- Kernel - mailweb.openeuler.org

[PATCH 1/2] arm64/mpam: Fix unreset resources when mkdir ctrl group or umount resctrl
by Yang Yingliang 01 Jun '20

01 Jun '20

From: Wang ShaoBo <bobo.shaobowang(a)huawei.com> hulk inclusion category: bugfix bugzilla: 34588 CVE: NA ----------------------------------------------- There are two problems related to schemata: 1) When rmdir a group and then mkdir a new group under resctrl root directory, the new group still inherits the schemata configuration from old. e.g. > mount -t resctrl resctrl /sys/fs/resctrl > cd /sys/fs/resctrl > mkdir p1 && cd p1 > echo 'L3:0=7f' > schemata > cd .. && rmdir p1 && mkdir p1 && cd p1 > cat schemata L3:0=7f;1=7fff;2=7fff;3=7fff MB:0=100;1=100;2=100;3=100 2) It still exists when umount /sys/fs/resctrl and remount. e.g. > mount -t resctrl resctrl /sys/fs/resctrl > cd /sys/fs/resctrl > echo 'L3:0=7f' > schemata > umount /sys/fs/resctrl > mount -t resctrl resctrl /sys/fs/resctrl > cat schemata L3:0=7f;1=7fff;2=7fff;3=7fff MB:0=100;1=100;2=100;3=100 Firstly we make each resctrl resource obtains their corresponding default configuration. NOTE we use zero to initialize L3 default value instead of max cpbm bits, as zero configurarion equals to maximum configuration for L3 MSCs. And we use max-percentage masks of max bandwidth to generate maximum configuration for MB. Then we reset resources' configuration settings to default value and back MSCs to default state, when mkdir or umount happended. Fixes: caf75b6b2540 ("resctrlfs: mpam: init struct for mpam") Fixes: 916dd9321e3c ("resctrlfs: init support resctrlfs") Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/include/asm/mpam_resource.h | 4 ++++ arch/arm64/include/asm/resctrl.h | 2 ++ arch/arm64/kernel/mpam.c | 17 +++++++++++++++++ arch/arm64/kernel/mpam_ctrlmon.c | 28 ++++++++++++++++++++++++++++ fs/resctrlfs.c | 5 +++++ 5 files changed, 56 insertions(+) diff --git a/arch/arm64/include/asm/mpam_resource.h b/arch/arm64/include/asm/mpam_resource.h index ab90596..1a6904c 100644 --- a/arch/arm64/include/asm/mpam_resource.h +++ b/arch/arm64/include/asm/mpam_resource.h @@ -89,6 +89,10 @@ /* [FIXME] hard code for hardlim */ #define MBW_MAX_SET(v) (MBW_MAX_HARDLIM|((v) << (16 - BWA_WD))) #define MBW_MAX_GET(v) (((v) & MBW_MAX_MASK) >> (16 - BWA_WD)) + +/* hard code for mbw_max max-percentage's cresponding masks */ +#define MBA_MAX_WD 63u + /* * emulate the mpam nodes * These should be reported by ACPI MPAM Table. diff --git a/arch/arm64/include/asm/resctrl.h b/arch/arm64/include/asm/resctrl.h index 0a0a12b..fb5fa6c 100644 --- a/arch/arm64/include/asm/resctrl.h +++ b/arch/arm64/include/asm/resctrl.h @@ -65,4 +65,6 @@ int mkdir_mondata_all(struct kernfs_node *parent_kn, mongroup_create_dir(struct kernfs_node *parent_kn, struct resctrl_group *prgrp, char *name, struct kernfs_node **dest_kn); +int rdtgroup_init_alloc(struct rdtgroup *rdtgrp); + #endif /* _ASM_ARM64_RESCTRL_H */ diff --git a/arch/arm64/kernel/mpam.c b/arch/arm64/kernel/mpam.c index 202e49a..120795e 100644 --- a/arch/arm64/kernel/mpam.c +++ b/arch/arm64/kernel/mpam.c @@ -86,6 +86,9 @@ static inline void mpam_node_assign_val(struct mpam_node *n, n->addr = hwpage_address; n->component_id = component_id; n->cpus_list = "0"; + + if (n->type == MPAM_RESOURCE_MC) + n->default_ctrl = MBA_MAX_WD; } #define MPAM_NODE_NAME_SIZE (10) @@ -544,6 +547,20 @@ void post_resctrl_mount(void) static int reset_all_ctrls(struct resctrl_resource *r) { + struct raw_resctrl_resource *rr; + struct rdt_domain *d; + int partid; + + rr = (struct raw_resctrl_resource *)r->res; + for (partid = 0; partid < rr->num_partid; partid++) { + list_for_each_entry(d, &r->domains, list) { + d->new_ctrl = rr->default_ctrl; + d->ctrl_val[partid] = rr->default_ctrl; + d->have_new_ctrl = true; + rr->msr_update(d, partid); + } + } + return 0; } diff --git a/arch/arm64/kernel/mpam_ctrlmon.c b/arch/arm64/kernel/mpam_ctrlmon.c index b9f9495..2b94efc 100644 --- a/arch/arm64/kernel/mpam_ctrlmon.c +++ b/arch/arm64/kernel/mpam_ctrlmon.c @@ -585,3 +585,31 @@ int resctrl_mkdir_ctrlmon_mondata(struct kernfs_node *parent_kn, } return ret; } + +/* Initialize the RDT group's allocations. */ +int rdtgroup_init_alloc(struct rdtgroup *rdtgrp) +{ + struct resctrl_resource *r; + struct raw_resctrl_resource *rr; + struct rdt_domain *d; + int ret; + + for_each_resctrl_resource(r) { + if (!r->alloc_enabled) + continue; + + rr = (struct raw_resctrl_resource *)r->res; + list_for_each_entry(d, &r->domains, list) { + d->new_ctrl = rr->default_ctrl; + d->have_new_ctrl = true; + } + + ret = update_domains(r, rdtgrp); + if (ret < 0) { + rdt_last_cmd_puts("Failed to initialize allocations\n"); + return ret; + } + } + + return 0; +} diff --git a/fs/resctrlfs.c b/fs/resctrlfs.c index 09e56384..8d463b8 100644 --- a/fs/resctrlfs.c +++ b/fs/resctrlfs.c @@ -670,6 +670,11 @@ static int resctrl_group_mkdir_ctrl_mon(struct kernfs_node *parent_kn, ret = 0; rdtgrp->closid = closid; + + ret = rdtgroup_init_alloc(rdtgrp); + if (ret < 0) + goto out_id_free; + list_add(&rdtgrp->resctrl_group_list, &resctrl_all_groups); if (resctrl_mon_capable) { -- 1.8.3

1 1

[PATCH] ext4: report error to userspace by netlink
by Yang Yingliang 01 Jun '20

01 Jun '20

From: Zhao Minmin <zhaominmin1(a)huawei.com> hulk inclusion category: feature bugzilla: 34592 CVE: NA ------------------------------------------------- Implement the ext3/ext4 file system error report. This patch is used to implement abnormal alarm of ext3/ext4 filesystem. You can archieve this by setting "FILESYSTEM_MONITOR" or "FILESYSTEM_ALARM" on in configuration file. With this setting, alarm will be raised when ext3/ext4 file system expection occurs. Signed-off-by: Zhao Minmin <zhaominmin1(a)huawei.com> Reviewed-by: Yi Zhang <yi.zhang(a)huawei.com> Link: http://hulk.huawei.com/pipermail/kernel.openeuler/2016-March/009711.html Signed-off-by: Wang Hui <john.wanghui(a)huawei.com> Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> [yebin: cherry-pick this patch from redhat-7.5, commit 13848b1856c1] Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Wenan Mao <maowenan(a)huawei.com> Reviewed-by: Yi Zhang <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/ext4/ext4.h | 9 ++++++++ fs/ext4/super.c | 51 ++++++++++++++++++++++++++++++++++++++++++++ include/uapi/linux/netlink.h | 1 + 3 files changed, 61 insertions(+) diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h index b1bcc6e..83bec07 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -54,6 +54,15 @@ #endif #endif +#define NL_EXT4_ERROR_GROUP 1 +#define EXT4_ERROR_MAGIC 0xAE32014U +struct ext4_err_msg { + int magic; + char s_id[32]; + unsigned long s_flags; + int ext4_errno; +}; + /* * The fourth extended filesystem constants/structures */ diff --git a/fs/ext4/super.c b/fs/ext4/super.c index bd6c1cf..33f1e7c 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -54,6 +54,10 @@ #include "mballoc.h" #include "fsmap.h" +#include <uapi/linux/netlink.h> +#include <net/sock.h> +#include <net/net_namespace.h> + #define CREATE_TRACE_POINTS #include <trace/events/ext4.h> @@ -84,6 +88,8 @@ static struct dentry *ext4_mount(struct file_system_type *fs_type, int flags, static void ext4_clear_request_list(void); static struct inode *ext4_get_journal_inode(struct super_block *sb, unsigned int journal_inum); +static void ext4_netlink_send_info(struct super_block *sb, int ext4_errno); +static struct sock *ext4nl; /* * Lock ordering @@ -439,6 +445,42 @@ static bool system_going_down(void) || system_state == SYSTEM_RESTART; } +static void ext4_netlink_send_info(struct super_block *sb, int ext4_errno) +{ + int size; + sk_buff_data_t old_tail; + struct sk_buff *skb; + struct nlmsghdr *nlh; + struct ext4_err_msg *msg; + + if (ext4nl) { + size = NLMSG_SPACE(sizeof(struct ext4_err_msg)); + skb = alloc_skb(size, GFP_ATOMIC); + if (!skb) { + printk(KERN_ERR "Cannot alloc skb!"); + return; + } + old_tail = skb->tail; + nlh = nlmsg_put(skb, 0, 0, NLMSG_ERROR, size - sizeof(*nlh), 0); + if (!nlh) + goto nlmsg_failure; + msg = (struct ext4_err_msg *)NLMSG_DATA(nlh); + msg->magic = EXT4_ERROR_MAGIC; + memcpy(msg->s_id, sb->s_id, sizeof(sb->s_id)); + msg->s_flags = sb->s_flags; + msg->ext4_errno = ext4_errno; + nlh->nlmsg_len = skb->tail - old_tail; + NETLINK_CB(skb).portid = 0; + NETLINK_CB(skb).dst_group = NL_EXT4_ERROR_GROUP; + netlink_broadcast(ext4nl, skb, 0, NL_EXT4_ERROR_GROUP, + GFP_ATOMIC); + return; +nlmsg_failure: + if (skb) + kfree_skb(skb); + } +} + /* Deal with the reporting of failure conditions on a filesystem such as * inconsistencies detected or read IO failures. * @@ -469,6 +511,9 @@ static void ext4_handle_error(struct super_block *sb) if (journal) jbd2_journal_abort(journal, -EIO); } + + ext4_netlink_send_info(sb, 1); + /* * We force ERRORS_RO behavior when system is rebooting. Otherwise we * could panic during 'reboot -f' as the underlying device got already @@ -700,6 +745,7 @@ void __ext4_abort(struct super_block *sb, const char *function, if (EXT4_SB(sb)->s_journal) jbd2_journal_abort(EXT4_SB(sb)->s_journal, -EIO); save_error_info(sb, function, line); + ext4_netlink_send_info(sb, 2); } if (test_opt(sb, ERRORS_PANIC) && !system_going_down()) { if (EXT4_SB(sb)->s_journal && @@ -6063,6 +6109,7 @@ static inline int ext3_feature_set_ok(struct super_block *sb) static int __init ext4_init_fs(void) { int i, err; + struct netlink_kernel_cfg cfg = {.groups = NL_EXT4_ERROR_GROUP,}; ratelimit_state_init(&ext4_mount_msg_ratelimit, 30 * HZ, 64); ext4_li_info = NULL; @@ -6102,6 +6149,9 @@ static int __init ext4_init_fs(void) if (err) goto out; + ext4nl = netlink_kernel_create(&init_net, NETLINK_FILESYSTEM, &cfg); + if (!ext4nl) + printk(KERN_ERR "EXT4-fs: Cannot create netlink socket.\n"); return 0; out: unregister_as_ext2(); @@ -6133,6 +6183,7 @@ static void __exit ext4_exit_fs(void) ext4_exit_system_zone(); ext4_exit_pageio(); ext4_exit_es(); + netlink_kernel_release(ext4nl); } MODULE_AUTHOR("Remy Card, Stephen Tweedie, Andrew Morton, Andreas Dilger, Theodore Ts'o and others"); diff --git a/include/uapi/linux/netlink.h b/include/uapi/linux/netlink.h index 776bc92..ecaefee 100644 --- a/include/uapi/linux/netlink.h +++ b/include/uapi/linux/netlink.h @@ -29,6 +29,7 @@ #define NETLINK_RDMA 20 #define NETLINK_CRYPTO 21 /* Crypto layer */ #define NETLINK_SMC 22 /* SMC monitoring */ +#define NETLINK_FILESYSTEM 28 /* filesystem alarm*/ #define NETLINK_INET_DIAG NETLINK_SOCK_DIAG -- 1.8.3

1 0

[PATCH 1/3] Added ethtool_ops interface to query optical module information
by Yang Yingliang 01 Jun '20

01 Jun '20

From: Chiqijun <chiqijun(a)huawei.com> driver inclusion category: feature bugzilla: 4472 ----------------------------------------------------------------------- Obtaining optical module information is time-consuming. If the user frequently acquires, it will affect the firmware to process other commands. To prevent such events, the firmware will actively report the optical module information to the driver when it is idle. Obtained from the driver cache information. When the user obtains through the command, directly obtain from the information saved by the driver. Signed-off-by: Chiqijun <chiqijun(a)huawei.com> Reviewed-by: Luoshaokai <luoshaokai(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/ethernet/huawei/hinic/hinic_ethtool.c | 77 ++++++++++ drivers/net/ethernet/huawei/hinic/hinic_hw.h | 54 +++++++ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c | 168 +++++++++++++++++++++ drivers/net/ethernet/huawei/hinic/hinic_lld.c | 2 + .../ethernet/huawei/hinic/hinic_mgmt_interface.h | 12 ++ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c | 139 ++++++++++++++++- drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.h | 2 + drivers/net/ethernet/huawei/hinic/hinic_nic_io.c | 11 +- drivers/net/ethernet/huawei/hinic/hinic_port_cmd.h | 3 + 9 files changed, 465 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_ethtool.c b/drivers/net/ethernet/huawei/hinic/hinic_ethtool.c index f321365..78d32ea 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_ethtool.c @@ -2039,6 +2039,74 @@ static void hinic_diag_test(struct net_device *netdev, hinic_lp_test(netdev, eth_test, data, 0); } +#ifdef ETHTOOL_GMODULEEEPROM +static int hinic_get_module_info(struct net_device *netdev, + struct ethtool_modinfo *modinfo) +{ + struct hinic_nic_dev *nic_dev = netdev_priv(netdev); + u8 sfp_type; + u8 sfp_type_ext; + int err; + + err = hinic_get_sfp_type(nic_dev->hwdev, &sfp_type, &sfp_type_ext); + if (err) + return err; + + switch (sfp_type) { + case MODULE_TYPE_SFP: + modinfo->type = ETH_MODULE_SFF_8472; + modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN; + break; + case MODULE_TYPE_QSFP: + modinfo->type = ETH_MODULE_SFF_8436; + modinfo->eeprom_len = STD_SFP_INFO_MAX_SIZE; + break; + case MODULE_TYPE_QSFP_PLUS: + if (sfp_type_ext >= 0x3) { + modinfo->type = ETH_MODULE_SFF_8636; + modinfo->eeprom_len = STD_SFP_INFO_MAX_SIZE; + + } else { + modinfo->type = ETH_MODULE_SFF_8436; + modinfo->eeprom_len = STD_SFP_INFO_MAX_SIZE; + } + break; + case MODULE_TYPE_QSFP28: + modinfo->type = ETH_MODULE_SFF_8636; + modinfo->eeprom_len = STD_SFP_INFO_MAX_SIZE; + break; + default: + nicif_warn(nic_dev, drv, netdev, + "Optical module unknown: 0x%x\n", sfp_type); + return -EINVAL; + } + + return 0; +} + +static int hinic_get_module_eeprom(struct net_device *netdev, + struct ethtool_eeprom *ee, u8 *data) +{ + struct hinic_nic_dev *nic_dev = netdev_priv(netdev); + u8 sfp_data[STD_SFP_INFO_MAX_SIZE]; + u16 len; + int err; + + if (!ee->len || ((ee->len + ee->offset) > STD_SFP_INFO_MAX_SIZE)) + return -EINVAL; + + memset(data, 0, ee->len); + + err = hinic_get_sfp_eeprom(nic_dev->hwdev, sfp_data, &len); + if (err) + return err; + + memcpy(data, sfp_data + ee->offset, ee->len); + + return 0; +} +#endif /* ETHTOOL_GMODULEEEPROM */ + static int set_l4_rss_hash_ops(struct ethtool_rxnfc *cmd, struct nic_rss_type *rss_type) { @@ -2532,6 +2600,10 @@ static int hinic_set_rxfh_indir(struct net_device *netdev, const u32 *indir) #ifndef HAVE_RHEL6_ETHTOOL_OPS_EXT_STRUCT .get_channels = hinic_get_channels, .set_channels = hinic_set_channels, +#ifdef ETHTOOL_GMODULEEEPROM + .get_module_info = hinic_get_module_info, + .get_module_eeprom = hinic_get_module_eeprom, +#endif #ifndef NOT_HAVE_GET_RXFH_INDIR_SIZE .get_rxfh_indir_size = hinic_get_rxfh_indir_size, #endif @@ -2552,6 +2624,11 @@ static int hinic_set_rxfh_indir(struct net_device *netdev, const u32 *indir) .set_phys_id = hinic_set_phys_id, .get_channels = hinic_get_channels, .set_channels = hinic_set_channels, +#ifdef ETHTOOL_GMODULEEEPROM + .get_module_info = hinic_get_module_info, + .get_module_eeprom = hinic_get_module_eeprom, +#endif + #ifndef NOT_HAVE_GET_RXFH_INDIR_SIZE .get_rxfh_indir_size = hinic_get_rxfh_indir_size, #endif diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw.h b/drivers/net/ethernet/huawei/hinic/hinic_hw.h index e489a00..d4becb6 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_hw.h +++ b/drivers/net/ethernet/huawei/hinic/hinic_hw.h @@ -264,6 +264,56 @@ struct hinic_init_para { #define INIT_SUCCESS 1 #define MAX_DRV_BUF_SIZE 4096 +struct hinic_cmd_get_light_module_abs { + u8 status; + u8 version; + u8 rsvd0[6]; + + u8 port_id; + u8 abs_status; /* 0:present, 1:absent */ + u8 rsv[2]; +}; + +#define MODULE_TYPE_SFP 0x3 +#define MODULE_TYPE_QSFP28 0x11 +#define MODULE_TYPE_QSFP 0x0C +#define MODULE_TYPE_QSFP_PLUS 0x0D + +#define SFP_INFO_MAX_SIZE 512 +struct hinic_cmd_get_sfp_qsfp_info { + u8 status; + u8 version; + u8 rsvd0[6]; + + u8 port_id; + u8 wire_type; + u16 out_len; + u8 sfp_qsfp_info[SFP_INFO_MAX_SIZE]; +}; + +#define STD_SFP_INFO_MAX_SIZE 640 +struct hinic_cmd_get_std_sfp_info { + u8 status; + u8 version; + u8 rsvd0[6]; + + u8 port_id; + u8 wire_type; + u16 eeprom_len; + u32 rsvd; + u8 sfp_info[STD_SFP_INFO_MAX_SIZE]; +}; + +#define HINIC_MAX_PORT_ID 4 + +struct hinic_port_routine_cmd { + int up_send_sfp_info; + int up_send_sfp_abs; + + struct hinic_cmd_get_sfp_qsfp_info sfp_info; + struct hinic_cmd_get_light_module_abs abs; +}; + struct card_node { struct list_head node; struct list_head func_list; @@ -282,6 +332,10 @@ struct card_node { bool disable_vf_load[HINIC_MAX_PF_NUM]; u32 vf_mbx_old_rand_id[MAX_FUNCTION_NUM]; u32 vf_mbx_rand_id[MAX_FUNCTION_NUM]; + struct hinic_port_routine_cmd rt_cmd[HINIC_MAX_PORT_ID]; + + /* mutex used for copy sfp info */ + struct mutex sfp_mutex; }; enum hinic_hwdev_init_state { diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hwdev.c b/drivers/net/ethernet/huawei/hinic/hinic_hwdev.c index 101b671..172be6c 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_hwdev.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_hwdev.c @@ -59,6 +59,8 @@ #define HINIC_OK_FLAG_FAILED 1 +#define HINIC_GET_SFP_INFO_REAL_TIME 0x1 + #define HINIC_GLB_SO_RO_CFG_SHIFT 0x0 #define HINIC_GLB_SO_RO_CFG_MASK 0x1 #define HINIC_DISABLE_ORDER 0 @@ -913,6 +915,80 @@ int hinic_pf_msg_to_mgmt_sync(void *hwdev, enum hinic_mod_type mod, u8 cmd, return err; } +static bool is_sfp_info_cmd_cached(struct hinic_hwdev *hwdev, + enum hinic_mod_type mod, u8 cmd, + void *buf_in, u16 in_size, + void *buf_out, u16 *out_size) +{ + struct hinic_cmd_get_sfp_qsfp_info *sfp_info = NULL; + struct hinic_port_routine_cmd *rt_cmd = NULL; + struct card_node *chip_node = hwdev->chip_node; + + sfp_info = buf_in; + if (sfp_info->port_id >= HINIC_MAX_PORT_ID || + *out_size < sizeof(*sfp_info)) + return false; + + if (sfp_info->version == HINIC_GET_SFP_INFO_REAL_TIME) + return false; + + rt_cmd = &chip_node->rt_cmd[sfp_info->port_id]; + mutex_lock(&chip_node->sfp_mutex); + memcpy(buf_out, &rt_cmd->sfp_info, sizeof(*sfp_info)); + mutex_unlock(&chip_node->sfp_mutex); + + return true; +} + +static bool is_sfp_abs_cmd_cached(struct hinic_hwdev *hwdev, + enum hinic_mod_type mod, u8 cmd, + void *buf_in, u16 in_size, + void *buf_out, u16 *out_size) +{ + struct hinic_cmd_get_light_module_abs *abs = NULL; + struct hinic_port_routine_cmd *rt_cmd = NULL; + struct card_node *chip_node = hwdev->chip_node; + + abs = buf_in; + if (abs->port_id >= HINIC_MAX_PORT_ID || + *out_size < sizeof(*abs)) + return false; + + if (abs->version == HINIC_GET_SFP_INFO_REAL_TIME) + return false; + + rt_cmd = &chip_node->rt_cmd[abs->port_id]; + mutex_lock(&chip_node->sfp_mutex); + memcpy(buf_out, &rt_cmd->abs, sizeof(*abs)); + mutex_unlock(&chip_node->sfp_mutex); + + return true; +} + +static bool driver_processed_cmd(struct hinic_hwdev *hwdev, + enum hinic_mod_type mod, u8 cmd, + void *buf_in, u16 in_size, + void *buf_out, u16 *out_size) +{ + struct card_node *chip_node = hwdev->chip_node; + + if (mod == HINIC_MOD_L2NIC) { + if (cmd == HINIC_PORT_CMD_GET_SFP_INFO && + chip_node->rt_cmd->up_send_sfp_info) { + return is_sfp_info_cmd_cached(hwdev, mod, cmd, buf_in, + in_size, buf_out, + out_size); + } else if (cmd == HINIC_PORT_CMD_GET_SFP_ABS && + chip_node->rt_cmd->up_send_sfp_abs) { + return is_sfp_abs_cmd_cached(hwdev, mod, cmd, buf_in, + in_size, buf_out, + out_size); + } + } + + return false; +} + int hinic_msg_to_mgmt_sync(void *hwdev, enum hinic_mod_type mod, u8 cmd, void *buf_in, u16 in_size, void *buf_out, u16 *out_size, u32 timeout) @@ -949,6 +1025,10 @@ int hinic_msg_to_mgmt_sync(void *hwdev, enum hinic_mod_type mod, u8 cmd, err = __func_send_mbox(hwdev, mod, cmd, buf_in, in_size, buf_out, out_size, timeout); } else { + if (driver_processed_cmd(hwdev, mod, cmd, buf_in, in_size, + buf_out, out_size)) + return 0; + do { if (!hinic_get_mgmt_channel_status(hwdev) || !hinic_get_chip_present_flag(hwdev)) @@ -3202,6 +3282,8 @@ enum hinic_event_cmd { HINIC_EVENT_MGMT_PCIE_DFX, HINIC_EVENT_MCTP_HOST_INFO, HINIC_EVENT_MGMT_HEARTBEAT_EHD, + HINIC_EVENT_SFP_INFO_REPORT, + HINIC_EVENT_SFP_ABS_REPORT, HINIC_EVENT_MAX_TYPE, }; @@ -3284,6 +3366,16 @@ struct hinic_event_convert { .cmd = HINIC_MGMT_CMD_HEARTBEAT_EVENT, .event = HINIC_EVENT_MGMT_HEARTBEAT_EHD, }, + { + .mod = HINIC_MOD_L2NIC, + .cmd = HINIC_PORT_CMD_GET_SFP_INFO, + .event = HINIC_EVENT_SFP_INFO_REPORT, + }, + { + .mod = HINIC_MOD_L2NIC, + .cmd = HINIC_PORT_CMD_GET_SFP_ABS, + .event = HINIC_EVENT_SFP_ABS_REPORT, + }, }; static enum hinic_event_cmd __get_event_type(u8 mod, u8 cmd) @@ -3587,12 +3679,22 @@ static void module_status_event(struct hinic_hwdev *hwdev, struct hinic_cable_plug_event *plug_event; struct hinic_link_err_event *link_err; struct hinic_event_info event_info = {0}; + struct hinic_port_routine_cmd *rt_cmd; + struct card_node *chip_node = hwdev->chip_node; event_info.type = HINIC_EVENT_PORT_MODULE_EVENT; if (cmd == HINIC_EVENT_CABLE_PLUG) { plug_event = buf_in; + if (plug_event->port_id < HINIC_MAX_PORT_ID) { + rt_cmd = &chip_node->rt_cmd[plug_event->port_id]; + mutex_lock(&chip_node->sfp_mutex); + rt_cmd->up_send_sfp_abs = false; + rt_cmd->up_send_sfp_info = false; + mutex_unlock(&chip_node->sfp_mutex); + } + event_info.module_event.type = plug_event->plugged ? HINIC_PORT_MODULE_CABLE_PLUGGED : HINIC_PORT_MODULE_CABLE_UNPLUGGED; @@ -3733,6 +3835,64 @@ static void mgmt_watchdog_timeout_event_handler(struct hinic_hwdev *hwdev, queue_work(hwdev->workq, &hwdev->fault_work); } +static void port_sfp_info_event(struct hinic_hwdev *hwdev, void *buf_in, + u16 in_size, void *buf_out, u16 *out_size) +{ + struct hinic_cmd_get_sfp_qsfp_info *sfp_info = buf_in; + struct hinic_port_routine_cmd *rt_cmd; + struct card_node *chip_node = hwdev->chip_node; + + if (in_size != sizeof(*sfp_info)) { + sdk_err(hwdev->dev_hdl, "Invalid sfp info cmd, length: %d, should be %ld\n", + in_size, sizeof(*sfp_info)); + return; + } + + if (sfp_info->port_id >= HINIC_MAX_PORT_ID) { + sdk_err(hwdev->dev_hdl, "Invalid sfp port id: %d, max port is %d\n", + sfp_info->port_id, HINIC_MAX_PORT_ID - 1); + return; + } + + if (!chip_node->rt_cmd) + return; + + rt_cmd = &chip_node->rt_cmd[sfp_info->port_id]; + mutex_lock(&chip_node->sfp_mutex); + memcpy(&rt_cmd->sfp_info, sfp_info, sizeof(rt_cmd->sfp_info)); + rt_cmd->up_send_sfp_info = true; + mutex_unlock(&chip_node->sfp_mutex); +} + +static void port_sfp_abs_event(struct hinic_hwdev *hwdev, void *buf_in, + u16 in_size, void *buf_out, u16 *out_size) +{ + struct hinic_cmd_get_light_module_abs *sfp_abs = buf_in; + struct hinic_port_routine_cmd *rt_cmd; + struct card_node *chip_node = hwdev->chip_node; + + if (in_size != sizeof(*sfp_abs)) { + sdk_err(hwdev->dev_hdl, "Invalid sfp absent cmd, length: %d, should be %ld\n", + in_size, sizeof(*sfp_abs)); + return; + } + + if (sfp_abs->port_id >= HINIC_MAX_PORT_ID) { + sdk_err(hwdev->dev_hdl, "Invalid sfp port id: %d, max port is %d\n", + sfp_abs->port_id, HINIC_MAX_PORT_ID - 1); + return; + } + + if (!chip_node->rt_cmd) + return; + + rt_cmd = &chip_node->rt_cmd[sfp_abs->port_id]; + mutex_lock(&chip_node->sfp_mutex); + memcpy(&rt_cmd->abs, sfp_abs, sizeof(rt_cmd->abs)); + rt_cmd->up_send_sfp_abs = true; + mutex_unlock(&chip_node->sfp_mutex); +} + static void mgmt_reset_event_handler(struct hinic_hwdev *hwdev) { sdk_info(hwdev->dev_hdl, "Mgmt is reset\n"); @@ -4241,6 +4401,14 @@ static void _event_handler(struct hinic_hwdev *hwdev, enum hinic_event_cmd cmd, buf_out, out_size); break; + case HINIC_EVENT_SFP_INFO_REPORT: + port_sfp_info_event(hwdev, buf_in, in_size, buf_out, out_size); + break; + + case HINIC_EVENT_SFP_ABS_REPORT: + port_sfp_abs_event(hwdev, buf_in, in_size, buf_out, out_size); + break; + default: sdk_warn(hwdev->dev_hdl, "Unsupported event %d to process\n", cmd); diff --git a/drivers/net/ethernet/huawei/hinic/hinic_lld.c b/drivers/net/ethernet/huawei/hinic/hinic_lld.c index e8e446a..3bf47ac 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_lld.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_lld.c @@ -1990,6 +1990,8 @@ static int alloc_chip_node(struct hinic_pcidev *pci_adapter) INIT_LIST_HEAD(&chip_node->func_list); pci_adapter->chip_node = chip_node; + mutex_init(&chip_node->sfp_mutex); + return 0; alloc_dbgtool_attr_file_err: diff --git a/drivers/net/ethernet/huawei/hinic/hinic_mgmt_interface.h b/drivers/net/ethernet/huawei/hinic/hinic_mgmt_interface.h index 13bc351..3c3be6e 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_mgmt_interface.h +++ b/drivers/net/ethernet/huawei/hinic/hinic_mgmt_interface.h @@ -680,6 +680,16 @@ struct hinic_capture_info { u32 data_vlan; }; +struct hinic_port_rt_cmd { + u8 status; + u8 version; + u8 rsvd0[6]; + + u8 pf_id; + u8 enable; + u8 rsvd1[6]; +}; + struct hinic_vf_dcb_state { u8 status; u8 version; @@ -737,6 +747,8 @@ struct hinic_set_link_follow { void hinic_unregister_vf_msg_handler(void *hwdev, u16 vf_id); +int hinic_set_port_routine_cmd_report(void *hwdev, bool enable); + int hinic_refresh_nic_cfg(void *hwdev, struct nic_port_info *port_info); int hinic_save_dcb_state(struct hinic_hwdev *hwdev, diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c b/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c index 07858be..6ddae36 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c @@ -35,7 +35,6 @@ #include "hinic_nic.h" #include "hinic_mgmt_interface.h" #include "hinic_hwif.h" -#include "hinic_eqs.h" static unsigned char set_vf_link_state; module_param(set_vf_link_state, byte, 0444); @@ -3571,6 +3570,35 @@ int hinic_set_super_cqe_state(void *hwdev, bool enable) return 0; } +int hinic_set_port_routine_cmd_report(void *hwdev, bool enable) +{ + struct hinic_port_rt_cmd rt_cmd = { 0 }; + struct hinic_hwdev *dev = hwdev; + u16 out_size = sizeof(rt_cmd); + int err; + + if (!hwdev) + return -EINVAL; + + rt_cmd.pf_id = (u8)hinic_global_func_id(hwdev); + rt_cmd.enable = enable; + + err = l2nic_msg_to_mgmt_sync(hwdev, + HINIC_PORT_CMD_SET_PORT_REPORT, + &rt_cmd, sizeof(rt_cmd), &rt_cmd, + &out_size); + if (rt_cmd.status == HINIC_MGMT_CMD_UNSUPPORTED) { + nic_info(dev->dev_hdl, "Current firmware doesn't support to set port routine command report\n"); + } else if (rt_cmd.status || err || !out_size) { + nic_err(dev->dev_hdl, + "Failed to set port routine command report, err: %d, status: 0x%x, out size: 0x%x\n", + err, rt_cmd.status, out_size); + return -EFAULT; + } + + return 0; +} + int hinic_set_func_capture_en(void *hwdev, u16 func_id, bool cap_en) { struct hinic_hwdev *dev = hwdev; @@ -3889,3 +3917,112 @@ int hinic_disable_tx_promisc(void *hwdev) } return 0; } + +static bool hinic_if_sfp_absent(void *hwdev) +{ + struct card_node *chip_node = ((struct hinic_hwdev *)hwdev)->chip_node; + struct hinic_port_routine_cmd *rt_cmd; + struct hinic_cmd_get_light_module_abs sfp_abs = {0}; + u8 port_id = hinic_physical_port_id(hwdev); + u16 out_size = sizeof(sfp_abs); + int err; + bool sfp_abs_valid; + bool sfp_abs_status; + + rt_cmd = &chip_node->rt_cmd[port_id]; + mutex_lock(&chip_node->sfp_mutex); + sfp_abs_valid = rt_cmd->up_send_sfp_abs; + sfp_abs_status = (bool)rt_cmd->abs.abs_status; + if (sfp_abs_valid) { + mutex_unlock(&chip_node->sfp_mutex); + return sfp_abs_status; + } + mutex_unlock(&chip_node->sfp_mutex); + + sfp_abs.port_id = port_id; + err = l2nic_msg_to_mgmt_sync(hwdev, HINIC_PORT_CMD_GET_SFP_ABS, + &sfp_abs, sizeof(sfp_abs), &sfp_abs, + &out_size); + if (sfp_abs.status || err || !out_size) { + nic_err(((struct hinic_hwdev *)hwdev)->dev_hdl, + "Failed to get port%d sfp absent status, err: %d, status: 0x%x, out size: 0x%x\n", + port_id, err, sfp_abs.status, out_size); + return true; + } + + return ((sfp_abs.abs_status == 0) ? false : true); +} + +int hinic_get_sfp_eeprom(void *hwdev, u8 *data, u16 *len) +{ + struct hinic_cmd_get_std_sfp_info sfp_info = {0}; + u8 port_id; + u16 out_size = sizeof(sfp_info); + int err; + + if (!hwdev || !data || !len) + return -EINVAL; + + port_id = hinic_physical_port_id(hwdev); + if (port_id >= HINIC_MAX_PORT_ID) + return -EINVAL; + + if (hinic_if_sfp_absent(hwdev)) + return -ENXIO; + + sfp_info.port_id = port_id; + err = l2nic_msg_to_mgmt_sync(hwdev, HINIC_PORT_CMD_GET_STD_SFP_INFO, + &sfp_info, sizeof(sfp_info), &sfp_info, + &out_size); + if (sfp_info.status || err || !out_size) { + nic_err(((struct hinic_hwdev *)hwdev)->dev_hdl, + "Failed to get port%d sfp eeprom information, err: %d, status: 0x%x, out size: 0x%x\n", + port_id, err, sfp_info.status, out_size); + return -EIO; + } + + *len = min_t(u16, sfp_info.eeprom_len, STD_SFP_INFO_MAX_SIZE); + memcpy(data, sfp_info.sfp_info, STD_SFP_INFO_MAX_SIZE); + + return 0; +} + +int hinic_get_sfp_type(void *hwdev, u8 *data0, u8 *data1) +{ + struct card_node *chip_node = NULL; + struct hinic_port_routine_cmd *rt_cmd; + u8 sfp_data[STD_SFP_INFO_MAX_SIZE]; + u16 len; + u8 port_id; + int err; + + if (!hwdev || !data0 || !data1) + return -EINVAL; + + port_id = hinic_physical_port_id(hwdev); + if (port_id >= HINIC_MAX_PORT_ID) + return -EINVAL; + + if (hinic_if_sfp_absent(hwdev)) + return -ENXIO; + + chip_node = ((struct hinic_hwdev *)hwdev)->chip_node; + rt_cmd = &chip_node->rt_cmd[port_id]; + mutex_lock(&chip_node->sfp_mutex); + if (rt_cmd->up_send_sfp_info) { + *data0 = rt_cmd->sfp_info.sfp_qsfp_info[0]; + *data1 = rt_cmd->sfp_info.sfp_qsfp_info[1]; + mutex_unlock(&chip_node->sfp_mutex); + return 0; + } + mutex_unlock(&chip_node->sfp_mutex); + + err = hinic_get_sfp_eeprom(hwdev, sfp_data, &len); + if (err) + return err; + + *data0 = sfp_data[0]; + *data1 = sfp_data[1]; + + return 0; +} diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.h b/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.h index 395f6d8..eb060fb 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.h +++ b/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.h @@ -620,5 +620,7 @@ int hinic_add_hw_rqfilter(void *hwdev, struct hinic_rq_filter_info *filter_info); int hinic_del_hw_rqfilter(void *hwdev, struct hinic_rq_filter_info *filter_info); +int hinic_get_sfp_eeprom(void *hwdev, u8 *data, u16 *len); +int hinic_get_sfp_type(void *hwdev, u8 *data0, u8 *data1); #endif diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nic_io.c b/drivers/net/ethernet/huawei/hinic/hinic_nic_io.c index 8d13105..1cb4e26 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nic_io.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_nic_io.c @@ -829,13 +829,20 @@ int hinic_init_nic_hwdev(void *hwdev, u16 rx_buff_len) } } } - return 0; + + /* VFs don't set port routine command report */ + if (hinic_func_type(dev) != TYPE_VF) + /* Inform mgmt to send sfp's information to driver */ + err = hinic_set_port_routine_cmd_report(hwdev, true); + + return err; } EXPORT_SYMBOL(hinic_init_nic_hwdev); void hinic_free_nic_hwdev(void *hwdev) { - /* nothing to do for now */ + if (hinic_func_type(hwdev) != TYPE_VF) + hinic_set_port_routine_cmd_report(hwdev, false); } EXPORT_SYMBOL(hinic_free_nic_hwdev); diff --git a/drivers/net/ethernet/huawei/hinic/hinic_port_cmd.h b/drivers/net/ethernet/huawei/hinic/hinic_port_cmd.h index 8730565..46464b1f 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_port_cmd.h +++ b/drivers/net/ethernet/huawei/hinic/hinic_port_cmd.h @@ -146,6 +146,8 @@ enum hinic_port_cmd { HINIC_PORT_CMD_SET_PORT_LINK_STATUS = 0x76, HINIC_PORT_CMD_SET_CGE_PAUSE_TIME_CFG = 0x77, + HINIC_PORT_CMD_SET_PORT_REPORT = 0x7B, + HINIC_PORT_CMD_LINK_STATUS_REPORT = 0xa0, HINIC_PORT_CMD_SET_LOSSLESS_ETH = 0xa3, @@ -200,6 +202,7 @@ enum hinic_port_cmd { HINIC_PORT_CMD_SET_LINK_FOLLOW = 0xF8, HINIC_PORT_CMD_SET_VF_MAX_MIN_RATE = 0xF9, HINIC_PORT_CMD_SET_RXQ_LRO_ADPT = 0xFA, + HINIC_PORT_CMD_GET_SFP_ABS = 0xFB, HINIC_PORT_CMD_Q_FILTER = 0xFC, HINIC_PORT_CMD_TCAM_FILTER = 0xFE, HINIC_PORT_CMD_SET_VLAN_FILTER = 0xFF, -- 1.8.3

1 2

[PATCH] Revert "consolemap: Fix a memory leaking bug in drivers/tty/vt/consolemap.c"
by Yang Yingliang 01 Jun '20

01 Jun '20

From: Ben Hutchings <ben(a)decadent.org.uk> mainline inclusion from mainline-v5.3-rc1 commit 15b3cd8ef46ad1b100e0d3c7e38774f330726820 category: bugfix bugzilla: 34617 CVE: CVE-2019-12379 --------------------------- This reverts commit 84ecc2f6eb1cb12e6d44818f94fa49b50f06e6ac. con_insert_unipair() is working with a sparse 3-dimensional array: - p->uni_pgdir[] is the top layer - p1 points to a middle layer - p2 points to a bottom layer If it needs to allocate a new middle layer, and then fails to allocate a new bottom layer, it would previously free only p2, and now it frees both p1 and p2. But since the new middle layer was already registered in the top layer, it was not leaked. However, if it looks up an *existing* middle layer and then fails to allocate a bottom layer, it now frees both p1 and p2 but does *not* free any other bottom layers under p1. So it *introduces* a memory leak. The error path also cleared the wrong index in p->uni_pgdir[], introducing a use-after-free. Signed-off-by: Ben Hutchings <ben(a)decadent.org.uk> Fixes: 84ecc2f6eb1c ("consolemap: Fix a memory leaking bug in drivers/tty/vt/consolemap.c") Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Bin <zhengbin13(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/tty/vt/consolemap.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c index 814d1b7..7c7ada0 100644 --- a/drivers/tty/vt/consolemap.c +++ b/drivers/tty/vt/consolemap.c @@ -489,11 +489,7 @@ static int con_unify_unimap(struct vc_data *conp, struct uni_pagedir *p) p2 = p1[n = (unicode >> 6) & 0x1f]; if (!p2) { p2 = p1[n] = kmalloc_array(64, sizeof(u16), GFP_KERNEL); - if (!p2) { - kfree(p1); - p->uni_pgdir[n] = NULL; - return -ENOMEM; - } + if (!p2) return -ENOMEM; memset(p2, 0xff, 64*sizeof(u16)); /* No glyphs for the characters (yet) */ } -- 1.8.3

1 0

[PATCH 1/3] sunrpc: check that domain table is empty at module unload.
by Yang Yingliang 26 May '20

26 May '20

From: NeilBrown <neilb(a)suse.de> hulk inclusion category: bugfix bugzilla: NA CVE: CVE-2020-12656 --------------------------- The domain table should be empty at module unload. If it isn't there is a bug somewhere. So check and report. Link: https://bugzilla.kernel.org/show_bug.cgi?id=206651 Signed-off-by: NeilBrown <neilb(a)suse.de> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Wenan Mao <maowenan(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/sunrpc/sunrpc.h | 1 + net/sunrpc/sunrpc_syms.c | 2 ++ net/sunrpc/svcauth.c | 27 +++++++++++++++++++++++++++ 3 files changed, 30 insertions(+) diff --git a/net/sunrpc/sunrpc.h b/net/sunrpc/sunrpc.h index c9bacb3..82035fa 100644 --- a/net/sunrpc/sunrpc.h +++ b/net/sunrpc/sunrpc.h @@ -56,4 +56,5 @@ int svc_send_common(struct socket *sock, struct xdr_buf *xdr, int rpc_clients_notifier_register(void); void rpc_clients_notifier_unregister(void); +void auth_domain_cleanup(void); #endif /* _NET_SUNRPC_SUNRPC_H */ diff --git a/net/sunrpc/sunrpc_syms.c b/net/sunrpc/sunrpc_syms.c index 56f9eff..7b4c6ee 100644 --- a/net/sunrpc/sunrpc_syms.c +++ b/net/sunrpc/sunrpc_syms.c @@ -22,6 +22,7 @@ #include <linux/sunrpc/rpc_pipe_fs.h> #include <linux/sunrpc/xprtsock.h> +#include "sunrpc.h" #include "netns.h" unsigned int sunrpc_net_id; @@ -130,6 +131,7 @@ static __net_exit void sunrpc_exit_net(struct net *net) unregister_rpc_pipefs(); rpc_destroy_mempool(); unregister_pernet_subsys(&sunrpc_net_ops); + auth_domain_cleanup(); #if IS_ENABLED(CONFIG_SUNRPC_DEBUG) rpc_unregister_sysctl(); #endif diff --git a/net/sunrpc/svcauth.c b/net/sunrpc/svcauth.c index bb8db3c..0107350 100644 --- a/net/sunrpc/svcauth.c +++ b/net/sunrpc/svcauth.c @@ -18,6 +18,10 @@ #include <linux/err.h> #include <linux/hash.h> +#include <trace/events/sunrpc.h> + +#include "sunrpc.h" + #define RPCDBG_FACILITY RPCDBG_AUTH @@ -170,3 +174,26 @@ struct auth_domain *auth_domain_find(char *name) return auth_domain_lookup(name, NULL); } EXPORT_SYMBOL_GPL(auth_domain_find); + +/** + * auth_domain_cleanup - check that the auth_domain table is empty + * + * On module unload the auth_domain_table must be empty. To make it + * easier to catch bugs which don't clean up domains properly, we + * warn if anything remains in the table at cleanup time. + * + * Note that we cannot proactively remove the domains at this stage. + * The ->release() function might be in a module that has already been + * unloaded. + */ + +void auth_domain_cleanup(void) +{ + int h; + struct auth_domain *hp; + + for (h = 0; h < DN_HASHMAX; h++) + hlist_for_each_entry(hp, &auth_domain_table[h], hash) + pr_warn("svc: domain %s still present at module unload.\n", + hp->name); +} -- 1.8.3

1 2

[PATCH 1/7] USB: gadget: fix illegal array access in binding with UDC
by Yang Yingliang 26 May '20

26 May '20

From: Kyungtae Kim <kt0755(a)gmail.com> mainline inclusion from mainline-v5.7-rc6 commit 15753588bcd4bbffae1cca33c8ced5722477fe1f category: bugfix bugzilla: 13690 CVE: CVE-2020-13143 ------------------------------------------------- FuzzUSB (a variant of syzkaller) found an illegal array access using an incorrect index while binding a gadget with UDC. Reference: https://www.spinics.net/lists/linux-usb/msg194331.html This bug occurs when a size variable used for a buffer is misused to access its strcpy-ed buffer. Given a buffer along with its size variable (taken from user input), from which, a new buffer is created using kstrdup(). Due to the original buffer containing 0 value in the middle, the size of the kstrdup-ed buffer becomes smaller than that of the original. So accessing the kstrdup-ed buffer with the same size variable triggers memory access violation. The fix makes sure no zero value in the buffer, by comparing the strlen() of the orignal buffer with the size variable, so that the access to the kstrdup-ed buffer is safe. BUG: KASAN: slab-out-of-bounds in gadget_dev_desc_UDC_store+0x1ba/0x200 drivers/usb/gadget/configfs.c:266 Read of size 1 at addr ffff88806a55dd7e by task syz-executor.0/17208 CPU: 2 PID: 17208 Comm: syz-executor.0 Not tainted 5.6.8 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xce/0x128 lib/dump_stack.c:118 print_address_description.constprop.4+0x21/0x3c0 mm/kasan/report.c:374 __kasan_report+0x131/0x1b0 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:641 __asan_report_load1_noabort+0x14/0x20 mm/kasan/generic_report.c:132 gadget_dev_desc_UDC_store+0x1ba/0x200 drivers/usb/gadget/configfs.c:266 flush_write_buffer fs/configfs/file.c:251 [inline] configfs_write_file+0x2f1/0x4c0 fs/configfs/file.c:283 __vfs_write+0x85/0x110 fs/read_write.c:494 vfs_write+0x1cd/0x510 fs/read_write.c:558 ksys_write+0x18a/0x220 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __x64_sys_write+0x73/0xb0 fs/read_write.c:620 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe Signed-off-by: Kyungtae Kim <kt0755(a)gmail.com> Reported-and-tested-by: Kyungtae Kim <kt0755(a)gmail.com> Cc: Felipe Balbi <balbi(a)kernel.org> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20200510054326.GA19198@pizza01 Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/usb/gadget/configfs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c index ab9ac48..a7709d1 100644 --- a/drivers/usb/gadget/configfs.c +++ b/drivers/usb/gadget/configfs.c @@ -260,6 +260,9 @@ static ssize_t gadget_dev_desc_UDC_store(struct config_item *item, char *name; int ret; + if (strlen(page) < len) + return -EOVERFLOW; + name = kstrdup(page, GFP_KERNEL); if (!name) return -ENOMEM; -- 1.8.3

1 6

[PATCH] signal: fix kabi changes in struct task_struct
by Yang Yingliang 20 May '20

20 May '20

hulk inclusion category: kabi bugzilla: NA CVE: CVE-2020-10741, CVE-2020-12826 --------------------------- Commit d1e7fd6462ca ("signal: Extend exec_id to 64bits") can fixes CVE-2020-10741 and CVE-2020-12826, but it introduces a kabi change in struct task_strcut. Fix this kabi broken by using another new 64bits variables parent_exec_id_u64 and self_exec_id_u64. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/exec.c | 1 + include/linux/sched.h | 9 +++++++-- kernel/fork.c | 2 ++ kernel/signal.c | 2 +- 4 files changed, 11 insertions(+), 3 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index 15d9974..19c0700 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1380,6 +1380,7 @@ void setup_new_exec(struct linux_binprm * bprm) /* An exec changes our domain. We are no longer part of the thread group */ WRITE_ONCE(current->self_exec_id, current->self_exec_id + 1); + WRITE_ONCE(current->self_exec_id_u64, current->self_exec_id_u64 + 1); flush_signal_handlers(current, 0); } EXPORT_SYMBOL(setup_new_exec); diff --git a/include/linux/sched.h b/include/linux/sched.h index 1d15ab4..302fa00 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -892,8 +892,8 @@ struct task_struct { struct seccomp seccomp; /* Thread group tracking: */ - u64 parent_exec_id; - u64 self_exec_id; + u32 parent_exec_id; + u32 self_exec_id; /* Protection against (de-)allocation: mm, files, fs, tty, keyrings, mems_allowed, mempolicy: */ spinlock_t alloc_lock; @@ -1212,8 +1212,13 @@ struct task_struct { */ randomized_struct_fields_end +#ifndef __GENKSYMS__ + u64 parent_exec_id_u64; + u64 self_exec_id_u64; +#else KABI_RESERVE(1) KABI_RESERVE(2) +#endif KABI_RESERVE(3) KABI_RESERVE(4) KABI_RESERVE(5) diff --git a/kernel/fork.c b/kernel/fork.c index 2839961..951aa6f 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -2055,9 +2055,11 @@ static __latent_entropy struct task_struct *copy_process( if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) { p->real_parent = current->real_parent; p->parent_exec_id = current->parent_exec_id; + p->parent_exec_id_u64 = current->parent_exec_id_u64; } else { p->real_parent = current; p->parent_exec_id = current->self_exec_id; + p->parent_exec_id_u64 = current->self_exec_id_u64; } klp_copy_process(p); diff --git a/kernel/signal.c b/kernel/signal.c index 60ea2ee..a58af7d 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -1827,7 +1827,7 @@ bool do_notify_parent(struct task_struct *tsk, int sig) * This is only possible if parent == real_parent. * Check if it has changed security domain. */ - if (tsk->parent_exec_id != READ_ONCE(tsk->parent->self_exec_id)) + if (tsk->parent_exec_id_u64 != READ_ONCE(tsk->parent->self_exec_id_u64)) sig = SIGCHLD; } -- 1.8.3

1 0

[PATCH 01/14] net: hns3: solve the unlock 2 times when rocee init fault
by Yang Yingliang 20 May '20

20 May '20

From: Hao Shen <shenhao21(a)huawei.com> driver inclusion category: bugfix bugzilla: NA CVE: NA -------------------------------------------------------- When rocee init fault, the rtnl_unlock execute 2 times Signed-off-by: Hao Shen <shenhao21(a)huawei.com> Reviewed-by: Zhong Zhaohui <zhongzhaohui(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c index 0b7e159..3e0afc4 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c @@ -3865,7 +3865,7 @@ static int hclge_resume(struct hnae3_ae_dev *ae_dev) ret = hclge_notify_roce_client(hdev, HNAE3_INIT_CLIENT); if (ret) - goto err_reset_lock; + return ret; rtnl_lock(); -- 1.8.3

1 13

[PATCH 1/2] KVM: SVM: Fix potential memory leak in svm_cpu_init()
by Yang Yingliang 13 May '20

13 May '20

From: Miaohe Lin <linmiaohe(a)huawei.com> mainline inclusion from mainline-v5.6-rc4 commit d80b64ff297e40c2b6f7d7abc1b3eba70d22a068 category: bugfix bugzilla: 13690 CVE: CVE-2020-12768 ------------------------------------------------- When kmalloc memory for sd->sev_vmcbs failed, we forget to free the page held by sd->save_area. Also get rid of the var r as '-ENOMEM' is actually the only possible outcome here. Reviewed-by: Liran Alon <liran.alon(a)oracle.com> Reviewed-by: Vitaly Kuznetsov <vkuznets(a)redhat.com> Signed-off-by: Miaohe Lin <linmiaohe(a)huawei.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/x86/kvm/svm.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c index df22744..226db3dc 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -998,33 +998,32 @@ static void svm_cpu_uninit(int cpu) static int svm_cpu_init(int cpu) { struct svm_cpu_data *sd; - int r; sd = kzalloc(sizeof(struct svm_cpu_data), GFP_KERNEL); if (!sd) return -ENOMEM; sd->cpu = cpu; - r = -ENOMEM; sd->save_area = alloc_page(GFP_KERNEL); if (!sd->save_area) - goto err_1; + goto free_cpu_data; if (svm_sev_enabled()) { - r = -ENOMEM; sd->sev_vmcbs = kmalloc_array(max_sev_asid + 1, sizeof(void *), GFP_KERNEL); if (!sd->sev_vmcbs) - goto err_1; + goto free_save_area; } per_cpu(svm_data, cpu) = sd; return 0; -err_1: +free_save_area: + __free_page(sd->save_area); +free_cpu_data: kfree(sd); - return r; + return -ENOMEM; } -- 1.8.3

1 1

[PATCH] config: disable CONFIG_ARM64_ERRATUM_1542419 by default
by Yang Yingliang 13 May '20

13 May '20

hulk inclusion category: config bugzilla: NA CVE: NA ------------------------------------------------- Introduced by 05460849c3b5 ("arm64: errata: Hide CTR_EL0.DIC on systems affected by Neoverse-N1 #1542419"). Disable CONFIG_ARM64_ERRATUM_1542419 by default. Reviewed-by: Xuefeng Wang <wxf.wang(a)hisilicon.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/configs/euleros_defconfig | 1 + arch/arm64/configs/hulk_defconfig | 1 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/configs/storage_ci_defconfig | 1 + arch/arm64/configs/syzkaller_defconfig | 1 + 5 files changed, 5 insertions(+) diff --git a/arch/arm64/configs/euleros_defconfig b/arch/arm64/configs/euleros_defconfig index 04456f3..360e692 100644 --- a/arch/arm64/configs/euleros_defconfig +++ b/arch/arm64/configs/euleros_defconfig @@ -387,6 +387,7 @@ CONFIG_ARM64_ERRATUM_845719=y CONFIG_ARM64_ERRATUM_843419=y CONFIG_ARM64_ERRATUM_1024718=y # CONFIG_ARM64_ERRATUM_1463225 is not set +# CONFIG_ARM64_ERRATUM_1542419 is not set CONFIG_CAVIUM_ERRATUM_22375=y CONFIG_CAVIUM_ERRATUM_23144=y CONFIG_CAVIUM_ERRATUM_23154=y diff --git a/arch/arm64/configs/hulk_defconfig b/arch/arm64/configs/hulk_defconfig index 6ee2472..bb020a1 100644 --- a/arch/arm64/configs/hulk_defconfig +++ b/arch/arm64/configs/hulk_defconfig @@ -386,6 +386,7 @@ CONFIG_ARM64_ERRATUM_845719=y # CONFIG_ARM64_ERRATUM_843419 is not set # CONFIG_ARM64_ERRATUM_1024718 is not set # CONFIG_ARM64_ERRATUM_1463225 is not set +# CONFIG_ARM64_ERRATUM_1542419 is not set # CONFIG_CAVIUM_ERRATUM_22375 is not set # CONFIG_CAVIUM_ERRATUM_23144 is not set # CONFIG_CAVIUM_ERRATUM_23154 is not set diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 9e6f560..b943729 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -389,6 +389,7 @@ CONFIG_ARM64_ERRATUM_845719=y CONFIG_ARM64_ERRATUM_843419=y CONFIG_ARM64_ERRATUM_1024718=y # CONFIG_ARM64_ERRATUM_1463225 is not set +# CONFIG_ARM64_ERRATUM_1542419 is not set CONFIG_CAVIUM_ERRATUM_22375=y CONFIG_CAVIUM_ERRATUM_23144=y CONFIG_CAVIUM_ERRATUM_23154=y diff --git a/arch/arm64/configs/storage_ci_defconfig b/arch/arm64/configs/storage_ci_defconfig index 2ad533d..b7f23ca 100644 --- a/arch/arm64/configs/storage_ci_defconfig +++ b/arch/arm64/configs/storage_ci_defconfig @@ -373,6 +373,7 @@ CONFIG_ARM64_ERRATUM_845719=y CONFIG_ARM64_ERRATUM_843419=y CONFIG_ARM64_ERRATUM_1024718=y # CONFIG_ARM64_ERRATUM_1463225 is not set +# CONFIG_ARM64_ERRATUM_1542419 is not set CONFIG_CAVIUM_ERRATUM_22375=y CONFIG_CAVIUM_ERRATUM_23144=y CONFIG_CAVIUM_ERRATUM_23154=y diff --git a/arch/arm64/configs/syzkaller_defconfig b/arch/arm64/configs/syzkaller_defconfig index 509713a..eaf5e32 100644 --- a/arch/arm64/configs/syzkaller_defconfig +++ b/arch/arm64/configs/syzkaller_defconfig @@ -385,6 +385,7 @@ CONFIG_ARM64_ERRATUM_845719=y # CONFIG_ARM64_ERRATUM_843419 is not set # CONFIG_ARM64_ERRATUM_1024718 is not set # CONFIG_ARM64_ERRATUM_1463225 is not set +# CONFIG_ARM64_ERRATUM_1542419 is not set # CONFIG_CAVIUM_ERRATUM_22375 is not set # CONFIG_CAVIUM_ERRATUM_23144 is not set # CONFIG_CAVIUM_ERRATUM_23154 is not set -- 1.8.3

1 0

[PATCH 01/33] vhost: vsock: kick send_pkt worker once device is started
by Yang Yingliang 13 May '20

13 May '20

From: Jia He <justin.he(a)arm.com> commit 0b841030625cde5f784dd62aec72d6a766faae70 upstream. Ning Bo reported an abnormal 2-second gap when booting Kata container [1]. The unconditional timeout was caused by VSOCK_DEFAULT_CONNECT_TIMEOUT of connecting from the client side. The vhost vsock client tries to connect an initializing virtio vsock server. The abnormal flow looks like: host-userspace vhost vsock guest vsock ============== =========== ============ connect() --------> vhost_transport_send_pkt_work() initializing | vq->private_data==NULL | will not be queued V schedule_timeout(2s) vhost_vsock_start() <--------- device ready set vq->private_data wait for 2s and failed connect() again vq->private_data!=NULL recv connecting pkt Details: 1. Host userspace sends a connect pkt, at that time, guest vsock is under initializing, hence the vhost_vsock_start has not been called. So vq->private_data==NULL, and the pkt is not been queued to send to guest 2. Then it sleeps for 2s 3. After guest vsock finishes initializing, vq->private_data is set 4. When host userspace wakes up after 2s, send connecting pkt again, everything is fine. As suggested by Stefano Garzarella, this fixes it by additional kicking the send_pkt worker in vhost_vsock_start once the virtio device is started. This makes the pending pkt sent again. After this patch, kata-runtime (with vsock enabled) boot time is reduced from 3s to 1s on a ThunderX2 arm64 server. [1] https://github.com/kata-containers/runtime/issues/1917 Reported-by: Ning Bo <n.b(a)live.com> Suggested-by: Stefano Garzarella <sgarzare(a)redhat.com> Signed-off-by: Jia He <justin.he(a)arm.com> Link: https://lore.kernel.org/r/20200501043840.186557-1-justin.he@arm.com Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Reviewed-by: Stefano Garzarella <sgarzare(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/vhost/vsock.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c index 5f5c5de..bac1365 100644 --- a/drivers/vhost/vsock.c +++ b/drivers/vhost/vsock.c @@ -499,6 +499,11 @@ static int vhost_vsock_start(struct vhost_vsock *vsock) mutex_unlock(&vq->mutex); } + /* Some packets may have been queued before the device was started, + * let's kick the send worker to send them. + */ + vhost_work_queue(&vsock->dev, &vsock->send_pkt_work); + mutex_unlock(&vsock->dev.mutex); return 0; -- 1.8.3

1 32

[PATCH 01/38] drm/edid: Fix off-by-one in DispID DTD pixel clock
by Yang Yingliang 12 May '20

12 May '20

From: Ville Syrjälä <ville.syrjala(a)linux.intel.com> commit 6292b8efe32e6be408af364132f09572aed14382 upstream. The DispID DTD pixel clock is documented as: "00 00 00 h → FF FF FF h | Pixel clock ÷ 10,000 0.01 → 167,772.16 Mega Pixels per Sec" Which seems to imply that we to add one to the raw value. Reality seems to agree as there are tiled displays in the wild which currently show a 10kHz difference in the pixel clock between the tiles (one tile gets its mode from the base EDID, the other from the DispID block). Cc: stable(a)vger.kernel.org References: https://gitlab.freedesktop.org/drm/intel/-/issues/27 Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20200423151743.18767-1-ville.… Reviewed-by: Manasi Navare <manasi.d.navare(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/gpu/drm/drm_edid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c index f5926bf5..d5dcee7 100644 --- a/drivers/gpu/drm/drm_edid.c +++ b/drivers/gpu/drm/drm_edid.c @@ -4706,7 +4706,7 @@ static struct drm_display_mode *drm_mode_displayid_detailed(struct drm_device *d struct drm_display_mode *mode; unsigned pixel_clock = (timings->pixel_clock[0] | (timings->pixel_clock[1] << 8) | - (timings->pixel_clock[2] << 16)); + (timings->pixel_clock[2] << 16)) + 1; unsigned hactive = (timings->hactive[0] | timings->hactive[1] << 8) + 1; unsigned hblank = (timings->hblank[0] | timings->hblank[1] << 8) + 1; unsigned hsync = (timings->hsync[0] | (timings->hsync[1] & 0x7f) << 8) + 1; -- 1.8.3

1 75

[PATCH 01/48] remoteproc: Fix wrong rvring index computation
by Yang Yingliang 12 May '20

12 May '20

From: Clement Leger <cleger(a)kalray.eu> commit 00a0eec59ddbb1ce966b19097d8a8d2f777e726a upstream. Index of rvring is computed using pointer arithmetic. However, since rvring->rvdev->vring is the base of the vring array, computation of rvring idx should be reversed. It previously lead to writing at negative indices in the resource table. Signed-off-by: Clement Leger <cleger(a)kalray.eu> Link: https://lore.kernel.org/r/20191004073736.8327-1-cleger@kalray.eu Signed-off-by: Bjorn Andersson <bjorn.andersson(a)linaro.org> Cc: Doug Anderson <dianders(a)chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/remoteproc/remoteproc_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c index abbef17..d5ff272 100644 --- a/drivers/remoteproc/remoteproc_core.c +++ b/drivers/remoteproc/remoteproc_core.c @@ -289,7 +289,7 @@ void rproc_free_vring(struct rproc_vring *rvring) { int size = PAGE_ALIGN(vring_size(rvring->len, rvring->align)); struct rproc *rproc = rvring->rvdev->rproc; - int idx = rvring->rvdev->vring - rvring; + int idx = rvring - rvring->rvdev->vring; struct fw_rsc_vdev *rsc; dma_free_coherent(rproc->dev.parent, size, rvring->va, rvring->dma); -- 1.8.3

1 95

[PATCH 001/124] ext4: fix extent_status fragmentation for plain files
by Yang Yingliang 12 May '20

12 May '20

From: Dmitry Monakhov <dmonakhov(a)gmail.com> [ Upstream commit 4068664e3cd2312610ceac05b74c4cf1853b8325 ] Extents are cached in read_extent_tree_block(); as a result, extents are not cached for inodes with depth == 0 when we try to find the extent using ext4_find_extent(). The result of the lookup is cached in ext4_map_blocks() but is only a subset of the extent on disk. As a result, the contents of extents status cache can get very badly fragmented for certain workloads, such as a random 4k read workload. File size of /mnt/test is 33554432 (8192 blocks of 4096 bytes) ext: logical_offset: physical_offset: length: expected: flags: 0: 0.. 8191: 40960.. 49151: 8192: last,eof $ perf record -e 'ext4:ext4_es_*' /root/bin/fio --name=t --direct=0 --rw=randread --bs=4k --filesize=32M --size=32M --filename=/mnt/test $ perf script | grep ext4_es_insert_extent | head -n 10 fio 131 [000] 13.975421: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [494/1) mapped 41454 status W fio 131 [000] 13.975939: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [6064/1) mapped 47024 status W fio 131 [000] 13.976467: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [6907/1) mapped 47867 status W fio 131 [000] 13.976937: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [3850/1) mapped 44810 status W fio 131 [000] 13.977440: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [3292/1) mapped 44252 status W fio 131 [000] 13.977931: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [6882/1) mapped 47842 status W fio 131 [000] 13.978376: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [3117/1) mapped 44077 status W fio 131 [000] 13.978957: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [2896/1) mapped 43856 status W fio 131 [000] 13.979474: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [7479/1) mapped 48439 status W Fix this by caching the extents for inodes with depth == 0 in ext4_find_extent(). [ Renamed ext4_es_cache_extents() to ext4_cache_extents() since this newly added function is not in extents_cache.c, and to avoid potential visual confusion with ext4_es_cache_extent(). -TYT ] Signed-off-by: Dmitry Monakhov <dmonakhov(a)gmail.com> Link: https://lore.kernel.org/r/20191106122502.19986-1-dmonakhov@gmail.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/ext4/extents.c | 47 +++++++++++++++++++++++++++-------------------- 1 file changed, 27 insertions(+), 20 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 90862ee..0f17c54 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -510,6 +510,30 @@ int ext4_ext_check_inode(struct inode *inode) return ext4_ext_check(inode, ext_inode_hdr(inode), ext_depth(inode), 0); } +static void ext4_cache_extents(struct inode *inode, + struct ext4_extent_header *eh) +{ + struct ext4_extent *ex = EXT_FIRST_EXTENT(eh); + ext4_lblk_t prev = 0; + int i; + + for (i = le16_to_cpu(eh->eh_entries); i > 0; i--, ex++) { + unsigned int status = EXTENT_STATUS_WRITTEN; + ext4_lblk_t lblk = le32_to_cpu(ex->ee_block); + int len = ext4_ext_get_actual_len(ex); + + if (prev && (prev != lblk)) + ext4_es_cache_extent(inode, prev, lblk - prev, ~0, + EXTENT_STATUS_HOLE); + + if (ext4_ext_is_unwritten(ex)) + status = EXTENT_STATUS_UNWRITTEN; + ext4_es_cache_extent(inode, lblk, len, + ext4_ext_pblock(ex), status); + prev = lblk + len; + } +} + static struct buffer_head * __read_extent_tree_block(const char *function, unsigned int line, struct inode *inode, ext4_fsblk_t pblk, int depth, @@ -544,26 +568,7 @@ int ext4_ext_check_inode(struct inode *inode) */ if (!(flags & EXT4_EX_NOCACHE) && depth == 0) { struct ext4_extent_header *eh = ext_block_hdr(bh); - struct ext4_extent *ex = EXT_FIRST_EXTENT(eh); - ext4_lblk_t prev = 0; - int i; - - for (i = le16_to_cpu(eh->eh_entries); i > 0; i--, ex++) { - unsigned int status = EXTENT_STATUS_WRITTEN; - ext4_lblk_t lblk = le32_to_cpu(ex->ee_block); - int len = ext4_ext_get_actual_len(ex); - - if (prev && (prev != lblk)) - ext4_es_cache_extent(inode, prev, - lblk - prev, ~0, - EXTENT_STATUS_HOLE); - - if (ext4_ext_is_unwritten(ex)) - status = EXTENT_STATUS_UNWRITTEN; - ext4_es_cache_extent(inode, lblk, len, - ext4_ext_pblock(ex), status); - prev = lblk + len; - } + ext4_cache_extents(inode, eh); } return bh; errout: @@ -911,6 +916,8 @@ struct ext4_ext_path * path[0].p_bh = NULL; i = depth; + if (!(flags & EXT4_EX_NOCACHE) && depth == 0) + ext4_cache_extents(inode, eh); /* walk through the tree */ while (i) { ext_debug("depth %d: num %d, max %d\n", -- 1.8.3

1 247

[PATCH 1/2] drivers sysctl: add read and write interface of pmbus
by Yang Yingliang 11 May '20

11 May '20

From: fengsheng <fengsheng5(a)huawei.com> driver inclusion category: feature bugzilla: NA CVE: NA 1. add interface: sysctl_pmbus_write_common 2. add interface: sysctl_pmbus_read_common Signed-off-by: fengsheng <fengsheng5(a)huawei.com> Reviewed-by: wuyang <wuyang7(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/soc/hisilicon/sysctl/sysctl_drv.c | 2 +- drivers/soc/hisilicon/sysctl/sysctl_pmbus.c | 113 ++++++++++++++++++++++------ drivers/soc/hisilicon/sysctl/sysctl_pmbus.h | 16 ++++ 3 files changed, 108 insertions(+), 23 deletions(-) diff --git a/drivers/soc/hisilicon/sysctl/sysctl_drv.c b/drivers/soc/hisilicon/sysctl/sysctl_drv.c index 3899fac..c4cb157 100644 --- a/drivers/soc/hisilicon/sysctl/sysctl_drv.c +++ b/drivers/soc/hisilicon/sysctl/sysctl_drv.c @@ -48,7 +48,7 @@ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #define DEBUG -#define SYSCTL_DRIVER_VERSION "1.9.39.1" +#define SYSCTL_DRIVER_VERSION "1.9.60.0" unsigned int g_sysctrl_debug; diff --git a/drivers/soc/hisilicon/sysctl/sysctl_pmbus.c b/drivers/soc/hisilicon/sysctl/sysctl_pmbus.c index 74d06a8..92eeba6 100644 --- a/drivers/soc/hisilicon/sysctl/sysctl_pmbus.c +++ b/drivers/soc/hisilicon/sysctl/sysctl_pmbus.c @@ -190,6 +190,9 @@ int InitPmbus(u8 chip_id) his_sysctrl_reg_wr(base, I2C_SS_SCL_HCNT_OFFSET, I2C_SS_SCLHCNT); /* ulSclLow > 1.5us */ his_sysctrl_reg_wr(base, I2C_SS_SCL_LCNT_OFFSET, I2C_SS_SCLLCNT); + /* set sda_hold_fs 1us > 250ns */ + his_sysctrl_reg_wr(base, I2C_SDA_HOLD_OFFSET, I2C_SS_SDA_HOLD_FS); + his_sysctrl_reg_wr(base, I2C_ENABLE_OFFSET, 0x1); debug_sysctrl_print("Initialize Pmbus end\n"); @@ -233,35 +236,36 @@ int sysctl_pmbus_cfg(u8 chip_id, u8 addr, u8 page, u32 slave_addr) return 0; } -int sysctl_pmbus_write(u8 chip_id, u8 addr, u32 slave_addr, u32 data_len, u32 buf) +int sysctl_pmbus_write_common(u8 chip_id, u32 slave_addr, u32 data_len, u8 *buf) { u32 i = 0; u32 temp = 0; u32 loop = 0x1000; - u32 temp_data = addr; + u32 temp_data; void __iomem *base = NULL; if ((chip_id >= CHIP_ID_NUM_MAX) || - (data_len > DATA_NUM_MAX) || - (slave_addr >= SLAVE_ADDR_MAX)) { + (slave_addr >= SLAVE_ADDR_MAX) || + (!data_len) || (data_len > PMBUS_WRITE_LEN_MAX) || + (!buf)) { pr_err("[sysctl pmbus] write param err,chipid=0x%x,data_len=0x%x,slave_addr=0x%x!\n", chip_id, data_len, slave_addr); return SYSCTL_ERR_PARAM; } + /* clear all interrupt */ base = g_sysctl_pmbus_base[chip_id]; - his_sysctrl_reg_wr(base, I2C_INTR_RAW_OFFSET, 0x3ffff); + /* send: slave_addr[7bit] + write[1bit] */ his_sysctrl_reg_wr(base, I2C_DATA_CMD_OFFSET, (0x2 << 0x8) | slave_addr); - if (data_len != 0) { - his_sysctrl_reg_wr(base, I2C_DATA_CMD_OFFSET, addr); - for (i = 0; i < data_len - 1; i++) - his_sysctrl_reg_wr(base, I2C_DATA_CMD_OFFSET, 0xff & (buf >> (i * 0x8))); + /* write data */ + for (i = 0; i < data_len - 1; i++) + his_sysctrl_reg_wr(base, I2C_DATA_CMD_OFFSET, buf[i]); - temp_data = (0xff & (buf >> (i * 0x8))); - } + /* last data should send stop */ + temp_data = buf[i]; his_sysctrl_reg_wr(base, I2C_DATA_CMD_OFFSET, (0x4 << 0x8) | temp_data); /* poll until send done */ @@ -273,14 +277,15 @@ int sysctl_pmbus_write(u8 chip_id, u8 addr, u32 slave_addr, u32 data_len, u32 bu /* send data failed */ if (temp & I2C_TX_ABRT) { his_sysctrl_reg_rd(base, I2C_TX_ABRT_SRC_REG, &temp); - pr_err("[sysctl pmbus]write data fail, chip_id:0x%x,slave_addr:0x%x, addr:0x%x!\r\n", - chip_id, slave_addr, addr); + pr_err("[sysctl pmbus]write data fail, chip_id:0x%x,slave_addr:0x%x\r\n", + chip_id, slave_addr); his_sysctrl_reg_rd(base, I2C_CLR_TX_ABRT_REG, &temp); return SYSCTL_ERR_FAILED; } his_sysctrl_reg_rd(base, I2C_STATUS_REG, &temp); + /* send done */ if (temp & I2C_TX_FIFO_EMPTY) { his_sysctrl_reg_rd(base, I2C_TX_FIFO_DATA_NUM_REG, &temp); if (temp == 0) @@ -289,8 +294,8 @@ int sysctl_pmbus_write(u8 chip_id, u8 addr, u32 slave_addr, u32 data_len, u32 bu loop--; if (loop == 0) { - pr_err("[sysctl pmbus]write data retry fail, chip_id:0x%x,slave_addr:0x%x, addr:0x%x!\r\n", - chip_id, slave_addr, addr); + pr_err("[sysctl pmbus]write data retry fail, chip_id:0x%x,slave_addr:0x%x\r\n", + chip_id, slave_addr); return SYSCTL_ERR_FAILED; } } @@ -298,7 +303,25 @@ int sysctl_pmbus_write(u8 chip_id, u8 addr, u32 slave_addr, u32 data_len, u32 bu return SYSCTL_ERR_OK; } -static int sysctl_pmbus_read_pre(void __iomem *base, u8 addr, u32 slave_addr, u32 data_len) +int sysctl_pmbus_write(u8 chip_id, u8 addr, u32 slave_addr, u32 data_len, u32 buf) +{ +#define TMP_LEN_MAX 5 + u8 i; + u8 tmp[TMP_LEN_MAX] = {0}; + + if (data_len > DATA_NUM_MAX) { + pr_err("[sysctl pmbus] write param err,data_len=0x%x!\n", data_len); + return SYSCTL_ERR_PARAM; + } + + tmp[0] = addr; + for (i = 0; i < data_len; i++) + tmp[i + 1] = (buf >> (i * 0x8)) & 0xff; + + return sysctl_pmbus_write_common(chip_id, slave_addr, data_len + sizeof(addr), &tmp[0]); +} + +static int sysctl_pmbus_read_pre(void __iomem *base, u32 cmd_len, u8 *cmd, u32 slave_addr, u32 data_len) { u32 i = 0; u32 fifo_num = 0; @@ -309,22 +332,29 @@ static int sysctl_pmbus_read_pre(void __iomem *base, u8 addr, u32 slave_addr, u3 return SYSCTL_ERR_PARAM; } + /* clear all interrupt */ his_sysctrl_reg_wr(base, I2C_INTR_RAW_OFFSET, 0x3ffff); + /* clear rx fifo */ his_sysctrl_reg_rd(base, I2C_RXFLR_OFFSET, &fifo_num); - debug_sysctrl_print("[sysctl_pmbus_read_byte]read pmbus , read empty rx fifo num:%d\r\n", fifo_num); for (i = 0; i < fifo_num; i++) his_sysctrl_reg_rd(base, I2C_DATA_CMD_OFFSET, &temp_byte); - his_sysctrl_reg_wr(base, I2C_DATA_CMD_OFFSET, (0x2 << 0x8) | slave_addr); - his_sysctrl_reg_wr(base, I2C_DATA_CMD_OFFSET, addr); - his_sysctrl_reg_wr(base, I2C_DATA_CMD_OFFSET, (0x3 << 0x8) | slave_addr); + /* send cmd */ + if (cmd_len) { + his_sysctrl_reg_wr(base, I2C_DATA_CMD_OFFSET, (0x2 << 0x8) | slave_addr); + for (i = 0; i < cmd_len; i++) + his_sysctrl_reg_wr(base, I2C_DATA_CMD_OFFSET, cmd[i]); + } + /* read data */ + his_sysctrl_reg_wr(base, I2C_DATA_CMD_OFFSET, (0x3 << 0x8) | slave_addr); i = data_len; while ((i - 1) > 0) { his_sysctrl_reg_wr(base, I2C_DATA_CMD_OFFSET, 0x100); i--; } + /* last data should send stop */ his_sysctrl_reg_wr(base, I2C_DATA_CMD_OFFSET, 0x500); return 0; @@ -366,6 +396,43 @@ static int sysctl_pmbus_wait_data(void __iomem *base, u32 data_len) return SYSCTL_ERR_OK; } +int sysctl_pmbus_read_common(u8 chip_id, struct pmbus_read_op *op) +{ + u32 ret; + u32 i = 0; + u32 temp_byte = 0; + void __iomem *base = NULL; + + if ((chip_id >= CHIP_ID_NUM_MAX) || (!op)) { + pr_err("[sysctl pmbus]read param err,chipid=0x%x!\n", chip_id); + return SYSCTL_ERR_PARAM; + } + + if ((op->slave_addr >= SLAVE_ADDR_MAX) || + (!op->data_len) || ((op->cmd_len + op->data_len) > PMBUS_READ_LEN_MAX) || + (!op->data) || ((op->cmd_len) && (!op->cmd))) { + pr_err("[sysctl pmbus]read param err,data_len=0x%x,cmd_len=0x%x,slave_addr=0x%x\n", + op->data_len, op->cmd_len, op->slave_addr); + return SYSCTL_ERR_PARAM; + } + + base = g_sysctl_pmbus_base[chip_id]; + ret = sysctl_pmbus_read_pre(base, op->cmd_len, op->cmd, op->slave_addr, op->data_len); + if (ret != SYSCTL_ERR_OK) + return ret; + + ret = sysctl_pmbus_wait_data(base, op->data_len); + if (ret != SYSCTL_ERR_OK) + return ret; + + for (i = 0; i < op->data_len; i++) { + his_sysctrl_reg_rd(base, I2C_DATA_CMD_OFFSET, &temp_byte); + op->data[i] = temp_byte & 0xff; + } + + return SYSCTL_ERR_OK; +} + int sysctl_pmbus_read(u8 chip_id, u8 addr, u32 slave_addr, u32 data_len, u32 *buf) { u32 ret; @@ -385,7 +452,7 @@ int sysctl_pmbus_read(u8 chip_id, u8 addr, u32 slave_addr, u32 data_len, u32 *bu base = g_sysctl_pmbus_base[chip_id]; - ret = sysctl_pmbus_read_pre(base, addr, slave_addr, data_len); + ret = sysctl_pmbus_read_pre(base, sizeof(addr), &addr, slave_addr, data_len); if (ret != SYSCTL_ERR_OK) return ret; @@ -566,7 +633,7 @@ static int sysctl_cpu_convert_vol_to_vid(u32 vid_table, u32 value, u32 *vid) return SYSCTL_ERR_OK; } -int sysctl_cpu_voltage_adjust (u8 chip_id, u8 loop, u32 slave_addr, u32 value) +int sysctl_cpu_voltage_adjust(u8 chip_id, u8 loop, u32 slave_addr, u32 value) { u32 ret; u32 vid; @@ -647,5 +714,7 @@ void hip_sysctl_pmbus_exit(void) EXPORT_SYMBOL(sysctl_cpu_voltage_adjust); EXPORT_SYMBOL(sysctl_pmbus_write); EXPORT_SYMBOL(sysctl_pmbus_read); +EXPORT_SYMBOL(sysctl_pmbus_write_common); +EXPORT_SYMBOL(sysctl_pmbus_read_common); EXPORT_SYMBOL(InitPmbus); EXPORT_SYMBOL(DeInitPmbus); diff --git a/drivers/soc/hisilicon/sysctl/sysctl_pmbus.h b/drivers/soc/hisilicon/sysctl/sysctl_pmbus.h index e1a4742..ce1d83d 100644 --- a/drivers/soc/hisilicon/sysctl/sysctl_pmbus.h +++ b/drivers/soc/hisilicon/sysctl/sysctl_pmbus.h @@ -20,6 +20,13 @@ #define PAGE_NUM_MAX (0x6f) #define DATA_NUM_MAX (0x4) +#define I2C_FIFO_DEPTH (256) + +/* slave_addr use 1 fifo */ +#define PMBUS_READ_LEN_MAX (I2C_FIFO_DEPTH - 1) +/* slave_addr use 2 fifo */ +#define PMBUS_WRITE_LEN_MAX (I2C_FIFO_DEPTH - 2) + #define I2C_TX_ABRT (0x040) #define I2C_TX_ABRT_SRC_REG (0x0880) #define I2C_CLR_TX_ABRT_REG (0x0854) @@ -29,6 +36,7 @@ #define I2C_SS_SCLHCNT 0x3db #define I2C_SS_SCLLCNT 0x3e6 +#define I2C_SS_SDA_HOLD_FS 0xfa /* AVS_REG_GEN */ #define AVS_WR_OPEN_OFFSET 0x0004 @@ -77,6 +85,14 @@ #define STATUS_RPT_OFFSET 0x0AA4 #define STATUS_ERR_RPT_OFFSET 0x0AA8 +struct pmbus_read_op { + u32 slave_addr; + u32 cmd_len; + u32 data_len; + u8 *cmd; + u8 *data; +}; + /* Define the union pmbus_vout_mode */ typedef union { /* Define the struct bits */ -- 1.8.3

1 1

[PATCH 01/62] arm, bpf: Fix offset overflow for BPF_MEM BPF_DW
by Yang Yingliang 11 May '20

11 May '20

From: Luke Nelson <lukenels(a)cs.washington.edu> commit 4178417cc5359c329790a4a8f4a6604612338cca upstream. This patch fixes an incorrect check in how immediate memory offsets are computed for BPF_DW on arm. For BPF_LDX/ST/STX + BPF_DW, the 32-bit arm JIT breaks down an 8-byte access into two separate 4-byte accesses using off+0 and off+4. If off fits in imm12, the JIT emits a ldr/str instruction with the immediate and avoids the use of a temporary register. While the current check off <= 0xfff ensures that the first immediate off+0 doesn't overflow imm12, it's not sufficient for the second immediate off+4, which may cause the second access of BPF_DW to read/write the wrong address. This patch fixes the problem by changing the check to off <= 0xfff - 4 for BPF_DW, ensuring off+4 will never overflow. A side effect of simplifying the check is that it now allows using negative immediate offsets in ldr/str. This means that small negative offsets can also avoid the use of a temporary register. This patch introduces no new failures in test_verifier or test_bpf.c. Fixes: c5eae692571d6 ("ARM: net: bpf: improve 64-bit store implementation") Fixes: ec19e02b343db ("ARM: net: bpf: fix LDX instructions") Co-developed-by: Xi Wang <xi.wang(a)gmail.com> Signed-off-by: Xi Wang <xi.wang(a)gmail.com> Signed-off-by: Luke Nelson <luke.r.nels(a)gmail.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/bpf/20200409221752.28448-1-luke.r.nels@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- arch/arm/net/bpf_jit_32.c | 40 ++++++++++++++++++++++++---------------- 1 file changed, 24 insertions(+), 16 deletions(-) diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c index 25b3ee8..d06293a 100644 --- a/arch/arm/net/bpf_jit_32.c +++ b/arch/arm/net/bpf_jit_32.c @@ -993,21 +993,35 @@ static inline void emit_a32_mul_r64(const s8 dst[], const s8 src[], arm_bpf_put_reg32(dst_hi, rd[0], ctx); } +static bool is_ldst_imm(s16 off, const u8 size) +{ + s16 off_max = 0; + + switch (size) { + case BPF_B: + case BPF_W: + off_max = 0xfff; + break; + case BPF_H: + off_max = 0xff; + break; + case BPF_DW: + /* Need to make sure off+4 does not overflow. */ + off_max = 0xfff - 4; + break; + } + return -off_max <= off && off <= off_max; +} + /* *(size *)(dst + off) = src */ static inline void emit_str_r(const s8 dst, const s8 src[], - s32 off, struct jit_ctx *ctx, const u8 sz){ + s16 off, struct jit_ctx *ctx, const u8 sz){ const s8 *tmp = bpf2a32[TMP_REG_1]; - s32 off_max; s8 rd; rd = arm_bpf_get_reg32(dst, tmp[1], ctx); - if (sz == BPF_H) - off_max = 0xff; - else - off_max = 0xfff; - - if (off < 0 || off > off_max) { + if (!is_ldst_imm(off, sz)) { emit_a32_mov_i(tmp[0], off, ctx); emit(ARM_ADD_R(tmp[0], tmp[0], rd), ctx); rd = tmp[0]; @@ -1036,18 +1050,12 @@ static inline void emit_str_r(const s8 dst, const s8 src[], /* dst = *(size*)(src + off) */ static inline void emit_ldx_r(const s8 dst[], const s8 src, - s32 off, struct jit_ctx *ctx, const u8 sz){ + s16 off, struct jit_ctx *ctx, const u8 sz){ const s8 *tmp = bpf2a32[TMP_REG_1]; const s8 *rd = is_stacked(dst_lo) ? tmp : dst; s8 rm = src; - s32 off_max; - - if (sz == BPF_H) - off_max = 0xff; - else - off_max = 0xfff; - if (off < 0 || off > off_max) { + if (!is_ldst_imm(off, sz)) { emit_a32_mov_i(tmp[0], off, ctx); emit(ARM_ADD_R(tmp[0], tmp[0], src), ctx); rm = tmp[0]; -- 1.8.3

1 61

Fwd: kfifo memory ordering analysis
by laokz 11 May '20

11 May '20

openEuler Kernel SIG：你好！内核社区(包括Linus)怀疑kfifo有潜在的BUG，见 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/l… 我于去年底向社区提交了一份分析报告，用litmus验证了问题的可能性，梳理了所有kfifo相关函数和宏，提出了建议。但杳无音信，不知是丢了，还是因无实践 BUG而未受重视。 ARM是典型的弱内存序架构，因此想到转给你们供参考。如无兴趣请忽略:-) 此致 laokz

2 4

[PATCH] net/hinic: Fix TX timeout under ipip tunnel packet
by Yang Yingliang 09 May '20

09 May '20

From: Chiqijun <chiqijun(a)huawei.com> driver inclusion category: bugfix bugzilla: 4472 ----------------------------------------------------------------------- The current driver does not support ipip tunnel packet parsing. When the csum of the device is turned on, driver will get wrong inner headers, and causing device error. Signed-off-by: Chiqijun <chiqijun(a)huawei.com> Reviewed-by: Luoshaokai <luoshaokai(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/ethernet/huawei/hinic/hinic_tx.c | 31 ++++++++++++++++++++++------ 1 file changed, 25 insertions(+), 6 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_tx.c b/drivers/net/ethernet/huawei/hinic/hinic_tx.c index 05291a5..c8492ae 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_tx.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_tx.c @@ -373,26 +373,45 @@ static int hinic_tx_csum(struct hinic_sq_task *task, u32 *queue_info, if (ip.v4->version == 4) { l3_type = IPV4_PKT_NO_CHKSUM_OFFLOAD; + l4_proto = ip.v4->protocol; } else if (ip.v4->version == 6) { + unsigned char *exthdr; + __be16 frag_off; + l3_type = IPV6_PKT; #ifdef HAVE_OUTER_IPV6_TUNNEL_OFFLOAD tunnel_type = TUNNEL_UDP_CSUM; #endif + exthdr = ip.hdr + sizeof(*ip.v6); + l4_proto = ip.v6->nexthdr; + l4.hdr = skb_transport_header(skb); + if (l4.hdr != exthdr) + ipv6_skip_exthdr(skb, exthdr - skb->data, + &l4_proto, &frag_off); } else { l3_type = UNKNOWN_L3TYPE; + l4_proto = IPPROTO_RAW; } hinic_task_set_outter_l3(task, l3_type, skb_network_header_len(skb)); - l4_tunnel_len = skb_inner_network_offset(skb) - - skb_transport_offset(skb); + if (l4_proto == IPPROTO_UDP || l4_proto == IPPROTO_GRE) { + l4_tunnel_len = skb_inner_network_offset(skb) - + skb_transport_offset(skb); + ip.hdr = skb_inner_network_header(skb); + l4.hdr = skb_inner_transport_header(skb); + network_hdr_len = skb_inner_network_header_len(skb); + } else { + tunnel_type = NOT_TUNNEL; + l4_tunnel_len = 0; - hinic_task_set_tunnel_l4(task, tunnel_type, l4_tunnel_len); + ip.hdr = skb_inner_network_header(skb); + l4.hdr = skb_transport_header(skb); + network_hdr_len = skb_network_header_len(skb); + } - ip.hdr = skb_inner_network_header(skb); - l4.hdr = skb_inner_transport_header(skb); - network_hdr_len = skb_inner_network_header_len(skb); + hinic_task_set_tunnel_l4(task, tunnel_type, l4_tunnel_len); } else { ip.hdr = skb_network_header(skb); l4.hdr = skb_transport_header(skb); -- 1.8.3

1 0

[PATCH 1/3] USB: core: Fix free-while-in-use bug in the USB S-Glibrary
by Yang Yingliang 09 May '20

09 May '20

From: Alan Stern <stern(a)rowland.harvard.edu> mainline inclusion from mainline-v5.7-rc3 commit 056ad39ee9253873522f6469c3364964a322912b category: bugfix bugzilla: 13690 CVE: CVE-2020-12464 ------------------------------------------------- FuzzUSB (a variant of syzkaller) found a free-while-still-in-use bug in the USB scatter-gather library: BUG: KASAN: use-after-free in atomic_read include/asm-generic/atomic-instrumented.h:26 [inline] BUG: KASAN: use-after-free in usb_hcd_unlink_urb+0x5f/0x170 drivers/usb/core/hcd.c:1607 Read of size 4 at addr ffff888065379610 by task kworker/u4:1/27 CPU: 1 PID: 27 Comm: kworker/u4:1 Not tainted 5.5.11 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Workqueue: scsi_tmf_2 scmd_eh_abort_handler Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xce/0x128 lib/dump_stack.c:118 print_address_description.constprop.4+0x21/0x3c0 mm/kasan/report.c:374 __kasan_report+0x153/0x1cb mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:639 check_memory_region_inline mm/kasan/generic.c:185 [inline] check_memory_region+0x152/0x1b0 mm/kasan/generic.c:192 __kasan_check_read+0x11/0x20 mm/kasan/common.c:95 atomic_read include/asm-generic/atomic-instrumented.h:26 [inline] usb_hcd_unlink_urb+0x5f/0x170 drivers/usb/core/hcd.c:1607 usb_unlink_urb+0x72/0xb0 drivers/usb/core/urb.c:657 usb_sg_cancel+0x14e/0x290 drivers/usb/core/message.c:602 usb_stor_stop_transport+0x5e/0xa0 drivers/usb/storage/transport.c:937 This bug occurs when cancellation of the S-G transfer races with transfer completion. When that happens, usb_sg_cancel() may continue to access the transfer's URBs after usb_sg_wait() has freed them. The bug is caused by the fact that usb_sg_cancel() does not take any sort of reference to the transfer, and so there is nothing to prevent the URBs from being deallocated while the routine is trying to use them. The fix is to take such a reference by incrementing the transfer's io->count field while the cancellation is in progres and decrementing it afterward. The transfer's URBs are not deallocated until io->complete is triggered, which happens when io->count reaches zero. Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Reported-and-tested-by: Kyungtae Kim <kt0755(a)gmail.com> CC: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.2003281615140.14837-100000@netrid… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/usb/core/message.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c index 0d3fd20..fcf84bf 100644 --- a/drivers/usb/core/message.c +++ b/drivers/usb/core/message.c @@ -588,12 +588,13 @@ void usb_sg_cancel(struct usb_sg_request *io) int i, retval; spin_lock_irqsave(&io->lock, flags); - if (io->status) { + if (io->status || io->count == 0) { spin_unlock_irqrestore(&io->lock, flags); return; } /* shut everything down */ io->status = -ECONNRESET; + io->count++; /* Keep the request alive until we're done */ spin_unlock_irqrestore(&io->lock, flags); for (i = io->entries - 1; i >= 0; --i) { @@ -607,6 +608,12 @@ void usb_sg_cancel(struct usb_sg_request *io) dev_warn(&io->dev->dev, "%s, unlink --> %d\n", __func__, retval); } + + spin_lock_irqsave(&io->lock, flags); + io->count--; + if (!io->count) + complete(&io->complete); + spin_unlock_irqrestore(&io->lock, flags); } EXPORT_SYMBOL_GPL(usb_sg_cancel); -- 1.8.3

1 2

[PATCH 1/2] net: hns3: update hns3 version to 1.9.37.9
by Yang Yingliang 09 May '20

09 May '20

From: Shengzui You <youshengzui(a)huawei.com> driver inclusion category: other bugzilla: NA CVE: NA --------------------------------- This patch is used to modify the hns3 driver version to 1.9.37.9 Signed-off-by: Shengzui You <youshengzui(a)huawei.com> Reviewed-by: Weiwei Deng <dengweiwei(a)huawei.com> Reviewed-by: Zhaohui Zhong <zhongzhaohui(a)huawei.com> Reviewed-by: Junxin Chen <chenjunxin1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_version.h | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h index 5253374..14b3991 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h +++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h @@ -30,7 +30,7 @@ #include <linux/pci.h> #include <linux/types.h> -#define HNAE3_MOD_VERSION "1.9.37.8" +#define HNAE3_MOD_VERSION "1.9.37.9" #define HNAE3_MIN_VECTOR_NUM 2 /* first one for misc, another for IO */ diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_version.h b/drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_version.h index 34ff097..b89b110 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_version.h +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_version.h @@ -4,7 +4,7 @@ #ifndef __HNS3_CAE_VERSION_H__ #define __HNS3_CAE_VERSION_H__ -#define HNS3_CAE_MOD_VERSION "1.9.37.8" +#define HNS3_CAE_MOD_VERSION "1.9.37.9" #define CMT_ID_LEN 8 #define RESV_LEN 3 diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h index 4567c2c..62f34e9 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h @@ -8,7 +8,7 @@ #include "hnae3.h" -#define HNS3_MOD_VERSION "1.9.37.8" +#define HNS3_MOD_VERSION "1.9.37.9" extern char hns3_driver_version[]; diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h index 80270e4..15af034 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h @@ -12,7 +12,7 @@ #include "hclge_cmd.h" #include "hnae3.h" -#define HCLGE_MOD_VERSION "1.9.37.8" +#define HCLGE_MOD_VERSION "1.9.37.9" #define HCLGE_DRIVER_NAME "hclge" #define HCLGE_MAX_PF_NUM 8 diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h index bd24595..f89ee1b 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h +++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h @@ -10,7 +10,7 @@ #include "hclgevf_cmd.h" #include "hnae3.h" -#define HCLGEVF_MOD_VERSION "1.9.37.8" +#define HCLGEVF_MOD_VERSION "1.9.37.9" #define HCLGEVF_DRIVER_NAME "hclgevf" #define HCLGEVF_MAX_VLAN_ID 4095 -- 1.8.3

1 1

[PATCH] Revert "scsi: fix failing unload of a LLDD module"
by Yang Yingliang 09 May '20

09 May '20

From: Ye Bin <yebin10(a)huawei.com> hulk inclusion category: bugfix bugzilla: 34271 CVE: NA -------------------------------- This reverts commit fd72360bc94ad304136beb56e8ff2ec089113bb8. test setp: ... rmmod hisi_sas_v3_hw lsmod fdisk -l insomd hisi_sas_v3_hw.ko lsmod fdisk -l .... We get follow error when we test by above test steps. [ 3660.259153] [ffff00000116f000] pgd=00002027ffffe003, pud=00002027ffffd003, pmd=00002027cdf28003, pte=0000000000000000 [ 3660.269719] Internal error: Oops: 96000007 [#1] PREEMPT SMP [ 3660.275266] Modules linked in: hisi_sas_v3_hw(+) hisi_sas_main hns_roce_hw_v2(O) hns_roce(O) rpcrdma ib_isert iscsi_target_mod ib_iser libiscsi scsi_transport_iscsi ib_ipoib ib_umad realtek hns3(O) hclge(O) hnae3(O) crc32_ce crct10dif_ce hisi_hpre hisi_zip hisi_qm uacce hisi_trng_v2 rng_core sfc lbc ip_tables x_tables libsas scsi_transport_sas [last unloaded: hisi_sas_main] [ 3660.308227] Process smartd (pid: 19570, stack limit = 0x000000001103634d) [ 3660.314985] CPU: 31 PID: 19570 Comm: smartd Kdump: loaded Tainted: G O 4.19.36-g32894fc #1 [ 3660.324504] Hardware name: Huawei TaiShan 200 (Model 2280)/BC82AMDD, BIOS 2280-V2 CS V3.B220.02 03/27/2020 [ 3660.334110] pstate: 60400009 (nZCv daif +PAN -UAO) [ 3660.338882] pc : scsi_device_put+0x18/0x38 [ 3660.342961] lr : scsi_disk_put+0x3c/0x58 [ 3660.346865] sp : ffff0000158a3cb0 [ 3660.350164] x29: ffff0000158a3cb0 x28: ffff8027b8111000 [ 3660.355451] x27: 00000000080a005d x26: 0000000000000000 [ 3660.360738] x25: ffff8027c6310398 x24: ffff8027cd2ec410 [ 3660.366025] x23: ffff000009811000 x22: ffff80276d274750 [ 3660.371312] x21: ffff8027abdd5000 x20: ffff8027b8110800 [ 3660.376599] x19: ffff8027abdd5000 x18: 0000000000000000 [ 3660.381886] x17: 0000000000000000 x16: 0000000000000000 [ 3660.387172] x15: 0000000000000000 x14: 0000000000000000 [ 3660.392459] x13: ffff000009996cd0 x12: ffffffffffffffff [ 3660.397746] x11: ffff000009996cc8 x10: 0000000000000000 [ 3660.403033] x9 : 0000000000000000 x8 : 0000000040000000 [ 3660.408320] x7 : ffff0000098116c8 x6 : 0000000000000000 [ 3660.413607] x5 : ffff00000820ebbc x4 : ffff7e009eb8fb20 [ 3660.418894] x3 : 0000000080400009 x2 : ffff8027ae3ec600 [ 3660.424180] x1 : 71b6030ca20bb300 x0 : ffff00000116f000 [ 3660.429467] Call trace: [ 3660.431904] scsi_device_put+0x18/0x38 [ 3660.435636] scsi_disk_put+0x3c/0x58 [ 3660.439195] sd_release+0x50/0xc0 [ 3660.442496] __blkdev_put+0x20c/0x220 [ 3660.446141] blkdev_put+0x4c/0x110 [ 3660.449527] blkdev_close+0x1c/0x28 [ 3660.453000] __fput+0x88/0x1b8 [ 3660.456042] ____fput+0xc/0x18 [ 3660.459085] task_work_run+0x94/0xb0 [ 3660.462646] do_notify_resume+0x17c/0x180 [ 3660.466637] work_pending+0x8/0x10 [ 3660.470022] Code: f9000bf3 aa0003f3 f9400000 f9404c00 (f9400000) [ 3660.476089] ---[ end trace ca1d0144f9241f71 ]--- void scsi_device_put(struct scsi_device *sdev) { module_put(sdev->host->hostt->module); ---> error code put_device(&sdev->sdev_gendev); } When access "sdev->host->hostt" occurs exception, as "sdev->host->hostt" is point to the module address space which is already removed. module_delete first check module reference count, then call module exit function. So after pass module reference count check and before call module exit, we can call scsi_device_get function successfully. As "scsi: fix failing unload of a LLDD module" lead to call scsi_device_get success during remove module. We revert this patch, "scsi: fixup kernel warning during rmmod()" already fixed previous error. Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/scsi/scsi.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c index 7d472c2..fc1356d 100644 --- a/drivers/scsi/scsi.c +++ b/drivers/scsi/scsi.c @@ -544,6 +544,9 @@ int scsi_report_opcode(struct scsi_device *sdev, unsigned char *buffer, * Description: Gets a reference to the scsi_device and increments the use count * of the underlying LLDD module. You must hold host_lock of the * parent Scsi_Host or already have a reference when calling this. + * + * This will fail if a device is deleted or cancelled, or when the LLD module + * is in the process of being unloaded. */ int scsi_device_get(struct scsi_device *sdev) { @@ -551,12 +554,12 @@ int scsi_device_get(struct scsi_device *sdev) goto fail; if (!get_device(&sdev->sdev_gendev)) goto fail; - /* We can fail try_module_get if we're doing SCSI operations - * from module exit (like cache flush) - */ - __module_get(sdev->host->hostt->module); + if (!try_module_get(sdev->host->hostt->module)) + goto fail_put_device; return 0; +fail_put_device: + put_device(&sdev->sdev_gendev); fail: return -ENXIO; } -- 1.8.3

1 0

[PATCH] s390/mm: fix page table upgrade vs 2ndary address mode accesses
by Yang Yingliang 09 May '20

09 May '20

From: Christian Borntraeger <borntraeger(a)de.ibm.com> mainline inclusion from mainline-v5.7-rc4 commit 316ec154810960052d4586b634156c54d0778f74 category: bugfix bugzilla: 13690 CVE: CVE-2020-11884 ------------------------------------------------- A page table upgrade in a kernel section that uses secondary address mode will mess up the kernel instructions as follows: Consider the following scenario: two threads are sharing memory. On CPU1 thread 1 does e.g. strnlen_user(). That gets to old_fs = enable_sacf_uaccess(); len = strnlen_user_srst(src, size); and " la %2,0(%1)\n" " la %3,0(%0,%1)\n" " slgr %0,%0\n" " sacf 256\n" "0: srst %3,%2\n" in strnlen_user_srst(). At that point we are in secondary space mode, control register 1 points to kernel page table and instruction fetching happens via c1, rather than usual c13. Interrupts are not disabled, for obvious reasons. On CPU2 thread 2 does MAP_FIXED mmap(), forcing the upgrade of page table from 3-level to e.g. 4-level one. We'd allocated new top-level table, set it up and now we hit this: notify = 1; spin_unlock_bh(&mm->page_table_lock); } if (notify) on_each_cpu(__crst_table_upgrade, mm, 0); OK, we need to actually change over to use of new page table and we need that to happen in all threads that are currently running. Which happens to include the thread 1. IPI is delivered and we have static void __crst_table_upgrade(void *arg) { struct mm_struct *mm = arg; if (current->active_mm == mm) set_user_asce(mm); __tlb_flush_local(); } run on CPU1. That does static inline void set_user_asce(struct mm_struct *mm) { S390_lowcore.user_asce = mm->context.asce; OK, user page table address updated... __ctl_load(S390_lowcore.user_asce, 1, 1); ... and control register 1 set to it. clear_cpu_flag(CIF_ASCE_PRIMARY); } IPI is run in home space mode, so it's fine - insns are fetched using c13, which always points to kernel page table. But as soon as we return from the interrupt, previous PSW is restored, putting CPU1 back into secondary space mode, at which point we no longer get the kernel instructions from the kernel mapping. The fix is to only fixup the control registers that are currently in use for user processes during the page table update. We must also disable interrupts in enable_sacf_uaccess to synchronize the cr and thread.mm_segment updates against the on_each-cpu. Fixes: 0aaba41b58bc ("s390: remove all code using the access register mode") Cc: stable(a)vger.kernel.org # 4.15+ Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Reviewed-by: Gerald Schaefer <gerald.schaefer(a)de.ibm.com> References: CVE-2020-11884 Signed-off-by: Christian Borntraeger <borntraeger(a)de.ibm.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/s390/lib/uaccess.c | 4 ++++ arch/s390/mm/pgalloc.c | 16 ++++++++++++++-- 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/arch/s390/lib/uaccess.c b/arch/s390/lib/uaccess.c index c4f8039..0267405 100644 --- a/arch/s390/lib/uaccess.c +++ b/arch/s390/lib/uaccess.c @@ -64,10 +64,13 @@ mm_segment_t enable_sacf_uaccess(void) { mm_segment_t old_fs; unsigned long asce, cr; + unsigned long flags; old_fs = current->thread.mm_segment; if (old_fs & 1) return old_fs; + /* protect against a concurrent page table upgrade */ + local_irq_save(flags); current->thread.mm_segment |= 1; asce = S390_lowcore.kernel_asce; if (likely(old_fs == USER_DS)) { @@ -83,6 +86,7 @@ mm_segment_t enable_sacf_uaccess(void) __ctl_load(asce, 7, 7); set_cpu_flag(CIF_ASCE_SECONDARY); } + local_irq_restore(flags); return old_fs; } EXPORT_SYMBOL(enable_sacf_uaccess); diff --git a/arch/s390/mm/pgalloc.c b/arch/s390/mm/pgalloc.c index 814f265..f3bc9c9 100644 --- a/arch/s390/mm/pgalloc.c +++ b/arch/s390/mm/pgalloc.c @@ -72,8 +72,20 @@ static void __crst_table_upgrade(void *arg) { struct mm_struct *mm = arg; - if (current->active_mm == mm) - set_user_asce(mm); + /* we must change all active ASCEs to avoid the creation of new TLBs */ + if (current->active_mm == mm) { + S390_lowcore.user_asce = mm->context.asce; + if (current->thread.mm_segment == USER_DS) { + __ctl_load(S390_lowcore.user_asce, 1, 1); + /* Mark user-ASCE present in CR1 */ + clear_cpu_flag(CIF_ASCE_PRIMARY); + } + if (current->thread.mm_segment == USER_DS_SACF) { + __ctl_load(S390_lowcore.user_asce, 7, 7); + /* enable_sacf_uaccess does all or nothing */ + WARN_ON(!test_cpu_flag(CIF_ASCE_SECONDARY)); + } + } __tlb_flush_local(); } -- 1.8.3

1 0

[PATCH kernel-4.19] kernel: just for testing
by Xie XiuQi 07 May '20

07 May '20

just for testing openeuler kernel ci. Signed-off-by: Xie XiuQi <xiexiuqi(a)huawei.com> --- init/version.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/init/version.c b/init/version.c index ef4012ec4375..b8871517a6b2 100644 --- a/init/version.c +++ b/init/version.c @@ -43,7 +43,7 @@ EXPORT_SYMBOL_GPL(init_uts_ns); /* FIXED STRINGS! Don't touch! */ const char linux_banner[] = - "Linux version " UTS_RELEASE " (" LINUX_COMPILE_BY "@" + "Linux Version " UTS_RELEASE " (" LINUX_COMPILE_BY "@" LINUX_COMPILE_HOST ") (" LINUX_COMPILER ") " UTS_VERSION "\n"; const char linux_proc_banner[] = -- 2.20.1

1 0

[PATCH kernel-4.19] kernel: just for testing
by Xie XiuQi 07 May '20

07 May '20

just for testing openeuler kernel ci. Signed-off-by: Xie XiuQi <xiexiuqi(a)huawei.com> --- init/version.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/init/version.c b/init/version.c index ef4012ec4375..b8871517a6b2 100644 --- a/init/version.c +++ b/init/version.c @@ -43,7 +43,7 @@ EXPORT_SYMBOL_GPL(init_uts_ns); /* FIXED STRINGS! Don't touch! */ const char linux_banner[] = - "Linux version " UTS_RELEASE " (" LINUX_COMPILE_BY "@" + "Linux Version " UTS_RELEASE " (" LINUX_COMPILE_BY "@" LINUX_COMPILE_HOST ") (" LINUX_COMPILER ") " UTS_VERSION "\n"; const char linux_proc_banner[] = -- 2.20.1

1 0

[PATCH 1/3] blk-mq: use static_rqs instead of rqs to iterate tags
by Yang Yingliang 06 May '20

06 May '20

From: yu kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 34280 CVE: NA --------------------------- tags->rqs[] will not been cleaned when free driver tag to avoid an extra store on a shared area in the per io path. But there is a window between get driver tag and write tags->rqs[], so we may see stale rq in tags->rqs[] which may have been freed, as the following case: blk_mq_get_request blk_mq_queue_tag_busy_iter -> blk_mq_get_tag -> bt_for_each -> bt_iter -> rq = tags->rqs[] -> rq->q -> blk_mq_rq_ctx_init -> data->hctx->tags->rqs[rq->tag] = rq; In additiion, tags->rqs[] only contains the requests that get driver tag. It is not accurate for io-scheduler case when account busy tags in part_in_flight. To fix both of them, the blk_mq_queue_tag_busy_iter is changed in this patch to use tags->static_rqs[] instead of tags->rqs[]. We have to identify whether there is a io scheduler attached to decide to use hctx->tags or hctx->sched_tags. And we will try to get a non-zero q_usage_counter before that, then could avoid race with update nr_hw_queues, switch io-scheduler and even queue cleanup. Add 'inflight' parameter to determine to iterate in-flight requests or just busy tags and add a new helper interface blk_mq_queue_tag_inflight_iter to iterate all of the in-flight tags and export this interface for drivers. Signed-off-by: yu kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-mq-tag.c | 77 ++++++++++++++++++++++++++++++++++++++++---------- block/blk-mq.c | 6 ++-- include/linux/blk-mq.h | 3 +- 3 files changed, 67 insertions(+), 19 deletions(-) diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c index 41317c5..323bbca 100644 --- a/block/blk-mq-tag.c +++ b/block/blk-mq-tag.c @@ -216,37 +216,51 @@ struct bt_iter_data { busy_iter_fn *fn; void *data; bool reserved; + bool inflight; }; static bool bt_iter(struct sbitmap *bitmap, unsigned int bitnr, void *data) { struct bt_iter_data *iter_data = data; struct blk_mq_hw_ctx *hctx = iter_data->hctx; - struct blk_mq_tags *tags = hctx->tags; bool reserved = iter_data->reserved; + struct blk_mq_tags *tags; struct request *rq; + tags = hctx->sched_tags ? hctx->sched_tags : hctx->tags; + if (!reserved) bitnr += tags->nr_reserved_tags; - rq = tags->rqs[bitnr]; /* - * We can hit rq == NULL here, because the tagging functions - * test and set the bit before assining ->rqs[]. + * Because tags->rqs[] will not been cleaned when free driver tag + * and there is a window between get driver tag and write tags->rqs[], + * so we may see stale rq in tags->rqs[] which may have been freed. + * Using static_rqs[] is safer. */ - if (rq && rq->q == hctx->queue) + rq = tags->static_rqs[bitnr]; + + /* + * There is a small window between get tag and blk_mq_rq_ctx_init, + * so rq->q and rq->mq_hctx maybe different. + */ + if (rq && rq->q == hctx->queue && + (!iter_data->inflight || + blk_mq_rq_state(rq) == MQ_RQ_IN_FLIGHT)) iter_data->fn(hctx, rq, iter_data->data, reserved); return true; } -static void bt_for_each(struct blk_mq_hw_ctx *hctx, struct sbitmap_queue *bt, - busy_iter_fn *fn, void *data, bool reserved) +static void bt_for_each(struct blk_mq_hw_ctx *hctx, + struct sbitmap_queue *bt, busy_iter_fn *fn, + void *data, bool reserved, bool inflight) { struct bt_iter_data iter_data = { .hctx = hctx, .fn = fn, .data = data, .reserved = reserved, + .inflight = inflight, }; sbitmap_for_each_set(&bt->sb, bt_iter, &iter_data); @@ -314,22 +328,23 @@ void blk_mq_tagset_busy_iter(struct blk_mq_tag_set *tagset, } EXPORT_SYMBOL(blk_mq_tagset_busy_iter); -void blk_mq_queue_tag_busy_iter(struct request_queue *q, busy_iter_fn *fn, - void *priv) +static void __blk_mq_queue_tag_busy_iter(struct request_queue *q, + busy_iter_fn *fn, void *priv, bool inflight) { struct blk_mq_hw_ctx *hctx; int i; /* - * __blk_mq_update_nr_hw_queues will update the nr_hw_queues and - * queue_hw_ctx after freeze the queue, so we use q_usage_counter - * to avoid race with it. + * Get a reference of the queue unless it has been zero. We use this + * to avoid the race with the code that would modify the hctxs after + * freeze and drain the queue, including updating nr_hw_queues, io + * scheduler switching and queue clean up. */ if (!percpu_ref_tryget(&q->q_usage_counter)) return; queue_for_each_hw_ctx(q, hctx, i) { - struct blk_mq_tags *tags = hctx->tags; + struct blk_mq_tags *tags; /* * If not software queues are currently mapped to this @@ -338,13 +353,45 @@ void blk_mq_queue_tag_busy_iter(struct request_queue *q, busy_iter_fn *fn, if (!blk_mq_hw_queue_mapped(hctx)) continue; + tags = hctx->sched_tags ? hctx->sched_tags : hctx->tags; + if (tags->nr_reserved_tags) - bt_for_each(hctx, &tags->breserved_tags, fn, priv, true); - bt_for_each(hctx, &tags->bitmap_tags, fn, priv, false); + bt_for_each(hctx, &tags->breserved_tags, + fn, priv, true, inflight); + bt_for_each(hctx, &tags->bitmap_tags, + fn, priv, false, inflight); + /* + * flush_rq represents the rq with REQ_PREFLUSH and REQ_FUA + * (if FUA is not supported by device) to be issued to + * device. So we need to consider it when iterate inflight + * rqs, but needn't to count it when iterate busy tags. + */ + if (inflight && + blk_mq_rq_state(hctx->fq->flush_rq) == MQ_RQ_IN_FLIGHT) + fn(hctx, hctx->fq->flush_rq, priv, false); } blk_queue_exit(q); } +/* + * Iterate all the busy tags including pending and in-flight ones. + */ +void blk_mq_queue_tag_busy_iter(struct request_queue *q, busy_iter_fn *fn, + void *priv) +{ + __blk_mq_queue_tag_busy_iter(q, fn, priv, false); +} + +/* + * Iterate all the inflight tags. + */ +void blk_mq_queue_tag_inflight_iter(struct request_queue *q, + busy_iter_fn *fn, void *priv) +{ + __blk_mq_queue_tag_busy_iter(q, fn, priv, true); +} +EXPORT_SYMBOL(blk_mq_queue_tag_inflight_iter); + static int bt_alloc(struct sbitmap_queue *bt, unsigned int depth, bool round_robin, int node) { diff --git a/block/blk-mq.c b/block/blk-mq.c index 8a7c3d8..ee07575 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -112,7 +112,7 @@ void blk_mq_in_flight(struct request_queue *q, struct hd_struct *part, struct mq_inflight mi = { .part = part, .inflight = inflight, }; inflight[0] = inflight[1] = 0; - blk_mq_queue_tag_busy_iter(q, blk_mq_check_inflight, &mi); + blk_mq_queue_tag_inflight_iter(q, blk_mq_check_inflight, &mi); } static void blk_mq_check_inflight_rw(struct blk_mq_hw_ctx *hctx, @@ -131,7 +131,7 @@ void blk_mq_in_flight_rw(struct request_queue *q, struct hd_struct *part, struct mq_inflight mi = { .part = part, .inflight = inflight, }; inflight[0] = inflight[1] = 0; - blk_mq_queue_tag_busy_iter(q, blk_mq_check_inflight_rw, &mi); + blk_mq_queue_tag_inflight_iter(q, blk_mq_check_inflight_rw, &mi); } void blk_freeze_queue_start(struct request_queue *q) @@ -875,7 +875,7 @@ static void blk_mq_timeout_work(struct work_struct *work) if (!percpu_ref_tryget(&q->q_usage_counter)) return; - blk_mq_queue_tag_busy_iter(q, blk_mq_check_expired, &next); + blk_mq_queue_tag_inflight_iter(q, blk_mq_check_expired, &next); if (next != 0) { mod_timer(&q->timeout, next); diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h index 6578070..149d411 100644 --- a/include/linux/blk-mq.h +++ b/include/linux/blk-mq.h @@ -320,7 +320,8 @@ void blk_mq_tagset_busy_iter(struct blk_mq_tag_set *tagset, void blk_mq_freeze_queue_wait(struct request_queue *q); int blk_mq_freeze_queue_wait_timeout(struct request_queue *q, unsigned long timeout); - +void blk_mq_queue_tag_inflight_iter(struct request_queue *q, busy_iter_fn *fn, + void *priv); int blk_mq_map_queues(struct blk_mq_tag_set *set); void blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, int nr_hw_queues); -- 1.8.3

1 2

[PATCH] perf: Make perf able to build with latest libbfd
by Yang Yingliang 06 May '20

06 May '20

From: Changbin Du <changbin.du(a)gmail.com> mainline inclusion from mainline-5.6 commit 0ada120c883d4f1f6aafd01cf0fbb10d8bbba015 category: bugfix bugzilla: 34555 CVE: NA ------------------------------------------------- libbfd has changed the bfd_section_* macros to inline functions bfd_section_<field> since 2019-09-18. See below two commits: o http://www.sourceware.org/ml/gdb-cvs/2019-09/msg00064.html o https://www.sourceware.org/ml/gdb-cvs/2019-09/msg00072.html This fix make perf able to build with both old and new libbfd. Signed-off-by: Changbin Du <changbin.du(a)gmail.com> Acked-by: Jiri Olsa <jolsa(a)redhat.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Link: http://lore.kernel.org/lkml/20200128152938.31413-1-changbin.du@gmail.com Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> Signed-off-by: Xie XiuQi <xiexiuqi(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- tools/perf/util/srcline.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/tools/perf/util/srcline.c b/tools/perf/util/srcline.c index af3f9b9..b8e7761 100644 --- a/tools/perf/util/srcline.c +++ b/tools/perf/util/srcline.c @@ -191,16 +191,30 @@ static void find_address_in_section(bfd *abfd, asection *section, void *data) bfd_vma pc, vma; bfd_size_type size; struct a2l_data *a2l = data; + flagword flags; if (a2l->found) return; - if ((bfd_get_section_flags(abfd, section) & SEC_ALLOC) == 0) +#ifdef bfd_get_section_flags + flags = bfd_get_section_flags(abfd, section); +#else + flags = bfd_section_flags(section); +#endif + if ((flags & SEC_ALLOC) == 0) return; pc = a2l->addr; +#ifdef bfd_get_section_vma vma = bfd_get_section_vma(abfd, section); +#else + vma = bfd_section_vma(section); +#endif +#ifdef bfd_get_section_size size = bfd_get_section_size(section); +#else + size = bfd_section_size(section); +#endif if (pc < vma || pc >= vma + size) return; -- 1.8.3

1 0

hello
by chenzy 30 Apr '20

30 Apr '20

subscribe linux-kernel

3 2

[PATCH] pcie_cae support getting chipnums of this system
by Yang Yingliang 28 Apr '20

28 Apr '20

From: Liu Yanshi <liuyanshi(a)huawei.com> driver inclusion category: feature bugzilla: NA CVE: NA pcie_cae add interface to get the chipnums of the current system. Signed-off-by: Liu Yanshi <liuyanshi(a)huawei.com> Reviewed-by: Zhu Xiongxiong <zhuxiongxiong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- .../controller/hisi-pcie-customer/hisi_pcie_cae.c | 37 ++++++++++++++++++++-- 1 file changed, 34 insertions(+), 3 deletions(-) diff --git a/drivers/pci/controller/hisi-pcie-customer/hisi_pcie_cae.c b/drivers/pci/controller/hisi-pcie-customer/hisi_pcie_cae.c index 8d0c801..6229a54 100644 --- a/drivers/pci/controller/hisi-pcie-customer/hisi_pcie_cae.c +++ b/drivers/pci/controller/hisi-pcie-customer/hisi_pcie_cae.c @@ -3,6 +3,7 @@ #include <linux/mm.h> #include <linux/miscdevice.h> +#include <linux/uaccess.h> #include <linux/device.h> #include <linux/module.h> #include <linux/io.h> @@ -21,6 +22,7 @@ #define CHIP_INFO_REG_SIZE 4 #define TYPE_SHIFT 4 #define BIT_SHIFT_8 8 +#define PCIE_CMD_GET_CHIPNUMS 0x01 #define DEVICE_NAME "pcie_reg_dev" @@ -37,7 +39,7 @@ enum { MMAP_TYPE_VIRTIO }; -static int current_chip_nums; +static u32 current_chip_nums; static const struct vm_operations_struct mmap_pcie_mem_ops = { #ifdef CONFIG_HAVE_IOREMAP_PROT @@ -100,10 +102,10 @@ static int pcie_reg_mmap(struct file *filep, struct vm_area_struct *vma) return 0; } -int pcie_get_chipnums(u32 cpu_info) +u32 pcie_get_chipnums(u32 cpu_info) { int i; - int chip_count = 0; + u32 chip_count = 0; u32 chip_i_info; for (i = 0; i < MAX_CHIP_NUM; i++) { @@ -144,12 +146,41 @@ static int pcie_release(struct inode *inode, struct file *f) return 0; } +static long pcie_reg_ioctl(struct file *pfile, unsigned int cmd, + unsigned long arg) +{ + int ret = 0; + + switch (cmd) { + case PCIE_CMD_GET_CHIPNUMS: + if ((void *)arg == NULL) { + pr_info("[PCIe Base] invalid arg address\n"); + ret = -EINVAL; + break; + } + + if (copy_to_user((void *)arg, (void *)&current_chip_nums, + sizeof(int))) { + pr_info("[PCIe Base] copy chip_nums to usr failed\n"); + ret = -EINVAL; + } + break; + + default: + pr_info("[PCIe Base] invalid pcie ioctl cmd:%u\n", cmd); + break; + } + + return ret; +} + static const struct file_operations pcie_dfx_fops = { .owner = THIS_MODULE, .open = pcie_open, .release = pcie_release, .llseek = noop_llseek, .mmap = pcie_reg_mmap, + .unlocked_ioctl = pcie_reg_ioctl, }; static struct miscdevice pcie_dfx_misc = { -- 1.8.3

1 0

[PATCH v2] net: hns3: remove the unnecessary ccflags
by Zhengyuan Liu 28 Apr '20

28 Apr '20

category: other bugzilla: NA CVE: NA ---------------------------------- The ccflags removed in this patch shouldn't be in open kernel tree. Especially for -fstack-protector-strong, there will be a compile error when CONFIG_STACKPROTECTOR_STRONG isn't enabled. Signed-off-by: Zhengyuan Liu <liuzhengyuan(a)tj.kylinos.cn> --- drivers/net/ethernet/hisilicon/hns3/Makefile | 9 --------- 1 file changed, 9 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/Makefile b/drivers/net/ethernet/hisilicon/hns3/Makefile index 6653e81..0365f1c 100644 --- a/drivers/net/ethernet/hisilicon/hns3/Makefile +++ b/drivers/net/ethernet/hisilicon/hns3/Makefile @@ -3,15 +3,6 @@ # Makefile for the HISILICON network device drivers. # -# Add security options -ccflags-y += -fstack-protector-strong -ccflags-y += -Wl,-z,relro,-z,now -ccflags-y += -Wl,-z,noexecstack -ccflags-y += -D_FORTIFY_SOURCE=2 -O2 -ccflags-y += -fvisibility=hidden -ccflags-y += -Wformat=2 -Wfloat-equal -ccflags-y += -fsigned-char - ccflags-y += -DCONFIG_IT_VALIDATION ccflags-y += -DCONFIG_HNS3_TEST -- 2.7.4

3 2

Re: [Infra] Re: [Community] 转发：gitee上已更新issue，请及时查收
by Fred Li 27 Apr '20

27 Apr '20

cc kernel(a)openeuler.org. Just for members who may not know, dwadm(a)pcl.ac.cn is from 鹏程实验室 and will help on issues related with VMs in 鹏程实验室。 On Sun, Apr 26, 2020 at 10:08 AM Xie XiuQi via Infra <infra(a)openeuler.org> wrote: > 感谢你的热心参与，我们正在和鹏程实验室的兄弟联合定位 > On 2020/4/25 13:30, Qichen Zhang wrote: > > > Qichen Zhang > 邮箱：17852657226(a)163.com > > <https://maas.mail.163.com/dashi-web-extend/html/proSignature.html?ftlId=1&n…> > > 签名由网易邮箱大师 <https://mail.163.com/dashi/dlpro.html?from=mail88> 定制 > > --------- 转发的邮件 --------- > 发件人： Qichen Zhang <17852657226(a)163.com> > 发送日期： 2020年04月25日 13:26 > 收件人： Xiehong (Cynthia) <xiehong(a)huawei.com> > 抄送人： > 主题：回复：gitee上已更新issue，请及时查收 > 各位工程师 > 你们好! > > bug依然存在，还是报Message > kernel watchdog Bug soft lockup > 在issue上已发布，昨晚上七点多一直等到今天凌晨一点，依然存在bug。 > > 请各位工程师看看如何解决? > 上周五发现的这个bug，不能这么愣着啊 > 你们需要我做什么，阔以直接给我说哈， > 我叫张琦琛，手机号同微信号17852657226 > 希望大家一起努力尽快解决这个bug > > 盼回复 > > > Qichen Zhang > 邮箱：17852657226(a)163.com > > <https://maas.mail.163.com/dashi-web-extend/html/proSignature.html?ftlId=1&n…> > > 签名由网易邮箱大师 <https://mail.163.com/dashi/dlpro.html?from=mail88> 定制 > > 在2020年04月21日 14:17，Xiehong (Cynthia) <xiehong(a)huawei.com> 写道： > > HI > > > > 多谢！ > > > > 我们会在社区上的ISSUE系统上继续跟踪。 > > > > > > *发件人:* Qichen Zhang [mailto:17852657226@163.com] > *发送时间:* 2020年4月21日 13:27 > *收件人:* Xiehong (Cynthia) <xiehong(a)huawei.com> > *主题:* gitee上已更新issue，请及时查收 > > > > 尊敬的工程师 > > 您好！ > > > > 我已在 gitee 上已更新issue，请及时查收 > > https://gitee.com/openeuler/community/issues/I1F13I?from=project-issue > > 很乐意和大家一块解决这个bug。 > > — — > > Qichen Zhang > > > _______________________________________________ > Community mailing list -- community(a)openeuler.org > To unsubscribe send an email to community-leave(a)openeuler.org > > _______________________________________________ > Infra mailing list -- infra(a)openeuler.org > To unsubscribe send an email to infra-leave(a)openeuler.org > -- Regards Fred Li (李永乐)

1 0

[PATCH 01/25] net: hns3: merge mac state HCLGE_MAC_TO_DEL and HCLGE_MAC_DEL_FAIL
by Yang Yingliang 26 Apr '20

26 Apr '20

From: shenhao <shenhao21(a)huawei.com> driver inclusion category: bugfix bugzilla: NA CVE: NA -------------------------------------------- HCLGE_MAC_DEL_FAIL is a middle state for mac address handling, it can be merged with HCLGE_MAC_TO_DEL. Btw, this patch also change the enum name from HCLGE_MAC_ADDR_STATE to HCLGE_MAC_NODE_STATE, for it's used to indicate the state of mac node. Signed-off-by: Jian Shen <shenjian15(a)huawei.com> Signed-off-by: shenhao <shenhao21(a)huawei.com> Reviewed-by: Zhong Zhaohui <zhongzhaohui(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 46 ++++++++++------------ .../ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 9 ++--- 2 files changed, 25 insertions(+), 30 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c index 478a3b5..d985c68 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c @@ -7422,14 +7422,13 @@ static void hclge_update_umv_space(struct hclge_vport *vport, bool is_free) return NULL; } -static void hclge_mac_node_convert(struct hclge_vport_mac_addr_cfg *mac_node, - enum HCLGE_MAC_ADDR_STATE state) +static void hclge_update_mac_node(struct hclge_vport_mac_addr_cfg *mac_node, + enum HCLGE_MAC_NODE_STATE state) { switch (state) { /* from set_rx_mode or tmp_add_list */ case HCLGE_MAC_TO_ADD: - if (mac_node->state == HCLGE_MAC_TO_DEL || - mac_node->state == HCLGE_MAC_DEL_FAIL) + if (mac_node->state == HCLGE_MAC_TO_DEL) mac_node->state = HCLGE_MAC_ACTIVE; break; /* only from set_rx_mode */ @@ -7442,14 +7441,7 @@ static void hclge_mac_node_convert(struct hclge_vport_mac_addr_cfg *mac_node, } break; /* only from tmp_add_list, the mac_node->state won't be - * HCLGE_MAC_ACTIVE/HCLGE_MAC_DEL_FAIL/HCLGE_MAC_ADD_FAIL - */ - case HCLGE_MAC_DEL_FAIL: - if (mac_node->state == HCLGE_MAC_TO_ADD) - mac_node->state = HCLGE_MAC_ACTIVE; - break; - /* only from tmp_add_list, the mac_node->state won't be - * HCLGE_MAC_ACTIVE/HCLGE_MAC_DEL_FAIL/HCLGE_MAC_ADD_FAIL + * ACTIVE. */ case HCLGE_MAC_ACTIVE: if (mac_node->state == HCLGE_MAC_TO_ADD) @@ -7460,7 +7452,7 @@ static void hclge_mac_node_convert(struct hclge_vport_mac_addr_cfg *mac_node, } int hclge_update_mac_list(struct hclge_vport *vport, - enum HCLGE_MAC_ADDR_STATE state, + enum HCLGE_MAC_NODE_STATE state, enum HCLGE_MAC_ADDR_TYPE mac_type, const unsigned char *addr) { @@ -7480,7 +7472,7 @@ int hclge_update_mac_list(struct hclge_vport *vport, */ mac_node = hclge_find_mac_node(list, addr); if (mac_node) { - hclge_mac_node_convert(mac_node, state); + hclge_update_mac_node(mac_node, state); spin_unlock_bh(&vport->mac_list_lock); return 0; } @@ -7731,7 +7723,6 @@ static void hclge_unsync_mac_list(struct hclge_vport *vport, list_del(&mac_node->node); kfree(mac_node); } else { - mac_node->state = HCLGE_MAC_DEL_FAIL; set_bit(HCLGE_VPORT_STATE_MAC_TBL_CHANGE, &vport->state); break; @@ -7753,13 +7744,13 @@ static bool hclge_sync_from_add_list(struct list_head *add_list, * uc/mc_mac_list, it means have received a TO_DEL request * during the time window of adding the mac address into mac * table. if mac_node state is ACTIVE, then change it to TO_DEL, - * then it will be removed at next time. else it must be TO_ADD - * or ADD_FAIL, this address hasn't been added into mac table, + * then it will be removed at next time. else it must be TO_ADD, + * this address hasn't been added into mac table, * so just remove the mac node. */ new_node = hclge_find_mac_node(mac_list, mac_node->mac_addr); if (new_node) { - hclge_mac_node_convert(new_node, mac_node->state); + hclge_update_mac_node(new_node, mac_node->state); list_del(&mac_node->node); kfree(mac_node); } else if (mac_node->state == HCLGE_MAC_ACTIVE) { @@ -7782,7 +7773,16 @@ static void hclge_sync_from_del_list(struct list_head *del_list, list_for_each_entry_safe(mac_node, tmp, del_list, node) { new_node = hclge_find_mac_node(mac_list, mac_node->mac_addr); if (new_node) { - hclge_mac_node_convert(new_node, mac_node->state); + /* If the mac addr exists in the mac list, it means + * received a new TO_ADD request during the time window + * of configuring the mac address. For the mac node + * state is TO_ADD, and the address is already in the + * in the hardware(due to delete fail), so we just need + * to change the mac node state to ACTIVE. + */ + new_node->state = HCLGE_MAC_ACTIVE; + list_del(&mac_node->node); + kfree(mac_node); } else { list_del(&mac_node->node); list_add_tail(&mac_node->node, mac_list); @@ -7850,7 +7850,6 @@ static void hclge_sync_vport_mac_table(struct hclge_vport *vport, list_for_each_entry_safe(mac_node, tmp, list, node) { switch (mac_node->state) { case HCLGE_MAC_TO_DEL: - case HCLGE_MAC_DEL_FAIL: list_del(&mac_node->node); list_add_tail(&mac_node->node, &tmp_del_list); break; @@ -7962,7 +7961,6 @@ void hclge_rm_vport_all_mac_table(struct hclge_vport *vport, bool is_del_list, list_for_each_entry_safe(mac_cfg, tmp, list, node) { switch (mac_cfg->state) { case HCLGE_MAC_TO_DEL: - case HCLGE_MAC_DEL_FAIL: case HCLGE_MAC_ACTIVE: list_del(&mac_cfg->node); list_add_tail(&mac_cfg->node, &tmp_del_list); @@ -8021,7 +8019,6 @@ static void hclge_uninit_mac_list(struct hclge_vport *vport, list_for_each_entry_safe(mac_node, tmp, list, node) { switch (mac_node->state) { case HCLGE_MAC_TO_DEL: - case HCLGE_MAC_DEL_FAIL: case HCLGE_MAC_ACTIVE: list_del(&mac_node->node); list_add_tail(&mac_node->node, &tmp_del_list); @@ -8221,7 +8218,7 @@ void hclge_replace_mac_node(struct list_head *list, const u8 *old_addr, } void hclge_modify_mac_node_state(struct list_head *list, const u8 *addr, - enum HCLGE_MAC_ADDR_STATE state) + enum HCLGE_MAC_NODE_STATE state) { struct hclge_vport_mac_addr_cfg *mac_node; @@ -8989,8 +8986,7 @@ static void hclge_mac_node_convert_for_reset(struct list_head *list) list_for_each_entry_safe(mac_node, tmp, list, node) { if (mac_node->state == HCLGE_MAC_ACTIVE) { mac_node->state = HCLGE_MAC_TO_ADD; - } else if (mac_node->state == HCLGE_MAC_TO_DEL || - mac_node->state == HCLGE_MAC_DEL_FAIL) { + } else if (mac_node->state == HCLGE_MAC_TO_DEL) { list_del(&mac_node->node); kfree(mac_node); } diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h index 5e462cf..a1fa782 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h @@ -640,16 +640,15 @@ struct hclge_fd_ad_data { u16 rule_id; }; -enum HCLGE_MAC_ADDR_STATE { +enum HCLGE_MAC_NODE_STATE { HCLGE_MAC_TO_ADD, HCLGE_MAC_TO_DEL, - HCLGE_MAC_DEL_FAIL, HCLGE_MAC_ACTIVE }; struct hclge_vport_mac_addr_cfg { struct list_head node; - enum HCLGE_MAC_ADDR_STATE state; + enum HCLGE_MAC_NODE_STATE state; u8 mac_addr[ETH_ALEN]; }; @@ -1016,13 +1015,13 @@ int hclge_set_vlan_filter(struct hnae3_handle *handle, __be16 proto, int hclge_notify_client(struct hclge_dev *hdev, enum hnae3_reset_notify_type type); int hclge_update_mac_list(struct hclge_vport *vport, - enum HCLGE_MAC_ADDR_STATE state, + enum HCLGE_MAC_NODE_STATE state, enum HCLGE_MAC_ADDR_TYPE mac_type, const unsigned char *addr); void hclge_replace_mac_node(struct list_head *list, const u8 *old_addr, const u8 *new_addr, bool keep_old); void hclge_modify_mac_node_state(struct list_head *list, const u8 *addr, - enum HCLGE_MAC_ADDR_STATE state); + enum HCLGE_MAC_NODE_STATE state); void hclge_rm_vport_all_mac_table(struct hclge_vport *vport, bool is_del_list, enum HCLGE_MAC_ADDR_TYPE mac_type); void hclge_rm_vport_all_vlan_table(struct hclge_vport *vport, bool is_del_list); -- 1.8.3

1 24

[PATCH] ACPI: GED: implement powerkey evged freeze function
by Hongbo Yao 24 Apr '20

24 Apr '20

From: Huang jun <huangjun61(a)huawei.com> If we want acpi ged to support wake from freeze, we need to implement the suspend/resume function. In these two methods, ACPI's _GPO, GPP method is called to realize the setting of sleep flag and anti-shake. Signed-off-by: Huangjun <huangjun63(a)huawei.com> --- drivers/acpi/evged.c | 108 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 108 insertions(+) diff --git a/drivers/acpi/evged.c b/drivers/acpi/evged.c index f13ba2c07667..dde8fbff8d19 100644 --- a/drivers/acpi/evged.c +++ b/drivers/acpi/evged.c @@ -46,11 +46,20 @@ #include <linux/list.h> #include <linux/platform_device.h> #include <linux/acpi.h> +#include <linux/timer.h> +#include <linux/jiffies.h> #define MODULE_NAME "acpi-ged" +struct acpi_ged_handle { + struct timer_list timer;/* For 4s anti-shake of power button */ + acpi_handle gpp_handle; /* ACPI Handle: enable shutdown */ + acpi_handle gpo_handle; /* ACPI Handle: set sleep flag */ +}; + struct acpi_ged_device { struct device *dev; + struct acpi_ged_handle *wakeup_handle; struct list_head event_list; }; @@ -131,6 +140,34 @@ static acpi_status acpi_ged_request_interrupt(struct acpi_resource *ares, return AE_OK; } +#ifdef CONFIG_PM_SLEEP +static void init_ged_handle(struct acpi_ged_device *geddev) { + struct acpi_ged_handle *wakeup_handle; + acpi_handle gpo_handle = NULL; + acpi_handle gpp_handle = NULL; + acpi_status acpi_ret; + + wakeup_handle = devm_kzalloc(geddev->dev, sizeof(*wakeup_handle), GFP_KERNEL); + if (!wakeup_handle) + return; + + geddev->wakeup_handle = wakeup_handle; + + /* Initialize wakeup_handle, prepare for ged suspend and resume */ + timer_setup(&wakeup_handle->timer, NULL, 0); + + acpi_ret = acpi_get_handle(ACPI_HANDLE(geddev->dev), "_GPO", &gpo_handle); + if (ACPI_FAILURE(acpi_ret)) + dev_info(geddev->dev, "cannot locate _GPO method\n"); + wakeup_handle->gpo_handle = gpo_handle; + + acpi_ret = acpi_get_handle(ACPI_HANDLE(geddev->dev), "_GPP", &gpp_handle); + if (ACPI_FAILURE(acpi_ret)) + dev_info(geddev->dev, "cannot locate _GPP method\n"); + wakeup_handle->gpp_handle = gpp_handle; +} +#endif + static int ged_probe(struct platform_device *pdev) { struct acpi_ged_device *geddev; @@ -149,6 +186,9 @@ static int ged_probe(struct platform_device *pdev) return -EINVAL; } platform_set_drvdata(pdev, geddev); +#ifdef CONFIG_PM_SLEEP + init_ged_handle(geddev); +#endif return 0; } @@ -164,6 +204,10 @@ static void ged_shutdown(struct platform_device *pdev) dev_dbg(geddev->dev, "GED releasing GSI %u @ IRQ %u\n", event->gsi, event->irq); } + + if (geddev->wakeup_handle) + del_timer(&geddev->wakeup_handle->timer); + } static int ged_remove(struct platform_device *pdev) @@ -172,6 +216,67 @@ static int ged_remove(struct platform_device *pdev) return 0; } +#ifdef CONFIG_PM_SLEEP +static void ged_timer_callback(struct timer_list *t) +{ + struct acpi_ged_handle *wakeup_handle = from_timer(wakeup_handle, t, timer); + acpi_status acpi_ret; + + /* _GPP method enable power button */ + if (wakeup_handle && wakeup_handle->gpp_handle) { + acpi_ret = acpi_execute_simple_method(wakeup_handle->gpp_handle, NULL, ACPI_IRQ_MODEL_GIC); + if (ACPI_FAILURE(acpi_ret)) + pr_warn("_GPP method execution failed\n"); + } +} + +static int ged_suspend(struct device *dev) +{ + struct acpi_ged_device *geddev = dev_get_drvdata(dev); + struct acpi_ged_handle *wakeup_handle = geddev->wakeup_handle; + struct acpi_ged_event *event, *next; + acpi_status acpi_ret; + + /* _GPO method set sleep flag */ + if (wakeup_handle && wakeup_handle->gpo_handle) { + acpi_ret = acpi_execute_simple_method(wakeup_handle->gpo_handle, NULL, ACPI_IRQ_MODEL_GIC); + if (ACPI_FAILURE(acpi_ret)) { + pr_warn("_GPO method execution failed\n"); + return AE_ERROR; + } + } + + list_for_each_entry_safe(event, next, &geddev->event_list, node) + enable_irq_wake(event->irq); + + return 0; +} + +static int ged_resume(struct device *dev) +{ + struct acpi_ged_device *geddev = dev_get_drvdata(dev); + struct acpi_ged_handle *wakeup_handle = geddev->wakeup_handle; + struct acpi_ged_event *event, *next; + + /* use timer to complete 4s anti-shake */ + if (wakeup_handle && wakeup_handle->gpp_handle) { + wakeup_handle->timer.expires = jiffies + (4 * HZ); + wakeup_handle->timer.function = ged_timer_callback; + add_timer(&wakeup_handle->timer); + } + + list_for_each_entry_safe(event, next, &geddev->event_list, node) + disable_irq_wake(event->irq); + + return 0; +} + +static const struct dev_pm_ops ged_pm_ops = { + SET_SYSTEM_SLEEP_PM_OPS(ged_suspend, ged_resume) +}; +#endif + + static const struct acpi_device_id ged_acpi_ids[] = { {"ACPI0013"}, {}, @@ -184,6 +289,9 @@ static struct platform_driver ged_driver = { .driver = { .name = MODULE_NAME, .acpi_match_table = ACPI_PTR(ged_acpi_ids), +#ifdef CONFIG_PM_SLEEP + .pm = &ged_pm_ops, +#endif }, }; builtin_platform_driver(ged_driver); -- 2.20.1

1 1

[PATCH 00/41] Backport lts patches from Linux-4.19.117
by Yang Yingliang 24 Apr '20

24 Apr '20

Alexei Avshalom Lazar (1): wil6210: add general initialization/size checks Amir Goldstein (1): ovl: fix value of i_ino for lower hardlink corner case Austin Kim (1): mm/vmalloc.c: move 'area->pages' after if statement Can Guo (1): scsi: ufs: Fix ufshcd_hold() caused scheduling while atomic Colin Ian King (2): ASoC: Intel: mrfld: fix incorrect check on p->sink ASoC: Intel: mrfld: return error codes when an error occurs DENG Qingfang (1): net: dsa: mt7530: fix tagged frames pass-through in VLAN-unaware mode Dedy Lansky (2): wil6210: check rx_buff_mgmt before accessing it wil6210: make sure Rx ring sizes are correlated Florian Fainelli (1): net: stmmac: dwmac-sunxi: Provide TX and RX fifo sizes Greg Kroah-Hartman (1): Linux 4.19.117 James Morse (1): x86/resctrl: Preserve CDP enable over CPU hotplug Jan Kara (1): ext4: do not zeroout extents beyond i_disksize Jim Mattson (1): kvm: x86: Host feature SSBD doesn't imply guest feature SPEC_CTRL_SSBD John Allen (1): x86/microcode/AMD: Increase microcode PATCH_MAX_SIZE Josef Bacik (1): btrfs: check commit root generation in should_ignore_root Josh Triplett (2): ext4: fix incorrect group count in ext4_fill_super error message ext4: fix incorrect inodes per group in error message Karthick Gopalasubramanian (1): wil6210: remove reset file from debugfs Konstantin Khlebnikov (1): net: revert default NAPI poll timeout to 2 jiffies Maurizio Lombardi (2): scsi: target: remove boilerplate code scsi: target: fix hang when multiple threads try to destroy the same iscsi session Maya Erez (1): wil6210: ignore HALP ICR if already handled Reinette Chatre (1): x86/resctrl: Fix invalid attempt at removing the default resource group Sasha Levin (1): usb: dwc3: gadget: don't enable interrupt when disabling endpoint Sebastian Andrzej Siewior (1): amd-xgbe: Use __napi_schedule() in BH context Sergei Lopatin (1): drm/amd/powerplay: force the trim of the mclk dpm_levels if OD is enabled Sven Van Asbroeck (1): pwm: pca9685: Fix PWM/GPIO inter-operation Taehee Yoo (1): hsr: check protocol version in hsr_newlink() Takashi Iwai (4): ALSA: usb-audio: Filter error from connector kctl ops, too ALSA: usb-audio: Don't override ignore_ctl_error value from the map ALSA: usb-audio: Don't create jack controls for PCM terminals ALSA: usb-audio: Check mapping at creating connector controls, too Taras Chornyi (1): net: ipv4: devinet: Fix crash when add/del multicast IP with autojoin Thinh Nguyen (1): usb: dwc3: gadget: Don't clear flags before transfer ended Tim Stallard (1): net: ipv6: do not consider routes via gateways for anycast address check Tuomas Tynkkynen (1): mac80211_hwsim: Use kstrndup() in place of kasprintf() Vasily Averin (1): keys: Fix proc_keys_next to increase position index Wang Wenhu (1): net: qrtr: send msgs from local of same id as broadcast Xiao Yang (1): tracing: Fix the race between registering 'snapshot' event trigger and triggering 'snapshot' operation zhangyi (F) (1): jbd2: improve comments about freeing data buffers whose page mapping is NULL Makefile | 2 +- arch/x86/include/asm/microcode_amd.h | 2 +- arch/x86/kernel/cpu/intel_rdt.c | 2 + arch/x86/kernel/cpu/intel_rdt.h | 1 + arch/x86/kernel/cpu/intel_rdt_rdtgroup.c | 16 ++++- arch/x86/kvm/cpuid.c | 3 +- drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 5 +- drivers/net/dsa/mt7530.c | 18 +++-- drivers/net/dsa/mt7530.h | 7 ++ drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 2 +- drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c | 2 + drivers/net/wireless/ath/wil6210/debugfs.c | 29 +------- drivers/net/wireless/ath/wil6210/interrupt.c | 12 ++-- drivers/net/wireless/ath/wil6210/main.c | 5 +- drivers/net/wireless/ath/wil6210/txrx.c | 4 +- drivers/net/wireless/ath/wil6210/txrx_edma.c | 14 +++- drivers/net/wireless/ath/wil6210/wil6210.h | 3 +- drivers/net/wireless/ath/wil6210/wmi.c | 2 +- drivers/net/wireless/mac80211_hwsim.c | 12 ++-- drivers/pwm/pwm-pca9685.c | 85 +++++++++++++---------- drivers/scsi/ufs/ufshcd.c | 5 ++ drivers/target/iscsi/iscsi_target.c | 79 ++++++--------------- drivers/target/iscsi/iscsi_target.h | 1 - drivers/target/iscsi/iscsi_target_configfs.c | 5 +- drivers/target/iscsi/iscsi_target_login.c | 5 +- drivers/usb/dwc3/gadget.c | 18 ++--- fs/btrfs/relocation.c | 4 +- fs/ext4/extents.c | 8 +-- fs/ext4/super.c | 6 +- fs/jbd2/commit.c | 7 +- fs/overlayfs/inode.c | 4 +- include/net/ip6_route.h | 1 + include/target/iscsi/iscsi_target_core.h | 2 +- kernel/trace/trace_events_trigger.c | 10 +-- mm/vmalloc.c | 8 ++- net/core/dev.c | 3 +- net/hsr/hsr_netlink.c | 10 ++- net/ipv4/devinet.c | 13 ++-- net/qrtr/qrtr.c | 7 +- security/keys/proc.c | 2 + sound/soc/intel/atom/sst-atom-controls.c | 2 +- sound/soc/intel/atom/sst/sst_pci.c | 2 +- sound/usb/mixer.c | 31 +++++---- sound/usb/mixer_maps.c | 4 +- 44 files changed, 251 insertions(+), 212 deletions(-) -- 1.8.3

1 41

[PATCH] btrfs: tree-checker: Enhance chunk checker to validate chunk profile
by Yang Yingliang 22 Apr '20

22 Apr '20

From: Qu Wenruo <wqu(a)suse.com> mainline inclusion from mainline-v5.2-rc1 commit 80e46cf22ba0bcb57b39c7c3b52961ab3a0fd5f2 category: bugfix bugzilla: 13690 CVE: CVE-2019-19378 ------------------------------------------------- Btrfs-progs already have a comprehensive type checker, to ensure there is only 0 (SINGLE profile) or 1 (DUP/RAID0/1/5/6/10) bit set for chunk profile bits. Do the same work for kernel. Reported-by: Yoon Jungyeon <jungyeon(a)gatech.edu> Link: https://bugzilla.kernel.org/show_bug.cgi?id=202765 Reviewed-by: Nikolay Borisov <nborisov(a)suse.com> Reviewed-by: Johannes Thumshirn <jthumshirn(a)suse.de> Signed-off-by: Qu Wenruo <wqu(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/volumes.c [yyl: btrfs_check_chunk_valid() is defined in fs/btrfs/volumes.c] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/btrfs/volumes.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c index 99260d2..110cdfd 100644 --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -6391,6 +6391,14 @@ static int btrfs_check_chunk_valid(struct btrfs_fs_info *fs_info, return -EIO; } + if (!is_power_of_2(type & BTRFS_BLOCK_GROUP_PROFILE_MASK) && + (type & BTRFS_BLOCK_GROUP_PROFILE_MASK) != 0) { + btrfs_err(fs_info, + "invalid chunk profile flag: 0x%llx, expect 0 or 1 bit set", + type & BTRFS_BLOCK_GROUP_PROFILE_MASK); + return -EIO; + } + if ((type & BTRFS_BLOCK_GROUP_TYPE_MASK) == 0) { btrfs_err(fs_info, "missing chunk type flag: 0x%llx", type); return -EIO; -- 1.8.3

1 0

[PATCH] livepatch/core: fix kabi for klp_rel_state
by Yang Yingliang 22 Apr '20

22 Apr '20

From: Cheng Jian <cj.chengjian(a)huawei.com> hulk inclusion category: feature bugzilla: 5391/28338/24634 CVE: NA ----------------------------------------------- The previous patch added a field klp_rel_state in the module structure, which caused KABI changes, so fix this problem Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/module.h | 33 ++++++++++++++++++++------------- 1 file changed, 20 insertions(+), 13 deletions(-) diff --git a/include/linux/module.h b/include/linux/module.h index 4994243..e1f3418 100644 --- a/include/linux/module.h +++ b/include/linux/module.h @@ -469,19 +469,6 @@ struct module { /* Elf information */ struct klp_modinfo *klp_info; - /* - * livepatch should relocate the key of jump_label by - * using klp_write_module_reloc. So it's necessary to - * do jump_label_apply_nops() and jump_label_add_module() - * later after livepatch relocation finised. - * - * for normal module : - * always MODULE_KLP_REL_DONE. - * for livepatch module : - * init as MODULE_KLP_REL_UNDO, - * set to MODULE_KLP_REL_DONE when relocate completed. - */ - enum MODULE_KLP_REL_STATE klp_rel_state; #endif #ifdef CONFIG_MODULE_UNLOAD @@ -507,7 +494,27 @@ struct module { unsigned int num_ei_funcs; #endif +#if defined(CONFIG_LIVEPATCH) && !defined(__GENKSYMS__) + union { + /* + * livepatch should relocate the key of jump_label by + * using klp_write_module_reloc. So it's necessary to + * do jump_label_apply_nops() and jump_label_add_module() + * later after livepatch relocation finised. + * + * for normal module : + * always MODULE_KLP_REL_DONE. + * for livepatch module : + * init as MODULE_KLP_REL_UNDO, + * set to MODULE_KLP_REL_DONE when relocate completed. + */ + enum MODULE_KLP_REL_STATE klp_rel_state; + long klp_rel_state_KABI; + }; +#else KABI_RESERVE(1) +#endif + KABI_RESERVE(2) KABI_RESERVE(3) KABI_RESERVE(4) -- 1.8.3

1 0

[PATCH v1] scsi: hisi_sas: do not reset the timer to wait for phyup when phy already up
by Luo Jiaxing 22 Apr '20

22 Apr '20

We found out that after phy up, the hardware report another oob interrupt, but did not follow a phy up interrupt. like: oob ready -> phy up -> DEV found -> oob read -> wait phy up -> timeout We run link reset when wait phy up timeout, and it make a normal disk into reset processing. So we made some circumvention action in the code, so that this abnormal oob interrupt will not start the timer to wait for phy up. Signed-off-by: Luo Jiaxing <luojiaxing(a)huawei.com> Signed-off-by: John Garry <john.garry(a)huawei.com> --- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c index acf2fc6..5b80856 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c @@ -1898,8 +1898,11 @@ static void handle_chl_int0_v3_hw(struct hisi_hba *hisi_hba, int phy_no) if (irq_value0 & CHL_INT0_PHY_RDY_MSK) { struct hisi_sas_phy *phy = &hisi_hba->phy[phy_no]; + dev_dbg(dev, "phy%d OOB ready\n", phy_no); + if (phy->phy_attached) + return; + if (!timer_pending(&phy->timer)) { - dev_dbg(dev, "phy%d OOB ready\n", phy_no); phy->timer.function = wait_phyup_timedout_v3_hw; phy->timer.expires = jiffies + WAIT_PHYUP_TIMEOUT_V3_HW * HZ; -- 2.7.4

1 0

How to get the patches openEuler 20.03 LTS Kernel has
by Fred Li 22 Apr '20

22 Apr '20

Hi all, We are frequently asked what patches kernel has comparing with Kernel 4.19. [1] shows how to find them and hope it helps. If more information is needed, please leave messages in the issue [1]. [1] https://gitee.com/openeuler/kernel/issues/I1F430 -- Regards Fred Li (李永乐)

1 0

[PATCH] net: hns3: add suspend/resume function for hns3 driver
by Jian Shen 21 Apr '20

21 Apr '20

From: Hao Shen <shenhao21(a)huawei.com> The suspend and resume feature is useful when you want to save the current state of your machine, and continue work later from the same state. This patch makes the hns3 net device work form the same state after s3 and s4. Signed-off-by: Weiwei Deng <dengweiwei(a)huawei.com> Signed-off-by: Hao Shen <shenhao21(a)huawei.com> Signed-off-by: Jian Shen <shenjian15(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 2 + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 32 ++++++++++ .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 70 ++++++++++++++++++++++ 3 files changed, 104 insertions(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h index bb29b46..8b1e690 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h +++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h @@ -561,6 +561,8 @@ struct hnae3_ae_ops { int (*set_vf_mac)(struct hnae3_handle *handle, int vf, u8 *p); int (*get_module_eeprom)(struct hnae3_handle *handle, u32 offset, u32 len, u8 *data); + int (*suspend)(struct hnae3_ae_dev *ae_dev); + int (*resume)(struct hnae3_ae_dev *ae_dev); }; struct hnae3_dcb_ops { diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c index 4eca8cf..de3d37c3 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c @@ -2226,6 +2226,34 @@ static void hns3_shutdown(struct pci_dev *pdev) pci_set_power_state(pdev, PCI_D3hot); } +#ifdef CONFIG_PM +static int hns3_suspend(struct pci_dev *pdev, pm_message_t state) +{ + struct hnae3_ae_dev *ae_dev = pci_get_drvdata(pdev); + + if (ae_dev->ops->suspend) + ae_dev->ops->suspend(ae_dev); + + pci_save_state(pdev); + pci_set_power_state(pdev, PCI_D3hot); + + return 0; +} + +static int hns3_resume(struct pci_dev *pdev) +{ + struct hnae3_ae_dev *ae_dev = pci_get_drvdata(pdev); + + pci_set_power_state(pdev, PCI_D0); + pci_restore_state(pdev); + + if (ae_dev->ops->resume) + return ae_dev->ops->resume(ae_dev); + + return 0; +} +#endif + static pci_ers_result_t hns3_error_detected(struct pci_dev *pdev, pci_channel_state_t state) { @@ -2310,6 +2338,10 @@ struct pci_driver hns3_driver = { .probe = hns3_probe, .remove = hns3_remove, .shutdown = hns3_shutdown, +#ifdef CONFIG_PM + .suspend = hns3_suspend, + .resume = hns3_resume, +#endif .sriov_configure = hns3_pci_sriov_configure, .err_handler = &hns3_err_handler, }; diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c index c2ae05f..478a3b5 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c @@ -3820,6 +3820,72 @@ static void hclge_reset(struct hclge_dev *hdev) hclge_reset_task_schedule(hdev); } +#ifdef CONFIG_PM +static int hclge_suspend(struct hnae3_ae_dev *ae_dev) +{ + struct hclge_dev *hdev = ae_dev->priv; + int ret; + + ret = hclge_notify_roce_client(hdev, HNAE3_DOWN_CLIENT); + if (ret) + return ret; + + rtnl_lock(); + + ret = hclge_notify_client(hdev, HNAE3_DOWN_CLIENT); + if (ret) + goto err_reset_lock; + + ret = hclge_notify_client(hdev, HNAE3_UNINIT_CLIENT); + if (ret) + goto err_reset_lock; + + rtnl_unlock(); + + return hclge_notify_roce_client(hdev, HNAE3_UNINIT_CLIENT); + +err_reset_lock: + rtnl_unlock(); + return ret; +} + +static int hclge_resume(struct hnae3_ae_dev *ae_dev) +{ + struct hclge_dev *hdev = ae_dev->priv; + int ret; + + rtnl_lock(); + + ret = hclge_reset_ae_dev(hdev->ae_dev); + if (ret) + goto err_reset_lock; + + ret = hclge_notify_client(hdev, HNAE3_INIT_CLIENT); + if (ret) + goto err_reset_lock; + + rtnl_unlock(); + + ret = hclge_notify_roce_client(hdev, HNAE3_INIT_CLIENT); + if (ret) + goto err_reset_lock; + + rtnl_lock(); + + ret = hclge_notify_client(hdev, HNAE3_UP_CLIENT); + if (ret) + goto err_reset_lock; + + rtnl_unlock(); + + return hclge_notify_roce_client(hdev, HNAE3_UP_CLIENT); + +err_reset_lock: + rtnl_unlock(); + return ret; +} +#endif + static void hclge_reset_event(struct pci_dev *pdev, struct hnae3_handle *handle) { struct hnae3_ae_dev *ae_dev = pci_get_drvdata(pdev); @@ -11525,6 +11591,10 @@ struct hnae3_ae_ops hclge_ops = { .set_vf_rate = hclge_set_vf_rate, .set_vf_mac = hclge_set_vf_mac, .get_module_eeprom = hclge_get_module_eeprom, +#ifdef CONFIG_PM + .suspend = hclge_suspend, + .resume = hclge_resume, +#endif }; static struct hnae3_ae_algo ae_algo = { -- 1.9.1

1 0

[PATCH] net: hns3: add suspend/resume function for hns3 driver
by Jian Shen 21 Apr '20

21 Apr '20

From: Hao Shen <shenhao21(a)huawei.com> The suspend and resume feature is useful when you want to save the current state of your machine, and continue work later from the same state. This patch makes the hns3 net device work form the same state after s3 and s4. Signed-off-by: Weiwei Deng <dengweiwei(a)huawei.com> Signed-off-by: Hao Shen <shenhao21(a)huawei.com> Signed-off-by: Jian Shen <shenjian15(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 2 + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 32 ++++++++++ .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 70 ++++++++++++++++++++++ 3 files changed, 104 insertions(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h index bb29b46..8b1e690 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h +++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h @@ -561,6 +561,8 @@ struct hnae3_ae_ops { int (*set_vf_mac)(struct hnae3_handle *handle, int vf, u8 *p); int (*get_module_eeprom)(struct hnae3_handle *handle, u32 offset, u32 len, u8 *data); + int (*suspend)(struct hnae3_ae_dev *ae_dev); + int (*resume)(struct hnae3_ae_dev *ae_dev); }; struct hnae3_dcb_ops { diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c index 4eca8cf..de3d37c3 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c @@ -2226,6 +2226,34 @@ static void hns3_shutdown(struct pci_dev *pdev) pci_set_power_state(pdev, PCI_D3hot); } +#ifdef CONFIG_PM +static int hns3_suspend(struct pci_dev *pdev, pm_message_t state) +{ + struct hnae3_ae_dev *ae_dev = pci_get_drvdata(pdev); + + if (ae_dev->ops->suspend) + ae_dev->ops->suspend(ae_dev); + + pci_save_state(pdev); + pci_set_power_state(pdev, PCI_D3hot); + + return 0; +} + +static int hns3_resume(struct pci_dev *pdev) +{ + struct hnae3_ae_dev *ae_dev = pci_get_drvdata(pdev); + + pci_set_power_state(pdev, PCI_D0); + pci_restore_state(pdev); + + if (ae_dev->ops->resume) + return ae_dev->ops->resume(ae_dev); + + return 0; +} +#endif + static pci_ers_result_t hns3_error_detected(struct pci_dev *pdev, pci_channel_state_t state) { @@ -2310,6 +2338,10 @@ struct pci_driver hns3_driver = { .probe = hns3_probe, .remove = hns3_remove, .shutdown = hns3_shutdown, +#ifdef CONFIG_PM + .suspend = hns3_suspend, + .resume = hns3_resume, +#endif .sriov_configure = hns3_pci_sriov_configure, .err_handler = &hns3_err_handler, }; diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c index c2ae05f..478a3b5 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c @@ -3820,6 +3820,72 @@ static void hclge_reset(struct hclge_dev *hdev) hclge_reset_task_schedule(hdev); } +#ifdef CONFIG_PM +static int hclge_suspend(struct hnae3_ae_dev *ae_dev) +{ + struct hclge_dev *hdev = ae_dev->priv; + int ret; + + ret = hclge_notify_roce_client(hdev, HNAE3_DOWN_CLIENT); + if (ret) + return ret; + + rtnl_lock(); + + ret = hclge_notify_client(hdev, HNAE3_DOWN_CLIENT); + if (ret) + goto err_reset_lock; + + ret = hclge_notify_client(hdev, HNAE3_UNINIT_CLIENT); + if (ret) + goto err_reset_lock; + + rtnl_unlock(); + + return hclge_notify_roce_client(hdev, HNAE3_UNINIT_CLIENT); + +err_reset_lock: + rtnl_unlock(); + return ret; +} + +static int hclge_resume(struct hnae3_ae_dev *ae_dev) +{ + struct hclge_dev *hdev = ae_dev->priv; + int ret; + + rtnl_lock(); + + ret = hclge_reset_ae_dev(hdev->ae_dev); + if (ret) + goto err_reset_lock; + + ret = hclge_notify_client(hdev, HNAE3_INIT_CLIENT); + if (ret) + goto err_reset_lock; + + rtnl_unlock(); + + ret = hclge_notify_roce_client(hdev, HNAE3_INIT_CLIENT); + if (ret) + goto err_reset_lock; + + rtnl_lock(); + + ret = hclge_notify_client(hdev, HNAE3_UP_CLIENT); + if (ret) + goto err_reset_lock; + + rtnl_unlock(); + + return hclge_notify_roce_client(hdev, HNAE3_UP_CLIENT); + +err_reset_lock: + rtnl_unlock(); + return ret; +} +#endif + static void hclge_reset_event(struct pci_dev *pdev, struct hnae3_handle *handle) { struct hnae3_ae_dev *ae_dev = pci_get_drvdata(pdev); @@ -11525,6 +11591,10 @@ struct hnae3_ae_ops hclge_ops = { .set_vf_rate = hclge_set_vf_rate, .set_vf_mac = hclge_set_vf_mac, .get_module_eeprom = hclge_get_module_eeprom, +#ifdef CONFIG_PM + .suspend = hclge_suspend, + .resume = hclge_resume, +#endif }; static struct hnae3_ae_algo ae_algo = { -- 1.9.1

1 0

[PATCH hulk-4.19-next] net: hns3: add suspend/resume function for hns3 driver
by Jian Shen 21 Apr '20

21 Apr '20

From: Hao Shen <shenhao21(a)huawei.com> The suspend and resume feature is useful when you want to save the current state of your machine, and continue work later from the same state. This patch makes the hns3 net device work form the same state after s3 and s4. Signed-off-by: Weiwei Deng <dengweiwei(a)huawei.com> Signed-off-by: Hao Shen <shenhao21(a)huawei.com> Signed-off-by: Jian Shen <shenjian15(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 2 + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 32 ++++++++++ .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 70 ++++++++++++++++++++++ 3 files changed, 104 insertions(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h index bb29b46..8b1e690 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h +++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h @@ -561,6 +561,8 @@ struct hnae3_ae_ops { int (*set_vf_mac)(struct hnae3_handle *handle, int vf, u8 *p); int (*get_module_eeprom)(struct hnae3_handle *handle, u32 offset, u32 len, u8 *data); + int (*suspend)(struct hnae3_ae_dev *ae_dev); + int (*resume)(struct hnae3_ae_dev *ae_dev); }; struct hnae3_dcb_ops { diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c index 4eca8cf..de3d37c3 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c @@ -2226,6 +2226,34 @@ static void hns3_shutdown(struct pci_dev *pdev) pci_set_power_state(pdev, PCI_D3hot); } +#ifdef CONFIG_PM +static int hns3_suspend(struct pci_dev *pdev, pm_message_t state) +{ + struct hnae3_ae_dev *ae_dev = pci_get_drvdata(pdev); + + if (ae_dev->ops->suspend) + ae_dev->ops->suspend(ae_dev); + + pci_save_state(pdev); + pci_set_power_state(pdev, PCI_D3hot); + + return 0; +} + +static int hns3_resume(struct pci_dev *pdev) +{ + struct hnae3_ae_dev *ae_dev = pci_get_drvdata(pdev); + + pci_set_power_state(pdev, PCI_D0); + pci_restore_state(pdev); + + if (ae_dev->ops->resume) + return ae_dev->ops->resume(ae_dev); + + return 0; +} +#endif + static pci_ers_result_t hns3_error_detected(struct pci_dev *pdev, pci_channel_state_t state) { @@ -2310,6 +2338,10 @@ struct pci_driver hns3_driver = { .probe = hns3_probe, .remove = hns3_remove, .shutdown = hns3_shutdown, +#ifdef CONFIG_PM + .suspend = hns3_suspend, + .resume = hns3_resume, +#endif .sriov_configure = hns3_pci_sriov_configure, .err_handler = &hns3_err_handler, }; diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c index c2ae05f..478a3b5 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c @@ -3820,6 +3820,72 @@ static void hclge_reset(struct hclge_dev *hdev) hclge_reset_task_schedule(hdev); } +#ifdef CONFIG_PM +static int hclge_suspend(struct hnae3_ae_dev *ae_dev) +{ + struct hclge_dev *hdev = ae_dev->priv; + int ret; + + ret = hclge_notify_roce_client(hdev, HNAE3_DOWN_CLIENT); + if (ret) + return ret; + + rtnl_lock(); + + ret = hclge_notify_client(hdev, HNAE3_DOWN_CLIENT); + if (ret) + goto err_reset_lock; + + ret = hclge_notify_client(hdev, HNAE3_UNINIT_CLIENT); + if (ret) + goto err_reset_lock; + + rtnl_unlock(); + + return hclge_notify_roce_client(hdev, HNAE3_UNINIT_CLIENT); + +err_reset_lock: + rtnl_unlock(); + return ret; +} + +static int hclge_resume(struct hnae3_ae_dev *ae_dev) +{ + struct hclge_dev *hdev = ae_dev->priv; + int ret; + + rtnl_lock(); + + ret = hclge_reset_ae_dev(hdev->ae_dev); + if (ret) + goto err_reset_lock; + + ret = hclge_notify_client(hdev, HNAE3_INIT_CLIENT); + if (ret) + goto err_reset_lock; + + rtnl_unlock(); + + ret = hclge_notify_roce_client(hdev, HNAE3_INIT_CLIENT); + if (ret) + goto err_reset_lock; + + rtnl_lock(); + + ret = hclge_notify_client(hdev, HNAE3_UP_CLIENT); + if (ret) + goto err_reset_lock; + + rtnl_unlock(); + + return hclge_notify_roce_client(hdev, HNAE3_UP_CLIENT); + +err_reset_lock: + rtnl_unlock(); + return ret; +} +#endif + static void hclge_reset_event(struct pci_dev *pdev, struct hnae3_handle *handle) { struct hnae3_ae_dev *ae_dev = pci_get_drvdata(pdev); @@ -11525,6 +11591,10 @@ struct hnae3_ae_ops hclge_ops = { .set_vf_rate = hclge_set_vf_rate, .set_vf_mac = hclge_set_vf_mac, .get_module_eeprom = hclge_get_module_eeprom, +#ifdef CONFIG_PM + .suspend = hclge_suspend, + .resume = hclge_resume, +#endif }; static struct hnae3_ae_algo ae_algo = { -- 1.9.1

1 0

[PATCH 000/144] Backport lts patches from Linux-4.19.116
by Yang Yingliang 21 Apr '20

21 Apr '20

Alain Volmat (1): i2c: st: fix missing struct parameter description Alex Vesker (1): IB/mlx5: Replace tunnel mpls capability bits for tunnel_offloads Alexander Duyck (1): mm: Use fixed constant in page_frag_alloc instead of size + 1 Alexander Sverdlin (1): genirq/irqdomain: Check pointer in irq_domain_alloc_irqs_hierarchy() Alexey Dobriyan (1): null_blk: fix spurious IO errors after failed past-wp access Andrei Botila (1): crypto: caam - update xts sector size for large input length Andy Lutomirski (1): selftests/x86/ptrace_syscall_32: Fix no-vDSO segfault Andy Shevchenko (1): mfd: dln2: Fix sanity checking for endpoints Aneesh Kumar K.V (1): powerpc/hash64/devmap: Use H_PAGE_THP_HUGE when setting up huge devmap PTE entries Anssi Hannula (1): tools: gpio: Fix out-of-tree build regression Ard Biesheuvel (1): efi/x86: Ignore the memory attributes table on i386 Arvind Sankar (1): x86/boot: Use unsigned comparison for addresses Bart Van Assche (2): null_blk: Fix the null_add_dev() error path null_blk: Handle null_add_dev() failures properly Benoit Parrot (1): media: ti-vpe: cal: fix disable_irqs to only the intended target Bob Liu (1): dm zoned: remove duplicate nr_rnd_zones increase in dmz_init_zone() Bob Peterson (1): gfs2: Don't demote a glock until its revokes are written Boqun Feng (1): locking/lockdep: Avoid recursion in lockdep_count_{for,back}ward_deps() Changwei Ge (1): ocfs2: no need try to truncate file beyond i_size Chris Wilson (1): drm: Remove PageReserved manipulation from drm_pci_alloc Christian Gmeiner (2): drm/etnaviv: rework perfmon query infrastructure etnaviv: perfmon: fix total and idle HI cyleces readout Christoph Niedermaier (1): cpufreq: imx6q: Fixes unwanted cpu overclocking on i.MX6ULL Christophe Leroy (1): powerpc/kprobes: Ignore traps that happened in real mode Clement Courbet (1): powerpc: Make setjmp/longjmp signature standard Cédric Le Goater (1): powerpc/xive: Use XIVE_BAD_IRQ instead of zero to catch non configured IPIs David Hildenbrand (2): KVM: s390: vsie: Fix region 1 ASCE sanity shadow address checks KVM: s390: vsie: Fix delivery of addressing exceptions Dongchun Zhu (1): media: i2c: ov5695: Fix power on and off sequences Eric Biggers (2): fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once() kmod: make request_module() return an error when autoloading is disabled Eric W. Biederman (1): signal: Extend exec_id to 64bits Filipe Manana (2): Btrfs: fix crash during unmount due to race with delayed inode workers btrfs: fix missing file extent item for hole after ranged fsync Fredrik Strupe (1): arm64: armv8_deprecated: Fix undef_hook mask for thumb setend Frieder Schrempf (2): mtd: spinand: Stop using spinand->oobbuf for buffering bad block markers mtd: spinand: Do not erase the block before writing a bad block marker Gao Xiang (1): erofs: correct the remaining shrink objects Gary Lin (1): efi/x86: Fix the deletion of variables in mixed mode Gilad Ben-Yossef (4): crypto: ccree - zero out internal struct before use crypto: ccree - don't mangle the request assoclen crypto: ccree - dec auth tag size from cryptlen map crypto: ccree - only try to map auth tag if needed Greg Kroah-Hartman (1): Linux 4.19.116 Guoqing Jiang (1): md: check arrays is suspended in mddev_detach before call quiesce operations Gustavo A. R. Silva (1): MIPS: OCTEON: irq: Fix potential NULL pointer dereference Hadar Gat (1): crypto: ccree - improve error handling Hans de Goede (1): Input: i8042 - add Acer Aspire 5738z to nomux list Huacai Chen (1): MIPS/tlbex: Fix LDDIR usage in setup_pw() for Loongson-3 James Morse (1): firmware: arm_sdei: fix double-lock on hibernate with shared events James Smart (2): nvme-fc: Revert "add module to ops template to allow module references" nvme: Treat discovery subsystems as unique subsystems Jan Engelhardt (1): acpi/x86: ignore unspecified bit positions in the ACPI global lock field John Garry (1): libata: Remove extra scsi_host_put() in ata_scsi_add_hosts() Josef Bacik (5): btrfs: remove a BUG_ON() from merge_reloc_roots() btrfs: track reloc roots based on their commit root bytenr btrfs: set update the uuid generation as soon as possible btrfs: drop block from cache on error in relocation btrfs: use nofs allocations for running delayed items Juergen Gross (1): xen/blkfront: fix memory allocation flags in blkfront_setup_indirect() Junyong Sun (1): firmware: fix a double abort case with fw_load_sysfs_fallback Kai-Heng Feng (1): libata: Return correct status in sata_pmp_eh_recover_pm() when ATA_DFLAG_DETACH is set Kees Cook (1): slub: improve bit diffusion for freelist ptr obfuscation Kishon Vijay Abraham I (1): PCI: endpoint: Fix for concurrent memory allocation in OB address region Konstantin Khlebnikov (1): block: keep bdi->io_pages in sync with max_sectors_kb for stacked devices Laurentiu Tudor (1): powerpc/fsl_booke: Avoid creating duplicate tlb1 entry Libor Pechacek (1): powerpc/pseries: Avoid NULL pointer dereference when drmem is unavailable Logan Gunthorpe (1): PCI/switchtec: Fix init_completion race condition with poll_wait() Lukas Wunner (1): PCI: pciehp: Fix indefinite wait on sysfs requests Lyude Paul (1): drm/dp_mst: Fix clearing payload state on topology disable Marc Zyngier (1): irqchip/gic-v4: Provide irq_retrigger to avoid circular locking dependency Martin Blumenstingl (1): thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n Masami Hiramatsu (1): ftrace/kprobe: Show the maxactive number on kprobe_events Mathias Nyman (1): xhci: bail out early if driver can't accress host in resume Matt Ranostay (1): media: i2c: video-i2c: fix build errors due to 'imply hwmon' Matthew Garrett (1): tpm: Don't make log failures fatal Maxime Ripard (1): arm64: dts: allwinner: h6: Fix PMU compatible Michael Ellerman (1): powerpc/64/tm: Don't let userspace set regs->trap via sigreturn Michael Mueller (1): s390/diag: fix display of diagnose call statistics Michael Wang (1): sched: Avoid scale real weight down to zero Michal Hocko (1): selftests: vm: drop dependencies on page flags from mlock2 tests Mikulas Patocka (1): dm writecache: add cond_resched to avoid CPU hangs Nathan Chancellor (2): rtc: omap: Use define directive for PIN_CONFIG_ACTIVE_HIGH misc: echo: Remove unnecessary parentheses and simplify check for zero Neil Armstrong (1): usb: dwc3: core: add support for disabling SS instances in park mode Oliver O'Halloran (1): cpufreq: powernv: Fix use-after-free Ondrej Jirman (2): ARM: dts: sun8i-a83t-tbs-a711: HM5065 doesn't like such a high voltage bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads Paul Cercueil (1): clk: ingenic/jz4770: Exit with error if CGU init failed Qian Cai (1): ext4: fix a data race at inode->i_blocks Qu Wenruo (1): btrfs: qgroup: ensure qgroup_rescan_running is only set when the worker is at least queued Raju Rangoju (1): cxgb4/ptp: pass the sign of offset delta in FW CMD Remi Pommarel (1): ath9k: Handle txpower changes even when TPC is disabled Robbie Ko (1): btrfs: fix missing semaphore unlock in btrfs_sync_file Rosioru Dragos (1): crypto: mxs-dcp - fix scatterlist linearization for hash Sahitya Tummala (1): block: Fix use-after-free issue accessing struct io_cq Sam Lunt (1): perf tools: Support Python 3.8+ in Makefile Sasha Levin (1): Revert "drm/dp_mst: Remove VCPI while disabling topology mgr" Sean Christopherson (4): KVM: nVMX: Properly handle userspace interrupt window request KVM: x86: Allocate new rmap and large page tracking when moving memslot KVM: VMX: Always VMCLEAR in-use VMCSes during crash with kexec support KVM: x86: Gracefully handle __vmalloc() failure during VM allocation Sean V Kelley (1): PCI: Add boot interrupt quirk mechanism for Xeon chipsets Segher Boessenkool (1): powerpc: Add attributes for setjmp/longjmp Shetty, Harshini X (EXT-Sony Mobile) (1): dm verity fec: fix memory leak in verity_fec_dtr Simon Gander (1): hfsplus: fix crash and filesystem corruption when deleting files Sreekanth Reddy (1): scsi: mpt3sas: Fix kernel panic observed on soft HBA unplug Sriharsha Allenki (1): usb: gadget: f_fs: Fix use after free issue as part of queue failure Steffen Maier (1): scsi: zfcp: fix missing erp_lock in port recovery trigger for point-to-point Stephan Gerhold (1): media: venus: hfi_parser: Ignore HEVC encoding for V1 Subash Abhinov Kasiviswanathan (1): net: qualcomm: rmnet: Allow configuration updates to existing devices Sungbo Eo (2): irqchip/versatile-fpga: Handle chained IRQs properly irqchip/versatile-fpga: Apply clear-mask earlier Takashi Iwai (6): ALSA: usb-audio: Add mixer workaround for TRX40 and co ALSA: hda: Add driver blacklist ALSA: hda: Fix potential access overflow in beep helper ALSA: ice1724: Fix invalid access for enumerated ctl items ALSA: pcm: oss: Fix regression by buffer overflow fix ALSA: hda/realtek - Add quirk for MSI GL63 Thinh Nguyen (1): usb: gadget: composite: Inform controller driver of self-powered Thomas Gleixner (1): x86/entry/32: Add missing ASM_CLAC to general_protection entry Thomas Hebb (3): ALSA: doc: Document PC Beep Hidden Register on Realtek ALC256 ALSA: hda/realtek - Set principled PC Beep configuration for ALC256 ALSA: hda/realtek - Remove now-unnecessary XPS 13 headphone noise fixups Thomas Hellstrom (1): x86: Don't let pgprot_modify() change the page encryption bit Trond Myklebust (1): NFS: Fix a page leak in nfs_destroy_unlinked_subrequests() Vasily Averin (3): tpm: tpm1_bios_measurements_next should increase position index tpm: tpm2_bios_measurements_next should increase position index pstore: pstore_ftrace_seq_next should increase position index Vitaly Kuznetsov (1): KVM: VMX: fix crash cleanup when KVM wasn't used Wen Yang (1): ipmi: fix hung processes in __get_guid() Xu Wang (1): qlcnic: Fix bad kzalloc null test Yang Xu (1): KEYS: reaching the keys quotas correctly Yicong Yang (1): PCI/ASPM: Clear the correct bits when enabling L1 substates YueHaibing (1): powerpc/pseries: Drop pointless static qualifier in vpa_debugfs_init() Yury Norov (1): uapi: rename ext2_swab() to swab() and share globally in swab.h Zheng Wei (1): net: vxge: fix wrong __VA_ARGS__ usage Zhenzhong Duan (1): x86/speculation: Remove redundant arch_smt_update() invocation Zhiqiang Liu (1): block, bfq: fix use-after-free in bfq_idle_slice_timer_body chenqiwu (1): pstore/platform: fix potential mem leak if pstore_init_fs failed 이경택 (4): ASoC: fix regwmask ASoC: dapm: connect virtual mux with default value ASoC: dpcm: allow start or stop during pause for backend ASoC: topology: use name_prefix for new kcontrol Documentation/sound/hd-audio/index.rst | 1 + Documentation/sound/hd-audio/models.rst | 2 - Documentation/sound/hd-audio/realtek-pc-beep.rst | 129 ++++++++++++ Makefile | 2 +- arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts | 4 +- arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi | 3 +- arch/arm64/kernel/armv8_deprecated.c | 2 +- arch/mips/cavium-octeon/octeon-irq.c | 3 + arch/mips/mm/tlbex.c | 5 +- arch/powerpc/include/asm/book3s/64/hash-4k.h | 6 + arch/powerpc/include/asm/book3s/64/hash-64k.h | 8 +- arch/powerpc/include/asm/book3s/64/pgtable.h | 4 +- arch/powerpc/include/asm/book3s/64/radix.h | 5 + arch/powerpc/include/asm/drmem.h | 4 +- arch/powerpc/include/asm/setjmp.h | 6 +- arch/powerpc/kernel/Makefile | 3 - arch/powerpc/kernel/kprobes.c | 3 + arch/powerpc/kernel/signal_64.c | 4 +- arch/powerpc/mm/tlb_nohash_low.S | 12 +- arch/powerpc/platforms/pseries/hotplug-memory.c | 8 +- arch/powerpc/platforms/pseries/lpar.c | 2 +- arch/powerpc/sysdev/xive/common.c | 12 +- arch/powerpc/sysdev/xive/native.c | 4 +- arch/powerpc/sysdev/xive/spapr.c | 4 +- arch/powerpc/sysdev/xive/xive-internal.h | 7 + arch/powerpc/xmon/Makefile | 3 - arch/s390/kernel/diag.c | 2 +- arch/s390/kvm/vsie.c | 1 + arch/s390/mm/gmap.c | 6 +- arch/x86/boot/compressed/head_32.S | 2 +- arch/x86/boot/compressed/head_64.S | 4 +- arch/x86/entry/entry_32.S | 1 + arch/x86/include/asm/kvm_host.h | 2 +- arch/x86/include/asm/pgtable.h | 7 +- arch/x86/include/asm/pgtable_types.h | 2 +- arch/x86/kernel/acpi/boot.c | 2 +- arch/x86/kvm/svm.c | 4 + arch/x86/kvm/vmx.c | 110 ++++------ arch/x86/kvm/x86.c | 21 +- arch/x86/platform/efi/efi_64.c | 4 +- block/bfq-iosched.c | 16 +- block/blk-ioc.c | 7 + block/blk-settings.c | 3 + drivers/ata/libata-pmp.c | 1 + drivers/ata/libata-scsi.c | 9 +- drivers/base/firmware_loader/fallback.c | 2 +- drivers/block/null_blk_main.c | 10 +- drivers/block/xen-blkfront.c | 17 +- drivers/bus/sunxi-rsb.c | 2 +- drivers/char/ipmi/ipmi_msghandler.c | 4 +- drivers/char/tpm/eventlog/common.c | 12 +- drivers/char/tpm/eventlog/tpm1.c | 2 +- drivers/char/tpm/eventlog/tpm2.c | 2 +- drivers/char/tpm/tpm-chip.c | 4 +- drivers/char/tpm/tpm.h | 2 +- drivers/clk/ingenic/jz4770-cgu.c | 4 +- drivers/cpufreq/imx6q-cpufreq.c | 3 + drivers/cpufreq/powernv-cpufreq.c | 6 + drivers/crypto/caam/caamalg_desc.c | 16 +- drivers/crypto/ccree/cc_aead.c | 56 +++-- drivers/crypto/ccree/cc_aead.h | 1 + drivers/crypto/ccree/cc_buffer_mgr.c | 108 +++++----- drivers/crypto/mxs-dcp.c | 58 +++-- drivers/firmware/arm_sdei.c | 32 ++- drivers/firmware/efi/efi.c | 2 +- drivers/gpu/drm/drm_dp_mst_topology.c | 19 +- drivers/gpu/drm/drm_pci.c | 25 +-- drivers/gpu/drm/etnaviv/etnaviv_perfmon.c | 103 +++++++-- drivers/i2c/busses/i2c-st.c | 1 + drivers/infiniband/hw/mlx5/main.c | 6 +- drivers/input/serio/i8042-x86ia64io.h | 11 + drivers/irqchip/irq-gic-v3-its.c | 6 + drivers/irqchip/irq-versatile-fpga.c | 18 +- drivers/md/dm-verity-fec.c | 1 + drivers/md/dm-writecache.c | 6 +- drivers/md/dm-zoned-metadata.c | 1 - drivers/md/md.c | 2 +- drivers/media/i2c/ov5695.c | 49 +++-- drivers/media/i2c/video-i2c.c | 2 +- drivers/media/platform/qcom/venus/hfi_parser.c | 1 + drivers/media/platform/ti-vpe/cal.c | 16 +- drivers/mfd/dln2.c | 9 +- drivers/misc/echo/echo.c | 2 +- drivers/mtd/nand/spi/core.c | 17 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c | 3 + drivers/net/ethernet/neterion/vxge/vxge-config.h | 2 +- drivers/net/ethernet/neterion/vxge/vxge-main.h | 14 +- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 2 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 31 +-- drivers/net/wireless/ath/ath9k/main.c | 3 + drivers/nvme/host/core.c | 11 + drivers/nvme/host/fc.c | 14 +- drivers/nvme/target/fcloop.c | 1 - drivers/pci/endpoint/pci-epc-mem.c | 10 +- drivers/pci/hotplug/pciehp_hpc.c | 14 +- drivers/pci/pcie/aspm.c | 4 +- drivers/pci/quirks.c | 80 ++++++- drivers/pci/switch/switchtec.c | 2 +- drivers/rtc/rtc-omap.c | 4 +- drivers/s390/scsi/zfcp_erp.c | 2 +- drivers/scsi/lpfc/lpfc_nvme.c | 2 - drivers/scsi/mpt3sas/mpt3sas_scsih.c | 8 +- drivers/scsi/qla2xxx/qla_nvme.c | 1 - drivers/staging/erofs/utils.c | 2 +- drivers/usb/dwc3/core.c | 5 + drivers/usb/dwc3/core.h | 4 + drivers/usb/gadget/composite.c | 9 + drivers/usb/gadget/function/f_fs.c | 1 + drivers/usb/host/xhci.c | 4 +- fs/btrfs/async-thread.c | 8 + fs/btrfs/async-thread.h | 1 + fs/btrfs/delayed-inode.c | 13 ++ fs/btrfs/disk-io.c | 27 ++- fs/btrfs/file.c | 11 + fs/btrfs/qgroup.c | 11 +- fs/btrfs/relocation.c | 35 ++-- fs/exec.c | 2 +- fs/ext4/inode.c | 2 +- fs/filesystems.c | 4 +- fs/gfs2/glock.c | 3 + fs/hfsplus/attributes.c | 4 + fs/nfs/write.c | 1 + fs/ocfs2/alloc.c | 4 + fs/pstore/inode.c | 5 +- fs/pstore/platform.c | 4 +- include/linux/devfreq_cooling.h | 2 +- include/linux/iocontext.h | 1 + include/linux/mlx5/mlx5_ifc.h | 9 +- include/linux/nvme-fc-driver.h | 4 - include/linux/pci-epc.h | 3 + include/linux/sched.h | 4 +- include/linux/swab.h | 1 + include/uapi/linux/swab.h | 10 + kernel/cpu.c | 5 +- kernel/irq/irqdomain.c | 10 +- kernel/kmod.c | 4 +- kernel/locking/lockdep.c | 4 + kernel/sched/sched.h | 8 +- kernel/signal.c | 2 +- kernel/trace/trace_kprobe.c | 2 + lib/find_bit.c | 16 +- mm/page_alloc.c | 8 +- mm/slub.c | 2 +- security/keys/key.c | 2 +- security/keys/keyctl.c | 4 +- sound/core/oss/pcm_plugin.c | 32 ++- sound/pci/hda/hda_beep.c | 6 +- sound/pci/hda/hda_intel.c | 16 ++ sound/pci/hda/patch_realtek.c | 50 +---- sound/pci/ice1712/prodigy_hifi.c | 4 +- sound/soc/soc-dapm.c | 8 +- sound/soc/soc-ops.c | 4 +- sound/soc/soc-pcm.c | 6 +- sound/soc/soc-topology.c | 2 +- sound/usb/mixer_maps.c | 28 +++ tools/gpio/Makefile | 2 +- tools/perf/Makefile.config | 11 +- tools/testing/selftests/vm/mlock2-tests.c | 233 ++++----------------- tools/testing/selftests/x86/ptrace_syscall.c | 8 +- 159 files changed, 1190 insertions(+), 777 deletions(-) create mode 100644 Documentation/sound/hd-audio/realtek-pc-beep.rst -- 1.8.3

1 144

[PATCH 1/2] ACPI: GED: implement powerkey evged freeze function
by Hongbo Yao 21 Apr '20

21 Apr '20

From: huangjun <huangjun63(a)huawei.com> If we want acpi ged to support wake from freeze, we need to implement the suspend/resume function. In these two methods, ACPI's _GPO, GPP method is called to realize the setting of sleep flag and anti-shake. Signed-off-by: Huangjun <huangjun63(a)huawei.com> --- drivers/acpi/evged.c | 82 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 82 insertions(+) diff --git a/drivers/acpi/evged.c b/drivers/acpi/evged.c index f13ba2c07667..84656fc09d15 100644 --- a/drivers/acpi/evged.c +++ b/drivers/acpi/evged.c @@ -46,11 +46,14 @@ #include <linux/list.h> #include <linux/platform_device.h> #include <linux/acpi.h> +#include <linux/timer.h> +#include <linux/jiffies.h> #define MODULE_NAME "acpi-ged" struct acpi_ged_device { struct device *dev; + struct timer_list timer; struct list_head event_list; }; @@ -148,6 +151,8 @@ static int ged_probe(struct platform_device *pdev) dev_err(&pdev->dev, "unable to parse the _CRS record\n"); return -EINVAL; } + + timer_setup(&geddev->timer, NULL, 0); platform_set_drvdata(pdev, geddev); return 0; @@ -164,6 +169,7 @@ static void ged_shutdown(struct platform_device *pdev) dev_dbg(geddev->dev, "GED releasing GSI %u @ IRQ %u\n", event->gsi, event->irq); } + del_timer(&geddev->timer); } static int ged_remove(struct platform_device *pdev) @@ -177,6 +183,78 @@ static const struct acpi_device_id ged_acpi_ids[] = { {}, }; +#ifdef CONFIG_PM_SLEEP +static acpi_status ged_acpi_execute(struct device *dev, char* method, u64 arg) +{ + acpi_status acpi_ret; + acpi_handle method_handle; + + acpi_ret = acpi_get_handle(ACPI_HANDLE(dev), method, &method_handle); + + if (ACPI_FAILURE(acpi_ret)) { + dev_err(dev, "cannot locate %s method\n", method); + return AE_NOT_FOUND; + } + + acpi_ret = acpi_execute_simple_method(method_handle, NULL, arg); + if (ACPI_FAILURE(acpi_ret)) { + dev_err(dev, "%s method execution failed\n", method); + return AE_ERROR; + } + + return AE_OK; +} + +static void ged_timer_callback(struct timer_list *t) +{ + struct acpi_ged_device *geddev = from_timer(geddev, t, timer); + struct acpi_ged_event *event, *next; + + list_for_each_entry_safe(event, next, &geddev->event_list, node) { + ged_acpi_execute(geddev->dev, "_GPP", event->gsi); + } +} + +static int ged_suspend(struct device *dev) +{ + struct acpi_ged_device *geddev = dev_get_drvdata(dev); + struct acpi_ged_event *event, *next; + acpi_status acpi_ret; + + list_for_each_entry_safe(event, next, &geddev->event_list, node) { + acpi_ret = ged_acpi_execute(dev, "_GPO", event->gsi); + + if (acpi_ret == AE_ERROR) + return -EINVAL; + + enable_irq_wake(event->irq); + } + return 0; +} + +static int ged_resume(struct device *dev) +{ + struct acpi_ged_device *geddev = dev_get_drvdata(dev); + struct acpi_ged_event *event, *next; + + list_for_each_entry_safe(event, next, &geddev->event_list, node) { + disable_irq_wake(event->irq); + } + + /* use timer to complete 4s anti-shake */ + geddev->timer.expires = jiffies + (4 * HZ); + geddev->timer.function = ged_timer_callback; + add_timer(&geddev->timer); + + return 0; +} + +static const struct dev_pm_ops ged_pm_ops = { + SET_SYSTEM_SLEEP_PM_OPS(ged_suspend, ged_resume) +}; +#endif + + static struct platform_driver ged_driver = { .probe = ged_probe, .remove = ged_remove, @@ -184,6 +262,10 @@ static struct platform_driver ged_driver = { .driver = { .name = MODULE_NAME, .acpi_match_table = ACPI_PTR(ged_acpi_ids), +#ifdef CONFIG_PM_SLEEP + .pm = &ged_pm_ops, +#endif + }, }; builtin_platform_driver(ged_driver); -- 2.20.1

1 1

[PATCH] irqchip/gic-v3-its: Fix the ITT address changing for hebernation.
by Hongbo Yao 20 Apr '20

20 Apr '20

From: Sunnanyong <sunnanyong(a)huawei.com> If we want to support S4 (suspend to Disk), it is necessary to guarantee that the ITS tables are at the same address in the booting kernel and the resumed kernel. That covers all the ITS tables and as well as the RDs'. To support this, allocting the itt memory from memory pool intead. Signed-off-by: Sunnanyong <sunnanyong(a)huawei.com> --- drivers/irqchip/irq-gic-v3-its.c | 72 ++++++++++++++++++++++++++++++-- 1 file changed, 69 insertions(+), 3 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 860f3ef2969e..9de585fe74fb 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -189,6 +189,14 @@ static DEFINE_IDA(its_vpeid_ida); #define gic_data_rdist_rd_base() (gic_data_rdist()->rd_base) #define gic_data_rdist_vlpi_base() (gic_data_rdist_rd_base() + SZ_128K) +static void *its_mem_pool_alloc(int dev_id); +#define ITS_MEM_POOL_SIZE (SZ_4M) +#define ITS_MEM_POOL_MAX (16) +#define GITS_OTHER_OFFSET 0x20000 +#define GITS_OTHER_REG_SIZE 0x100 +#define GITS_FUNC_REG_OFFSET 0x80 +static void *its_mem_pool[ITS_MEM_POOL_MAX] = {0}; + static u16 get_its_list(struct its_vm *vm) { struct its_node *its; @@ -2436,7 +2444,11 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id, nr_ites = max(2, nvecs); sz = nr_ites * its->ite_size; sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1; - itt = kzalloc_node(sz, GFP_KERNEL, its->numa_node); + + itt = its_mem_pool_alloc(dev_id); + if (!itt) + itt = kzalloc_node(sz, GFP_KERNEL, its->numa_node); + if (alloc_lpis) { lpi_map = its_lpi_alloc(nvecs, &lpi_base, &nr_lpis); if (lpi_map) @@ -2450,7 +2462,6 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id, if (!dev || !itt || !col_map || (!lpi_map && alloc_lpis)) { kfree(dev); - kfree(itt); kfree(lpi_map); kfree(col_map); return NULL; @@ -2486,7 +2497,6 @@ static void its_free_device(struct its_device *its_dev) raw_spin_lock_irqsave(&its_dev->its->lock, flags); list_del(&its_dev->entry); raw_spin_unlock_irqrestore(&its_dev->its->lock, flags); - kfree(its_dev->itt); kfree(its_dev); } @@ -3798,11 +3808,41 @@ static int redist_disable_lpis(void) return 0; } +static void its_cpu_clear_cache(void) +{ + struct its_node *its; + u64 val = 0; + void __iomem *func_base; + + raw_spin_lock(&its_lock); + + list_for_each_entry(its, &its_nodes, entry) { + func_base = ioremap(its->phys_base + GITS_OTHER_OFFSET, + GITS_OTHER_REG_SIZE); + if (!func_base) { + pr_err("ITS@%p : Unable to map ITS OTHER registers\n", + (void *)(its->phys_base + GITS_OTHER_OFFSET)); + raw_spin_unlock(&its_lock); + return; + } + + val = readl_relaxed(func_base + GITS_FUNC_REG_OFFSET); + val = val | (0x7 << 16); + writel_relaxed(val, func_base + GITS_FUNC_REG_OFFSET); + dsb(sy); + iounmap(func_base); + } + + raw_spin_unlock(&its_lock); +} + + int its_cpu_init(void) { if (!list_empty(&its_nodes)) { int ret; + its_cpu_clear_cache(); ret = redist_disable_lpis(); if (ret) return ret; @@ -4001,6 +4041,7 @@ int __init its_init(struct fwnode_handle *handle, struct rdists *rdists, struct its_node *its; bool has_v4 = false; int err; + int i; its_parent = parent_domain; of_node = to_of_node(handle); @@ -4014,6 +4055,16 @@ int __init its_init(struct fwnode_handle *handle, struct rdists *rdists, return -ENXIO; } + for (i = 0; i < ITS_MEM_POOL_MAX; i++) { + if (!its_mem_pool[i]) { + its_mem_pool[i] = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, + get_order(ITS_MEM_POOL_SIZE)); + if (!its_mem_pool[i]) + pr_err("err:[its mem[%d]] has no memory\n", i); + } + } + + gic_rdists = rdists; err = allocate_lpi_tables(); @@ -4035,3 +4086,18 @@ int __init its_init(struct fwnode_handle *handle, struct rdists *rdists, return 0; } + +void *its_mem_pool_alloc(int dev_id) +{ + int pool_num = dev_id / (ITS_MEM_POOL_SIZE / SZ_512); + int idx = dev_id % (ITS_MEM_POOL_SIZE / SZ_512); + void *addr = NULL; + + if (pool_num >= ITS_MEM_POOL_MAX || !its_mem_pool[pool_num]) { + pr_err("[its mem[%d]] alloc error\n", pool_num); + return NULL; + } + + addr = its_mem_pool[pool_num] + idx * SZ_512; + return addr; +} -- 2.20.1

1 0

[PATCH 00/22] Add support for Hygon Dhyana Family 18h processor
by Pu Wen 20 Apr '20

20 Apr '20

As a new x86 CPU Vendor, Chengdu Haiguang IC Design Co., Ltd (Hygon) is a Joint Venture between AMD and Haiguang Information Technology Co., Ltd., and aims at providing high performance x86 processor for China server market. The first generation Hygon's processor(Dhyana) originates from AMD technology and shares most of the architecture with AMD's family 17h, but with different CPU Vendor ID("HygonGenuine")/PCIE Device Vendor ID (0x1D94)/Family series number (Family 18h). To enable the support of Linux kernel to Hygon's CPU, we added a new vendor type (X86_VENDOR_HYGON, with value of 9) in arch/x86/include/ asm/processor.h, and shared most of kernel support codes with AMD family 17h. As Hygon will negotiate with AMD to make sure that only Hygon will use family 18h, so try to minimize code modification and share most codes with AMD under this consideration. This patch series have been applied and tested successfully on Hygon Dhyana SoC silicon. Also tested on AMD EPYC (Family 17h) processor, it works fine and makes no harm to the existing codes. This patch series are created for the current branch openEuler-1.0-LTS. References: [1] Linux kernel patches for Hygon Dhyana, merged in 4.20: https://git.kernel.org/tip/c9661c1e80b609cd038db7c908e061f0535804ef [2] MSR and CPUID definition: https://www.amd.com/system/files/TechDocs/54945_PPR_Family_17h_Models_00h-0… Pu Wen (22): x86/cpu: Create Hygon Dhyana architecture support file x86/cpu: Get cache info and setup cache cpumap for Hygon Dhyana x86/cpu/mtrr: Support TOP_MEM2 and get MTRR number x86/smpboot: Do not use BSP INIT delay and MWAIT to idle on Dhyana x86/events: Add Hygon Dhyana support to PMU infrastructure x86/alternative: Init ideal_nops for Hygon Dhyana x86/amd_nb: Check vendor in AMD-only functions x86/pci, x86/amd_nb: Add Hygon Dhyana support to PCI and northbridge x86/apic: Add Hygon Dhyana support x86/bugs: Add Hygon Dhyana to the respective mitigation machinery x86/mce: Add Hygon Dhyana support to the MCA infrastructure x86/kvm: Add Hygon Dhyana support to KVM x86/xen: Add Hygon Dhyana support to Xen ACPI: Add Hygon Dhyana support cpufreq: Add Hygon Dhyana support EDAC, amd64: Add Hygon Dhyana support tools/cpupower: Add Hygon Dhyana support hwmon: (k10temp) Add Hygon Dhyana support x86/CPU/hygon: Fix phys_proc_id calculation logic for multi-die processors i2c-piix4: Add Hygon Dhyana SMBus support x86/amd_nb: Make hygon_nb_misc_ids static NTB: Add Hygon Device ID Documentation/i2c/busses/i2c-piix4 | 2 + MAINTAINERS | 6 + arch/x86/Kconfig.cpu | 14 + arch/x86/events/amd/core.c | 4 + arch/x86/events/amd/uncore.c | 20 +- arch/x86/events/core.c | 4 + arch/x86/include/asm/amd_nb.h | 3 + arch/x86/include/asm/cacheinfo.h | 1 + arch/x86/include/asm/kvm_emulate.h | 4 + arch/x86/include/asm/mce.h | 2 + arch/x86/include/asm/processor.h | 3 +- arch/x86/include/asm/virtext.h | 5 +- arch/x86/kernel/alternative.c | 4 + arch/x86/kernel/amd_nb.c | 49 ++- arch/x86/kernel/apic/apic.c | 7 + arch/x86/kernel/apic/probe_32.c | 1 + arch/x86/kernel/cpu/Makefile | 1 + arch/x86/kernel/cpu/bugs.c | 4 +- arch/x86/kernel/cpu/cacheinfo.c | 31 +- arch/x86/kernel/cpu/common.c | 4 + arch/x86/kernel/cpu/cpu.h | 1 + arch/x86/kernel/cpu/hygon.c | 413 ++++++++++++++++++ arch/x86/kernel/cpu/mce/core.c | 20 +- arch/x86/kernel/cpu/mce/severity.c | 3 +- arch/x86/kernel/cpu/mtrr/cleanup.c | 3 +- arch/x86/kernel/cpu/mtrr/mtrr.c | 2 +- arch/x86/kernel/cpu/perfctr-watchdog.c | 2 + arch/x86/kernel/smpboot.c | 4 +- arch/x86/kvm/emulate.c | 11 +- arch/x86/pci/amd_bus.c | 6 +- arch/x86/xen/pmu.c | 12 +- drivers/acpi/acpi_pad.c | 1 + drivers/acpi/processor_idle.c | 1 + drivers/cpufreq/acpi-cpufreq.c | 5 + drivers/cpufreq/amd_freq_sensitivity.c | 9 +- drivers/edac/amd64_edac.c | 10 +- drivers/edac/mce_amd.c | 4 +- drivers/hwmon/k10temp.c | 3 +- drivers/i2c/busses/Kconfig | 1 + drivers/i2c/busses/i2c-piix4.c | 15 +- drivers/ntb/hw/amd/ntb_hw_amd.c | 1 + include/linux/pci_ids.h | 2 + tools/power/cpupower/utils/cpufreq-info.c | 6 +- tools/power/cpupower/utils/helpers/amd.c | 4 +- tools/power/cpupower/utils/helpers/cpuid.c | 8 +- tools/power/cpupower/utils/helpers/helpers.h | 2 +- tools/power/cpupower/utils/helpers/misc.c | 2 +- .../utils/idle_monitor/mperf_monitor.c | 3 +- 48 files changed, 668 insertions(+), 55 deletions(-) create mode 100644 arch/x86/kernel/cpu/hygon.c -- 2.23.0

5 28

[PATCH 00/52] Backport lts patches from Linux-4.19.115
by Yang Yingliang 18 Apr '20

18 Apr '20

Alexander Usyskin (1): mei: me: add cedar fork device ids Amritha Nambiar (1): net: Fix Tx hash bound checking Arun KS (1): arm64: Fix size of __early_cpu_boot_status Avihai Horon (1): RDMA/cm: Update num_paths in cma_resolve_iboe_route error flow Chris Lew (1): rpmsg: glink: Remove chunk size word align warning Daniel Jordan (1): padata: always acquire cpu_hotplug_lock before pinst->lock David Ahern (1): tools/accounting/getdelays.c: fix netlink attribute length David Howells (1): rxrpc: Fix sendmsg(MSG_WAITALL) handling Eugene Syromiatnikov (1): coresight: do not use the BIT() macro in the UAPI header Eugeniy Paltsev (1): initramfs: restore default compression behavior Florian Fainelli (2): net: dsa: bcm_sf2: Do not register slave MDIO bus with OF net: dsa: bcm_sf2: Ensure correct sub-node is parsed Geoffrey Allott (1): ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on EVGA X99 Classified motherboard Gerd Hoffmann (1): drm/bochs: downgrade pci_request_region failure from error to warning Greg Kroah-Hartman (1): Linux 4.19.115 Hans Verkuil (1): drm_dp_mst_topology: fix broken drm_dp_sideband_parse_remote_dpcd_read() Hans de Goede (2): extcon: axp288: Add wakeup support power: supply: axp288_charger: Add special handling for HP Pavilion x2 10 Ilya Dryomov (1): ceph: canonicalize server path in place James Zhu (1): drm/amdgpu: fix typo for vcn1 idle check Jarod Wilson (1): ipv6: don't auto-add link-local address to lag ports Jason A. Donenfeld (1): random: always use batched entropy for get_random_u{32, 64} Jason Gunthorpe (2): RDMA/ucma: Put a lock around every call to the rdma_cm layer RDMA/cma: Teach lockdep about the order of rtnl and lock Jisheng Zhang (1): net: stmmac: dwmac1000: fix out-of-bounds mac address reg setting Kaike Wan (2): IB/hfi1: Call kobject_put() when kobject_init_and_add() fails IB/hfi1: Fix memory leaks in sysfs registration and unregistration Kishon Vijay Abraham I (2): misc: pci_endpoint_test: Fix to support > 10 pci-endpoint-test devices misc: pci_endpoint_test: Avoid using module parameter to determine irqtype Len Brown (2): tools/power turbostat: Fix gcc build warnings tools/power turbostat: Fix missing SYS_LPI counter on some Chromebooks Lucas Stach (1): drm/etnaviv: replace MMU flush marker with flush sequence Marcelo Ricardo Leitner (1): sctp: fix possibly using a bad saddr with a given dst Mario Kleiner (1): drm/amd/display: Add link_rate quirk for Apple 15" MBP 2017 Martin Kaiser (1): hwrng: imx-rngc - fix an error path Oleksij Rempel (1): net: phy: micrel: kszphy_resume(): add delay after genphy_resume() before accessing PHY registers Paul Cercueil (1): ASoC: jz4740-i2s: Fix divider written at incorrect offset in register Petr Machata (1): mlxsw: spectrum_flower: Do not stop at FLOW_ACTION_VLAN_MANGLE Prabhath Sajeepa (1): nvme-rdma: Avoid double freeing of async event data Qian Cai (1): ipv4: fix a RCU-list lock in fib_triestat_seq_show Qiujun Huang (3): sctp: fix refcount bug in sctp_wfree Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl fbcon: fix null-ptr-deref in fbcon_switch Rob Clark (2): drm/msm: stop abusing dma_map/unmap for cache drm/msm: Use the correct dma_sync calls in msm_gem Roger Quadros (1): usb: dwc3: don't set gadget->is_otg flag Sean Young (1): media: rc: IR signal for Panasonic air conditioner too long Taniya Das (1): clk: qcom: rcg: Return failure for RCG update Thinh Nguyen (1): usb: dwc3: gadget: Wrap around when skip TRBs William Dauchy (1): net, ip_tunnel: fix interface lookup with no key Xiubo Li (1): ceph: remove the extra slashes in the server path YueHaibing (1): misc: rtsx: set correct pcr_ops for rts522A Makefile | 2 +- arch/arm64/kernel/head.S | 2 +- drivers/char/hw_random/imx-rngc.c | 4 +- drivers/char/random.c | 20 ++------ drivers/clk/qcom/clk-rcg2.c | 2 +- drivers/extcon/extcon-axp288.c | 32 ++++++++++++ drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 2 +- drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 11 +++++ drivers/gpu/drm/bochs/bochs_hw.c | 6 +-- drivers/gpu/drm/drm_dp_mst_topology.c | 1 + drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 10 ++-- drivers/gpu/drm/etnaviv/etnaviv_gpu.h | 1 + drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 6 +-- drivers/gpu/drm/etnaviv/etnaviv_mmu.h | 2 +- drivers/gpu/drm/msm/msm_gem.c | 47 ++++++++++++++++-- drivers/infiniband/core/cma.c | 14 ++++++ drivers/infiniband/core/ucma.c | 49 ++++++++++++++++++- drivers/infiniband/hw/hfi1/sysfs.c | 26 +++++++--- drivers/media/rc/lirc_dev.c | 2 +- drivers/misc/cardreader/rts5227.c | 1 + drivers/misc/mei/hw-me-regs.h | 2 + drivers/misc/mei/pci-me.c | 2 + drivers/misc/pci_endpoint_test.c | 14 ++++-- drivers/net/dsa/bcm_sf2.c | 9 +++- .../net/ethernet/mellanox/mlxsw/spectrum_flower.c | 8 +-- .../net/ethernet/stmicro/stmmac/dwmac1000_core.c | 2 +- drivers/net/phy/micrel.c | 7 +++ drivers/nvme/host/rdma.c | 8 +-- drivers/power/supply/axp288_charger.c | 57 +++++++++++++++++++++- drivers/rpmsg/qcom_glink_native.c | 3 -- drivers/usb/dwc3/gadget.c | 3 +- drivers/video/fbdev/core/fbcon.c | 3 ++ fs/ceph/super.c | 56 +++++++++++++-------- fs/ceph/super.h | 2 +- include/uapi/linux/coresight-stm.h | 6 ++- kernel/padata.c | 4 +- net/bluetooth/rfcomm/tty.c | 4 +- net/core/dev.c | 2 + net/ipv4/fib_trie.c | 3 ++ net/ipv4/ip_tunnel.c | 6 +-- net/ipv6/addrconf.c | 4 ++ net/rxrpc/sendmsg.c | 4 +- net/sctp/ipv6.c | 20 +++++--- net/sctp/protocol.c | 28 +++++++---- net/sctp/socket.c | 31 +++++++++--- sound/pci/hda/patch_ca0132.c | 1 + sound/soc/jz4740/jz4740-i2s.c | 2 +- tools/accounting/getdelays.c | 2 +- tools/power/x86/turbostat/turbostat.c | 27 +++++----- usr/Kconfig | 22 ++++----- 50 files changed, 434 insertions(+), 148 deletions(-) -- 1.8.3

1 52

[PATCH] srcu: Apply *_ONCE() to ->srcu_last_gp_end
by Yang Yingliang 18 Apr '20

18 Apr '20

From: "Paul E. McKenney" <paulmck(a)kernel.org> mainline inclusion from mainline-v5.6-rc1 commit 844a378de3372c923909681706d62336d702531e category: bugfix bugzilla: 28851 CVE: NA ------------------------------------------------------------------------- The ->srcu_last_gp_end field is accessed from any CPU at any time by synchronize_srcu(), so non-initialization references need to use READ_ONCE() and WRITE_ONCE(). This commit therefore makes that change. Reported-by: syzbot+08f3e9d26e5541e1ecf2(a)syzkaller.appspotmail.com Acked-by: Marco Elver <elver(a)google.com> Signed-off-by: Paul E. McKenney <paulmck(a)kernel.org> Conflicts: kernel/rcu/srcutree.c Signed-off-by: Zhen Lei <thunder.leizhen(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/rcu/srcutree.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c index 4b0a6e3..7bd0204 100644 --- a/kernel/rcu/srcutree.c +++ b/kernel/rcu/srcutree.c @@ -552,7 +552,7 @@ static void srcu_gp_end(struct srcu_struct *sp) idx = rcu_seq_state(sp->srcu_gp_seq); WARN_ON_ONCE(idx != SRCU_STATE_SCAN2); cbdelay = srcu_get_delay(sp); - sp->srcu_last_gp_end = ktime_get_mono_fast_ns(); + WRITE_ONCE(sp->srcu_last_gp_end, ktime_get_mono_fast_ns()); rcu_seq_end(&sp->srcu_gp_seq); gpseq = rcu_seq_current(&sp->srcu_gp_seq); if (ULONG_CMP_LT(sp->srcu_gp_seq_needed_exp, gpseq)) @@ -780,6 +780,7 @@ static bool srcu_might_be_idle(struct srcu_struct *sp) unsigned long flags; struct srcu_data *sdp; unsigned long t; + unsigned long tlast; /* If the local srcu_data structure has callbacks, not idle. */ local_irq_save(flags); @@ -798,9 +799,9 @@ static bool srcu_might_be_idle(struct srcu_struct *sp) /* First, see if enough time has passed since the last GP. */ t = ktime_get_mono_fast_ns(); + tlast = READ_ONCE(sp->srcu_last_gp_end); if (exp_holdoff == 0 || - time_in_range_open(t, sp->srcu_last_gp_end, - sp->srcu_last_gp_end + exp_holdoff)) + time_in_range_open(t, tlast, tlast + exp_holdoff)) return false; /* Too soon after last GP. */ /* Next, check for probable idleness. */ -- 1.8.3

1 0

[PATCH 1/2] iommu/dma: Fix for dereferencing before null checking
by Yang Yingliang 18 Apr '20

18 Apr '20

From: Yunsheng Lin <linyunsheng(a)huawei.com> mainline inclusion from mainline-v5.4-rc1 commit 6b0c54e7f2715997c366e8374209bc74259b0a59 category: bugfix bugzilla: 21318 CVE: NA ------------------------------------------------------------------------- The cookie is dereferenced before null checking in the function iommu_dma_init_domain. This patch moves the dereferencing after the null checking. Fixes: fdbe574eb693 ("iommu/dma: Allow MSI-only cookies") Signed-off-by: Yunsheng Lin <linyunsheng(a)huawei.com> Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Conflicts: drivers/iommu/dma-iommu.c Signed-off-by: Zhen Lei <thunder.leizhen(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/iommu/dma-iommu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c index 64ae17e8b..b68d9fd 100644 --- a/drivers/iommu/dma-iommu.c +++ b/drivers/iommu/dma-iommu.c @@ -290,13 +290,15 @@ int iommu_dma_init_domain(struct iommu_domain *domain, dma_addr_t base, u64 size, struct device *dev) { struct iommu_dma_cookie *cookie = domain->iova_cookie; - struct iova_domain *iovad = &cookie->iovad; unsigned long order, base_pfn, end_pfn; + struct iova_domain *iovad; int attr; if (!cookie || cookie->type != IOMMU_DMA_IOVA_COOKIE) return -EINVAL; + iovad = &cookie->iovad; + /* Use the smallest supported page size for IOVA granularity */ order = __ffs(domain->pgsize_bitmap); base_pfn = max_t(unsigned long, 1, base >> order); -- 1.8.3

1 1

[PATCH] net/hinic: fix the problem that out-of-bounds access
by Yang Yingliang 18 Apr '20

18 Apr '20

From: Shaozhengchao <shaozhengchao(a)huawei.com> driver inclusion category: bugfix bugzilla: 4472 ----------------------------------------------------------------------- Fix the problem that out-of-bounds access caused by user input In order to solve the problem, restrictions are imposed on each input which is done in kernel driver. Signed-off-by: Shaozhengchao <shaozhengchao(a)huawei.com> Reviewed-by: Luoshaokai <luoshaokai(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/ethernet/huawei/hinic/hinic_nictool.c | 18 ++++++++++++++++++ drivers/net/ethernet/huawei/hinic/hinic_nictool.h | 2 ++ drivers/net/ethernet/huawei/hinic/hinic_sml_counter.c | 16 +++++++++++++--- 3 files changed, 33 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nictool.c b/drivers/net/ethernet/huawei/hinic/hinic_nictool.c index 46dd9ec..df01088 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nictool.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_nictool.c @@ -1712,6 +1712,19 @@ static u32 get_up_timeout_val(enum hinic_mod_type mod, u8 cmd) return UP_COMP_TIME_OUT_VAL; } +static int check_useparam_valid(struct msg_module *nt_msg, void *buf_in) +{ + struct csr_write_st *csr_write_msg = (struct csr_write_st *)buf_in; + u32 rd_len = csr_write_msg->rd_len; + + if (rd_len > TOOL_COUNTER_MAX_LEN) { + pr_err("Csr read or write len is invalid!\n"); + return -EINVAL; + } + + return 0; +} + static int send_to_up(void *hwdev, struct msg_module *nt_msg, void *buf_in, u32 in_size, void *buf_out, u32 *out_size) { @@ -1744,6 +1757,9 @@ static int send_to_up(void *hwdev, struct msg_module *nt_msg, } } else if (nt_msg->up_cmd.up_db.up_api_type == API_CHAIN) { + if (check_useparam_valid(nt_msg, buf_in)) + return -EINVAL; + if (nt_msg->up_cmd.up_db.chipif_cmd == API_CSR_WRITE) { ret = api_csr_write(hwdev, nt_msg, buf_in, in_size, buf_out, out_size); @@ -1994,6 +2010,8 @@ static int get_all_chip_id_cmd(struct msg_module *nt_msg) { struct nic_card_id card_id; + memset(&card_id, 0, sizeof(card_id)); + hinic_get_all_chip_id((void *)&card_id); if (copy_to_user(nt_msg->out_buf, &card_id, sizeof(card_id))) { diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nictool.h b/drivers/net/ethernet/huawei/hinic/hinic_nictool.h index cfbe435..e8eccaf 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nictool.h +++ b/drivers/net/ethernet/huawei/hinic/hinic_nictool.h @@ -285,4 +285,6 @@ struct hinic_pf_info { extern void hinic_get_io_stats(struct hinic_nic_dev *nic_dev, struct hinic_show_item *items); +#define TOOL_COUNTER_MAX_LEN 512 + #endif diff --git a/drivers/net/ethernet/huawei/hinic/hinic_sml_counter.c b/drivers/net/ethernet/huawei/hinic/hinic_sml_counter.c index 9536adf..eb35df6 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_sml_counter.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_sml_counter.c @@ -253,9 +253,19 @@ int hinic_sm_ctr_rd64_pair(void *hwdev, u8 node, u8 instance, ctr_rd_rsp_u rsp; int ret; - if (!hwdev || (0 != (ctr_id & 0x1)) || !value1 || !value2) { - pr_err("Hwdev(0x%p) or value1(0x%p) or value2(0x%p) is NULL or ctr_id(%d) is odd number\n", - hwdev, value1, value2, ctr_id); + if (!value1) { + pr_err("value1 is NULL for read 64 bit pair\n"); + return -EFAULT; + } + + if (!value2) { + pr_err("value2 is NULL for read 64 bit pair\n"); + return -EFAULT; + } + + if (!hwdev || (0 != (ctr_id & 0x1))) { + pr_err("Hwdev is NULL or ctr_id(%d) is odd number for read 64 bit pair\n", + ctr_id); return -EFAULT; } -- 1.8.3

1 0

[PATCH 1/2] scsi: sg: add sg_remove_request in sg_common_write
by Yang Yingliang 18 Apr '20

18 Apr '20

From: Li Bin <huawei.libin(a)huawei.com> hulk inclusion category: bugfix bugzilla: 34234 CVE: NA -------------------------------- If the dxfer_len is greater than 256M then the request is invalid, it should call sg_remove_request in sg_common_write. Fixes: f930c7043663 ("scsi: sg: only check for dxfer_len greater than 256M") Signed-off-by: Li Bin <huawei.libin(a)huawei.com> Acked-by: Douglas Gilbert <dgilbert(a)interlog.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/scsi/sg.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index c75324a..9c4b71e 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -808,8 +808,10 @@ static int sg_allow_access(struct file *filp, unsigned char *cmd) "sg_common_write: scsi opcode=0x%02x, cmd_size=%d\n", (int) cmnd[0], (int) hp->cmd_len)); - if (hp->dxfer_len >= SZ_256M) + if (hp->dxfer_len >= SZ_256M) { + sg_remove_request(sfp, srp); return -EINVAL; + } k = sg_start_req(srp, cmnd); if (k) { -- 1.8.3

1 1

[PATCH 1/2] btrfs: extent_io: Handle errors better in extent_write_full_page()
by Yang Yingliang 18 Apr '20

18 Apr '20

From: Qu Wenruo <wqu(a)suse.com> mainline inclusion from mainline-v5.2-rc2 commit 3065976b045f77a910809fa7699f99a1e7c0dbbb category: bugfix bugzilla: 13690 CVE: CVE-2019-19377 Introduce end_write_bio() for CVE-2019-19377. ------------------------------------------------- Since now flush_write_bio() could return error, kill the BUG_ON() first. Then don't call flush_write_bio() unconditionally, instead we check the return value from __extent_writepage() first. If __extent_writepage() fails, we do cleanup, and return error without submitting the possible corrupted or half-baked bio. If __extent_writepage() successes, then we call flush_write_bio() and return the result. Signed-off-by: Qu Wenruo <wqu(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent_io.c [yyl: adjust context] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/btrfs/extent_io.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c index 11efb4f..7f2990f 100644 --- a/fs/btrfs/extent_io.c +++ b/fs/btrfs/extent_io.c @@ -2731,6 +2731,16 @@ static int __must_check submit_one_bio(struct bio *bio, int mirror_num, return blk_status_to_errno(ret); } +/* Cleanup unsubmitted bios */ +static void end_write_bio(struct extent_page_data *epd, int ret) +{ + if (epd->bio) { + epd->bio->bi_status = errno_to_blk_status(ret); + bio_endio(epd->bio); + epd->bio = NULL; + } +} + /* * @opf: bio REQ_OP_* and REQ_* flags as one value * @tree: tree so we can call our merge_bio hook @@ -3438,6 +3448,9 @@ static noinline_for_stack int __extent_writepage_io(struct inode *inode, * records are inserted to lock ranges in the tree, and as dirty areas * are found, they are marked writeback. Then the lock bits are removed * and the end_io handler clears the writeback ranges + * + * Return 0 if everything goes well. + * Return <0 for error. */ static int __extent_writepage(struct page *page, struct writeback_control *wbc, struct extent_page_data *epd) @@ -3505,6 +3518,7 @@ static int __extent_writepage(struct page *page, struct writeback_control *wbc, end_extent_writepage(page, ret, start, page_end); } unlock_page(page); + ASSERT(ret <= 0); return ret; done_unlocked: @@ -4054,6 +4068,11 @@ int extent_write_full_page(struct page *page, struct writeback_control *wbc) }; ret = __extent_writepage(page, wbc, &epd); + ASSERT(ret <= 0); + if (ret < 0) { + end_write_bio(&epd, ret); + return ret; + } flush_write_bio(&epd); return ret; -- 1.8.3

1 1

2024

2023

2022

2021

2020

2019

Kernel