/net/sctp/sctp.h | 6 +++--- include/net/sctp/structs.h | 3 ++- net/sctp/diag.c | 12 ++++++------ net/sctp/endpointola.c | 23 +++++++++++++++-------- net/sctp/socket.c | 23 +++++++++++++++-------- 5 files changed, 41 insertions(+), 26 deletions(-) diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h index fef8c3372aee..6d201c6700be 100644 --- a/include/net/sctp/sctp.h +++ b/include/net/sctp/sctp.h @@ -118,6 +118,7 @@ extern struct percpu_counter sctp_sockets_allocated; int sctp_asconf_mgmt(struct sctp_sock *, struct sctp_sockaddr_entry *); struct sk_buff *sctp_skb_recv_datagram(struct sock *, int, int, int *); +typedef int (*sctp_callback_t)(struct sctp_endpoint *, struct sctp_transport *, void *); void sctp_transport_walk_start(struct rhashtable_iter *iter); void sctp_transport_walk_stop(struct rhashtable_iter *iter); struct sctp_transport *sctp_transport_get_next(struct net *net, @@ -128,9 +129,8 @@ int sctp_transport_lookup_process(int (*cb)(struct sctp_transport *, void *), struct net *net, const union sctp_addr *laddr, const union sctp_addr *paddr, void *p); -int sctp_for_each_transport(int (*cb)(struct sctp_transport *, void *), - int (*cb_done)(struct sctp_transport *, void *), - struct net *net, int *pos, void *p); +int sctp_transport_traverse_process(sctp_callback_t cb, sctp_callback_t cb_done, + struct net *net, int *pos, void *p); int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *), void *p); int sctp_get_sctp_info(struct sock *sk, struct sctp_association *asoc, struct sctp_info *info); diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h index 2882bc7a5b4b..18f9924aa250 100644 --- a/include/net/sctp/structs.h +++ b/include/net/sctp/structs.h @@ -1348,6 +1348,7 @@ struct sctp_endpoint { u32 secid; u32 peer_secid; + struct rcu_head rcu; }; /* Recover the outter endpoint structure. */ @@ -1363,7 +1364,7 @@ static inline struct sctp_endpoint *sctp_ep(struct sctp_ep_common *base) struct sctp_endpoint *sctp_endpoint_new(struct sock *, gfp_t); void sctp_endpoint_free(struct sctp_endpoint *); void sctp_endpoint_put(struct sctp_endpoint *); -void sctp_endpoint_hold(struct sctp_endpoint *); +int sctp_endpoint_hold(struct sctp_endpoint *ep); void sctp_endpoint_add_asoc(struct sctp_endpoint *, struct sctp_association *); struct sctp_association *sctp_endpoint_lookup_assoc( const struct sctp_endpoint *ep, diff --git a/net/sctp/diag.c b/net/sctp/diag.c index 8767405de9fa..0a9db0a7f423 100644 --- a/net/sctp/diag.c +++ b/net/sctp/diag.c @@ -307,9 +307,8 @@ static int sctp_tsp_dump_one(struct sctp_transport *tsp, void *p) return err; } -static int sctp_sock_dump(struct sctp_transport *tsp, void *p) +static int sctp_sock_dump(struct sctp_endpoint *ep, struct sctp_transport *tsp, void *p) { - struct sctp_endpoint *ep = tsp->asoc->ep; struct sctp_comm_param *commp = p; struct sock *sk = ep->base.sk; struct sk_buff *skb = commp->skb; @@ -319,6 +318,8 @@ static int sctp_sock_dump(struct sctp_transport *tsp, void *p) int err = 0; lock_sock(sk); + if (ep != tsp->asoc->ep) + goto release; list_for_each_entry(assoc, &ep->asocs, asocs) { if (cb->args[4] < cb->args[1]) goto next; @@ -361,9 +362,8 @@ static int sctp_sock_dump(struct sctp_transport *tsp, void *p) return err; } -static int sctp_sock_filter(struct sctp_transport *tsp, void *p) +static int sctp_sock_filter(struct sctp_endpoint *ep, struct sctp_transport *tsp, void *p) { - struct sctp_endpoint *ep = tsp->asoc->ep; struct sctp_comm_param *commp = p; struct sock *sk = ep->base.sk; const struct inet_diag_req_v2 *r = commp->r; @@ -521,8 +521,8 @@ static void sctp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb, if (!(idiag_states & ~(TCPF_LISTEN | TCPF_CLOSE))) goto done; - sctp_for_each_transport(sctp_sock_filter, sctp_sock_dump, - net, &pos, &commp); + sctp_transport_traverse_process(sctp_sock_filter, sctp_sock_dump, + net, &pos, &commp); cb->args[2] = pos; done: diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c index 8640dedcf64f..c4068451b9c7 100644 --- a/net/sctp/endpointola.c +++ b/net/sctp/endpointola.c @@ -242,6 +242,18 @@ void sctp_endpoint_free(struct sctp_endpoint *ep) } /* Final destructor for endpoint. */ +static void sctp_endpoint_destroy_rcu(struct rcu_head *head) +{ + struct sctp_endpoint *ep = container_of(head, struct sctp_endpoint, rcu); + struct sock *sk = ep->base.sk; + + sctp_sk(sk)->ep = NULL; + sock_put(sk); + + kfree(ep); + SCTP_DBG_OBJCNT_DEC(ep); +} + static void sctp_endpoint_destroy(struct sctp_endpoint *ep) { struct sock *sk; @@ -275,18 +287,13 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep) if (sctp_sk(sk)->bind_hash) sctp_put_port(sk); - sctp_sk(sk)->ep = NULL; - /* Give up our hold on the sock */ - sock_put(sk); - - kfree(ep); - SCTP_DBG_OBJCNT_DEC(ep); + call_rcu(&ep->rcu, sctp_endpoint_destroy_rcu); } /* Hold a reference to an endpoint. */ -void sctp_endpoint_hold(struct sctp_endpoint *ep) +int sctp_endpoint_hold(struct sctp_endpoint *ep) { - refcount_inc(&ep->base.refcnt); + return refcount_inc_not_zero(&ep->base.refcnt); } /* Release a reference to an endpoint and clean up if there are diff --git a/net/sctp/socket.c b/net/sctp/socket.c index cfa54e56add9..0e979a273dcd 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -5059,11 +5059,12 @@ int sctp_transport_lookup_process(int (*cb)(struct sctp_transport *, void *), } EXPORT_SYMBOL_GPL(sctp_transport_lookup_process); -int sctp_for_each_transport(int (*cb)(struct sctp_transport *, void *), - int (*cb_done)(struct sctp_transport *, void *), - struct net *net, int *pos, void *p) { +int sctp_transport_traverse_process(sctp_callback_t cb, sctp_callback_t cb_done, + struct net *net, int *pos, void *p) +{ struct rhashtable_iter hti; struct sctp_transport *tsp; + struct sctp_endpoint *ep; int ret; again: @@ -5072,26 +5073,32 @@ int sctp_for_each_transport(int (*cb)(struct sctp_transport *, void *), tsp = sctp_transport_get_idx(net, &hti, *pos + 1); for (; !IS_ERR_OR_NULL(tsp); tsp = sctp_transport_get_next(net, &hti)) { - ret = cb(tsp, p); - if (ret) - break; + ep = tsp->asoc->ep; + if (sctp_endpoint_hold(ep)) { /* asoc can be peeled off */ + ret = cb(ep, tsp, p); + if (ret) + break; + sctp_endpoint_put(ep); + } (*pos)++; sctp_transport_put(tsp); } sctp_transport_walk_stop(&hti); if (ret) { - if (cb_done && !cb_done(tsp, p)) { + if (cb_done && !cb_done(ep, tsp, p)) { (*pos)++; + sctp_endpoint_put(ep); sctp_transport_put(tsp); goto again; } + sctp_endpoint_put(ep); sctp_transport_put(tsp); } return ret; } -EXPORT_SYMBOL_GPL(sctp_for_each_transport); +EXPORT_SYMBOL_GPL(sctp_transport_traverse_process); /* 7.2.1 Association Status (SCTP_STATUS) -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] ext4: convert from atomic_t to refcount_t on ext4_io_end->count
by Yongqiang Liu 14 Jun '22

14 Jun '22

From: Xiyu Yang <xiyuyang19(a)fudan.edu.cn> hulk inclusion category: bugfix bugzilla: 186971, https://gitee.com/openeuler/kernel/issues/I5C8IW CVE: NA -------------------------------- refcount_t type and corresponding API can protect refcounters from accidental underflow and overflow and further use-after-free situations. Signed-off-by: Xiyu Yang <xiyuyang19(a)fudan.edu.cn> Signed-off-by: Xin Tan <tanxin.ctf(a)gmail.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/1626674355-55795-1-git-send-email-xiyuyang19@fuda… Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Li Nan <linan122(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/ext4.h | 3 ++- fs/ext4/page-io.c | 8 ++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h index 16e2b719d47c..6efc710b07bf 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -17,6 +17,7 @@ #ifndef _EXT4_H #define _EXT4_H +#include <linux/refcount.h> #include <linux/types.h> #include <linux/blkdev.h> #include <linux/magic.h> @@ -231,7 +232,7 @@ typedef struct ext4_io_end { struct bio *bio; /* Linked list of completed * bios covering the extent */ unsigned int flag; /* unwritten or not */ - atomic_t count; /* reference counter */ + refcount_t count; /* reference counter */ loff_t offset; /* offset in the file */ ssize_t size; /* size of the extent */ } ext4_io_end_t; diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c index 3de933354a08..decae80aeb98 100644 --- a/fs/ext4/page-io.c +++ b/fs/ext4/page-io.c @@ -256,14 +256,14 @@ ext4_io_end_t *ext4_init_io_end(struct inode *inode, gfp_t flags) if (io) { io->inode = inode; INIT_LIST_HEAD(&io->list); - atomic_set(&io->count, 1); + refcount_set(&io->count, 1); } return io; } void ext4_put_io_end_defer(ext4_io_end_t *io_end) { - if (atomic_dec_and_test(&io_end->count)) { + if (refcount_dec_and_test(&io_end->count)) { if (!(io_end->flag & EXT4_IO_END_UNWRITTEN) || !io_end->size) { ext4_release_io_end(io_end); return; @@ -276,7 +276,7 @@ int ext4_put_io_end(ext4_io_end_t *io_end) { int err = 0; - if (atomic_dec_and_test(&io_end->count)) { + if (refcount_dec_and_test(&io_end->count)) { if (io_end->flag & EXT4_IO_END_UNWRITTEN) { err = ext4_convert_unwritten_extents(io_end->handle, io_end->inode, io_end->offset, @@ -291,7 +291,7 @@ int ext4_put_io_end(ext4_io_end_t *io_end) ext4_io_end_t *ext4_get_io_end(ext4_io_end_t *io_end) { - atomic_inc(&io_end->count); + refcount_inc(&io_end->count); return io_end; } -- 2.25.1

1 0

[PATCH openEuler-5.10 01/49] io_uring: always use original task when preparing req identity
by Zheng Zengkai 14 Jun '22

14 Jun '22

From: Jens Axboe <axboe(a)kernel.dk> stable inclusion from stable-v5.10.116 commit 29f077d070519a88a793fbc70f1e6484dc6d9e35 category: bugfix bugzilla: 186865,https://gitee.com/src-openeuler/kernel/issues/I593SI CVE: CVE-2022-1786 -------------------------------- If the ring is setup with IORING_SETUP_IOPOLL and we have more than one task doing submissions on a ring, we can up in a situation where we assign the context from the current task rather than the request originator. Always use req->task rather than assume it's the same as current. No upstream patch exists for this issue, as only older kernels with the non-native workers have this problem. Reported-by: Kyle Zeng <zengyhkyle(a)gmail.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Xuenan <guoxuenan(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- fs/io_uring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 2ed0da75000e..cadd491edc6f 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -1156,7 +1156,7 @@ static inline void __io_req_init_async(struct io_kiocb *req) */ static inline void io_req_init_async(struct io_kiocb *req) { - struct io_uring_task *tctx = current->io_uring; + struct io_uring_task *tctx = req->task->io_uring; if (req->flags & REQ_F_WORK_INITIALIZED) return; -- 2.20.1

1 48

[openEuler-5.10 00/19] Backport 5.10.107 LTS
by Zheng Zengkai 14 Jun '22

14 Jun '22

Backport 5.10.107 LTS patches from upstream kselftest/vm: fix tests build with old libc sfc: extend the locking on mcdi->seqno tcp: make tcp_read_sock() more robust nl80211: Update bss channel on channel switch for P2P_CLIENT drm/vrr: Set VRR capable prop only if it is attached to connector iwlwifi: don't advertise TWT support atm: firestream: check the return value of ioremap() in fs_init() can: rcar_canfd: rcar_canfd_channel_probe(): register the CAN device when fully ready ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE MIPS: smp: fill in sibling and core maps earlier mac80211: refuse aggregations sessions before authorized ARM: dts: rockchip: fix a typo on rk3288 crypto-controller ARM: dts: rockchip: reorder rk322x hmdi clocks arm64: dts: agilex: use the compatible "intel,socfpga-agilex-hsotg" arm64: dts: rockchip: reorder rk3399 hdmi clocks arm64: dts: rockchip: fix rk3399-puma eMMC HS400 signal integrity xfrm: Fix xfrm migrate issues when address family changes xfrm: Check if_id in xfrm_migrate Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0" Already merged(3) arm64: kvm: Fix copy-and-paste error in bhb templates for v5.10 stable io_uring: return back safer resurrect sctp: fix the processing for INIT chunk Total patches: 22 - 3 = 19 Alexander Lobakin (1): MIPS: smp: fill in sibling and core maps earlier Chengming Zhou (1): kselftest/vm: fix tests build with old libc Corentin Labbe (1): ARM: dts: rockchip: fix a typo on rk3288 crypto-controller Dinh Nguyen (1): arm64: dts: agilex: use the compatible "intel,socfpga-agilex-hsotg" Eric Dumazet (1): tcp: make tcp_read_sock() more robust Golan Ben Ami (1): iwlwifi: don't advertise TWT support Jakob Unterwurzacher (1): arm64: dts: rockchip: fix rk3399-puma eMMC HS400 signal integrity Jia-Ju Bai (1): atm: firestream: check the return value of ioremap() in fs_init() Johannes Berg (1): mac80211: refuse aggregations sessions before authorized Julian Braha (1): ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE Kai Lueke (1): Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0" Lad Prabhakar (1): can: rcar_canfd: rcar_canfd_channel_probe(): register the CAN device when fully ready Manasi Navare (1): drm/vrr: Set VRR capable prop only if it is attached to connector Niels Dossche (1): sfc: extend the locking on mcdi->seqno Sascha Hauer (2): arm64: dts: rockchip: reorder rk3399 hdmi clocks ARM: dts: rockchip: reorder rk322x hmdi clocks Sreeramya Soratkal (1): nl80211: Update bss channel on channel switch for P2P_CLIENT Yan Yan (2): xfrm: Check if_id in xfrm_migrate xfrm: Fix xfrm migrate issues when address family changes arch/arm/boot/dts/rk322x.dtsi | 4 +-- arch/arm/boot/dts/rk3288.dtsi | 2 +- arch/arm64/boot/dts/intel/socfpga_agilex.dtsi | 4 +-- arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 6 +++++ arch/arm64/boot/dts/rockchip/rk3399.dtsi | 6 ++--- arch/mips/kernel/smp.c | 6 ++--- drivers/atm/firestream.c | 2 ++ drivers/gpu/drm/drm_connector.c | 3 +++ drivers/net/can/rcar/rcar_canfd.c | 6 ++--- drivers/net/ethernet/sfc/mcdi.c | 2 +- .../wireless/intel/iwlwifi/iwl-nvm-parse.c | 3 +-- .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 1 - include/net/xfrm.h | 5 ++-- lib/Kconfig | 1 - net/ipv4/tcp.c | 10 ++++--- net/key/af_key.c | 2 +- net/mac80211/agg-tx.c | 10 ++++++- net/wireless/nl80211.c | 3 ++- net/xfrm/xfrm_policy.c | 14 +++++----- net/xfrm/xfrm_state.c | 15 ++++++++--- net/xfrm/xfrm_user.c | 27 ++++++------------- tools/testing/selftests/vm/userfaultfd.c | 1 + 22 files changed, 76 insertions(+), 57 deletions(-) -- 2.20.1

1 19

[PATCH openEuler-1.0-LTS 1/9] HID: add hid_is_usb() function to make it simpler for USB detection
by Yongqiang Liu 14 Jun '22

14 Jun '22

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> stable inclusion from linux-4.19.221 commit b1efa723b986a84f84a95b6907cffe3a357338c9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5BTIG CVE: CVE-2022-20132 -------------------------------- commit f83baa0cb6cfc92ebaf7f9d3a99d7e34f2e77a8a upstream. A number of HID drivers already call hid_is_using_ll_driver() but only for the detection of if this is a USB device or not. Make this more obvious by creating hid_is_usb() and calling the function that way. Also converts the existing hid_is_using_ll_driver() functions to use the new call. Cc: Jiri Kosina <jikos(a)kernel.org> Cc: Benjamin Tissoires <benjamin.tissoires(a)redhat.com> Cc: linux-input(a)vger.kernel.org Cc: stable(a)vger.kernel.org Tested-by: Benjamin Tissoires <benjamin.tissoires(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Benjamin Tissoires <benjamin.tissoires(a)redhat.com> Link: https://lore.kernel.org/r/20211201183503.2373082-1-gregkh@linuxfoundation.o… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Rui Xiang <rui.xiang(a)huawei.com> Reviewed-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/hid/hid-asus.c | 2 +- drivers/hid/wacom_sys.c | 2 +- include/linux/hid.h | 5 +++++ 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index 88a5672f42cd..800b2364e29e 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -622,7 +622,7 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id) if (drvdata->quirks & QUIRK_IS_MULTITOUCH) drvdata->tp = &asus_i2c_tp; - if (drvdata->quirks & QUIRK_T100_KEYBOARD) { + if ((drvdata->quirks & QUIRK_T100_KEYBOARD) && hid_is_usb(hdev)) { struct usb_interface *intf = to_usb_interface(hdev->dev.parent); if (intf->altsetting->desc.bInterfaceNumber == T100_TPAD_INTF) { diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c index 3038c975e417..101b5ae2c3a7 100644 --- a/drivers/hid/wacom_sys.c +++ b/drivers/hid/wacom_sys.c @@ -2154,7 +2154,7 @@ static void wacom_update_name(struct wacom *wacom, const char *suffix) if ((features->type == HID_GENERIC) && !strcmp("Wacom HID", features->name)) { char *product_name = wacom->hdev->name; - if (hid_is_using_ll_driver(wacom->hdev, &usb_hid_driver)) { + if (hid_is_usb(wacom->hdev)) { struct usb_interface *intf = to_usb_interface(wacom->hdev->dev.parent); struct usb_device *dev = interface_to_usbdev(intf); product_name = dev->product; diff --git a/include/linux/hid.h b/include/linux/hid.h index bbbe6c0e0e26..7f321909ec58 100644 --- a/include/linux/hid.h +++ b/include/linux/hid.h @@ -832,6 +832,11 @@ static inline bool hid_is_using_ll_driver(struct hid_device *hdev, return hdev->ll_driver == driver; } +static inline bool hid_is_usb(struct hid_device *hdev) +{ + return hid_is_using_ll_driver(hdev, &usb_hid_driver); +} + #define PM_HINT_FULLON 1<<5 #define PM_HINT_NORMAL 1<<1 -- 2.25.1

1 8

[PATCH openEuler-5.10-LTS 01/42] netfilter: nf_tables: sanitize nft_set_desc_concat_parse()
by Zheng Zengkai 14 Jun '22

14 Jun '22

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v5.10.120 commit c0aff1faf66b6b7a19103f83e6a5d0fdc64b9048 category: bugfix bugzilla: 186913 https://gitee.com/src-openeuler/kernel/issues/I5B69E CVE: CVE-2022-1972 -------------------------------- commit fecf31ee395b0295f2d7260aa29946b7605f7c85 upstream. Add several sanity checks for nft_set_desc_concat_parse(): - validate desc->field_count not larger than desc->field_len array. - field length cannot be larger than desc->field_len (ie. U8_MAX) - total length of the concatenation cannot be larger than register array. Joint work with Florian Westphal. Fixes: f3a2181e16f1 ("netfilter: nf_tables: Support for sets with multiple ranged fields") Reported-by: <zhangziming.zzm(a)antgroup.com> Reviewed-by: Stefano Brivio <sbrivio(a)redhat.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- net/netfilter/nf_tables_api.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index fdd1da9ecea9..164b686bb4c9 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4047,6 +4047,9 @@ static int nft_set_desc_concat_parse(const struct nlattr *attr, u32 len; int err; + if (desc->field_count >= ARRAY_SIZE(desc->field_len)) + return -E2BIG; + err = nla_parse_nested_deprecated(tb, NFTA_SET_FIELD_MAX, attr, nft_concat_policy, NULL); if (err < 0) @@ -4056,9 +4059,8 @@ static int nft_set_desc_concat_parse(const struct nlattr *attr, return -EINVAL; len = ntohl(nla_get_be32(tb[NFTA_SET_FIELD_LEN])); - - if (len * BITS_PER_BYTE / 32 > NFT_REG32_COUNT) - return -E2BIG; + if (!len || len > U8_MAX) + return -EINVAL; desc->field_len[desc->field_count++] = len; @@ -4069,7 +4071,8 @@ static int nft_set_desc_concat(struct nft_set_desc *desc, const struct nlattr *nla) { struct nlattr *attr; - int rem, err; + u32 num_regs = 0; + int rem, err, i; nla_for_each_nested(attr, nla, rem) { if (nla_type(attr) != NFTA_LIST_ELEM) @@ -4080,6 +4083,12 @@ static int nft_set_desc_concat(struct nft_set_desc *desc, return err; } + for (i = 0; i < desc->field_count; i++) + num_regs += DIV_ROUND_UP(desc->field_len[i], sizeof(u32)); + + if (num_regs > NFT_REG32_COUNT) + return -E2BIG; + return 0; } -- 2.20.1

1 41

[PATCH openEuler-5.10 00/19] Backport 5.10.107 LTS
by Zheng Zengkai 14 Jun '22

14 Jun '22

Backport 5.10.107 LTS patches from upstream kselftest/vm: fix tests build with old libc sfc: extend the locking on mcdi->seqno tcp: make tcp_read_sock() more robust nl80211: Update bss channel on channel switch for P2P_CLIENT drm/vrr: Set VRR capable prop only if it is attached to connector iwlwifi: don't advertise TWT support atm: firestream: check the return value of ioremap() in fs_init() can: rcar_canfd: rcar_canfd_channel_probe(): register the CAN device when fully ready ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE MIPS: smp: fill in sibling and core maps earlier mac80211: refuse aggregations sessions before authorized ARM: dts: rockchip: fix a typo on rk3288 crypto-controller ARM: dts: rockchip: reorder rk322x hmdi clocks arm64: dts: agilex: use the compatible "intel,socfpga-agilex-hsotg" arm64: dts: rockchip: reorder rk3399 hdmi clocks arm64: dts: rockchip: fix rk3399-puma eMMC HS400 signal integrity xfrm: Fix xfrm migrate issues when address family changes xfrm: Check if_id in xfrm_migrate Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0" Already merged(3) arm64: kvm: Fix copy-and-paste error in bhb templates for v5.10 stable io_uring: return back safer resurrect sctp: fix the processing for INIT chunk Total patches: 22 - 3 = 19 Alexander Lobakin (1): MIPS: smp: fill in sibling and core maps earlier Chengming Zhou (1): kselftest/vm: fix tests build with old libc Corentin Labbe (1): ARM: dts: rockchip: fix a typo on rk3288 crypto-controller Dinh Nguyen (1): arm64: dts: agilex: use the compatible "intel,socfpga-agilex-hsotg" Eric Dumazet (1): tcp: make tcp_read_sock() more robust Golan Ben Ami (1): iwlwifi: don't advertise TWT support Jakob Unterwurzacher (1): arm64: dts: rockchip: fix rk3399-puma eMMC HS400 signal integrity Jia-Ju Bai (1): atm: firestream: check the return value of ioremap() in fs_init() Johannes Berg (1): mac80211: refuse aggregations sessions before authorized Julian Braha (1): ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE Kai Lueke (1): Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0" Lad Prabhakar (1): can: rcar_canfd: rcar_canfd_channel_probe(): register the CAN device when fully ready Manasi Navare (1): drm/vrr: Set VRR capable prop only if it is attached to connector Niels Dossche (1): sfc: extend the locking on mcdi->seqno Sascha Hauer (2): arm64: dts: rockchip: reorder rk3399 hdmi clocks ARM: dts: rockchip: reorder rk322x hmdi clocks Sreeramya Soratkal (1): nl80211: Update bss channel on channel switch for P2P_CLIENT Yan Yan (2): xfrm: Check if_id in xfrm_migrate xfrm: Fix xfrm migrate issues when address family changes arch/arm/boot/dts/rk322x.dtsi | 4 +-- arch/arm/boot/dts/rk3288.dtsi | 2 +- arch/arm64/boot/dts/intel/socfpga_agilex.dtsi | 4 +-- arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 6 +++++ arch/arm64/boot/dts/rockchip/rk3399.dtsi | 6 ++--- arch/mips/kernel/smp.c | 6 ++--- drivers/atm/firestream.c | 2 ++ drivers/gpu/drm/drm_connector.c | 3 +++ drivers/net/can/rcar/rcar_canfd.c | 6 ++--- drivers/net/ethernet/sfc/mcdi.c | 2 +- .../wireless/intel/iwlwifi/iwl-nvm-parse.c | 3 +-- .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 1 - include/net/xfrm.h | 5 ++-- lib/Kconfig | 1 - net/ipv4/tcp.c | 10 ++++--- net/key/af_key.c | 2 +- net/mac80211/agg-tx.c | 10 ++++++- net/wireless/nl80211.c | 3 ++- net/xfrm/xfrm_policy.c | 14 +++++----- net/xfrm/xfrm_state.c | 15 ++++++++--- net/xfrm/xfrm_user.c | 27 ++++++------------- tools/testing/selftests/vm/userfaultfd.c | 1 + 22 files changed, 76 insertions(+), 57 deletions(-) -- 2.20.1

1 19

[PATCH openEuler-1.0-LTS] netfilter: nf_tables: disallow non-stateful expression in sets earlier
by Yongqiang Liu 14 Jun '22

14 Jun '22

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v5.19-rc1 commit 520778042ccca019f3ffa136dd0ca565c486cedd category: bugfix bugzilla: 186905, https://gitee.com/src-openeuler/kernel/issues/I5B3QZ CVE: CVE-2022-1966 -------------------------------- Since 3e135cd499bf ("netfilter: nft_dynset: dynamic stateful expression instantiation"), it is possible to attach stateful expressions to set elements. cd5125d8f518 ("netfilter: nf_tables: split set destruction in deactivate and destroy phase") introduces conditional destruction on the object to accomodate transaction semantics. nft_expr_init() calls expr->ops->init() first, then check for NFT_STATEFUL_EXPR, this stills allows to initialize a non-stateful lookup expressions which points to a set, which might lead to UAF since the set is not properly detached from the set->binding for this case. Anyway, this combination is non-sense from nf_tables perspective. This patch fixes this problem by checking for NFT_STATEFUL_EXPR before expr->ops->init() is called. The reporter provides a KASAN splat and a poc reproducer (similar to those autogenerated by syzbot to report use-after-free errors). It is unknown to me if they are using syzbot or if they use similar automated tool to locate the bug that they are reporting. For the record, this is the KASAN splat. [ 85.431824] ================================================================== [ 85.432901] BUG: KASAN: use-after-free in nf_tables_bind_set+0x81b/0xa20 [ 85.433825] Write of size 8 at addr ffff8880286f0e98 by task poc/776 [ 85.434756] [ 85.434999] CPU: 1 PID: 776 Comm: poc Tainted: G W 5.18.0+ #2 [ 85.436023] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Fixes: 0b2d8a7b638b ("netfilter: nf_tables: add helper functions for expression handling") Reported-and-tested-by: Aaron Adams <edg-e(a)nccgroup.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> conflict: net/netfilter/nf_tables_api.c net/netfilter/nft_dynset.c Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/netfilter/nf_tables_api.c | 16 ++++++++++------ net/netfilter/nft_dynset.c | 3 --- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 9cc8e92f4b00..ab68076d2cba 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -2167,27 +2167,31 @@ struct nft_expr *nft_expr_init(const struct nft_ctx *ctx, err = nf_tables_expr_parse(ctx, nla, &info); if (err < 0) - goto err1; + goto err_expr_parse; + + err = -EOPNOTSUPP; + if (!(info.ops->type->flags & NFT_EXPR_STATEFUL)) + goto err_expr_stateful; err = -ENOMEM; expr = kzalloc(info.ops->size, GFP_KERNEL); if (expr == NULL) - goto err2; + goto err_expr_stateful; err = nf_tables_newexpr(ctx, &info, expr); if (err < 0) - goto err3; + goto err_expr_new; return expr; -err3: +err_expr_new: kfree(expr); -err2: +err_expr_stateful: owner = info.ops->type->owner; if (info.ops->type->release_ops) info.ops->type->release_ops(info.ops); module_put(owner); -err1: +err_expr_parse: return ERR_PTR(err); } diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c index 4e544044fc2d..cc076d535e14 100644 --- a/net/netfilter/nft_dynset.c +++ b/net/netfilter/nft_dynset.c @@ -193,9 +193,6 @@ static int nft_dynset_init(const struct nft_ctx *ctx, return PTR_ERR(priv->expr); err = -EOPNOTSUPP; - if (!(priv->expr->ops->type->flags & NFT_EXPR_STATEFUL)) - goto err1; - if (priv->expr->ops->type->flags & NFT_EXPR_GC) { if (set->flags & NFT_SET_TIMEOUT) goto err1; -- 2.25.1

1 0

[PATCH OLK-5.10 v2] eulerfs: fix potential sbi->persisters free error
by gouhao＠uniontech.com 14 Jun '22

14 Jun '22

From: Gou Hao <gouhao(a)uniontech.com> uniontech inclusion category: bugfix bugzilla: NA CVE: NA ------------------- After alloc the sbi->persisters memory, dep_init will call dep_fini when error happened.Because sbi->persisters is not set to 0, -> dep_fini() can be called with sbi->persisters[] uninitialized, thus kthread_stop() can be called with random value. Signed-off-by: Gou Hao <gouhao(a)uniontech.com> --- fs/eulerfs/dep.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/eulerfs/dep.c b/fs/eulerfs/dep.c index ec014bbf3700..a41471c5f2ec 100644 --- a/fs/eulerfs/dep.c +++ b/fs/eulerfs/dep.c @@ -718,7 +718,7 @@ int dep_init(struct super_block *sb) for_each_possible_cpu(cpu) init_llist_head(per_cpu_ptr(sbi->persistee_list, cpu)); - sbi->persisters = kmalloc(sizeof(struct task_struct *) * + sbi->persisters = kzalloc(sizeof(struct task_struct *) * persisters_per_socket * num_sockets, GFP_KERNEL); if (!sbi->persisters) { -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 1/2] Revert "NFSv4: Handle the special Linux file open access mode"
by Yongqiang Liu 14 Jun '22

14 Jun '22

From: ChenXiaoSong <chenxiaosong2(a)huawei.com> mainline inclusion from mainline-v5.18-rc2 commit ab0fc21bc7105b54bafd85bd8b82742f9e68898a category: bugfix bugzilla: 186890, https://gitee.com/openeuler/kernel/issues/I5BZTX CVE: NA -------------------------------- This reverts commit 44942b4e457beda00981f616402a1a791e8c616e. After secondly opening a file with O_ACCMODE|O_DIRECT flags, nfs4_valid_open_stateid() will dereference NULL nfs4_state when lseek(). Reproducer: 1. mount -t nfs -o vers=4.2 $server_ip:/ /mnt/ 2. fd = open("/mnt/file", O_ACCMODE|O_DIRECT|O_CREAT) 3. close(fd) 4. fd = open("/mnt/file", O_ACCMODE|O_DIRECT) 5. lseek(fd) Reported-by: Lyu Tao <tao.lyu(a)epfl.ch> Signed-off-by: ChenXiaoSong <chenxiaosong2(a)huawei.com> Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: ChenXiaoSong <chenxiaosong2(a)huawei.com> Reviewed-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/nfs/inode.c | 1 - fs/nfs/nfs4file.c | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c index db52430dfbd7..053e78d777f1 100644 --- a/fs/nfs/inode.c +++ b/fs/nfs/inode.c @@ -1103,7 +1103,6 @@ int nfs_open(struct inode *inode, struct file *filp) nfs_fscache_open_file(inode, filp); return 0; } -EXPORT_SYMBOL_GPL(nfs_open); /* * This function is called whenever some part of NFS notices that diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c index e053a883d08d..09d65a654c2b 100644 --- a/fs/nfs/nfs4file.c +++ b/fs/nfs/nfs4file.c @@ -49,7 +49,7 @@ nfs4_file_open(struct inode *inode, struct file *filp) return err; if ((openflags & O_ACCMODE) == 3) - return nfs_open(inode, filp); + openflags--; /* We can't create new files here */ openflags &= ~(O_CREAT|O_EXCL); -- 2.25.1

1 1

openEuler kernel SIG例会&技术分享
by openEuler conference 14 Jun '22

14 Jun '22

您好！ Kernel SIG 邀请您参加 2022-06-17 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler kernel SIG例会&技术分享会议内容： openEuler kernel 技术分享：执行实体创建与切换会议链接：https://us06web.zoom.us/j/82875828076?pwd=cWVmcGtITlJlM0RxcXYzcDlXZjVJUT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-06-17 14:00, The subject of the conference is openEuler kernel SIG例会&技术分享, Summary: openEuler kernel 技术分享：执行实体创建与切换 You can join the meeting at https://us06web.zoom.us/j/82875828076?pwd=cWVmcGtITlJlM0RxcXYzcDlXZjVJUT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] nvme: Assign subsys instance from first ctrl
by Chen Taotao 09 Jun '22

09 Jun '22

mainline inclusion from mainline-5.3.0-rc3 commit 733e4b69d508d03c20adfdcf4bd27abc60fae9cc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5986O CVE: NA -------------------------------- The namespace disk names must be unique for the lifetime of the subsystem. This was accomplished by using their parent subsystems' instances which were allocated independently from the controllers connected to that subsystem. This allowed name prefixes assigned to namespaces to match a controller from an unrelated subsystem, and has created confusion among users examining device nodes. Ensure a namespace's subsystem instance never clashes with a controller instance of another subsystem by transferring the instance ownership to the parent subsystem from the first controller discovered in that subsystem. Reviewed-by: Logan Gunthorpe <logang(a)deltatee.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Minwoo Im <minwoo.im(a)samsung.com> Reviewed-by: Hannes Reinecke <hare(a)suse.com> Reviewed-off-by: Sagi Grimberg <sagi(a)grimberg.me> Signed-off-by: Sagi Grimberg <sagi(a)grimberg.me> Signed-off-by: Chen Taotao <chentt10(a)chinatelecom.cn> Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> --- drivers/nvme/host/core.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index 164ec45da..0b47c8fd8 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -89,7 +89,6 @@ EXPORT_SYMBOL_GPL(nvme_reset_wq); struct workqueue_struct *nvme_delete_wq; EXPORT_SYMBOL_GPL(nvme_delete_wq); -static DEFINE_IDA(nvme_subsystems_ida); static LIST_HEAD(nvme_subsystems); static DEFINE_MUTEX(nvme_subsystems_lock); @@ -2350,7 +2349,8 @@ static void nvme_release_subsystem(struct device *dev) struct nvme_subsystem *subsys = container_of(dev, struct nvme_subsystem, dev); - ida_simple_remove(&nvme_subsystems_ida, subsys->instance); + if (subsys->instance >= 0) + ida_simple_remove(&nvme_instance_ida, subsys->instance); kfree(subsys); } @@ -2461,12 +2461,8 @@ static int nvme_init_subsystem(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) subsys = kzalloc(sizeof(*subsys), GFP_KERNEL); if (!subsys) return -ENOMEM; - ret = ida_simple_get(&nvme_subsystems_ida, 0, 0, GFP_KERNEL); - if (ret < 0) { - kfree(subsys); - return ret; - } - subsys->instance = ret; + + subsys->instance = -1; mutex_init(&subsys->lock); kref_init(&subsys->ref); INIT_LIST_HEAD(&subsys->ctrls); @@ -2481,7 +2477,7 @@ static int nvme_init_subsystem(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) subsys->dev.class = nvme_subsys_class; subsys->dev.release = nvme_release_subsystem; subsys->dev.groups = nvme_subsys_attrs_groups; - dev_set_name(&subsys->dev, "nvme-subsys%d", subsys->instance); + dev_set_name(&subsys->dev, "nvme-subsys%d", ctrl->instance); device_initialize(&subsys->dev); mutex_lock(&nvme_subsystems_lock); @@ -2514,6 +2510,8 @@ static int nvme_init_subsystem(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) list_add_tail(&subsys->entry, &nvme_subsystems); } + if (!found) + subsys->instance = ctrl->instance; ctrl->subsys = subsys; mutex_unlock(&nvme_subsystems_lock); @@ -3840,7 +3838,9 @@ static void nvme_free_ctrl(struct device *dev) container_of(dev, struct nvme_ctrl, ctrl_device); struct nvme_subsystem *subsys = ctrl->subsys; - ida_simple_remove(&nvme_instance_ida, ctrl->instance); + if (subsys && ctrl->instance != subsys->instance) + ida_simple_remove(&nvme_instance_ida, ctrl->instance); + kfree(ctrl->effects); nvme_mpath_uninit(ctrl); __free_page(ctrl->discard_page); @@ -4102,7 +4102,6 @@ int __init nvme_core_init(void) void nvme_core_exit(void) { - ida_destroy(&nvme_subsystems_ida); class_destroy(nvme_subsys_class); class_destroy(nvme_class); unregister_chrdev_region(nvme_chr_devt, NVME_MINORS); -- 2.27.0

1 0

[openEuler-5.10-LTS 01/11] xhci: Fix a logic issue when display Zhaoxin XHCI root hub speed
by Zheng Zengkai 07 Jun '22

07 Jun '22

From: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> zhaoxin inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I40QDN CVE: NA ---------------------------------------------------------------- Fix a logic issue when display Zhaoxin XHCI root hub speed. Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/usb/host/xhci.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index ba2b2b5afdd1..0984bd31e0e9 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -5271,10 +5271,10 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks) if (XHCI_EXT_PORT_PSIV(xhci->port_caps[j].psi[i]) >= 5) minor_rev = 1; } - if (minor_rev != 1) { - hcd->speed = HCD_USB3; - hcd->self.root_hub->speed = USB_SPEED_SUPER; - } + } + if (minor_rev != 1) { + hcd->speed = HCD_USB3; + hcd->self.root_hub->speed = USB_SPEED_SUPER; } } -- 2.20.1

1 10

[PATCH openEuler-5.10-LTS 00/67] Backport 5.10.106 LTS
by Zheng Zengkai 07 Jun '22

07 Jun '22

Backport 5.10.106 LTS patches from upstream watch_queue: Fix filter limit check ext4: add check to prevent attempting to resize an fs with sparse_super2 x86/traps: Mark do_int3() NOKPROBE_SYMBOL x86/boot: Add setup_indirect support in early_memremap_is_setup_data() x86/boot: Fix memremap of setup_indirect structures watch_queue: Make comment about setting ->defunct more accurate watch_queue: Fix lack of barrier/sync/lock between post and read watch_queue: Free the alloc bitmap when the watch_queue is torn down watch_queue: Fix the alloc bitmap size to reflect notes allocated watch_queue: Fix to always request a pow-of-2 pipe ring size watch_queue: Fix to release page in ->release() watch_queue, pipe: Free watchqueue state after clearing pipe ring virtio: acknowledge all features before access virtio: unexport virtio_finalize_features arm64: dts: marvell: armada-37xx: Remap IO space to bus address 0x0 riscv: Fix auipc+jalr relocation range checks mmc: meson: Fix usage of meson_mmc_post_req() net: macb: Fix lost RX packet wakeup race in NAPI receive staging: gdm724x: fix use after free in gdm_lte_rx() staging: rtl8723bs: Fix access-point mode deadlock selftests/memfd: clean up mapping in mfd_fail_write selftest/vm: fix map_fixed_noreplace test failure tracing: Ensure trace buffer is at least 4096 bytes large ipv6: prevent a possible race condition with lifetimes Revert "xen-netback: Check for hotplug-status existence before watching" Revert "xen-netback: remove 'hotplug-status' once it has served its purpose" gpio: Return EPROBE_DEFER if gc->to_irq is NULL hwmon: (pmbus) Clear pmbus fault/warning bits after read net-sysfs: add check for netdevice being present to speed_show spi: rockchip: terminate dma transmission when slave abort spi: rockchip: Fix error in getting num-cs property selftests/bpf: Add test for bpf_timer overwriting crash net: bcmgenet: Don't claim WOL when its not available sctp: fix kernel-infoleak for SCTP sockets net: phy: DP83822: clear MISR2 register to disable interrupts gianfar: ethtool: Fix refcount leak in gfar_get_ts_info gpio: ts4900: Do not set DAT and OE together selftests: pmtu.sh: Kill tcpdump processes launched by subshell. NFC: port100: fix use-after-free in port100_send_complete net/mlx5e: Lag, Only handle events from highest priority multipath entry net/mlx5: Fix a race on command flush flow net/mlx5: Fix size field in bufferx_reg struct net: ethernet: lpc_eth: Handle error for clk_enable net: ethernet: ti: cpts: Handle error for clk_enable tipc: fix incorrect order of state message data sanity check ethernet: Fix error handling in xemaclite_of_probe ice: Fix curr_link_speed advertised speed ice: Rename a couple of variables ice: Remove unnecessary checker loop ice: Align macro names to the specification ice: stop disabling VFs due to PF error responses i40e: stop disabling VFs due to PF error responses ARM: dts: aspeed: Fix AST2600 quad spi group net: dsa: mt7530: fix incorrect test in mt753x_phylink_validate() drm/sun4i: mixer: Fix P010 and P210 format numbers qed: return status of qed_iov_get_link esp: Fix BEET mode inter address family tunneling on GSO net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare() isdn: hfcpci: check the return value of dma_set_mask() in setup_hw() virtio-blk: Don't use MAX_DISCARD_SEGMENTS if max_discard_seg is zero mISDN: Fix memory leak in dsp_pipeline_build() mISDN: Remove obsolete PIPELINE_DEBUG debugging information tipc: fix kernel panic when enabling bearer arm64: dts: armada-3720-turris-mox: Add missing ethernet0 alias HID: vivaldi: fix sysfs attributes leak clk: qcom: gdsc: Add support to update GDSC transition delay ARM: boot: dts: bcm2711: Fix HVS register range Already merged: ax25: Fix NULL pointer dereference in ax25_kill_by_device ARM: Spectre-BHB: provide empty stub for non-config fuse: fix pipe buffer lifetime for direct_io ARM: fix Thumb2 regression with Spectre BHB Total patches: 71 - 4 = 67 Alexey Khoroshilov (1): mISDN: Fix memory leak in dsp_pipeline_build() Aneesh Kumar K.V (1): selftest/vm: fix map_fixed_noreplace test failure Anirudh Venkataramanan (3): ice: Align macro names to the specification ice: Remove unnecessary checker loop ice: Rename a couple of variables Clément Léger (1): net: phy: DP83822: clear MISR2 register to disable interrupts Dan Carpenter (1): staging: gdm724x: fix use after free in gdm_lte_rx() David Howells (8): watch_queue, pipe: Free watchqueue state after clearing pipe ring watch_queue: Fix to release page in ->release() watch_queue: Fix to always request a pow-of-2 pipe ring size watch_queue: Fix the alloc bitmap size to reflect notes allocated watch_queue: Free the alloc bitmap when the watch_queue is torn down watch_queue: Fix lack of barrier/sync/lock between post and read watch_queue: Make comment about setting ->defunct more accurate watch_queue: Fix filter limit check Dmitry Torokhov (1): HID: vivaldi: fix sysfs attributes leak Emil Renner Berthing (1): riscv: Fix auipc+jalr relocation range checks Eric Dumazet (1): sctp: fix kernel-infoleak for SCTP sockets Guillaume Nault (1): selftests: pmtu.sh: Kill tcpdump processes launched by subshell. Hans de Goede (1): staging: rtl8723bs: Fix access-point mode deadlock Jacob Keller (2): i40e: stop disabling VFs due to PF error responses ice: stop disabling VFs due to PF error responses Jedrzej Jagielski (1): ice: Fix curr_link_speed advertised speed Jeremy Linton (1): net: bcmgenet: Don't claim WOL when its not available Jernej Skrabec (1): drm/sun4i: mixer: Fix P010 and P210 format numbers Jia-Ju Bai (2): isdn: hfcpci: check the return value of dma_set_mask() in setup_hw() net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare() Jiasheng Jiang (2): net: ethernet: ti: cpts: Handle error for clk_enable net: ethernet: lpc_eth: Handle error for clk_enable Joel Stanley (1): ARM: dts: aspeed: Fix AST2600 quad spi group Jon Lin (2): spi: rockchip: Fix error in getting num-cs property spi: rockchip: terminate dma transmission when slave abort Josh Triplett (1): ext4: add check to prevent attempting to resize an fs with sparse_super2 Kumar Kartikeya Dwivedi (1): selftests/bpf: Add test for bpf_timer overwriting crash Li Huafei (1): x86/traps: Mark do_int3() NOKPROBE_SYMBOL Marek Marczykowski-Górecki (2): Revert "xen-netback: remove 'hotplug-status' once it has served its purpose" Revert "xen-netback: Check for hotplug-status existence before watching" Mark Featherston (1): gpio: ts4900: Do not set DAT and OE together Maxime Ripard (1): ARM: boot: dts: bcm2711: Fix HVS register range Miaoqian Lin (2): ethernet: Fix error handling in xemaclite_of_probe gianfar: ethtool: Fix refcount leak in gfar_get_ts_info Michael S. Tsirkin (2): virtio: unexport virtio_finalize_features virtio: acknowledge all features before access Mike Kravetz (1): selftests/memfd: clean up mapping in mfd_fail_write Mohammad Kabat (1): net/mlx5: Fix size field in bufferx_reg struct Moshe Shemesh (1): net/mlx5: Fix a race on command flush flow Niels Dossche (1): ipv6: prevent a possible race condition with lifetimes Pali Rohár (2): arm64: dts: armada-3720-turris-mox: Add missing ethernet0 alias arm64: dts: marvell: armada-37xx: Remap IO space to bus address 0x0 Pavel Skripkin (1): NFC: port100: fix use-after-free in port100_send_complete Robert Hancock (1): net: macb: Fix lost RX packet wakeup race in NAPI receive Roi Dayan (1): net/mlx5e: Lag, Only handle events from highest priority multipath entry Rong Chen (1): mmc: meson: Fix usage of meson_mmc_post_req() Ross Philipson (2): x86/boot: Fix memremap of setup_indirect structures x86/boot: Add setup_indirect support in early_memremap_is_setup_data() Russell King (Oracle) (1): net: dsa: mt7530: fix incorrect test in mt753x_phylink_validate() Shreeya Patel (1): gpio: Return EPROBE_DEFER if gc->to_irq is NULL Steffen Klassert (1): esp: Fix BEET mode inter address family tunneling on GSO Sven Schnelle (1): tracing: Ensure trace buffer is at least 4096 bytes large Taniya Das (1): clk: qcom: gdsc: Add support to update GDSC transition delay Tom Rix (1): qed: return status of qed_iov_get_link Tung Nguyen (2): tipc: fix kernel panic when enabling bearer tipc: fix incorrect order of state message data sanity check Vikash Chandola (1): hwmon: (pmbus) Clear pmbus fault/warning bits after read Xie Yongji (1): virtio-blk: Don't use MAX_DISCARD_SEGMENTS if max_discard_seg is zero Zhen Lei (1): mISDN: Remove obsolete PIPELINE_DEBUG debugging information suresh kumar (1): net-sysfs: add check for netdevice being present to speed_show arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi | 2 +- arch/arm/boot/dts/bcm2711.dtsi | 1 + .../dts/marvell/armada-3720-turris-mox.dts | 8 +- arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 2 +- arch/riscv/kernel/module.c | 21 +++-- arch/x86/kernel/e820.c | 41 +++++++--- arch/x86/kernel/kdebugfs.c | 37 ++++++--- arch/x86/kernel/ksysfs.c | 77 +++++++++++++++---- arch/x86/kernel/setup.c | 34 ++++++-- arch/x86/kernel/traps.c | 1 + arch/x86/mm/ioremap.c | 57 ++++++++++++-- drivers/block/virtio_blk.c | 10 ++- drivers/clk/qcom/gdsc.c | 26 +++++-- drivers/clk/qcom/gdsc.h | 8 +- drivers/gpio/gpio-ts4900.c | 24 ++++-- drivers/gpio/gpiolib.c | 10 +++ drivers/gpu/drm/sun4i/sun8i_mixer.h | 8 +- drivers/hid/hid-vivaldi.c | 2 +- drivers/hwmon/pmbus/pmbus_core.c | 5 ++ drivers/isdn/hardware/mISDN/hfcpci.c | 6 +- drivers/isdn/mISDN/dsp_pipeline.c | 52 ++----------- drivers/mmc/host/meson-gx-mmc.c | 15 ++-- drivers/net/dsa/mt7530.c | 2 +- .../ethernet/broadcom/genet/bcmgenet_wol.c | 7 ++ drivers/net/ethernet/cadence/macb_main.c | 25 +++++- .../net/ethernet/freescale/gianfar_ethtool.c | 1 + .../net/ethernet/intel/i40e/i40e_debugfs.c | 6 +- .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 57 ++------------ .../ethernet/intel/i40e/i40e_virtchnl_pf.h | 5 -- .../net/ethernet/intel/ice/ice_adminq_cmd.h | 10 +-- drivers/net/ethernet/intel/ice/ice_common.c | 13 ++-- drivers/net/ethernet/intel/ice/ice_ethtool.c | 70 ++++++++--------- drivers/net/ethernet/intel/ice/ice_main.c | 12 +-- .../net/ethernet/intel/ice/ice_virtchnl_pf.c | 18 ----- .../net/ethernet/intel/ice/ice_virtchnl_pf.h | 3 - drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 15 ++-- .../net/ethernet/mellanox/mlx5/core/lag_mp.c | 11 ++- drivers/net/ethernet/nxp/lpc_eth.c | 5 +- drivers/net/ethernet/qlogic/qed/qed_sriov.c | 18 +++-- drivers/net/ethernet/qlogic/qed/qed_vf.c | 7 ++ drivers/net/ethernet/ti/cpts.c | 4 +- drivers/net/ethernet/xilinx/xilinx_emaclite.c | 4 +- drivers/net/phy/dp83822.c | 2 +- drivers/net/xen-netback/xenbus.c | 14 ++-- drivers/nfc/port100.c | 2 + drivers/spi/spi-rockchip.c | 13 +++- drivers/staging/gdm724x/gdm_lte.c | 5 +- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 7 +- drivers/staging/rtl8723bs/core/rtw_recv.c | 10 ++- drivers/staging/rtl8723bs/core/rtw_sta_mgt.c | 22 +++--- drivers/staging/rtl8723bs/core/rtw_xmit.c | 16 ++-- .../staging/rtl8723bs/hal/rtl8723bs_xmit.c | 2 + drivers/virtio/virtio.c | 40 +++++----- fs/ext4/resize.c | 5 ++ fs/pipe.c | 11 ++- include/linux/mlx5/mlx5_ifc.h | 4 +- include/linux/virtio.h | 1 - include/linux/virtio_config.h | 3 +- include/linux/watch_queue.h | 3 +- kernel/trace/trace.c | 10 ++- kernel/watch_queue.c | 15 ++-- net/core/net-sysfs.c | 2 +- net/ipv4/esp4_offload.c | 3 + net/ipv6/addrconf.c | 2 + net/ipv6/esp6_offload.c | 3 + net/sctp/diag.c | 9 +-- net/tipc/bearer.c | 12 +-- net/tipc/link.c | 9 ++- .../selftests/bpf/prog_tests/timer_crash.c | 32 ++++++++ .../testing/selftests/bpf/progs/timer_crash.c | 54 +++++++++++++ tools/testing/selftests/memfd/memfd_test.c | 1 + tools/testing/selftests/net/pmtu.sh | 7 +- .../selftests/vm/map_fixed_noreplace.c | 49 +++++++++--- 73 files changed, 714 insertions(+), 394 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/timer_crash.c create mode 100644 tools/testing/selftests/bpf/progs/timer_crash.c -- 2.20.1

1 67

[PATCH openEuler-5.10 01/16] xhci: Fix a logic issue when display Zhaoxin XHCI root hub speed
by Zheng Zengkai 07 Jun '22

07 Jun '22

From: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> zhaoxin inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I40QDN CVE: NA ---------------------------------------------------------------- Fix a logic issue when display Zhaoxin XHCI root hub speed. Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/usb/host/xhci.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index ba2b2b5afdd1..0984bd31e0e9 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -5271,10 +5271,10 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks) if (XHCI_EXT_PORT_PSIV(xhci->port_caps[j].psi[i]) >= 5) minor_rev = 1; } - if (minor_rev != 1) { - hcd->speed = HCD_USB3; - hcd->self.root_hub->speed = USB_SPEED_SUPER; - } + } + if (minor_rev != 1) { + hcd->speed = HCD_USB3; + hcd->self.root_hub->speed = USB_SPEED_SUPER; } } -- 2.20.1

1 15

[PATCH openEuler-5.10 00/90] Backport SW64 enhancement and bugfix
by Zheng Zengkai 07 Jun '22

07 Jun '22

Backport SW64 enhancement and bugfix patches from hardware vendor. Cui Mingrui (2): sw64: optimize ip checksum calculation sw64: fix ip checksum calculation Du Yilong (3): sw64: kvm: fix bug when open file with the O_DIRECT flag sw64: add set time support for hypervisor based rtc sw64: kvm: remap pages of guest by vm_insert_page() Gu Zitao (7): config: add initial openeuler_defconfig for sw64 sw64: fix coding style problems sw64: fix the VDSO symbol generation for nm sw64: fix SPDX license identifier in uapi headers sw64: add SO_RCVTIMEO/ SO_SNDTIMEO socket options sw64: remove unnecessary include headers sw64: fix some compile errors He Chuyue (2): sw64: add regs and stack access APIs to support kprobe events sw64: remove unnecessary parameter in REG_OFFSET_NAME He Sheng (20): sw64: clean up useless #if 0 and #if 1 sw64: switch GUP to the generic get_user_pages_fast() implementation sw64: remove unused a.out.h sw64: fix ex_table entries from misalignment handlers sw64: define NR_SYSCALLS as generated __NR_syscalls sw64: clean up a.out and ECOFF binary related headers sw64: ptrace: clean up debug codes sw64: add kbuild defconfig rule sw64: clean up out-of-date selected options sw64: Kconfig: remove dependence on !PREEMPT sw64: Kconfig: remove dependence on ARCH_SUPPORTS_ACPI sw64: add missing global __constant_c_memset sw64: do some cleanups for rt_sigframe sw64: fix setup_rt_frame for non SA_SIGINFO sw64: fix compile error for DISCONTIGMEM=y sw64: force signal and fault for traps and debugging sw64: push and pop kernel stack with ldi instruction sw64: signal: save/restore fpregs with copy user sw64: fix the number of aux entries in ARCH_DLINFO sw64: fix sendfile system call Lu Feifei (6): sw64: fix printk method for guest os sw64: unify access to LONGTIME for guest and emulator sw64: kvm: handle ldl_u and stl_u when exit mmio sw64: kvm: simplify the code sw64: pci: align the address of mmio resource to PAGE_SIZE sw64: unify 32-bit MEMIO address of host and guest Mao Minkai (29): sw64: vdso: add automatic syscall fallback sw64: vdso: change vdso version sw64: vdso: fix time calculation sw64: mm: reorder memblock_init process sw64: mm: warn overlapped memmap and DMA region sw64: mm: use memblock to find the end of memory sw64: print correct initrd address sw64: remove redundant Kconfig source sw64: modify tc_sched_clock debugfs file sw64: simplify cpumask_of_node sw64: remove CONFIG_USE_PERCPU_NUMA_NODE_ID=n code sw64: fix all compile warnings sw64: numa: switch to arch node_distance sw64: mm: mark pci and memmap region as nomap sw64: use jump label for running modes sw64: remove MAX_ASN sw64: kvm: remove MAX_VPN sw64: fix coding style problems sw64: rename kvm_mem variables sw64: reformat syscall.tbl sw64: add missing pkey syscall numbers sw64: add clone3 syscall support sw64: add required include headers to ptrace.h sw64: switch to old-style semctl/shmctl syscalls sw64: increase position index in c_next for cpuinfo sw64: add old sigprocmask back for compatibility sw64: vdso: fix backtrace of vrt_sigreturn sw64: vdso: fix CFI directives for fpregs in vrt_sigreturn sw64: optimize simd version of memcpy and memset Min Fanlei (4): sw64: fix the value of QEMU_PRINTF_BUFF_BASE sw64: add support for emulator running mode sw64: enable more than 32 CPUs for guest sw64: kvm: fix bad page state setting outside of kvm memory pool Tang Jinyang (2): sw64: add dynamic frequency scaling support sw64: add dynamic turning on/off cores support Wang Yingying (3): hwmon: add voltage sensor support for sw64 sw64: add pvt device to chip3.dts hwmon: add support for sw64 temperature sensor Xu Chenjiao (2): sw64: radeon: add a force flush to delay work when radeon uvd suspend sw64: pcie: enable PME and AER support Zhao Yihan (1): sw64: remap PA with |= in early_ioremap Zheng Chongzhen (3): sw64: re-implement sw64_dma_direct_ops according upstream sw64: iommu: fix 32-bit devices dma ops sw64: fix compile error for CONFIG_PCI=n Zhou Xuemei (5): sw64: pci: remove some useless code sw64: switch to generic pcibios_set_master and pci_common_swizzle sw64: clean up some useless codes sw64: dts: rename spi flash partition to fix warning sw64: add ARCH_HAS_PTE_SPECIAL support Zhu Donghong (1): ipmi: add ipmi driver support arch/sw_64/Kconfig | 325 +- arch/sw_64/Makefile | 1 + arch/sw_64/boot/dts/chip3.dts | 41 +- arch/sw_64/chip/chip3/chip.c | 130 +- arch/sw_64/chip/chip3/cpufreq_debugfs.c | 7 +- arch/sw_64/chip/chip3/i2c-lib.c | 4 - arch/sw_64/chip/chip3/irq_chip.c | 13 +- arch/sw_64/chip/chip3/msi.c | 7 +- arch/sw_64/chip/chip3/pci-quirks.c | 7 +- arch/sw_64/chip/chip3/vt_msi.c | 6 - arch/sw_64/configs/openeuler_defconfig | 4312 +++++++++++++++++++++ arch/sw_64/defconfig | 73 - arch/sw_64/include/asm/Kbuild | 1 + arch/sw_64/include/asm/a.out-core.h | 80 - arch/sw_64/include/asm/a.out.h | 16 - arch/sw_64/include/asm/checksum.h | 58 +- arch/sw_64/include/asm/chip3_io.h | 4 +- arch/sw_64/include/asm/clock.h | 56 + arch/sw_64/include/asm/cputime.h | 4 +- arch/sw_64/include/asm/early_ioremap.h | 2 +- arch/sw_64/include/asm/hw_init.h | 29 +- arch/sw_64/include/asm/kvm_host.h | 3 +- arch/sw_64/include/asm/mmu_context.h | 3 +- arch/sw_64/include/asm/numa.h | 1 + arch/sw_64/include/asm/pci.h | 24 +- arch/sw_64/include/asm/pgtable.h | 26 +- arch/sw_64/include/asm/ptrace.h | 8 +- arch/sw_64/include/asm/topology.h | 29 +- arch/sw_64/include/asm/unistd.h | 3 +- arch/sw_64/include/asm/user.h | 53 - arch/sw_64/include/asm/vdso.h | 4 +- arch/sw_64/include/asm/vga.h | 18 +- arch/sw_64/include/uapi/asm/a.out.h | 88 - arch/sw_64/include/uapi/asm/auxvec.h | 25 +- arch/sw_64/include/uapi/asm/bitsperlong.h | 2 +- arch/sw_64/include/uapi/asm/byteorder.h | 2 +- arch/sw_64/include/uapi/asm/compiler.h | 2 +- arch/sw_64/include/uapi/asm/console.h | 2 +- arch/sw_64/include/uapi/asm/errno.h | 2 +- arch/sw_64/include/uapi/asm/fcntl.h | 2 +- arch/sw_64/include/uapi/asm/fpu.h | 2 +- arch/sw_64/include/uapi/asm/gentrap.h | 2 +- arch/sw_64/include/uapi/asm/hmcall.h | 2 +- arch/sw_64/include/uapi/asm/ioctl.h | 2 +- arch/sw_64/include/uapi/asm/ioctls.h | 48 +- arch/sw_64/include/uapi/asm/ipcbuf.h | 2 +- arch/sw_64/include/uapi/asm/kvm.h | 14 +- arch/sw_64/include/uapi/asm/kvm_para.h | 2 +- arch/sw_64/include/uapi/asm/mman.h | 2 +- arch/sw_64/include/uapi/asm/msgbuf.h | 2 +- arch/sw_64/include/uapi/asm/param.h | 2 +- arch/sw_64/include/uapi/asm/poll.h | 2 +- arch/sw_64/include/uapi/asm/posix_types.h | 2 +- arch/sw_64/include/uapi/asm/ptrace.h | 2 +- arch/sw_64/include/uapi/asm/reg.h | 2 +- arch/sw_64/include/uapi/asm/regdef.h | 2 +- arch/sw_64/include/uapi/asm/resource.h | 2 +- arch/sw_64/include/uapi/asm/sembuf.h | 2 +- arch/sw_64/include/uapi/asm/setup.h | 2 +- arch/sw_64/include/uapi/asm/shmbuf.h | 2 +- arch/sw_64/include/uapi/asm/sigcontext.h | 2 +- arch/sw_64/include/uapi/asm/siginfo.h | 2 +- arch/sw_64/include/uapi/asm/signal.h | 2 +- arch/sw_64/include/uapi/asm/socket.h | 34 +- arch/sw_64/include/uapi/asm/sockios.h | 2 +- arch/sw_64/include/uapi/asm/stat.h | 2 +- arch/sw_64/include/uapi/asm/statfs.h | 2 +- arch/sw_64/include/uapi/asm/swab.h | 2 +- arch/sw_64/include/uapi/asm/sysinfo.h | 2 +- arch/sw_64/include/uapi/asm/termbits.h | 2 +- arch/sw_64/include/uapi/asm/termios.h | 2 +- arch/sw_64/include/uapi/asm/types.h | 2 +- arch/sw_64/include/uapi/asm/unistd.h | 7 +- arch/sw_64/kernel/Makefile | 5 +- arch/sw_64/kernel/acpi.c | 19 +- arch/sw_64/kernel/asm-offsets.c | 7 +- arch/sw_64/kernel/audit.c | 2 +- arch/sw_64/kernel/cacheinfo.c | 3 +- arch/sw_64/kernel/clock.c | 184 + arch/sw_64/kernel/core.c | 41 +- arch/sw_64/kernel/cpuautoplug.c | 496 +++ arch/sw_64/kernel/crash_dump.c | 2 - arch/sw_64/kernel/dup_print.c | 10 +- arch/sw_64/kernel/early_printk.c | 4 +- arch/sw_64/kernel/entry.S | 5 +- arch/sw_64/kernel/ftrace.c | 5 - arch/sw_64/kernel/insn.c | 13 - arch/sw_64/kernel/irq.c | 15 - arch/sw_64/kernel/irq_sw64.c | 9 +- arch/sw_64/kernel/jump_label.c | 3 +- arch/sw_64/kernel/kgdb.c | 9 +- arch/sw_64/kernel/kprobes/decode-insn.c | 6 +- arch/sw_64/kernel/kprobes/kprobes.c | 4 - arch/sw_64/kernel/kvm_cma.c | 4 - arch/sw_64/kernel/machine_kexec.c | 7 +- arch/sw_64/kernel/module.c | 9 - arch/sw_64/kernel/msi.c | 25 - arch/sw_64/kernel/pci-noop.c | 8 - arch/sw_64/kernel/pci-sysfs.c | 3 - arch/sw_64/kernel/pci.c | 102 +- arch/sw_64/kernel/pci_common.c | 285 +- arch/sw_64/kernel/pci_impl.h | 49 - arch/sw_64/kernel/perf_event.c | 12 - arch/sw_64/kernel/perf_regs.c | 4 - arch/sw_64/kernel/platform.c | 20 + arch/sw_64/kernel/process.c | 26 - arch/sw_64/kernel/ptrace.c | 132 +- arch/sw_64/kernel/relocate.c | 13 +- arch/sw_64/kernel/segvdbg.c | 4 +- arch/sw_64/kernel/setup.c | 124 +- arch/sw_64/kernel/signal.c | 74 +- arch/sw_64/kernel/smp.c | 25 +- arch/sw_64/kernel/stacktrace.c | 1 - arch/sw_64/kernel/suspend.c | 22 +- arch/sw_64/kernel/syscalls/syscall.tbl | 28 +- arch/sw_64/kernel/tc.c | 3 - arch/sw_64/kernel/time.c | 31 +- arch/sw_64/kernel/timer.c | 21 +- arch/sw_64/kernel/topology.c | 19 - arch/sw_64/kernel/traps.c | 95 +- arch/sw_64/kernel/unaligned.c | 3 - arch/sw_64/kernel/uprobes.c | 5 - arch/sw_64/kernel/vdso.c | 9 - arch/sw_64/kernel/vdso/so2s.sh | 3 +- arch/sw_64/kernel/vdso/vdso.S | 2 - arch/sw_64/kernel/vdso/vdso.lds.S | 2 +- arch/sw_64/kernel/vdso/vgettimeofday.c | 33 +- arch/sw_64/kernel/vdso/vrt_sigreturn.S | 40 + arch/sw_64/kvm/emulate.c | 2 + arch/sw_64/kvm/kvm-sw64.c | 39 +- arch/sw_64/kvm/vmem.c | 37 +- arch/sw_64/lib/checksum.c | 136 +- arch/sw_64/lib/csum_partial_copy.c | 310 +- arch/sw_64/lib/deep-memcpy.S | 449 ++- arch/sw_64/lib/deep-memset.S | 27 +- arch/sw_64/lib/fls.c | 1 - arch/sw_64/lib/iomap.c | 4 +- arch/sw_64/lib/udelay.c | 5 - arch/sw_64/math-emu/math.c | 10 +- arch/sw_64/mm/fault.c | 21 +- arch/sw_64/mm/hugetlbpage.c | 7 +- arch/sw_64/mm/init.c | 48 +- arch/sw_64/mm/numa.c | 30 +- arch/sw_64/mm/physaddr.c | 1 - arch/sw_64/mm/thp.c | 9 - drivers/cpufreq/Makefile | 1 + drivers/cpufreq/sw64_cpufreq.c | 186 + drivers/gpu/drm/radeon/radeon_uvd.c | 5 + drivers/hwmon/Kconfig | 10 + drivers/hwmon/Makefile | 1 + drivers/hwmon/sw64_pvt.c | 223 ++ drivers/iommu/sw64/sunway_iommu.c | 58 +- drivers/iommu/sw64/sunway_iommu.h | 2 +- drivers/rtc/rtc-sw64-virt.c | 24 +- 154 files changed, 7028 insertions(+), 2337 deletions(-) create mode 100644 arch/sw_64/configs/openeuler_defconfig delete mode 100644 arch/sw_64/defconfig delete mode 100644 arch/sw_64/include/asm/a.out-core.h delete mode 100644 arch/sw_64/include/asm/a.out.h create mode 100644 arch/sw_64/include/asm/clock.h delete mode 100644 arch/sw_64/include/asm/user.h delete mode 100644 arch/sw_64/include/uapi/asm/a.out.h create mode 100644 arch/sw_64/kernel/clock.c create mode 100644 arch/sw_64/kernel/cpuautoplug.c create mode 100644 arch/sw_64/kernel/platform.c create mode 100644 drivers/cpufreq/sw64_cpufreq.c create mode 100644 drivers/hwmon/sw64_pvt.c -- 2.20.1

1 90

[PATCH openEuler-5.10 00/67] Backport 5.10.106 LTS
by Zheng Zengkai 07 Jun '22

07 Jun '22

Backport 5.10.106 LTS patches from upstream watch_queue: Fix filter limit check ext4: add check to prevent attempting to resize an fs with sparse_super2 x86/traps: Mark do_int3() NOKPROBE_SYMBOL x86/boot: Add setup_indirect support in early_memremap_is_setup_data() x86/boot: Fix memremap of setup_indirect structures watch_queue: Make comment about setting ->defunct more accurate watch_queue: Fix lack of barrier/sync/lock between post and read watch_queue: Free the alloc bitmap when the watch_queue is torn down watch_queue: Fix the alloc bitmap size to reflect notes allocated watch_queue: Fix to always request a pow-of-2 pipe ring size watch_queue: Fix to release page in ->release() watch_queue, pipe: Free watchqueue state after clearing pipe ring virtio: acknowledge all features before access virtio: unexport virtio_finalize_features arm64: dts: marvell: armada-37xx: Remap IO space to bus address 0x0 riscv: Fix auipc+jalr relocation range checks mmc: meson: Fix usage of meson_mmc_post_req() net: macb: Fix lost RX packet wakeup race in NAPI receive staging: gdm724x: fix use after free in gdm_lte_rx() staging: rtl8723bs: Fix access-point mode deadlock selftests/memfd: clean up mapping in mfd_fail_write selftest/vm: fix map_fixed_noreplace test failure tracing: Ensure trace buffer is at least 4096 bytes large ipv6: prevent a possible race condition with lifetimes Revert "xen-netback: Check for hotplug-status existence before watching" Revert "xen-netback: remove 'hotplug-status' once it has served its purpose" gpio: Return EPROBE_DEFER if gc->to_irq is NULL hwmon: (pmbus) Clear pmbus fault/warning bits after read net-sysfs: add check for netdevice being present to speed_show spi: rockchip: terminate dma transmission when slave abort spi: rockchip: Fix error in getting num-cs property selftests/bpf: Add test for bpf_timer overwriting crash net: bcmgenet: Don't claim WOL when its not available sctp: fix kernel-infoleak for SCTP sockets net: phy: DP83822: clear MISR2 register to disable interrupts gianfar: ethtool: Fix refcount leak in gfar_get_ts_info gpio: ts4900: Do not set DAT and OE together selftests: pmtu.sh: Kill tcpdump processes launched by subshell. NFC: port100: fix use-after-free in port100_send_complete net/mlx5e: Lag, Only handle events from highest priority multipath entry net/mlx5: Fix a race on command flush flow net/mlx5: Fix size field in bufferx_reg struct net: ethernet: lpc_eth: Handle error for clk_enable net: ethernet: ti: cpts: Handle error for clk_enable tipc: fix incorrect order of state message data sanity check ethernet: Fix error handling in xemaclite_of_probe ice: Fix curr_link_speed advertised speed ice: Rename a couple of variables ice: Remove unnecessary checker loop ice: Align macro names to the specification ice: stop disabling VFs due to PF error responses i40e: stop disabling VFs due to PF error responses ARM: dts: aspeed: Fix AST2600 quad spi group net: dsa: mt7530: fix incorrect test in mt753x_phylink_validate() drm/sun4i: mixer: Fix P010 and P210 format numbers qed: return status of qed_iov_get_link esp: Fix BEET mode inter address family tunneling on GSO net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare() isdn: hfcpci: check the return value of dma_set_mask() in setup_hw() virtio-blk: Don't use MAX_DISCARD_SEGMENTS if max_discard_seg is zero mISDN: Fix memory leak in dsp_pipeline_build() mISDN: Remove obsolete PIPELINE_DEBUG debugging information tipc: fix kernel panic when enabling bearer arm64: dts: armada-3720-turris-mox: Add missing ethernet0 alias HID: vivaldi: fix sysfs attributes leak clk: qcom: gdsc: Add support to update GDSC transition delay ARM: boot: dts: bcm2711: Fix HVS register range Already merged: ax25: Fix NULL pointer dereference in ax25_kill_by_device ARM: Spectre-BHB: provide empty stub for non-config fuse: fix pipe buffer lifetime for direct_io ARM: fix Thumb2 regression with Spectre BHB Total patches: 71 - 4 = 67 Alexey Khoroshilov (1): mISDN: Fix memory leak in dsp_pipeline_build() Aneesh Kumar K.V (1): selftest/vm: fix map_fixed_noreplace test failure Anirudh Venkataramanan (3): ice: Align macro names to the specification ice: Remove unnecessary checker loop ice: Rename a couple of variables Clément Léger (1): net: phy: DP83822: clear MISR2 register to disable interrupts Dan Carpenter (1): staging: gdm724x: fix use after free in gdm_lte_rx() David Howells (8): watch_queue, pipe: Free watchqueue state after clearing pipe ring watch_queue: Fix to release page in ->release() watch_queue: Fix to always request a pow-of-2 pipe ring size watch_queue: Fix the alloc bitmap size to reflect notes allocated watch_queue: Free the alloc bitmap when the watch_queue is torn down watch_queue: Fix lack of barrier/sync/lock between post and read watch_queue: Make comment about setting ->defunct more accurate watch_queue: Fix filter limit check Dmitry Torokhov (1): HID: vivaldi: fix sysfs attributes leak Emil Renner Berthing (1): riscv: Fix auipc+jalr relocation range checks Eric Dumazet (1): sctp: fix kernel-infoleak for SCTP sockets Guillaume Nault (1): selftests: pmtu.sh: Kill tcpdump processes launched by subshell. Hans de Goede (1): staging: rtl8723bs: Fix access-point mode deadlock Jacob Keller (2): i40e: stop disabling VFs due to PF error responses ice: stop disabling VFs due to PF error responses Jedrzej Jagielski (1): ice: Fix curr_link_speed advertised speed Jeremy Linton (1): net: bcmgenet: Don't claim WOL when its not available Jernej Skrabec (1): drm/sun4i: mixer: Fix P010 and P210 format numbers Jia-Ju Bai (2): isdn: hfcpci: check the return value of dma_set_mask() in setup_hw() net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare() Jiasheng Jiang (2): net: ethernet: ti: cpts: Handle error for clk_enable net: ethernet: lpc_eth: Handle error for clk_enable Joel Stanley (1): ARM: dts: aspeed: Fix AST2600 quad spi group Jon Lin (2): spi: rockchip: Fix error in getting num-cs property spi: rockchip: terminate dma transmission when slave abort Josh Triplett (1): ext4: add check to prevent attempting to resize an fs with sparse_super2 Kumar Kartikeya Dwivedi (1): selftests/bpf: Add test for bpf_timer overwriting crash Li Huafei (1): x86/traps: Mark do_int3() NOKPROBE_SYMBOL Marek Marczykowski-Górecki (2): Revert "xen-netback: remove 'hotplug-status' once it has served its purpose" Revert "xen-netback: Check for hotplug-status existence before watching" Mark Featherston (1): gpio: ts4900: Do not set DAT and OE together Maxime Ripard (1): ARM: boot: dts: bcm2711: Fix HVS register range Miaoqian Lin (2): ethernet: Fix error handling in xemaclite_of_probe gianfar: ethtool: Fix refcount leak in gfar_get_ts_info Michael S. Tsirkin (2): virtio: unexport virtio_finalize_features virtio: acknowledge all features before access Mike Kravetz (1): selftests/memfd: clean up mapping in mfd_fail_write Mohammad Kabat (1): net/mlx5: Fix size field in bufferx_reg struct Moshe Shemesh (1): net/mlx5: Fix a race on command flush flow Niels Dossche (1): ipv6: prevent a possible race condition with lifetimes Pali Rohár (2): arm64: dts: armada-3720-turris-mox: Add missing ethernet0 alias arm64: dts: marvell: armada-37xx: Remap IO space to bus address 0x0 Pavel Skripkin (1): NFC: port100: fix use-after-free in port100_send_complete Robert Hancock (1): net: macb: Fix lost RX packet wakeup race in NAPI receive Roi Dayan (1): net/mlx5e: Lag, Only handle events from highest priority multipath entry Rong Chen (1): mmc: meson: Fix usage of meson_mmc_post_req() Ross Philipson (2): x86/boot: Fix memremap of setup_indirect structures x86/boot: Add setup_indirect support in early_memremap_is_setup_data() Russell King (Oracle) (1): net: dsa: mt7530: fix incorrect test in mt753x_phylink_validate() Shreeya Patel (1): gpio: Return EPROBE_DEFER if gc->to_irq is NULL Steffen Klassert (1): esp: Fix BEET mode inter address family tunneling on GSO Sven Schnelle (1): tracing: Ensure trace buffer is at least 4096 bytes large Taniya Das (1): clk: qcom: gdsc: Add support to update GDSC transition delay Tom Rix (1): qed: return status of qed_iov_get_link Tung Nguyen (2): tipc: fix kernel panic when enabling bearer tipc: fix incorrect order of state message data sanity check Vikash Chandola (1): hwmon: (pmbus) Clear pmbus fault/warning bits after read Xie Yongji (1): virtio-blk: Don't use MAX_DISCARD_SEGMENTS if max_discard_seg is zero Zhen Lei (1): mISDN: Remove obsolete PIPELINE_DEBUG debugging information suresh kumar (1): net-sysfs: add check for netdevice being present to speed_show arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi | 2 +- arch/arm/boot/dts/bcm2711.dtsi | 1 + .../dts/marvell/armada-3720-turris-mox.dts | 8 +- arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 2 +- arch/riscv/kernel/module.c | 21 +++-- arch/x86/kernel/e820.c | 41 +++++++--- arch/x86/kernel/kdebugfs.c | 37 ++++++--- arch/x86/kernel/ksysfs.c | 77 +++++++++++++++---- arch/x86/kernel/setup.c | 34 ++++++-- arch/x86/kernel/traps.c | 1 + arch/x86/mm/ioremap.c | 57 ++++++++++++-- drivers/block/virtio_blk.c | 10 ++- drivers/clk/qcom/gdsc.c | 26 +++++-- drivers/clk/qcom/gdsc.h | 8 +- drivers/gpio/gpio-ts4900.c | 24 ++++-- drivers/gpio/gpiolib.c | 10 +++ drivers/gpu/drm/sun4i/sun8i_mixer.h | 8 +- drivers/hid/hid-vivaldi.c | 2 +- drivers/hwmon/pmbus/pmbus_core.c | 5 ++ drivers/isdn/hardware/mISDN/hfcpci.c | 6 +- drivers/isdn/mISDN/dsp_pipeline.c | 52 ++----------- drivers/mmc/host/meson-gx-mmc.c | 15 ++-- drivers/net/dsa/mt7530.c | 2 +- .../ethernet/broadcom/genet/bcmgenet_wol.c | 7 ++ drivers/net/ethernet/cadence/macb_main.c | 25 +++++- .../net/ethernet/freescale/gianfar_ethtool.c | 1 + .../net/ethernet/intel/i40e/i40e_debugfs.c | 6 +- .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 57 ++------------ .../ethernet/intel/i40e/i40e_virtchnl_pf.h | 5 -- .../net/ethernet/intel/ice/ice_adminq_cmd.h | 10 +-- drivers/net/ethernet/intel/ice/ice_common.c | 13 ++-- drivers/net/ethernet/intel/ice/ice_ethtool.c | 70 ++++++++--------- drivers/net/ethernet/intel/ice/ice_main.c | 12 +-- .../net/ethernet/intel/ice/ice_virtchnl_pf.c | 18 ----- .../net/ethernet/intel/ice/ice_virtchnl_pf.h | 3 - drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 15 ++-- .../net/ethernet/mellanox/mlx5/core/lag_mp.c | 11 ++- drivers/net/ethernet/nxp/lpc_eth.c | 5 +- drivers/net/ethernet/qlogic/qed/qed_sriov.c | 18 +++-- drivers/net/ethernet/qlogic/qed/qed_vf.c | 7 ++ drivers/net/ethernet/ti/cpts.c | 4 +- drivers/net/ethernet/xilinx/xilinx_emaclite.c | 4 +- drivers/net/phy/dp83822.c | 2 +- drivers/net/xen-netback/xenbus.c | 14 ++-- drivers/nfc/port100.c | 2 + drivers/spi/spi-rockchip.c | 13 +++- drivers/staging/gdm724x/gdm_lte.c | 5 +- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 7 +- drivers/staging/rtl8723bs/core/rtw_recv.c | 10 ++- drivers/staging/rtl8723bs/core/rtw_sta_mgt.c | 22 +++--- drivers/staging/rtl8723bs/core/rtw_xmit.c | 16 ++-- .../staging/rtl8723bs/hal/rtl8723bs_xmit.c | 2 + drivers/virtio/virtio.c | 40 +++++----- fs/ext4/resize.c | 5 ++ fs/pipe.c | 11 ++- include/linux/mlx5/mlx5_ifc.h | 4 +- include/linux/virtio.h | 1 - include/linux/virtio_config.h | 3 +- include/linux/watch_queue.h | 3 +- kernel/trace/trace.c | 10 ++- kernel/watch_queue.c | 15 ++-- net/core/net-sysfs.c | 2 +- net/ipv4/esp4_offload.c | 3 + net/ipv6/addrconf.c | 2 + net/ipv6/esp6_offload.c | 3 + net/sctp/diag.c | 9 +-- net/tipc/bearer.c | 12 +-- net/tipc/link.c | 9 ++- .../selftests/bpf/prog_tests/timer_crash.c | 32 ++++++++ .../testing/selftests/bpf/progs/timer_crash.c | 54 +++++++++++++ tools/testing/selftests/memfd/memfd_test.c | 1 + tools/testing/selftests/net/pmtu.sh | 7 +- .../selftests/vm/map_fixed_noreplace.c | 49 +++++++++--- 73 files changed, 714 insertions(+), 394 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/timer_crash.c create mode 100644 tools/testing/selftests/bpf/progs/timer_crash.c -- 2.20.1

1 67

[PATCH] nvme: Assign subsys instance from first ctrl upstream 733e4b69
by Chen Taotao 06 Jun '22

06 Jun '22

The namespace disk names must be unique for the lifetime of the subsystem. This was accomplished by using their parent subsystems' instances which were allocated independently from the controllers connected to that subsystem. This allowed name prefixes assigned to namespaces to match a controller from an unrelated subsystem, and has created confusion among users examining device nodes. Ensure a namespace's subsystem instance never clashes with a controller instance of another subsystem by transferring the instance ownership to the parent subsystem from the first controller discovered in that subsystem. Reviewed-by: Logan Gunthorpe <logang(a)deltatee.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Minwoo Im <minwoo.im(a)samsung.com> Reviewed-by: Hannes Reinecke <hare(a)suse.com> Reviewed-off-by: Sagi Grimberg <sagi(a)grimberg.me> Signed-off-by: Sagi Grimberg <sagi(a)grimberg.me> --- drivers/nvme/host/core.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index 8c760493354f..576da5820a57 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -88,7 +88,6 @@ EXPORT_SYMBOL_GPL(nvme_reset_wq); struct workqueue_struct *nvme_delete_wq; EXPORT_SYMBOL_GPL(nvme_delete_wq); -static DEFINE_IDA(nvme_subsystems_ida); static LIST_HEAD(nvme_subsystems); static DEFINE_MUTEX(nvme_subsystems_lock); @@ -2308,7 +2307,8 @@ static void nvme_release_subsystem(struct device *dev) struct nvme_subsystem *subsys = container_of(dev, struct nvme_subsystem, dev); - ida_simple_remove(&nvme_subsystems_ida, subsys->instance); + if (subsys->instance >= 0) + ida_simple_remove(&nvme_instance_ida, subsys->instance); kfree(subsys); } @@ -2419,12 +2419,8 @@ static int nvme_init_subsystem(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) subsys = kzalloc(sizeof(*subsys), GFP_KERNEL); if (!subsys) return -ENOMEM; - ret = ida_simple_get(&nvme_subsystems_ida, 0, 0, GFP_KERNEL); - if (ret < 0) { - kfree(subsys); - return ret; - } - subsys->instance = ret; + + subsys->instance = -1; mutex_init(&subsys->lock); kref_init(&subsys->ref); INIT_LIST_HEAD(&subsys->ctrls); @@ -2439,7 +2435,7 @@ static int nvme_init_subsystem(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) subsys->dev.class = nvme_subsys_class; subsys->dev.release = nvme_release_subsystem; subsys->dev.groups = nvme_subsys_attrs_groups; - dev_set_name(&subsys->dev, "nvme-subsys%d", subsys->instance); + dev_set_name(&subsys->dev, "nvme-subsys%d", ctrl->instance); device_initialize(&subsys->dev); mutex_lock(&nvme_subsystems_lock); @@ -2472,6 +2468,8 @@ static int nvme_init_subsystem(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) list_add_tail(&subsys->entry, &nvme_subsystems); } + if (!found) + subsys->instance = ctrl->instance; ctrl->subsys = subsys; mutex_unlock(&nvme_subsystems_lock); @@ -3749,7 +3747,9 @@ static void nvme_free_ctrl(struct device *dev) container_of(dev, struct nvme_ctrl, ctrl_device); struct nvme_subsystem *subsys = ctrl->subsys; - ida_simple_remove(&nvme_instance_ida, ctrl->instance); + if (subsys && ctrl->instance != subsys->instance) + ida_simple_remove(&nvme_instance_ida, ctrl->instance); + kfree(ctrl->effects); nvme_mpath_uninit(ctrl); __free_page(ctrl->discard_page); @@ -4009,7 +4009,6 @@ int __init nvme_core_init(void) void nvme_core_exit(void) { - ida_destroy(&nvme_subsystems_ida); class_destroy(nvme_subsys_class); class_destroy(nvme_class); unregister_chrdev_region(nvme_chr_devt, NVME_MINORS); -- 2.27.0

1 0

Re: [PATCH OLK-5.10 1/4] eulerfs: add socket_num to eufs_sb_info
by Yu Kuai 06 Jun '22

06 Jun '22

在 2022/06/02 19:24, Gou Hao 写道: > > 在 2022/6/2 17:10, Yu Kuai 写道: >> 在 2022/06/02 10:50, Gou Hao 写道: >>> uniontech inclusion >>> category: bugfix >>> bugzilla: NA >>> CVE: NA >>> >>> ---------------------- >>> >>> We should not get the socket num in init_eufs_fs, becuse >>> system usually supports cpu hotplug,so we should get socket >>> num in dep_int. >> Hi, >> >> What if cpu is offline during mount, and online afterwards? >> > Well, in this case, we have to add a monitoring mechanism to > > dynamically adjust the number of threads according to the > > online status of the CPU. > > Or there are other better ways ... I prefer to keep the current implementation for now. Thanks, Kuai >> Thanks, >> Kuai >>> >>> Socket num is not necessarily the same when file system >>> mount,so it shoule be eufs_sb_info's member. >>> >>> Signed-off-by: Gou Hao <gouhao(a)uniontech.com> >>> --- >>> fs/eulerfs/dep.c | 28 ++++++++++++++++++++++------ >>> fs/eulerfs/euler.h | 2 -- >>> fs/eulerfs/euler_def.h | 1 + >>> fs/eulerfs/super.c | 15 +-------------- >>> 4 files changed, 24 insertions(+), 22 deletions(-) >>

2 1

[openEuler-22.09 00/34] bcache backport for openEuler-22.09 (up to Linux v5.19-rc1)
by Coly Li 04 Jun '22

04 Jun '22

This series is bcache backport up to Linux v5.19. The referenced bug is, https://gitee.com/openeuler/kernel/issues/I59A5L#note_10515416 All the patches are tested on Intel x86-64 platform, but not tested on ARM64 plantform yet. Coly Li --- Arnd Bergmann (1): md: bcache: avoid -Wempty-body warnings Bhaskar Chowdhury (1): md: bcache: Trivial typo fixes in the file journal.c Chao Yu (1): bcache: fix error info in register_bcache() Christoph Hellwig (1): bcache: remove PTR_CACHE Coly Li (10): bcache: fix a regression of code compiling failure in debug.c bcache: remove bcache device self-defined readahead bcache: avoid oversized read request in cache missing code path bcache: move uapi header bcache.h to bcache code directory bcache: improve multithreaded bch_btree_check() bcache: improve multithreaded bch_sectors_dirty_init() bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() bcache: avoid journal no-space deadlock by reserving 1 journal bucket bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() Ding Senjie (1): md: bcache: Fix spelling of 'acquire' Dongsheng Yang (1): bcache: fix race between setting bdev state to none and new write request direct to backing Greg Kroah-Hartman (1): bcache: use default_groups in kobj_type Gustavo A. R. Silva (1): bcache: Use 64-bit arithmetic instead of 32-bit Jia-Ju Bai (1): md: bcache: check the return value of kzalloc() in detached_dev_do_request() Joe Perches (1): bcache: Avoid comma separated statements Kai Krakow (1): bcache: Fix register_device_aync typo Lin Feng (2): bcache: move calc_cached_dev_sectors to proper place on backing device detach bcache: fix NULL pointer reference in cached_dev_detach_finish Ming Lei (1): bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded in 'cache_set' Mingzhe Zou (2): bcache: fixup bcache_dev_sectors_dirty_add() multithreaded CPU false sharing bcache: fixup multiple threads crash Qing Wang (1): bcache: replace snprintf in show functions with sysfs_emit Yang Li (1): bcache: use NULL instead of using plain integer as pointer Yi Li (2): bcache:remove a superfluous check in register_bcache bcache: set pdev_set_uuid before scond loop iteration YueHaibing (1): lib: crc64: fix kernel-doc warning Zheng Yongjun (1): md/bcache: convert comma to semicolon Zhiqiang Liu (1): bcache: reduce redundant code in bch_cached_dev_run() dongdong tao (1): bcache: consider the fragmentation when update the writeback rate drivers/md/bcache/alloc.c | 5 +- drivers/md/bcache/bcache.h | 25 ++- .../md/bcache/bcache_ondisk.h | 0 drivers/md/bcache/bset.c | 12 +- drivers/md/bcache/bset.h | 2 +- drivers/md/bcache/btree.c | 67 +++--- drivers/md/bcache/btree.h | 2 +- drivers/md/bcache/debug.c | 2 +- drivers/md/bcache/extents.c | 4 +- drivers/md/bcache/features.c | 4 +- drivers/md/bcache/features.h | 3 +- drivers/md/bcache/io.c | 4 +- drivers/md/bcache/journal.c | 37 +++- drivers/md/bcache/journal.h | 2 + drivers/md/bcache/request.c | 25 +-- drivers/md/bcache/stats.c | 17 +- drivers/md/bcache/stats.h | 1 - drivers/md/bcache/super.c | 63 +++--- drivers/md/bcache/sysfs.c | 50 +++-- drivers/md/bcache/sysfs.h | 20 +- drivers/md/bcache/util.h | 19 +- drivers/md/bcache/writeback.c | 198 +++++++++++------- drivers/md/bcache/writeback.h | 6 +- lib/crc64.c | 2 +- 24 files changed, 324 insertions(+), 246 deletions(-) rename include/uapi/linux/bcache.h => drivers/md/bcache/bcache_ondisk.h (100%) -- 2.35.3

1 34

[openEuler-22.03-LTS 00/34] bcache backport for openEuler-22.03-LTS (up to Linux v5.19-rc1)
by Coly Li 04 Jun '22

04 Jun '22

This series is bcache backport up to Linux v5.19. The referenced bug is, https://gitee.com/openeuler/kernel/issues/I59A5L#note_10515416 All the patches are tested on Intel x86-64 platform, but not tested on ARM64 plantform yet. Coly Li --- Arnd Bergmann (1): md: bcache: avoid -Wempty-body warnings Bhaskar Chowdhury (1): md: bcache: Trivial typo fixes in the file journal.c Chao Yu (1): bcache: fix error info in register_bcache() Christoph Hellwig (1): bcache: remove PTR_CACHE Coly Li (10): bcache: fix a regression of code compiling failure in debug.c bcache: remove bcache device self-defined readahead bcache: avoid oversized read request in cache missing code path bcache: move uapi header bcache.h to bcache code directory bcache: improve multithreaded bch_btree_check() bcache: improve multithreaded bch_sectors_dirty_init() bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() bcache: avoid journal no-space deadlock by reserving 1 journal bucket bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() Ding Senjie (1): md: bcache: Fix spelling of 'acquire' Dongsheng Yang (1): bcache: fix race between setting bdev state to none and new write request direct to backing Greg Kroah-Hartman (1): bcache: use default_groups in kobj_type Gustavo A. R. Silva (1): bcache: Use 64-bit arithmetic instead of 32-bit Jia-Ju Bai (1): md: bcache: check the return value of kzalloc() in detached_dev_do_request() Joe Perches (1): bcache: Avoid comma separated statements Kai Krakow (1): bcache: Fix register_device_aync typo Lin Feng (2): bcache: move calc_cached_dev_sectors to proper place on backing device detach bcache: fix NULL pointer reference in cached_dev_detach_finish Ming Lei (1): bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded in 'cache_set' Mingzhe Zou (2): bcache: fixup bcache_dev_sectors_dirty_add() multithreaded CPU false sharing bcache: fixup multiple threads crash Qing Wang (1): bcache: replace snprintf in show functions with sysfs_emit Yang Li (1): bcache: use NULL instead of using plain integer as pointer Yi Li (2): bcache:remove a superfluous check in register_bcache bcache: set pdev_set_uuid before scond loop iteration YueHaibing (1): lib: crc64: fix kernel-doc warning Zheng Yongjun (1): md/bcache: convert comma to semicolon Zhiqiang Liu (1): bcache: reduce redundant code in bch_cached_dev_run() dongdong tao (1): bcache: consider the fragmentation when update the writeback rate drivers/md/bcache/alloc.c | 5 +- drivers/md/bcache/bcache.h | 25 ++- .../md/bcache/bcache_ondisk.h | 0 drivers/md/bcache/bset.c | 12 +- drivers/md/bcache/bset.h | 2 +- drivers/md/bcache/btree.c | 67 +++--- drivers/md/bcache/btree.h | 2 +- drivers/md/bcache/debug.c | 2 +- drivers/md/bcache/extents.c | 4 +- drivers/md/bcache/features.c | 4 +- drivers/md/bcache/features.h | 3 +- drivers/md/bcache/io.c | 4 +- drivers/md/bcache/journal.c | 37 +++- drivers/md/bcache/journal.h | 2 + drivers/md/bcache/request.c | 25 +-- drivers/md/bcache/stats.c | 17 +- drivers/md/bcache/stats.h | 1 - drivers/md/bcache/super.c | 63 +++--- drivers/md/bcache/sysfs.c | 50 +++-- drivers/md/bcache/sysfs.h | 20 +- drivers/md/bcache/util.h | 19 +- drivers/md/bcache/writeback.c | 198 +++++++++++------- drivers/md/bcache/writeback.h | 6 +- lib/crc64.c | 2 +- 24 files changed, 324 insertions(+), 246 deletions(-) rename include/uapi/linux/bcache.h => drivers/md/bcache/bcache_ondisk.h (100%) -- 2.35.3

1 34

[OLK-5.10 PATCH 00/34] bcache backport for OLK-5.10 (up to Linux v5.19-rc1)
by Coly Li 04 Jun '22

04 Jun '22

This series is bcache backport up to Linux v5.19. The referenced bug is, https://gitee.com/openeuler/kernel/issues/I59A5L#note_10515416 All the patches are tested on Intel x86-64 platform, but not tested on ARM64 plantform yet. Coly Li --- Arnd Bergmann (1): md: bcache: avoid -Wempty-body warnings Bhaskar Chowdhury (1): md: bcache: Trivial typo fixes in the file journal.c Chao Yu (1): bcache: fix error info in register_bcache() Christoph Hellwig (1): bcache: remove PTR_CACHE Coly Li (10): bcache: fix a regression of code compiling failure in debug.c bcache: remove bcache device self-defined readahead bcache: avoid oversized read request in cache missing code path bcache: move uapi header bcache.h to bcache code directory bcache: improve multithreaded bch_btree_check() bcache: improve multithreaded bch_sectors_dirty_init() bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() bcache: avoid journal no-space deadlock by reserving 1 journal bucket bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() Ding Senjie (1): md: bcache: Fix spelling of 'acquire' Dongsheng Yang (1): bcache: fix race between setting bdev state to none and new write request direct to backing Greg Kroah-Hartman (1): bcache: use default_groups in kobj_type Gustavo A. R. Silva (1): bcache: Use 64-bit arithmetic instead of 32-bit Jia-Ju Bai (1): md: bcache: check the return value of kzalloc() in detached_dev_do_request() Joe Perches (1): bcache: Avoid comma separated statements Kai Krakow (1): bcache: Fix register_device_aync typo Lin Feng (2): bcache: move calc_cached_dev_sectors to proper place on backing device detach bcache: fix NULL pointer reference in cached_dev_detach_finish Ming Lei (1): bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded in 'cache_set' Mingzhe Zou (2): bcache: fixup bcache_dev_sectors_dirty_add() multithreaded CPU false sharing bcache: fixup multiple threads crash Qing Wang (1): bcache: replace snprintf in show functions with sysfs_emit Yang Li (1): bcache: use NULL instead of using plain integer as pointer Yi Li (2): bcache:remove a superfluous check in register_bcache bcache: set pdev_set_uuid before scond loop iteration YueHaibing (1): lib: crc64: fix kernel-doc warning Zheng Yongjun (1): md/bcache: convert comma to semicolon Zhiqiang Liu (1): bcache: reduce redundant code in bch_cached_dev_run() dongdong tao (1): bcache: consider the fragmentation when update the writeback rate drivers/md/bcache/alloc.c | 5 +- drivers/md/bcache/bcache.h | 25 ++- .../md/bcache/bcache_ondisk.h | 0 drivers/md/bcache/bset.c | 12 +- drivers/md/bcache/bset.h | 2 +- drivers/md/bcache/btree.c | 67 +++--- drivers/md/bcache/btree.h | 2 +- drivers/md/bcache/debug.c | 2 +- drivers/md/bcache/extents.c | 4 +- drivers/md/bcache/features.c | 4 +- drivers/md/bcache/features.h | 3 +- drivers/md/bcache/io.c | 4 +- drivers/md/bcache/journal.c | 37 +++- drivers/md/bcache/journal.h | 2 + drivers/md/bcache/request.c | 25 +-- drivers/md/bcache/stats.c | 17 +- drivers/md/bcache/stats.h | 1 - drivers/md/bcache/super.c | 63 +++--- drivers/md/bcache/sysfs.c | 50 +++-- drivers/md/bcache/sysfs.h | 20 +- drivers/md/bcache/util.h | 19 +- drivers/md/bcache/writeback.c | 198 +++++++++++------- drivers/md/bcache/writeback.h | 6 +- lib/crc64.c | 2 +- 24 files changed, 324 insertions(+), 246 deletions(-) rename include/uapi/linux/bcache.h => drivers/md/bcache/bcache_ondisk.h (100%) -- 2.35.3

1 34

[PATCH openEuler-1.0-LTS] xfs: show the proper user quota options
by tangbin 02 Jun '22

02 Jun '22

From: Kaixu Xia <kaixuxia(a)tencent.com> mainline inclusion from mainline-v5.11-rc6 commit 237d7887ae723af7d978e8b9a385fdff416f357b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5AG18 CVE: NA -------------------------------- The quota option 'usrquota' should be shown if both the XFS_UQUOTA_ACCT and XFS_UQUOTA_ENFD flags are set. The option 'uqnoenforce' should be shown when only the XFS_UQUOTA_ACCT flag is set. The current code logic seems wrong, Fix it and show proper options. Signed-off-by: Kaixu Xia <kaixuxia(a)tencent.com> Reviewed-by: Darrick J. Wong <darrick.wong(a)oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong(a)oracle.com> Signed-off-by: tangbin <tangbin(a)cmss.chinamobile.com> --- fs/xfs/xfs_super.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c index e126bc6cdeb8..5d8e3a4d2671 100644 --- a/fs/xfs/xfs_super.c +++ b/fs/xfs/xfs_super.c @@ -505,10 +505,12 @@ xfs_showargs( seq_printf(m, ",swidth=%d", (int)XFS_FSB_TO_BB(mp, mp->m_swidth)); - if (mp->m_qflags & (XFS_UQUOTA_ACCT|XFS_UQUOTA_ENFD)) - seq_puts(m, ",usrquota"); - else if (mp->m_qflags & XFS_UQUOTA_ACCT) - seq_puts(m, ",uqnoenforce"); + if (mp->m_qflags & XFS_UQUOTA_ACCT) { + if (mp->m_qflags & XFS_UQUOTA_ENFD) + seq_puts(m, ",usrquota"); + else + seq_puts(m, ",uqnoenforce"); + } if (mp->m_qflags & XFS_PQUOTA_ACCT) { if (mp->m_qflags & XFS_PQUOTA_ENFD) -- 2.18.4

1 0

[PATCH] xfs: show the proper user quota options
by tangbin 02 Jun '22

02 Jun '22

From: Kaixu Xia <kaixuxia(a)tencent.com> mainline inclusion from mainline-v5.11-rc6 commit 237d7887ae723af7d978e8b9a385fdff416f357b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5AG18 CVE: NA -------------------------------- The quota option 'usrquota' should be shown if both the XFS_UQUOTA_ACCT and XFS_UQUOTA_ENFD flags are set. The option 'uqnoenforce' should be shown when only the XFS_UQUOTA_ACCT flag is set. The current code logic seems wrong, Fix it and show proper options. Signed-off-by: Kaixu Xia <kaixuxia(a)tencent.com> Reviewed-by: Darrick J. Wong <darrick.wong(a)oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong(a)oracle.com> Signed-off-by: tangbin <tangbin(a)cmss.chinamobile.com> --- fs/xfs/xfs_super.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c index e126bc6cdeb8..5d8e3a4d2671 100644 --- a/fs/xfs/xfs_super.c +++ b/fs/xfs/xfs_super.c @@ -505,10 +505,12 @@ xfs_showargs( seq_printf(m, ",swidth=%d", (int)XFS_FSB_TO_BB(mp, mp->m_swidth)); - if (mp->m_qflags & (XFS_UQUOTA_ACCT|XFS_UQUOTA_ENFD)) - seq_puts(m, ",usrquota"); - else if (mp->m_qflags & XFS_UQUOTA_ACCT) - seq_puts(m, ",uqnoenforce"); + if (mp->m_qflags & XFS_UQUOTA_ACCT) { + if (mp->m_qflags & XFS_UQUOTA_ENFD) + seq_puts(m, ",usrquota"); + else + seq_puts(m, ",uqnoenforce"); + } if (mp->m_qflags & XFS_PQUOTA_ACCT) { if (mp->m_qflags & XFS_PQUOTA_ENFD) -- 2.18.4

1 0

Re: [PATCH OLK-5.10 1/4] eulerfs: add socket_num to eufs_sb_info
by Gou Hao 02 Jun '22

02 Jun '22

在 2022/6/2 17:10, Yu Kuai 写道: > 在 2022/06/02 10:50, Gou Hao 写道: >> uniontech inclusion >> category: bugfix >> bugzilla: NA >> CVE: NA >> >> ---------------------- >> >> We should not get the socket num in init_eufs_fs, becuse >> system usually supports cpu hotplug,so we should get socket >> num in dep_int. > Hi, > > What if cpu is offline during mount, and online afterwards? > Well, in this case, we have to add a monitoring mechanism to dynamically adjust the number of threads according to the online status of the CPU. Or there are other better ways ... > Thanks, > Kuai >> >> Socket num is not necessarily the same when file system >> mount,so it shoule be eufs_sb_info's member. >> >> Signed-off-by: Gou Hao <gouhao(a)uniontech.com> >> --- >> fs/eulerfs/dep.c | 28 ++++++++++++++++++++++------ >> fs/eulerfs/euler.h | 2 -- >> fs/eulerfs/euler_def.h | 1 + >> fs/eulerfs/super.c | 15 +-------------- >> 4 files changed, 24 insertions(+), 22 deletions(-) > -- thanks, Gou Hao

1 0

Re: [PATCH OLK-5.10 4/4] eulerfs: fix potential sbi->persisters free error
by Gou Hao 02 Jun '22

02 Jun '22

在 2022/6/2 17:15, Yu Kuai 写道: > 在 2022/06/02 10:51, Gou Hao 写道: >> uniontech inclusion >> category: bugfix >> bugzilla: NA >> CVE: NA >> >> ------------------- >> >> After alloc the sbi->persisters memory, dep_init >> will call dep_fini when error happened.Because >> sbi->persisters is not set to 0, kthread_stop >> may happened error. > > Looks good to me, just one language fixup: > > sbi->persisters is not set to 0 > -> dep_fini() can be called with sbi->persisters[] uninitialized, thus > kthread_stop() can be called with random value. > ok, thank you : ) > Thanks, > Kuai >> >> Signed-off-by: Gou Hao <gouhao(a)uniontech.com> >> --- >> fs/eulerfs/dep.c | 4 ++-- >> 1 file changed, 2 insertions(+), 2 deletions(-) >> >> diff --git a/fs/eulerfs/dep.c b/fs/eulerfs/dep.c >> index da826a18fa31..62fd1376f980 100644 >> --- a/fs/eulerfs/dep.c >> +++ b/fs/eulerfs/dep.c >> @@ -728,8 +728,8 @@ int dep_init(struct super_block *sb) >> node_num++; >> sbi->persister_num = node_num * persisters_per_socket; >> - >> - sbi->persisters = kmalloc(sizeof(struct task_struct *) * >> + >> + sbi->persisters = kzalloc(sizeof(struct task_struct *) * >> sbi->persister_num, GFP_KERNEL); >> if (!sbi->persisters) { >> err = -ENOMEM; >> > -- thanks, Gou Hao

1 0

[PATCH OLK-5.10 0/4] eulerfs: improve the creation of persister
by Gou Hao 02 Jun '22

02 Jun '22

Patch series "improve the creation of persister". The main modification is to create a persistent thread only when a NUMA node has an online CPU at least, instead of on all NUMA nodes. In the current code, the number of NUMA nodes is obtained when the module is loaded, and the same number of persistent threads are created when the file system is mounted. However, we should ignore NUMA nodes that do not have an online CPU. So we should decide how many threads to create according to the online CPU condition when initializing persist. Patch4 is a bugfix about dep_init(). Gou Hao (4): eulerfs: add socket_num to eufs_sb_info eulerfs: create persister on node when it has online cpu eulerfs: record persister num eulerfs: fix potential sbi->persisters free error fs/eulerfs/dep.c | 48 +++++++++++++++++++++++++++--------------- fs/eulerfs/euler.h | 2 -- fs/eulerfs/euler_def.h | 1 + fs/eulerfs/super.c | 21 ++++-------------- 4 files changed, 36 insertions(+), 36 deletions(-) -- 2.20.1

1 4

[PATCH openEuler-5.10-LTS 01/31] inet: fully convert sk->sk_rx_dst to RCU rules
by Zheng Zengkai 31 May '22

31 May '22

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v5.16-rc7 commit 8f905c0e7354ef261360fb7535ea079b1082c105 category: bugfix bugzilla: 186714 https://gitee.com/src-openeuler/kernel/issues/I57QUK -------------------------------- syzbot reported various issues around early demux, one being included in this changelog [1] sk->sk_rx_dst is using RCU protection without clearly documenting it. And following sequences in tcp_v4_do_rcv()/tcp_v6_do_rcv() are not following standard RCU rules. [a] dst_release(dst); [b] sk->sk_rx_dst = NULL; They look wrong because a delete operation of RCU protected pointer is supposed to clear the pointer before the call_rcu()/synchronize_rcu() guarding actual memory freeing. In some cases indeed, dst could be freed before [b] is done. We could cheat by clearing sk_rx_dst before calling dst_release(), but this seems the right time to stick to standard RCU annotations and debugging facilities. [1] BUG: KASAN: use-after-free in dst_check include/net/dst.h:470 [inline] BUG: KASAN: use-after-free in tcp_v4_early_demux+0x95b/0x960 net/ipv4/tcp_ipv4.c:1792 Read of size 2 at addr ffff88807f1cb73a by task syz-executor.5/9204 CPU: 0 PID: 9204 Comm: syz-executor.5 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x320 mm/kasan/report.c:247 __kasan_report mm/kasan/report.c:433 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:450 dst_check include/net/dst.h:470 [inline] tcp_v4_early_demux+0x95b/0x960 net/ipv4/tcp_ipv4.c:1792 ip_rcv_finish_core.constprop.0+0x15de/0x1e80 net/ipv4/ip_input.c:340 ip_list_rcv_finish.constprop.0+0x1b2/0x6e0 net/ipv4/ip_input.c:583 ip_sublist_rcv net/ipv4/ip_input.c:609 [inline] ip_list_rcv+0x34e/0x490 net/ipv4/ip_input.c:644 __netif_receive_skb_list_ptype net/core/dev.c:5508 [inline] __netif_receive_skb_list_core+0x549/0x8e0 net/core/dev.c:5556 __netif_receive_skb_list net/core/dev.c:5608 [inline] netif_receive_skb_list_internal+0x75e/0xd80 net/core/dev.c:5699 gro_normal_list net/core/dev.c:5853 [inline] gro_normal_list net/core/dev.c:5849 [inline] napi_complete_done+0x1f1/0x880 net/core/dev.c:6590 virtqueue_napi_complete drivers/net/virtio_net.c:339 [inline] virtnet_poll+0xca2/0x11b0 drivers/net/virtio_net.c:1557 __napi_poll+0xaf/0x440 net/core/dev.c:7023 napi_poll net/core/dev.c:7090 [inline] net_rx_action+0x801/0xb40 net/core/dev.c:7177 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 common_interrupt+0x52/0xc0 arch/x86/kernel/irq.c:240 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:629 RIP: 0033:0x7f5e972bfd57 Code: 39 d1 73 14 0f 1f 80 00 00 00 00 48 8b 50 f8 48 83 e8 08 48 39 ca 77 f3 48 39 c3 73 3e 48 89 13 48 8b 50 f8 48 89 38 49 8b 0e <48> 8b 3e 48 83 c3 08 48 83 c6 08 eb bc 48 39 d1 72 9e 48 39 d0 73 RSP: 002b:00007fff8a413210 EFLAGS: 00000283 RAX: 00007f5e97108990 RBX: 00007f5e97108338 RCX: ffffffff81d3aa45 RDX: ffffffff81d3aa45 RSI: 00007f5e97108340 RDI: ffffffff81d3aa45 RBP: 00007f5e97107eb8 R08: 00007f5e97108d88 R09: 0000000093c2e8d9 R10: 0000000000000000 R11: 0000000000000000 R12: 00007f5e97107eb0 R13: 00007f5e97108338 R14: 00007f5e97107ea8 R15: 0000000000000019 </TASK> Allocated by task 13: kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] __kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:467 kasan_slab_alloc include/linux/kasan.h:259 [inline] slab_post_alloc_hook mm/slab.h:519 [inline] slab_alloc_node mm/slub.c:3234 [inline] slab_alloc mm/slub.c:3242 [inline] kmem_cache_alloc+0x202/0x3a0 mm/slub.c:3247 dst_alloc+0x146/0x1f0 net/core/dst.c:92 rt_dst_alloc+0x73/0x430 net/ipv4/route.c:1613 ip_route_input_slow+0x1817/0x3a20 net/ipv4/route.c:2340 ip_route_input_rcu net/ipv4/route.c:2470 [inline] ip_route_input_noref+0x116/0x2a0 net/ipv4/route.c:2415 ip_rcv_finish_core.constprop.0+0x288/0x1e80 net/ipv4/ip_input.c:354 ip_list_rcv_finish.constprop.0+0x1b2/0x6e0 net/ipv4/ip_input.c:583 ip_sublist_rcv net/ipv4/ip_input.c:609 [inline] ip_list_rcv+0x34e/0x490 net/ipv4/ip_input.c:644 __netif_receive_skb_list_ptype net/core/dev.c:5508 [inline] __netif_receive_skb_list_core+0x549/0x8e0 net/core/dev.c:5556 __netif_receive_skb_list net/core/dev.c:5608 [inline] netif_receive_skb_list_internal+0x75e/0xd80 net/core/dev.c:5699 gro_normal_list net/core/dev.c:5853 [inline] gro_normal_list net/core/dev.c:5849 [inline] napi_complete_done+0x1f1/0x880 net/core/dev.c:6590 virtqueue_napi_complete drivers/net/virtio_net.c:339 [inline] virtnet_poll+0xca2/0x11b0 drivers/net/virtio_net.c:1557 __napi_poll+0xaf/0x440 net/core/dev.c:7023 napi_poll net/core/dev.c:7090 [inline] net_rx_action+0x801/0xb40 net/core/dev.c:7177 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 Freed by task 13: kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:46 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free mm/kasan/common.c:328 [inline] __kasan_slab_free+0xff/0x130 mm/kasan/common.c:374 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:1723 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1749 slab_free mm/slub.c:3513 [inline] kmem_cache_free+0xbd/0x5d0 mm/slub.c:3530 dst_destroy+0x2d6/0x3f0 net/core/dst.c:127 rcu_do_batch kernel/rcu/tree.c:2506 [inline] rcu_core+0x7ab/0x1470 kernel/rcu/tree.c:2741 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 Last potentially related work creation: kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38 __kasan_record_aux_stack+0xf5/0x120 mm/kasan/generic.c:348 __call_rcu kernel/rcu/tree.c:2985 [inline] call_rcu+0xb1/0x740 kernel/rcu/tree.c:3065 dst_release net/core/dst.c:177 [inline] dst_release+0x79/0xe0 net/core/dst.c:167 tcp_v4_do_rcv+0x612/0x8d0 net/ipv4/tcp_ipv4.c:1712 sk_backlog_rcv include/net/sock.h:1030 [inline] __release_sock+0x134/0x3b0 net/core/sock.c:2768 release_sock+0x54/0x1b0 net/core/sock.c:3300 tcp_sendmsg+0x36/0x40 net/ipv4/tcp.c:1441 inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 sock_write_iter+0x289/0x3c0 net/socket.c:1057 call_write_iter include/linux/fs.h:2162 [inline] new_sync_write+0x429/0x660 fs/read_write.c:503 vfs_write+0x7cd/0xae0 fs/read_write.c:590 ksys_write+0x1ee/0x250 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae The buggy address belongs to the object at ffff88807f1cb700 which belongs to the cache ip_dst_cache of size 176 The buggy address is located 58 bytes inside of 176-byte region [ffff88807f1cb700, ffff88807f1cb7b0) The buggy address belongs to the page: page:ffffea0001fc72c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f1cb flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 dead000000000100 dead000000000122 ffff8881413bb780 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL), pid 5, ts 108466983062, free_ts 108048976062 prep_new_page mm/page_alloc.c:2418 [inline] get_page_from_freelist+0xa72/0x2f50 mm/page_alloc.c:4149 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5369 alloc_pages+0x1a7/0x300 mm/mempolicy.c:2191 alloc_slab_page mm/slub.c:1793 [inline] allocate_slab mm/slub.c:1930 [inline] new_slab+0x32d/0x4a0 mm/slub.c:1993 ___slab_alloc+0x918/0xfe0 mm/slub.c:3022 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3109 slab_alloc_node mm/slub.c:3200 [inline] slab_alloc mm/slub.c:3242 [inline] kmem_cache_alloc+0x35c/0x3a0 mm/slub.c:3247 dst_alloc+0x146/0x1f0 net/core/dst.c:92 rt_dst_alloc+0x73/0x430 net/ipv4/route.c:1613 __mkroute_output net/ipv4/route.c:2564 [inline] ip_route_output_key_hash_rcu+0x921/0x2d00 net/ipv4/route.c:2791 ip_route_output_key_hash+0x18b/0x300 net/ipv4/route.c:2619 __ip_route_output_key include/net/route.h:126 [inline] ip_route_output_flow+0x23/0x150 net/ipv4/route.c:2850 ip_route_output_key include/net/route.h:142 [inline] geneve_get_v4_rt+0x3a6/0x830 drivers/net/geneve.c:809 geneve_xmit_skb drivers/net/geneve.c:899 [inline] geneve_xmit+0xc4a/0x3540 drivers/net/geneve.c:1082 __netdev_start_xmit include/linux/netdevice.h:4994 [inline] netdev_start_xmit include/linux/netdevice.h:5008 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x1eb/0x920 net/core/dev.c:3606 __dev_queue_xmit+0x299a/0x3650 net/core/dev.c:4229 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1338 [inline] free_pcp_prepare+0x374/0x870 mm/page_alloc.c:1389 free_unref_page_prepare mm/page_alloc.c:3309 [inline] free_unref_page+0x19/0x690 mm/page_alloc.c:3388 qlink_free mm/kasan/quarantine.c:146 [inline] qlist_free_all+0x5a/0xc0 mm/kasan/quarantine.c:165 kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:272 __kasan_slab_alloc+0xa2/0xc0 mm/kasan/common.c:444 kasan_slab_alloc include/linux/kasan.h:259 [inline] slab_post_alloc_hook mm/slab.h:519 [inline] slab_alloc_node mm/slub.c:3234 [inline] kmem_cache_alloc_node+0x255/0x3f0 mm/slub.c:3270 __alloc_skb+0x215/0x340 net/core/skbuff.c:414 alloc_skb include/linux/skbuff.h:1126 [inline] alloc_skb_with_frags+0x93/0x620 net/core/skbuff.c:6078 sock_alloc_send_pskb+0x783/0x910 net/core/sock.c:2575 mld_newpack+0x1df/0x770 net/ipv6/mcast.c:1754 add_grhead+0x265/0x330 net/ipv6/mcast.c:1857 add_grec+0x1053/0x14e0 net/ipv6/mcast.c:1995 mld_send_initial_cr.part.0+0xf6/0x230 net/ipv6/mcast.c:2242 mld_send_initial_cr net/ipv6/mcast.c:1232 [inline] mld_dad_work+0x1d3/0x690 net/ipv6/mcast.c:2268 process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298 worker_thread+0x658/0x11f0 kernel/workqueue.c:2445 Memory state around the buggy address: ffff88807f1cb600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807f1cb680: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc >ffff88807f1cb700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88807f1cb780: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc ffff88807f1cb800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fixes: 41063e9dd119 ("ipv4: Early TCP socket demux.") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20211220143330.680945-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Conflict: include/net/sock.h net/ipv4/tcp_ipv4.c net/ipv6/tcp_ipv6.c net/ipv6/udp.c Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/net/sock.h | 2 +- net/ipv4/af_inet.c | 2 +- net/ipv4/tcp.c | 3 +-- net/ipv4/tcp_input.c | 2 +- net/ipv4/tcp_ipv4.c | 11 +++++++---- net/ipv4/udp.c | 6 +++--- net/ipv6/tcp_ipv6.c | 11 +++++++---- net/ipv6/udp.c | 4 ++-- 8 files changed, 23 insertions(+), 18 deletions(-) diff --git a/include/net/sock.h b/include/net/sock.h index c958be11d172..bd34faf53b1f 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -428,7 +428,7 @@ struct sock { #ifdef CONFIG_XFRM struct xfrm_policy __rcu *sk_policy[2]; #endif - struct dst_entry *sk_rx_dst; + struct dst_entry __rcu *sk_rx_dst; struct dst_entry __rcu *sk_dst_cache; atomic_t sk_omem_alloc; int sk_sndbuf; diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index 8bf43ca7139a..911ad595dbb9 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -158,7 +158,7 @@ void inet_sock_destruct(struct sock *sk) kfree(rcu_dereference_protected(inet->inet_opt, 1)); dst_release(rcu_dereference_protected(sk->sk_dst_cache, 1)); - dst_release(sk->sk_rx_dst); + dst_release(rcu_dereference_protected(sk->sk_rx_dst, 1)); sk_refcnt_debug_dec(sk); } EXPORT_SYMBOL(inet_sock_destruct); diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index fcd792816756..c19428e97876 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -2814,8 +2814,7 @@ int tcp_disconnect(struct sock *sk, int flags) icsk->icsk_ack.rcv_mss = TCP_MIN_MSS; memset(&tp->rx_opt, 0, sizeof(tp->rx_opt)); __sk_dst_reset(sk); - dst_release(sk->sk_rx_dst); - sk->sk_rx_dst = NULL; + dst_release(xchg((__force struct dst_entry **)&sk->sk_rx_dst, NULL)); tcp_saved_syn_free(tp); tp->compressed_ack = 0; tp->segs_in = 0; diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 11f3f8e23a8a..6f4ac0f10f57 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -5744,7 +5744,7 @@ void tcp_rcv_established(struct sock *sk, struct sk_buff *skb) trace_tcp_probe(sk, skb); tcp_mstamp_refresh(tp); - if (unlikely(!sk->sk_rx_dst)) + if (unlikely(!rcu_access_pointer(sk->sk_rx_dst))) inet_csk(sk)->icsk_af_ops->sk_rx_dst_set(sk, skb); /* * Header prediction. diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index ebfeeeadd47c..078f3a5d65b3 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -1670,15 +1670,18 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb) struct sock *rsk; if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */ - struct dst_entry *dst = sk->sk_rx_dst; + struct dst_entry *dst; + + dst = rcu_dereference_protected(sk->sk_rx_dst, + lockdep_sock_is_held(sk)); sock_rps_save_rxhash(sk, skb); sk_mark_napi_id(sk, skb); if (dst) { if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif || !dst->ops->check(dst, 0)) { + RCU_INIT_POINTER(sk->sk_rx_dst, NULL); dst_release(dst); - sk->sk_rx_dst = NULL; } } tcp_rcv_established(sk, skb); @@ -1753,7 +1756,7 @@ int tcp_v4_early_demux(struct sk_buff *skb) skb->sk = sk; skb->destructor = sock_edemux; if (sk_fullsock(sk)) { - struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst); + struct dst_entry *dst = rcu_dereference(sk->sk_rx_dst); if (dst) dst = dst_check(dst, 0); @@ -2160,7 +2163,7 @@ void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb) struct dst_entry *dst = skb_dst(skb); if (dst && dst_hold_safe(dst)) { - sk->sk_rx_dst = dst; + rcu_assign_pointer(sk->sk_rx_dst, dst); inet_sk(sk)->rx_dst_ifindex = skb->skb_iif; } } diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 8cca8bda0612..121c08d4255c 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -2186,7 +2186,7 @@ bool udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst) struct dst_entry *old; if (dst_hold_safe(dst)) { - old = xchg(&sk->sk_rx_dst, dst); + old = xchg((__force struct dst_entry **)&sk->sk_rx_dst, dst); dst_release(old); return old != dst; } @@ -2376,7 +2376,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, struct dst_entry *dst = skb_dst(skb); int ret; - if (unlikely(sk->sk_rx_dst != dst)) + if (unlikely(rcu_dereference(sk->sk_rx_dst) != dst)) udp_sk_rx_dst_set(sk, dst); ret = udp_unicast_rcv_skb(sk, skb, uh); @@ -2535,7 +2535,7 @@ int udp_v4_early_demux(struct sk_buff *skb) skb->sk = sk; skb->destructor = sock_efree; - dst = READ_ONCE(sk->sk_rx_dst); + dst = rcu_dereference(sk->sk_rx_dst); if (dst) dst = dst_check(dst, 0); diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index df33145b876c..b87b04526e65 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -107,7 +107,7 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb) if (dst && dst_hold_safe(dst)) { const struct rt6_info *rt = (const struct rt6_info *)dst; - sk->sk_rx_dst = dst; + rcu_assign_pointer(sk->sk_rx_dst, dst); inet_sk(sk)->rx_dst_ifindex = skb->skb_iif; tcp_inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt); } @@ -1482,15 +1482,18 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) opt_skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC)); if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */ - struct dst_entry *dst = sk->sk_rx_dst; + struct dst_entry *dst; + + dst = rcu_dereference_protected(sk->sk_rx_dst, + lockdep_sock_is_held(sk)); sock_rps_save_rxhash(sk, skb); sk_mark_napi_id(sk, skb); if (dst) { if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif || dst->ops->check(dst, np->rx_dst_cookie) == NULL) { + RCU_INIT_POINTER(sk->sk_rx_dst, NULL); dst_release(dst); - sk->sk_rx_dst = NULL; } } @@ -1842,7 +1845,7 @@ INDIRECT_CALLABLE_SCOPE void tcp_v6_early_demux(struct sk_buff *skb) skb->sk = sk; skb->destructor = sock_edemux; if (sk_fullsock(sk)) { - struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst); + struct dst_entry *dst = rcu_dereference(sk->sk_rx_dst); if (dst) dst = dst_check(dst, tcp_inet6_sk(sk)->rx_dst_cookie); diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index 503706397839..7022dcbb5a11 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -940,7 +940,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, struct dst_entry *dst = skb_dst(skb); int ret; - if (unlikely(sk->sk_rx_dst != dst)) + if (unlikely(rcu_dereference(sk->sk_rx_dst) != dst)) udp6_sk_rx_dst_set(sk, dst); if (!uh->check && !udp_sk(sk)->no_check6_rx) { @@ -1054,7 +1054,7 @@ INDIRECT_CALLABLE_SCOPE void udp_v6_early_demux(struct sk_buff *skb) skb->sk = sk; skb->destructor = sock_efree; - dst = READ_ONCE(sk->sk_rx_dst); + dst = rcu_dereference(sk->sk_rx_dst); if (dst) dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie); -- 2.20.1

1 30

[PATCH openEuler-5.10-LTS 0/7] Backport 5.10.105 LTS
by Zheng Zengkai 31 May '22

31 May '22

Backport 5.10.105 LTS patches from upstream Revert "ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE" arm64: cpufeature: add HWCAP for FEAT_RPRES arm64: cpufeature: add HWCAP for FEAT_AFP arm64: Add Cortex-A510 CPU part definition arm64: Add Cortex-X2 CPU part definition arm64: Add Neoverse-N2, Cortex-A710 CPU part definition arm64: cputype: Add CPU implementor & types for the Apple M1 cores Conflicts: arm64: cpufeature: add HWCAP for FEAT_RPRES arm64: cpufeature: add HWCAP for FEAT_AFP arm64: Add Cortex-A510 CPU part definition arm64: Add Neoverse-N2, Cortex-A710 CPU part definition arm64: cputype: Add CPU implementor & types for the Apple M1 cores Already merged(51): xen/netfront: react properly to failing gnttab_end_foreign_access_ref() xen/gnttab: fix gnttab_end_foreign_access() without page specified xen/pvcalls: use alloc/free_pages_exact() xen/9p: use alloc/free_pages_exact() xen: remove gnttab_query_foreign_access() xen/gntalloc: don't use gnttab_query_foreign_access() xen/scsifront: don't use gnttab_query_foreign_access() for mapped status xen/netfront: don't use gnttab_query_foreign_access() for mapped status xen/blkfront: don't use gnttab_query_foreign_access() for mapped status xen/grant-table: add gnttab_try_end_foreign_access() xen/xenbus: don't let xenbus_grant_ring() remove grants in error case ARM: Do not use NOCROSSREFS directive with ld.lld arm64: proton-pack: Include unprivileged eBPF status in Spectre v2 mitigation reporting arm64: Use the clearbhb instruction in mitigations KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated arm64: Mitigate spectre style branch history side channels KVM: arm64: Allow indirect vectors to be used without SPECTRE_V3A arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2 arm64: Add percpu vectors for EL1 arm64: entry: Add macro for reading symbol addresses from the trampoline arm64: entry: Add vectors that have the bhb mitigation sequences arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations arm64: entry: Allow the trampoline text to occupy multiple pages arm64: entry: Make the kpti trampoline's kpti sequence optional arm64: entry: Move trampoline macros out of ifdef'd section arm64: entry: Don't assume tramp_vectors is the start of the vectors arm64: entry: Allow tramp_alias to access symbols after the 4K boundary arm64: entry: Move the trampoline data page before the text page arm64: entry: Free up another register on kpti's tramp_exit path arm64: entry: Make the trampoline cleanup optional arm64: spectre: Rename spectre_v4_patch_fw_mitigation_conduit arm64: entry.S: Add ventry overflow sanity checks arm64: add ID_AA64ISAR2_EL1 sys register arm64: Add HWCAP for self-synchronising virtual counter ARM: include unprivileged BPF status in Spectre V2 reporting ARM: Spectre-BHB workaround ARM: use LOADADDR() to get load address of sections ARM: early traps initialisation ARM: report Spectre v2 status through sysfs x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT x86/speculation: Warn about Spectre v2 LFENCE mitigation x86/speculation: Update link to AMD speculation whitepaper x86/speculation: Use generic retpoline by default on AMD x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting Documentation/hw-vuln: Update spectre doc x86/speculation: Add eIBRS + Retpoline options x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE x86,bugs: Unconditionally allow spectre_v2=retpoline,amd ARM: fix build error when BPF_SYSCALL is disabled ARM: fix co-processor register typo ARM: fix build warning in proc-v7-bugs.c Total patches: 58 - 51 = 7 Anshuman Khandual (2): arm64: Add Cortex-X2 CPU part definition arm64: Add Cortex-A510 CPU part definition Greg Kroah-Hartman (1): Revert "ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE" Hector Martin (1): arm64: cputype: Add CPU implementor & types for the Apple M1 cores Joey Gouly (2): arm64: cpufeature: add HWCAP for FEAT_AFP arm64: cpufeature: add HWCAP for FEAT_RPRES Suzuki K Poulose (1): arm64: Add Neoverse-N2, Cortex-A710 CPU part definition Documentation/arm64/cpu-feature-registers.rst | 17 +++++++++++++++++ Documentation/arm64/elf_hwcaps.rst | 8 ++++++++ arch/arm64/include/asm/cputype.h | 14 ++++++++++++++ arch/arm64/include/asm/hwcap.h | 2 ++ arch/arm64/include/asm/sysreg.h | 1 + arch/arm64/include/uapi/asm/hwcap.h | 2 ++ arch/arm64/kernel/cpufeature.c | 4 ++++ arch/arm64/kernel/cpuinfo.c | 2 ++ drivers/acpi/ec.c | 10 ---------- drivers/acpi/sleep.c | 14 ++++++++++---- 10 files changed, 60 insertions(+), 14 deletions(-) -- 2.20.1

1 7

[PATCH openEuler-5.10 01/50] inet: fully convert sk->sk_rx_dst to RCU rules
by Zheng Zengkai 31 May '22

31 May '22

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v5.16-rc7 commit 8f905c0e7354ef261360fb7535ea079b1082c105 category: bugfix bugzilla: 186714 https://gitee.com/src-openeuler/kernel/issues/I57QUK -------------------------------- syzbot reported various issues around early demux, one being included in this changelog [1] sk->sk_rx_dst is using RCU protection without clearly documenting it. And following sequences in tcp_v4_do_rcv()/tcp_v6_do_rcv() are not following standard RCU rules. [a] dst_release(dst); [b] sk->sk_rx_dst = NULL; They look wrong because a delete operation of RCU protected pointer is supposed to clear the pointer before the call_rcu()/synchronize_rcu() guarding actual memory freeing. In some cases indeed, dst could be freed before [b] is done. We could cheat by clearing sk_rx_dst before calling dst_release(), but this seems the right time to stick to standard RCU annotations and debugging facilities. [1] BUG: KASAN: use-after-free in dst_check include/net/dst.h:470 [inline] BUG: KASAN: use-after-free in tcp_v4_early_demux+0x95b/0x960 net/ipv4/tcp_ipv4.c:1792 Read of size 2 at addr ffff88807f1cb73a by task syz-executor.5/9204 CPU: 0 PID: 9204 Comm: syz-executor.5 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x320 mm/kasan/report.c:247 __kasan_report mm/kasan/report.c:433 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:450 dst_check include/net/dst.h:470 [inline] tcp_v4_early_demux+0x95b/0x960 net/ipv4/tcp_ipv4.c:1792 ip_rcv_finish_core.constprop.0+0x15de/0x1e80 net/ipv4/ip_input.c:340 ip_list_rcv_finish.constprop.0+0x1b2/0x6e0 net/ipv4/ip_input.c:583 ip_sublist_rcv net/ipv4/ip_input.c:609 [inline] ip_list_rcv+0x34e/0x490 net/ipv4/ip_input.c:644 __netif_receive_skb_list_ptype net/core/dev.c:5508 [inline] __netif_receive_skb_list_core+0x549/0x8e0 net/core/dev.c:5556 __netif_receive_skb_list net/core/dev.c:5608 [inline] netif_receive_skb_list_internal+0x75e/0xd80 net/core/dev.c:5699 gro_normal_list net/core/dev.c:5853 [inline] gro_normal_list net/core/dev.c:5849 [inline] napi_complete_done+0x1f1/0x880 net/core/dev.c:6590 virtqueue_napi_complete drivers/net/virtio_net.c:339 [inline] virtnet_poll+0xca2/0x11b0 drivers/net/virtio_net.c:1557 __napi_poll+0xaf/0x440 net/core/dev.c:7023 napi_poll net/core/dev.c:7090 [inline] net_rx_action+0x801/0xb40 net/core/dev.c:7177 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 common_interrupt+0x52/0xc0 arch/x86/kernel/irq.c:240 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:629 RIP: 0033:0x7f5e972bfd57 Code: 39 d1 73 14 0f 1f 80 00 00 00 00 48 8b 50 f8 48 83 e8 08 48 39 ca 77 f3 48 39 c3 73 3e 48 89 13 48 8b 50 f8 48 89 38 49 8b 0e <48> 8b 3e 48 83 c3 08 48 83 c6 08 eb bc 48 39 d1 72 9e 48 39 d0 73 RSP: 002b:00007fff8a413210 EFLAGS: 00000283 RAX: 00007f5e97108990 RBX: 00007f5e97108338 RCX: ffffffff81d3aa45 RDX: ffffffff81d3aa45 RSI: 00007f5e97108340 RDI: ffffffff81d3aa45 RBP: 00007f5e97107eb8 R08: 00007f5e97108d88 R09: 0000000093c2e8d9 R10: 0000000000000000 R11: 0000000000000000 R12: 00007f5e97107eb0 R13: 00007f5e97108338 R14: 00007f5e97107ea8 R15: 0000000000000019 </TASK> Allocated by task 13: kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] __kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:467 kasan_slab_alloc include/linux/kasan.h:259 [inline] slab_post_alloc_hook mm/slab.h:519 [inline] slab_alloc_node mm/slub.c:3234 [inline] slab_alloc mm/slub.c:3242 [inline] kmem_cache_alloc+0x202/0x3a0 mm/slub.c:3247 dst_alloc+0x146/0x1f0 net/core/dst.c:92 rt_dst_alloc+0x73/0x430 net/ipv4/route.c:1613 ip_route_input_slow+0x1817/0x3a20 net/ipv4/route.c:2340 ip_route_input_rcu net/ipv4/route.c:2470 [inline] ip_route_input_noref+0x116/0x2a0 net/ipv4/route.c:2415 ip_rcv_finish_core.constprop.0+0x288/0x1e80 net/ipv4/ip_input.c:354 ip_list_rcv_finish.constprop.0+0x1b2/0x6e0 net/ipv4/ip_input.c:583 ip_sublist_rcv net/ipv4/ip_input.c:609 [inline] ip_list_rcv+0x34e/0x490 net/ipv4/ip_input.c:644 __netif_receive_skb_list_ptype net/core/dev.c:5508 [inline] __netif_receive_skb_list_core+0x549/0x8e0 net/core/dev.c:5556 __netif_receive_skb_list net/core/dev.c:5608 [inline] netif_receive_skb_list_internal+0x75e/0xd80 net/core/dev.c:5699 gro_normal_list net/core/dev.c:5853 [inline] gro_normal_list net/core/dev.c:5849 [inline] napi_complete_done+0x1f1/0x880 net/core/dev.c:6590 virtqueue_napi_complete drivers/net/virtio_net.c:339 [inline] virtnet_poll+0xca2/0x11b0 drivers/net/virtio_net.c:1557 __napi_poll+0xaf/0x440 net/core/dev.c:7023 napi_poll net/core/dev.c:7090 [inline] net_rx_action+0x801/0xb40 net/core/dev.c:7177 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 Freed by task 13: kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:46 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free mm/kasan/common.c:328 [inline] __kasan_slab_free+0xff/0x130 mm/kasan/common.c:374 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:1723 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1749 slab_free mm/slub.c:3513 [inline] kmem_cache_free+0xbd/0x5d0 mm/slub.c:3530 dst_destroy+0x2d6/0x3f0 net/core/dst.c:127 rcu_do_batch kernel/rcu/tree.c:2506 [inline] rcu_core+0x7ab/0x1470 kernel/rcu/tree.c:2741 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 Last potentially related work creation: kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38 __kasan_record_aux_stack+0xf5/0x120 mm/kasan/generic.c:348 __call_rcu kernel/rcu/tree.c:2985 [inline] call_rcu+0xb1/0x740 kernel/rcu/tree.c:3065 dst_release net/core/dst.c:177 [inline] dst_release+0x79/0xe0 net/core/dst.c:167 tcp_v4_do_rcv+0x612/0x8d0 net/ipv4/tcp_ipv4.c:1712 sk_backlog_rcv include/net/sock.h:1030 [inline] __release_sock+0x134/0x3b0 net/core/sock.c:2768 release_sock+0x54/0x1b0 net/core/sock.c:3300 tcp_sendmsg+0x36/0x40 net/ipv4/tcp.c:1441 inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 sock_write_iter+0x289/0x3c0 net/socket.c:1057 call_write_iter include/linux/fs.h:2162 [inline] new_sync_write+0x429/0x660 fs/read_write.c:503 vfs_write+0x7cd/0xae0 fs/read_write.c:590 ksys_write+0x1ee/0x250 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae The buggy address belongs to the object at ffff88807f1cb700 which belongs to the cache ip_dst_cache of size 176 The buggy address is located 58 bytes inside of 176-byte region [ffff88807f1cb700, ffff88807f1cb7b0) The buggy address belongs to the page: page:ffffea0001fc72c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f1cb flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 dead000000000100 dead000000000122 ffff8881413bb780 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL), pid 5, ts 108466983062, free_ts 108048976062 prep_new_page mm/page_alloc.c:2418 [inline] get_page_from_freelist+0xa72/0x2f50 mm/page_alloc.c:4149 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5369 alloc_pages+0x1a7/0x300 mm/mempolicy.c:2191 alloc_slab_page mm/slub.c:1793 [inline] allocate_slab mm/slub.c:1930 [inline] new_slab+0x32d/0x4a0 mm/slub.c:1993 ___slab_alloc+0x918/0xfe0 mm/slub.c:3022 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3109 slab_alloc_node mm/slub.c:3200 [inline] slab_alloc mm/slub.c:3242 [inline] kmem_cache_alloc+0x35c/0x3a0 mm/slub.c:3247 dst_alloc+0x146/0x1f0 net/core/dst.c:92 rt_dst_alloc+0x73/0x430 net/ipv4/route.c:1613 __mkroute_output net/ipv4/route.c:2564 [inline] ip_route_output_key_hash_rcu+0x921/0x2d00 net/ipv4/route.c:2791 ip_route_output_key_hash+0x18b/0x300 net/ipv4/route.c:2619 __ip_route_output_key include/net/route.h:126 [inline] ip_route_output_flow+0x23/0x150 net/ipv4/route.c:2850 ip_route_output_key include/net/route.h:142 [inline] geneve_get_v4_rt+0x3a6/0x830 drivers/net/geneve.c:809 geneve_xmit_skb drivers/net/geneve.c:899 [inline] geneve_xmit+0xc4a/0x3540 drivers/net/geneve.c:1082 __netdev_start_xmit include/linux/netdevice.h:4994 [inline] netdev_start_xmit include/linux/netdevice.h:5008 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x1eb/0x920 net/core/dev.c:3606 __dev_queue_xmit+0x299a/0x3650 net/core/dev.c:4229 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1338 [inline] free_pcp_prepare+0x374/0x870 mm/page_alloc.c:1389 free_unref_page_prepare mm/page_alloc.c:3309 [inline] free_unref_page+0x19/0x690 mm/page_alloc.c:3388 qlink_free mm/kasan/quarantine.c:146 [inline] qlist_free_all+0x5a/0xc0 mm/kasan/quarantine.c:165 kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:272 __kasan_slab_alloc+0xa2/0xc0 mm/kasan/common.c:444 kasan_slab_alloc include/linux/kasan.h:259 [inline] slab_post_alloc_hook mm/slab.h:519 [inline] slab_alloc_node mm/slub.c:3234 [inline] kmem_cache_alloc_node+0x255/0x3f0 mm/slub.c:3270 __alloc_skb+0x215/0x340 net/core/skbuff.c:414 alloc_skb include/linux/skbuff.h:1126 [inline] alloc_skb_with_frags+0x93/0x620 net/core/skbuff.c:6078 sock_alloc_send_pskb+0x783/0x910 net/core/sock.c:2575 mld_newpack+0x1df/0x770 net/ipv6/mcast.c:1754 add_grhead+0x265/0x330 net/ipv6/mcast.c:1857 add_grec+0x1053/0x14e0 net/ipv6/mcast.c:1995 mld_send_initial_cr.part.0+0xf6/0x230 net/ipv6/mcast.c:2242 mld_send_initial_cr net/ipv6/mcast.c:1232 [inline] mld_dad_work+0x1d3/0x690 net/ipv6/mcast.c:2268 process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298 worker_thread+0x658/0x11f0 kernel/workqueue.c:2445 Memory state around the buggy address: ffff88807f1cb600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807f1cb680: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc >ffff88807f1cb700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88807f1cb780: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc ffff88807f1cb800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fixes: 41063e9dd119 ("ipv4: Early TCP socket demux.") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20211220143330.680945-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Conflict: include/net/sock.h net/ipv4/tcp_ipv4.c net/ipv6/tcp_ipv6.c net/ipv6/udp.c Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/net/sock.h | 2 +- net/ipv4/af_inet.c | 2 +- net/ipv4/tcp.c | 3 +-- net/ipv4/tcp_input.c | 2 +- net/ipv4/tcp_ipv4.c | 11 +++++++---- net/ipv4/udp.c | 6 +++--- net/ipv6/tcp_ipv6.c | 11 +++++++---- net/ipv6/udp.c | 4 ++-- 8 files changed, 23 insertions(+), 18 deletions(-) diff --git a/include/net/sock.h b/include/net/sock.h index af73dda0285b..7d068cf871a3 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -429,7 +429,7 @@ struct sock { #ifdef CONFIG_XFRM struct xfrm_policy __rcu *sk_policy[2]; #endif - struct dst_entry *sk_rx_dst; + struct dst_entry __rcu *sk_rx_dst; struct dst_entry __rcu *sk_dst_cache; atomic_t sk_omem_alloc; int sk_sndbuf; diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index 8bf43ca7139a..911ad595dbb9 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -158,7 +158,7 @@ void inet_sock_destruct(struct sock *sk) kfree(rcu_dereference_protected(inet->inet_opt, 1)); dst_release(rcu_dereference_protected(sk->sk_dst_cache, 1)); - dst_release(sk->sk_rx_dst); + dst_release(rcu_dereference_protected(sk->sk_rx_dst, 1)); sk_refcnt_debug_dec(sk); } EXPORT_SYMBOL(inet_sock_destruct); diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index fcd792816756..c19428e97876 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -2814,8 +2814,7 @@ int tcp_disconnect(struct sock *sk, int flags) icsk->icsk_ack.rcv_mss = TCP_MIN_MSS; memset(&tp->rx_opt, 0, sizeof(tp->rx_opt)); __sk_dst_reset(sk); - dst_release(sk->sk_rx_dst); - sk->sk_rx_dst = NULL; + dst_release(xchg((__force struct dst_entry **)&sk->sk_rx_dst, NULL)); tcp_saved_syn_free(tp); tp->compressed_ack = 0; tp->segs_in = 0; diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 11f3f8e23a8a..6f4ac0f10f57 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -5744,7 +5744,7 @@ void tcp_rcv_established(struct sock *sk, struct sk_buff *skb) trace_tcp_probe(sk, skb); tcp_mstamp_refresh(tp); - if (unlikely(!sk->sk_rx_dst)) + if (unlikely(!rcu_access_pointer(sk->sk_rx_dst))) inet_csk(sk)->icsk_af_ops->sk_rx_dst_set(sk, skb); /* * Header prediction. diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index ebfeeeadd47c..078f3a5d65b3 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -1670,15 +1670,18 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb) struct sock *rsk; if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */ - struct dst_entry *dst = sk->sk_rx_dst; + struct dst_entry *dst; + + dst = rcu_dereference_protected(sk->sk_rx_dst, + lockdep_sock_is_held(sk)); sock_rps_save_rxhash(sk, skb); sk_mark_napi_id(sk, skb); if (dst) { if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif || !dst->ops->check(dst, 0)) { + RCU_INIT_POINTER(sk->sk_rx_dst, NULL); dst_release(dst); - sk->sk_rx_dst = NULL; } } tcp_rcv_established(sk, skb); @@ -1753,7 +1756,7 @@ int tcp_v4_early_demux(struct sk_buff *skb) skb->sk = sk; skb->destructor = sock_edemux; if (sk_fullsock(sk)) { - struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst); + struct dst_entry *dst = rcu_dereference(sk->sk_rx_dst); if (dst) dst = dst_check(dst, 0); @@ -2160,7 +2163,7 @@ void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb) struct dst_entry *dst = skb_dst(skb); if (dst && dst_hold_safe(dst)) { - sk->sk_rx_dst = dst; + rcu_assign_pointer(sk->sk_rx_dst, dst); inet_sk(sk)->rx_dst_ifindex = skb->skb_iif; } } diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 8cca8bda0612..121c08d4255c 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -2186,7 +2186,7 @@ bool udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst) struct dst_entry *old; if (dst_hold_safe(dst)) { - old = xchg(&sk->sk_rx_dst, dst); + old = xchg((__force struct dst_entry **)&sk->sk_rx_dst, dst); dst_release(old); return old != dst; } @@ -2376,7 +2376,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, struct dst_entry *dst = skb_dst(skb); int ret; - if (unlikely(sk->sk_rx_dst != dst)) + if (unlikely(rcu_dereference(sk->sk_rx_dst) != dst)) udp_sk_rx_dst_set(sk, dst); ret = udp_unicast_rcv_skb(sk, skb, uh); @@ -2535,7 +2535,7 @@ int udp_v4_early_demux(struct sk_buff *skb) skb->sk = sk; skb->destructor = sock_efree; - dst = READ_ONCE(sk->sk_rx_dst); + dst = rcu_dereference(sk->sk_rx_dst); if (dst) dst = dst_check(dst, 0); diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index df33145b876c..b87b04526e65 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -107,7 +107,7 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb) if (dst && dst_hold_safe(dst)) { const struct rt6_info *rt = (const struct rt6_info *)dst; - sk->sk_rx_dst = dst; + rcu_assign_pointer(sk->sk_rx_dst, dst); inet_sk(sk)->rx_dst_ifindex = skb->skb_iif; tcp_inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt); } @@ -1482,15 +1482,18 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) opt_skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC)); if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */ - struct dst_entry *dst = sk->sk_rx_dst; + struct dst_entry *dst; + + dst = rcu_dereference_protected(sk->sk_rx_dst, + lockdep_sock_is_held(sk)); sock_rps_save_rxhash(sk, skb); sk_mark_napi_id(sk, skb); if (dst) { if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif || dst->ops->check(dst, np->rx_dst_cookie) == NULL) { + RCU_INIT_POINTER(sk->sk_rx_dst, NULL); dst_release(dst); - sk->sk_rx_dst = NULL; } } @@ -1842,7 +1845,7 @@ INDIRECT_CALLABLE_SCOPE void tcp_v6_early_demux(struct sk_buff *skb) skb->sk = sk; skb->destructor = sock_edemux; if (sk_fullsock(sk)) { - struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst); + struct dst_entry *dst = rcu_dereference(sk->sk_rx_dst); if (dst) dst = dst_check(dst, tcp_inet6_sk(sk)->rx_dst_cookie); diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index 503706397839..7022dcbb5a11 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -940,7 +940,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, struct dst_entry *dst = skb_dst(skb); int ret; - if (unlikely(sk->sk_rx_dst != dst)) + if (unlikely(rcu_dereference(sk->sk_rx_dst) != dst)) udp6_sk_rx_dst_set(sk, dst); if (!uh->check && !udp_sk(sk)->no_check6_rx) { @@ -1054,7 +1054,7 @@ INDIRECT_CALLABLE_SCOPE void udp_v6_early_demux(struct sk_buff *skb) skb->sk = sk; skb->destructor = sock_efree; - dst = READ_ONCE(sk->sk_rx_dst); + dst = rcu_dereference(sk->sk_rx_dst); if (dst) dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie); -- 2.20.1

1 49

[PATCH openEuler-5.10 0/7] Backport 5.10.105 LTS
by Zheng Zengkai 31 May '22

31 May '22

Backport 5.10.105 LTS patches from upstream Revert "ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE" arm64: cpufeature: add HWCAP for FEAT_RPRES arm64: cpufeature: add HWCAP for FEAT_AFP arm64: Add Cortex-A510 CPU part definition arm64: Add Cortex-X2 CPU part definition arm64: Add Neoverse-N2, Cortex-A710 CPU part definition arm64: cputype: Add CPU implementor & types for the Apple M1 cores Conflicts: Revert "ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE" arm64: Add Cortex-X2 CPU part definition Anshuman Khandual (2): arm64: Add Cortex-X2 CPU part definition arm64: Add Cortex-A510 CPU part definition Greg Kroah-Hartman (1): Revert "ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE" Hector Martin (1): arm64: cputype: Add CPU implementor & types for the Apple M1 cores Joey Gouly (2): arm64: cpufeature: add HWCAP for FEAT_AFP arm64: cpufeature: add HWCAP for FEAT_RPRES Suzuki K Poulose (1): arm64: Add Neoverse-N2, Cortex-A710 CPU part definition Documentation/arm64/cpu-feature-registers.rst | 17 +++++++++++++++++ Documentation/arm64/elf_hwcaps.rst | 8 ++++++++ arch/arm64/include/asm/cputype.h | 14 ++++++++++++++ arch/arm64/include/asm/hwcap.h | 2 ++ arch/arm64/include/asm/sysreg.h | 1 + arch/arm64/include/uapi/asm/hwcap.h | 2 ++ arch/arm64/kernel/cpufeature.c | 4 ++++ arch/arm64/kernel/cpuinfo.c | 2 ++ drivers/acpi/ec.c | 10 ---------- drivers/acpi/sleep.c | 14 ++++++++++---- 10 files changed, 60 insertions(+), 14 deletions(-) -- 2.20.1

1 7

Re:[PATCH OLK-5.10] config: change CONFIG_DMATEST from y to m
by 焦芬芳 30 May '22

30 May '22

hi, all      Reviewed-by, "jiaofenfang"<jiaofenfang(a)uniontech.com>     ------------------ Original ------------------ From:  "Chao Liu"<liuchao173(a)huawei.com>gt;; Date:  Sat, May 28, 2022 03:47 PM To:  "kernel"<kernel(a)openeuler.org>gt;; Cc:  "hewenliang4"<hewenliang4(a)huawei.com>gt;; "fangchuangchuang"<fangchuangchuang(a)huawei.com>gt;; "xiexiuqi"<xiexiuqi(a)huawei.com>gt;; "zhengzengkai"<zhengzengkai(a)huawei.com>gt;; "kai.liu"<kai.liu(a)suse.com>gt;; "jiaofenfang"<jiaofenfang(a)uniontech.com>gt;; "yinxiujiang"<yinxiujiang(a)kylinos.cn>gt;; Subject:  [PATCH OLK-5.10] config: change CONFIG_DMATEST from y to m   euler inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I59Q07 CVE: NA -------------------------------- Simple DMA test client. Say N unless you're debugging a DMA Device driver. It doesn't need to be compiled into the vmlinux, change it to m. Signed-off-by: Chao Liu <liuchao173(a)huawei.com> ---  arch/x86/configs/openeuler_defconfig | 2 +-  1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 61c4be815462..f9c94b618ad4 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -6370,7 +6370,7 @@ CONFIG_HSU_DMA=y  # DMA Clients  #  CONFIG_ASYNC_TX_DMA=y -CONFIG_DMATEST=y +CONFIG_DMATEST=m  CONFIG_DMA_ENGINE_RAID=y    # -- 2.23.0

1 0

[PATCH OLK-5.10] config: change CONFIG_DMATEST from y to m
by Chao Liu 30 May '22

30 May '22

euler inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I59Q07 CVE: NA -------------------------------- Simple DMA test client. Say N unless you're debugging a DMA Device driver. It doesn't need to be compiled into the vmlinux, change it to m. Signed-off-by: Chao Liu <liuchao173(a)huawei.com> --- arch/x86/configs/openeuler_defconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 61c4be815462..f9c94b618ad4 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -6370,7 +6370,7 @@ CONFIG_HSU_DMA=y # DMA Clients # CONFIG_ASYNC_TX_DMA=y -CONFIG_DMATEST=y +CONFIG_DMATEST=m CONFIG_DMA_ENGINE_RAID=y # -- 2.23.0

3 2

[PATCH openEuler-5.10 1/8] Revert "audit: bugfix for infinite loop when flush the hold queue"
by Zheng Zengkai 28 May '22

28 May '22

From: Cui GaoSheng <cuigaosheng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186383 https://gitee.com/openeuler/kernel/issues/I4X1AI?from=project-issue CVE: NA backport: openEuler-22.03-LTS -------------------------------- This reverts commit fcfdde9cfc503cfd191b7286f9c48077fb5bf420. Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- kernel/audit.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/kernel/audit.c b/kernel/audit.c index 21be62bc8205..2a38cbaf3ddb 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -732,8 +732,6 @@ static int kauditd_send_queue(struct sock *sk, u32 portid, if (!sk) { if (err_hook) (*err_hook)(skb); - if (queue == &audit_hold_queue) - goto out; continue; } @@ -750,8 +748,6 @@ static int kauditd_send_queue(struct sock *sk, u32 portid, (*err_hook)(skb); if (rc == -EAGAIN) rc = 0; - if (queue == &audit_hold_queue) - goto out; /* continue to drain the queue */ continue; } else @@ -763,7 +759,6 @@ static int kauditd_send_queue(struct sock *sk, u32 portid, } } -out: return (rc >= 0 ? 0 : rc); } -- 2.20.1

1 7

2024

2023

2022

2021

2020

2019