- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 0/1] CVE-2021-46990
by Lin Yujun 05 Mar '24

05 Mar '24

*** BLURB HERE *** Michael Ellerman (1): powerpc/64s: Fix crashes when toggling entry flush barrier arch/powerpc/lib/feature-fixups.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] sched: migtate user interface from smart grid to sched bpf
by Liao Chen 05 Mar '24

05 Mar '24

Migtating user interface from smart grid to sched bpf, which allows users to set SCHED_GRID_QOS_TASK_LEVEL through: /proc/${pid}/task/${pid}/tag interface. Although arbitrary integer value could be assigned to , currnetly we clamp the value of SCHED_GRID_QOS_TASK_LEVEL to 0-7, which maintains consistency. Liao Chen (1): sched: migtate user interface from smart grid to sched bpf fs/proc/base.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] i2c: xiic: fix reference leak when pm_runtime_get_sync fails
by Yang Yingliang 05 Mar '24

05 Mar '24

From: Qinglang Miao <miaoqinglang(a)huawei.com> mainline inclusion from mainline-v5.13-rc1 commit a85c5c7a3aa8041777ff691400b4046e56149fd3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94JCX CVE: CVE-2020-36778 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?i… -------------------------------- The PM reference count is not expected to be incremented on return in xiic_xfer and xiic_i2c_remove. However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here. Replace it with pm_runtime_resume_and_get to keep usage counter balanced. Fixes: 10b17004a74c ("i2c: xiic: Fix the clocking across bind unbind") Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Qinglang Miao <miaoqinglang(a)huawei.com> Signed-off-by: Wolfram Sang <wsa(a)kernel.org> Conflicts: drivers/i2c/busses/i2c-xiic.c Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/i2c/busses/i2c-xiic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c index 8d6b6eeef71c..f686a45801e6 100644 --- a/drivers/i2c/busses/i2c-xiic.c +++ b/drivers/i2c/busses/i2c-xiic.c @@ -678,7 +678,7 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) dev_dbg(adap->dev.parent, "%s entry SR: 0x%x\n", __func__, xiic_getreg8(i2c, XIIC_SR_REG_OFFSET)); - err = pm_runtime_get_sync(i2c->dev); + err = pm_runtime_resume_and_get(i2c->dev); if (err < 0) return err; -- 2.25.1

2 1

[PATCH v2 OLK-6.6 0/3] kworker: Fix the problem of ipsan performance degradation
by jiangdongxu 05 Mar '24

05 Mar '24

From: Shao Denghui <shaodenghui(a)huawei.com> When the current downstream FS tests IPSAN, it is found that the performance on ARM is much worse than that on X86, and the test data of IPSAN fluctuates greatly. After analysis, the reason is that when iscsi issues IO, the task is sent to kworker for processing by iscsi_xmitworker. The workqueue created by iscsi can automatically identify the CPU of the soft interrupt currently processed by iscsi, and automatically schedule the workqueue to the corresponding NUMA node. Shao Denghui (3): workqueue: add member for NUMA aware order workqueue and implement NUMA affinity for single thread workqueue iscsi: use dynamic single thread workqueue to improve performance Add kernel compilation configuration options arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/scsi/iscsi_tcp.c | 13 +++++++++++++ drivers/scsi/libiscsi.c | 24 ++++++++++++++++++++++-- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + kernel/workqueue.c | 21 +++++++++++++++++++-- lib/Kconfig | 16 ++++++++++++++++ 8 files changed, 74 insertions(+), 4 deletions(-) -- 2.33.0

2 4

openEuler Kernel SIG双周例会
by openEuler conference 05 Mar '24

05 Mar '24

您好！ Kernel 邀请您参加 2024-03-08 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 待申报（议题申报可直接填写至Kernel SIG例会看板）会议链接：https://bmeeting.huaweicloud.com:36443/#/j/989606341 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2024-03-08 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 待申报（议题申报可直接填写至Kernel SIG例会看板） You can join the meeting at https://bmeeting.huaweicloud.com:36443/#/j/989606341. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] binder: fix async_free_space accounting for empty parcels
by Li Huafei 05 Mar '24

05 Mar '24

From: Todd Kjos <tkjos(a)google.com> stable inclusion from stable-v4.19.224 commit 7c7064402609aeb6fb11be1b4ec10673ff17b593 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I947U7 CVE: CVE-2021-46935 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit cfd0d84ba28c18b531648c9d4a35ecca89ad9901 upstream. In 4.13, commit 74310e06be4d ("android: binder: Move buffer out of area shared with user space") fixed a kernel structure visibility issue. As part of that patch, sizeof(void *) was used as the buffer size for 0-length data payloads so the driver could detect abusive clients sending 0-length asynchronous transactions to a server by enforcing limits on async_free_size. Unfortunately, on the "free" side, the accounting of async_free_space did not add the sizeof(void *) back. The result was that up to 8-bytes of async_free_space were leaked on every async transaction of 8-bytes or less. These small transactions are uncommon, so this accounting issue has gone undetected for several years. The fix is to use "buffer_size" (the allocated buffer size) instead of "size" (the logical buffer size) when updating the async_free_space during the free operation. These are the same except for this corner case of asynchronous transactions with payloads < 8 bytes. Fixes: 74310e06be4d ("android: binder: Move buffer out of area shared with user space") Signed-off-by: Todd Kjos <tkjos(a)google.com> Cc: stable(a)vger.kernel.org # 4.14+ Link: https://lore.kernel.org/r/20211220190150.2107077-1-tkjos@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/android/binder_alloc.c Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/android/binder_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index af856205d40a..d866a70cba7b 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -622,7 +622,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc, BUG_ON(buffer->user_data > alloc->buffer + alloc->buffer_size); if (buffer->async_transaction) { - alloc->free_async_space += size + sizeof(struct binder_buffer); + alloc->free_async_space += buffer_size + sizeof(struct binder_buffer); binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, "%d: binder_free_buf size %zd async free %zd\n", -- 2.25.1

2 1

[PATCH v2 OLK-6.6 0/3] kworker: Fix the problem of ipsan performance degradation
by jiangdongxu 05 Mar '24

05 Mar '24

From: Shao Denghui <shaodenghui(a)huawei.com> When the current downstream FS tests IPSAN, it is found that the performance on ARM is much worse than that on X86, and the test data of IPSAN fluctuates greatly. After analysis, the reason is that when iscsi issues IO, the task is sent to kworker for processing by iscsi_xmitworker. The workqueue created by iscsi can automatically identify the CPU of the soft interrupt currently processed by iscsi, and automatically schedule the workqueue to the corresponding NUMA node. Shao Denghui (3): workqueue: add member for NUMA aware order workqueue and implement NUMA affinity for single thread workqueue iscsi: use dynamic single thread workqueue to improve performance Add kernel compilation configuration options arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/scsi/iscsi_tcp.c | 13 +++++++++++++ drivers/scsi/libiscsi.c | 24 ++++++++++++++++++++++-- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + kernel/workqueue.c | 21 +++++++++++++++++++-- lib/Kconfig | 16 ++++++++++++++++ 8 files changed, 74 insertions(+), 4 deletions(-) -- 2.33.0

2 4

[PATCH openEuler-22.03-LTS-SP1] arm64: head.S: always initialize PSTATE
by Li Zetao 05 Mar '24

05 Mar '24

From: Mark Rutland <mark.rutland(a)arm.com> mainline inclusion from mainline-v5.11-rc1 commit d87a8e65b5101123a24cddeb7a8a2c7b45f7b60c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I95U8R Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As with SCTLR_ELx and other control registers, some PSTATE bits are UNKNOWN out-of-reset, and we may not be able to rely on hardware or firmware to initialize them to our liking prior to entry to the kernel, e.g. in the primary/secondary boot paths and return from idle/suspend. It would be more robust (and easier to reason about) if we consistently initialized PSTATE to a default value, as we do with control registers. This will ensure that the kernel is not adversely affected by bits it is not aware of, e.g. when support for a feature such as PAN/UAO is disabled. This patch ensures that PSTATE is consistently initialized at boot time via an ERET. This is not intended to relax the existing requirements (e.g. DAIF bits must still be set prior to entering the kernel). For features detected dynamically (which may require system-wide support), it is still necessary to subsequently modify PSTATE. As ERET is not always a Context Synchronization Event, an ISB is placed before each exception return to ensure updates to control registers have taken effect. This handles the kernel being entered with SCTLR_ELx.EOS clear (or any future control bits being in an UNKNOWN state). Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: Christoph Hellwig <hch(a)lst.de> Cc: James Morse <james.morse(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Link: https://lore.kernel.org/r/20201113124937.20574-6-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Conflicts: arch/arm64/kernel/head.S Signed-off-by: Li Zetao <lizetao1(a)huawei.com> --- arch/arm64/include/asm/ptrace.h | 5 +++++ arch/arm64/kernel/head.S | 32 +++++++++++++++++++++----------- 2 files changed, 26 insertions(+), 11 deletions(-) diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h index 27fee85c3c2b..e58568f94b5e 100644 --- a/arch/arm64/include/asm/ptrace.h +++ b/arch/arm64/include/asm/ptrace.h @@ -16,6 +16,11 @@ #define CurrentEL_EL1 (1 << 2) #define CurrentEL_EL2 (2 << 2) +#define INIT_PSTATE_EL1 \ + (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL1h) +#define INIT_PSTATE_EL2 \ + (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL2h) + /* * PMR values used to mask/unmask interrupts. * diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S index e4ba7c189bb2..332b70331c85 100644 --- a/arch/arm64/kernel/head.S +++ b/arch/arm64/kernel/head.S @@ -486,21 +486,29 @@ EXPORT_SYMBOL(kimage_vaddr) * If we're fortunate enough to boot at EL2, ensure that the world is * sane before dropping to EL1. * + * Since we cannot always rely on ERET synchronizing writes to sysregs (e.g. if + * SCTLR_ELx.EOS is clear), we place an ISB prior to ERET. + * * Returns either BOOT_CPU_MODE_EL1 or BOOT_CPU_MODE_EL2 in w0 if * booted in EL1 or EL2 respectively. */ SYM_FUNC_START(el2_setup) - msr SPsel, #1 // We want to use SP_EL{1,2} mrs x0, CurrentEL cmp x0, #CurrentEL_EL2 - b.eq 1f + b.eq init_el2 + +SYM_INNER_LABEL(init_el1, SYM_L_LOCAL) mov_q x0, INIT_SCTLR_EL1_MMU_OFF msr sctlr_el1, x0 - mov w0, #BOOT_CPU_MODE_EL1 // This cpu booted in EL1 isb - ret + mov_q x0, INIT_PSTATE_EL1 + msr spsr_el1, x0 + msr elr_el1, lr + mov w0, #BOOT_CPU_MODE_EL1 + eret -1: mov_q x0, INIT_SCTLR_EL2_MMU_OFF +SYM_INNER_LABEL(init_el2, SYM_L_LOCAL) + mov_q x0, INIT_SCTLR_EL2_MMU_OFF msr sctlr_el2, x0 #ifdef CONFIG_ARM64_VHE @@ -609,9 +617,12 @@ set_hcr: cbz x2, install_el2_stub - mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 isb - ret + mov_q x0, INIT_PSTATE_EL2 + msr spsr_el2, x0 + msr elr_el2, lr + mov w0, #BOOT_CPU_MODE_EL2 + eret SYM_INNER_LABEL(install_el2_stub, SYM_L_LOCAL) /* @@ -643,12 +654,11 @@ SYM_INNER_LABEL(install_el2_stub, SYM_L_LOCAL) 7: adr_l x0, __hyp_stub_vectors msr vbar_el2, x0 - /* spsr */ - mov x0, #(PSR_F_BIT | PSR_I_BIT | PSR_A_BIT | PSR_D_BIT |\ - PSR_MODE_EL1h) + isb + mov x0, #INIT_PSTATE_EL1 msr spsr_el2, x0 msr elr_el2, lr - mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 + mov w0, #BOOT_CPU_MODE_EL2 eret SYM_FUNC_END(el2_setup) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] scsi: qedf: Add pointer checks in qedf_update_link_speed()
by Li Nan 05 Mar '24

05 Mar '24

From: Javed Hasan <jhasan(a)marvell.com> mainline inclusion from mainline-v5.13-rc3 commit 73578af92a0fae6609b955fcc9113e50e413c80f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I956GS CVE: CVE-2021-47077 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The following trace was observed: [ 14.042059] Call Trace: [ 14.042061] <IRQ> [ 14.042068] qedf_link_update+0x144/0x1f0 [qedf] [ 14.042117] qed_link_update+0x5c/0x80 [qed] [ 14.042135] qed_mcp_handle_link_change+0x2d2/0x410 [qed] [ 14.042155] ? qed_set_ptt+0x70/0x80 [qed] [ 14.042170] ? qed_set_ptt+0x70/0x80 [qed] [ 14.042186] ? qed_rd+0x13/0x40 [qed] [ 14.042205] qed_mcp_handle_events+0x437/0x690 [qed] [ 14.042221] ? qed_set_ptt+0x70/0x80 [qed] [ 14.042239] qed_int_sp_dpc+0x3a6/0x3e0 [qed] [ 14.042245] tasklet_action_common.isra.14+0x5a/0x100 [ 14.042250] __do_softirq+0xe4/0x2f8 [ 14.042253] irq_exit+0xf7/0x100 [ 14.042255] do_IRQ+0x7f/0xd0 [ 14.042257] common_interrupt+0xf/0xf [ 14.042259] </IRQ> API qedf_link_update() is getting called from QED but by that time shost_data is not initialised. This results in a NULL pointer dereference when we try to dereference shost_data while updating supported_speeds. Add a NULL pointer check before dereferencing shost_data. Link: https://lore.kernel.org/r/20210512072533.23618-1-jhasan@marvell.com Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.") Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com> Signed-off-by: Javed Hasan <jhasan(a)marvell.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Conflict: Context is changed many times. Changing code is consistent. Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/scsi/qedf/qedf_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c index cd61905ca2f5..30f62b65ffa9 100644 --- a/drivers/scsi/qedf/qedf_main.c +++ b/drivers/scsi/qedf/qedf_main.c @@ -477,7 +477,9 @@ static void qedf_update_link_speed(struct qedf_ctx *qedf, lport->link_supported_speeds |= FC_PORTSPEED_50GBIT; if (link->supported_caps & SUPPORTED_100000baseKR4_Full) lport->link_supported_speeds |= FC_PORTSPEED_100GBIT; - fc_host_supported_speeds(lport->host) = lport->link_supported_speeds; + if (lport->host && lport->host->shost_data) + fc_host_supported_speeds(lport->host) = + lport->link_supported_speeds; } static void qedf_link_update(void *dev, struct qed_link_output *link) -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS] arm64: head.S: always initialize PSTATE
by Li Zetao 05 Mar '24

05 Mar '24

From: Mark Rutland <mark.rutland(a)arm.com> mainline inclusion from mainline-v5.11-rc1 commit d87a8e65b5101123a24cddeb7a8a2c7b45f7b60c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I95U8R Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As with SCTLR_ELx and other control registers, some PSTATE bits are UNKNOWN out-of-reset, and we may not be able to rely on hardware or firmware to initialize them to our liking prior to entry to the kernel, e.g. in the primary/secondary boot paths and return from idle/suspend. It would be more robust (and easier to reason about) if we consistently initialized PSTATE to a default value, as we do with control registers. This will ensure that the kernel is not adversely affected by bits it is not aware of, e.g. when support for a feature such as PAN/UAO is disabled. This patch ensures that PSTATE is consistently initialized at boot time via an ERET. This is not intended to relax the existing requirements (e.g. DAIF bits must still be set prior to entering the kernel). For features detected dynamically (which may require system-wide support), it is still necessary to subsequently modify PSTATE. As ERET is not always a Context Synchronization Event, an ISB is placed before each exception return to ensure updates to control registers have taken effect. This handles the kernel being entered with SCTLR_ELx.EOS clear (or any future control bits being in an UNKNOWN state). Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: Christoph Hellwig <hch(a)lst.de> Cc: James Morse <james.morse(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Link: https://lore.kernel.org/r/20201113124937.20574-6-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Conflicts: arch/arm64/kernel/head.S Signed-off-by: Li Zetao <lizetao1(a)huawei.com> --- arch/arm64/include/asm/ptrace.h | 5 +++++ arch/arm64/kernel/head.S | 32 +++++++++++++++++++++----------- 2 files changed, 26 insertions(+), 11 deletions(-) diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h index 27fee85c3c2b..e58568f94b5e 100644 --- a/arch/arm64/include/asm/ptrace.h +++ b/arch/arm64/include/asm/ptrace.h @@ -16,6 +16,11 @@ #define CurrentEL_EL1 (1 << 2) #define CurrentEL_EL2 (2 << 2) +#define INIT_PSTATE_EL1 \ + (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL1h) +#define INIT_PSTATE_EL2 \ + (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL2h) + /* * PMR values used to mask/unmask interrupts. * diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S index e4ba7c189bb2..332b70331c85 100644 --- a/arch/arm64/kernel/head.S +++ b/arch/arm64/kernel/head.S @@ -486,21 +486,29 @@ EXPORT_SYMBOL(kimage_vaddr) * If we're fortunate enough to boot at EL2, ensure that the world is * sane before dropping to EL1. * + * Since we cannot always rely on ERET synchronizing writes to sysregs (e.g. if + * SCTLR_ELx.EOS is clear), we place an ISB prior to ERET. + * * Returns either BOOT_CPU_MODE_EL1 or BOOT_CPU_MODE_EL2 in w0 if * booted in EL1 or EL2 respectively. */ SYM_FUNC_START(el2_setup) - msr SPsel, #1 // We want to use SP_EL{1,2} mrs x0, CurrentEL cmp x0, #CurrentEL_EL2 - b.eq 1f + b.eq init_el2 + +SYM_INNER_LABEL(init_el1, SYM_L_LOCAL) mov_q x0, INIT_SCTLR_EL1_MMU_OFF msr sctlr_el1, x0 - mov w0, #BOOT_CPU_MODE_EL1 // This cpu booted in EL1 isb - ret + mov_q x0, INIT_PSTATE_EL1 + msr spsr_el1, x0 + msr elr_el1, lr + mov w0, #BOOT_CPU_MODE_EL1 + eret -1: mov_q x0, INIT_SCTLR_EL2_MMU_OFF +SYM_INNER_LABEL(init_el2, SYM_L_LOCAL) + mov_q x0, INIT_SCTLR_EL2_MMU_OFF msr sctlr_el2, x0 #ifdef CONFIG_ARM64_VHE @@ -609,9 +617,12 @@ set_hcr: cbz x2, install_el2_stub - mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 isb - ret + mov_q x0, INIT_PSTATE_EL2 + msr spsr_el2, x0 + msr elr_el2, lr + mov w0, #BOOT_CPU_MODE_EL2 + eret SYM_INNER_LABEL(install_el2_stub, SYM_L_LOCAL) /* @@ -643,12 +654,11 @@ SYM_INNER_LABEL(install_el2_stub, SYM_L_LOCAL) 7: adr_l x0, __hyp_stub_vectors msr vbar_el2, x0 - /* spsr */ - mov x0, #(PSR_F_BIT | PSR_I_BIT | PSR_A_BIT | PSR_D_BIT |\ - PSR_MODE_EL1h) + isb + mov x0, #INIT_PSTATE_EL1 msr spsr_el2, x0 msr elr_el2, lr - mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 + mov w0, #BOOT_CPU_MODE_EL2 eret SYM_FUNC_END(el2_setup) -- 2.34.1

2 1

[PATCH openEuler-20.03-LTS-SP3] arm64: head.S: always initialize PSTATE
by Li Zetao 05 Mar '24

05 Mar '24

From: Mark Rutland <mark.rutland(a)arm.com> mainline inclusion from mainline-v5.11-rc1 commit d87a8e65b5101123a24cddeb7a8a2c7b45f7b60c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I95U8R Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As with SCTLR_ELx and other control registers, some PSTATE bits are UNKNOWN out-of-reset, and we may not be able to rely on hardware or firmware to initialize them to our liking prior to entry to the kernel, e.g. in the primary/secondary boot paths and return from idle/suspend. It would be more robust (and easier to reason about) if we consistently initialized PSTATE to a default value, as we do with control registers. This will ensure that the kernel is not adversely affected by bits it is not aware of, e.g. when support for a feature such as PAN/UAO is disabled. This patch ensures that PSTATE is consistently initialized at boot time via an ERET. This is not intended to relax the existing requirements (e.g. DAIF bits must still be set prior to entering the kernel). For features detected dynamically (which may require system-wide support), it is still necessary to subsequently modify PSTATE. As ERET is not always a Context Synchronization Event, an ISB is placed before each exception return to ensure updates to control registers have taken effect. This handles the kernel being entered with SCTLR_ELx.EOS clear (or any future control bits being in an UNKNOWN state). Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: Christoph Hellwig <hch(a)lst.de> Cc: James Morse <james.morse(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Link: https://lore.kernel.org/r/20201113124937.20574-6-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Conflicts: arch/arm64/kernel/head.S Signed-off-by: Li Zetao <lizetao1(a)huawei.com> --- arch/arm64/include/asm/ptrace.h | 5 +++++ arch/arm64/kernel/head.S | 25 ++++++++++++++++--------- 2 files changed, 21 insertions(+), 9 deletions(-) diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h index f1662df255ca..408bc4719f3b 100644 --- a/arch/arm64/include/asm/ptrace.h +++ b/arch/arm64/include/asm/ptrace.h @@ -27,6 +27,11 @@ #define CurrentEL_EL1 (1 << 2) #define CurrentEL_EL2 (2 << 2) +#define INIT_PSTATE_EL1 \ + (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL1h) +#define INIT_PSTATE_EL2 \ + (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL2h) + /* * PMR values used to mask/unmask interrupts. * diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S index 9f083b11efe2..04dc533ea8b6 100644 --- a/arch/arm64/kernel/head.S +++ b/arch/arm64/kernel/head.S @@ -465,19 +465,24 @@ ENTRY(kimage_vaddr) * If we're fortunate enough to boot at EL2, ensure that the world is * sane before dropping to EL1. * + * Since we cannot always rely on ERET synchronizing writes to sysregs (e.g. if + * SCTLR_ELx.EOS is clear), we place an ISB prior to ERET. + * * Returns either BOOT_CPU_MODE_EL1 or BOOT_CPU_MODE_EL2 in w0 if * booted in EL1 or EL2 respectively. */ ENTRY(el2_setup) - msr SPsel, #1 // We want to use SP_EL{1,2} mrs x0, CurrentEL cmp x0, #CurrentEL_EL2 b.eq 1f mov_q x0, (SCTLR_EL1_RES1 | ENDIAN_SET_EL1) msr sctlr_el1, x0 - mov w0, #BOOT_CPU_MODE_EL1 // This cpu booted in EL1 isb - ret + mov_q x0, INIT_PSTATE_EL1 + msr spsr_el1, x0 + msr elr_el1, lr + mov w0, #BOOT_CPU_MODE_EL1 + eret 1: mov_q x0, (SCTLR_EL2_RES1 | ENDIAN_SET_EL2) msr sctlr_el2, x0 @@ -588,9 +593,12 @@ set_hcr: cbz x2, install_el2_stub - mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 isb - ret + mov_q x0, INIT_PSTATE_EL2 + msr spsr_el2, x0 + msr elr_el2, lr + mov w0, #BOOT_CPU_MODE_EL2 + eret install_el2_stub: /* @@ -622,12 +630,11 @@ install_el2_stub: 7: adr_l x0, __hyp_stub_vectors msr vbar_el2, x0 - /* spsr */ - mov x0, #(PSR_F_BIT | PSR_I_BIT | PSR_A_BIT | PSR_D_BIT |\ - PSR_MODE_EL1h) + isb + mov x0, #INIT_PSTATE_EL1 msr spsr_el2, x0 msr elr_el2, lr - mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 + mov w0, #BOOT_CPU_MODE_EL2 eret ENDPROC(el2_setup) -- 2.34.1

2 1

[PATCH] Wayca: Add RoCE new feature description and important bugfix information
by Chengchang Tang 05 Mar '24

05 Mar '24

From: Juan Zhou <zhoujuan51(a)h-partners.com> Added descriptions of new features 26 to 30 and some important bugfix information for older features. Signed-off-by: Juan Zhou <zhoujuan51(a)h-partners.com> Signed-off-by: Ran Zhou <zhouran10(a)h-partners.com> --- ...eng-��-RoCE��.md | 1243 ++++++++++++----- 1 file changed, 923 insertions(+), 320 deletions(-) diff --git a/WayCa-Kunpeng-��/Wayca-Kunpeng-��/WayCa-Kunpeng-��-RoCE��.md b/WayCa-Kunpeng-��/Wayca-Kunpeng-��/WayCa-Kunpeng-��-RoCE��.md index 5cb1563..f83caec 100644 --- a/WayCa-Kunpeng-��/Wayca-Kunpeng-��/WayCa-Kunpeng-��-RoCE��.md +++ b/WayCa-Kunpeng-��/Wayca-Kunpeng-��/WayCa-Kunpeng-��-RoCE��.md @@ -83,10 +83,28 @@ HNS RoCE��920��RoCE�� openeuler OLK-5.10 �� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :------------------------------------------------: | :-----------------------------: | - | dd74282df573 | RDMA/hns: Initialize the PCI device for hip08 RoCE | Y | - + | COMMITID | SUBJECT | + | :----------: | :------------------------------------------------: | + | dd74282df573 | RDMA/hns: Initialize the PCI device for hip08 RoCE | + +- **��bugfix** + + linux �� + + | COMMITID | SUBJECT | TAG | + | :----------: | :----------------------------------------------------------: | :------------: | + | cb06b6b3f6cb | [RDMA/core: Get IB width and speed from netdev](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/… | kernel 6.6-rc1 | + | df1bcf90a66a | [RDMA/hns: Fix port active speed](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/c… | kernel 6.6-rc1 | + | 7243396aaf12 | [RDMA/hns: Add a max length of gid table](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/c… | kernel 6.8-rc1 | + + openeuler OLK-5.10 �� + + | COMMITID | SUBJECT | + | ------------ | :--------------------------------------: | + | 729ff7ab6996 | RDMA/core: Add support more netdev speed | + | 48a799947374 | RDMA/hns: Fix port active speed | + | 5c0a1aea9746 | RDMA/hns: Add a max length of gid table | + ### ��2: �� PD �� - **��** @@ -112,9 +130,17 @@ HNS RoCE��920��RoCE�� openeuler OLK-5.10 �� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :-------------------------------------------------: | :-----------------------------: | - | 3a63c964eaa1 | RDMA/hns: Update some attributes of the RoCE device | Y | + | COMMITID | SUBJECT | + | :----------: | :-------------------------------------------------: | + | 3a63c964eaa1 | RDMA/hns: Update some attributes of the RoCE device | + +- **��bugfix** + + openEuler/rdma-core + + | SUBJECT | TAG | + | ----------------------------------------------- | -------- | + | libhns: Fix parent domain unsupported comp mask | v41.0-23 | ### ��3: �� MR �� @@ -145,17 +171,17 @@ RDMA��MR(Memory Region)��MR�� | :----------: | :----------------------------------------------------------: | :------------: | | 9a4435375cd1 | [IB/hns: Add driver files for hns RoCE driver](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/… | kernel 4.9-rc1 | - openeuler OLK-5.10 �� + openeuler OLK-5.10 �� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :--------------------------------------------: | :-----------------------------: | - | 9a4435375cd1 | IB/hns: Add driver files for hns RoCE driver | Y | - | 9a9fa2f04d16 | RDMA/hns: Fix level-0 addressing for huge page | Y | - | cf2f2029935c | RDMA/hns: Support adaptive hopnum for MTR | Y | - | cfad301fb303 | RDMA/hns: Support flexible pagesize for MTR | Y | - | 5be3bbe7f0e6 | RDMA/hns: Alloc MTR memory before alloc_mtt() | Y | - | 47968dd6159d | RDMA/hns: Refactor mtr_init_buf_cfg() | Y | - | 893026a80118 | RDMA/hns: Fix PBL page MTR find | Y | + | COMMITID | SUBJECT | + | :----------: | :--------------------------------------------: | + | 9a4435375cd1 | IB/hns: Add driver files for hns RoCE driver | + | 9a9fa2f04d16 | RDMA/hns: Fix level-0 addressing for huge page | + | cf2f2029935c | RDMA/hns: Support adaptive hopnum for MTR | + | cfad301fb303 | RDMA/hns: Support flexible pagesize for MTR | + | 5be3bbe7f0e6 | RDMA/hns: Alloc MTR memory before alloc_mtt() | + | 47968dd6159d | RDMA/hns: Refactor mtr_init_buf_cfg() | + | 893026a80118 | RDMA/hns: Fix PBL page MTR find | - **��** @@ -167,9 +193,23 @@ RDMA��MR(Memory Region)��MR�� openeuler/rdma �� - | COMMITID | SUBJECT | openeuler ENABLED(Y/N) | - | :----------: | :----------------------------: | :--------------------: | - | 887b78c80224 | libhns: Add initial main frame | Y | + | COMMITID | SUBJECT | + | :----------: | :----------------------------: | + | 887b78c80224 | libhns: Add initial main frame | + +- **��bugfix** + + linux �� + + NA + + openeuler OLK-5.10 �� + + | COMMITID | SUBJECT | + | ------------ | :----------------------------------------------------------: | + | 8b0e700ab707 | RDMA/hns: Fix memory leak in free_mr_exit() and free_mr_init() | + | 44ce91624cd6 | RDMA/hns: Fix the spin_lock and spin_unlock objects are inconsistent | + | ec799ad0f9d3 | RDMA/hns: Fix Use-After-Free of rsv_qp | #### �� MR ��Rereg MR�� @@ -193,9 +233,9 @@ RDMA��MR(Memory Region)��MR�� openeuler/rdma �� - | COMMITID | SUBJECT | openeuler ENABLED(Y/N) | - | ------------ | ------------------------------------------- | ----------------------- | - | d326d54fed3e | libhns: Add rereg mr interface in userspace | Y | + | COMMITID | SUBJECT | + | ------------ | ------------------------------------------- | + | d326d54fed3e | libhns: Add rereg mr interface in userspace | #### �� MR��FRMR�� @@ -225,11 +265,11 @@ RDMA��MR(Memory Region)��MR�� openeuler OLK-5.10 �� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :----------------------------------------------: | :-----------------------------: | - | 68a997c5d28c | RDMA/hns: Add FRMR support for hip08 | Y | - | 68a997c5d28c | RDMA/hns: Configure capacity of hns device | Y | - | 79352749ea09 | RDMA/hns: Use new interface to write FRMR fields | Y | + | COMMITID | SUBJECT | + | :----------: | :----------------------------------------------: | + | 68a997c5d28c | RDMA/hns: Add FRMR support for hip08 | + | 68a997c5d28c | RDMA/hns: Configure capacity of hns device | + | 79352749ea09 | RDMA/hns: Use new interface to write FRMR fields | ### ��4: �� CQ �� @@ -268,18 +308,18 @@ RDMA��MR(Memory Region)��MR�� openeuler OLK-5.10 �� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | ------------ | :--------------------------------------------------------: | :-----------------------------: | - | 75c994e6943c | RDMA/hns: Stop doorbell update while qp state error | Y | - | 0425e3e6e0c7 | RDMA/hns: Support flush cqe for hip08 in kernel space | Y | - | b53742865e9f | RDMA/hns: Delayed flush cqe process with workqueue | Y | - | 60c3becfd1a1 | RDMA/hns: Fix sg offset non-zero issue | Y | - | 0fc99566f6ee | RDMA/hns: Use flush framework for the case in aeq | Y | - | 1d500a3f452d | RDMA/hns: Remove unnecessary flush operation for workqueue | Y | - | 66b1000f5715 | RDMA/hns: Encapsulate flushing CQE as a function | Y | - | d3b33dffb51a | RDMA/hns: Fix memory corruption when allocating XRCDN | Y | - | b44fac86ca3d | RDMA/hns: Add XRC subtype in QPC and XRC type in SRQC | Y | - | ae394640bc89 | RDMA/hns: Add support for XRC on HIP09 | Y | + | COMMITID | SUBJECT | + | ------------ | :--------------------------------------------------------: | + | 75c994e6943c | RDMA/hns: Stop doorbell update while qp state error | + | 0425e3e6e0c7 | RDMA/hns: Support flush cqe for hip08 in kernel space | + | b53742865e9f | RDMA/hns: Delayed flush cqe process with workqueue | + | 60c3becfd1a1 | RDMA/hns: Fix sg offset non-zero issue | + | 0fc99566f6ee | RDMA/hns: Use flush framework for the case in aeq | + | 1d500a3f452d | RDMA/hns: Remove unnecessary flush operation for workqueue | + | 66b1000f5715 | RDMA/hns: Encapsulate flushing CQE as a function | + | d3b33dffb51a | RDMA/hns: Fix memory corruption when allocating XRCDN | + | b44fac86ca3d | RDMA/hns: Add XRC subtype in QPC and XRC type in SRQC | + | ae394640bc89 | RDMA/hns: Add support for XRC on HIP09 | - **��** @@ -298,16 +338,33 @@ RDMA��MR(Memory Region)��MR�� openeuler/rdma �� - | COMMITID | SUBJECT | openeuler ENABLED(Y/N) | - | :----------: | :----------------------------------------------------------: | :--------------------: | - | e1726e934574 | libhns: Support flush cqe for hip08 in user space | Y | - | 482eb44bc296 | libhns: Not process return value of flushing cqe | Y | - | 366374ee6372 | libhns: Update ibvqp->state in hns_roce_u_v2_modify_qp() | Y | - | f1a80cc3dfe2 | libhns: Bugfix for flush cqe in case multi-process | Y | - | 4ed874a5cf30 | libhns: Add support for XRC for HIP09 | Y | - | 9e3df7578153 | libhns: Support ibv_create_srq_ex | Y | - | 7c3937d93e7a | libhns: Avoid accessing NULL pointer when locking/unlocking CQ | Y | - | d8596eff4eb4 | libhns: Add support for creating extended CQ | Y | + | COMMITID | SUBJECT | + | :----------: | :----------------------------------------------------------: | + | e1726e934574 | libhns: Support flush cqe for hip08 in user space | + | 482eb44bc296 | libhns: Not process return value of flushing cqe | + | 366374ee6372 | libhns: Update ibvqp->state in hns_roce_u_v2_modify_qp() | + | f1a80cc3dfe2 | libhns: Bugfix for flush cqe in case multi-process | + | 4ed874a5cf30 | libhns: Add support for XRC for HIP09 | + | 9e3df7578153 | libhns: Support ibv_create_srq_ex | + | 7c3937d93e7a | libhns: Avoid accessing NULL pointer when locking/unlocking CQ | + | d8596eff4eb4 | libhns: Add support for creating extended CQ | + + +- ###### **��bugfix** + + ###### linux/rdma-core + + | SUBJECT | commit id | + | ------------------------------------------------- | --------- | + | libhns: Fix uninitialized qp attr when flush cqe | 23c210471 | + | libhns: Fix reference to uninitialized cq pointer | e850ebe15 | + + **openEuler/rdma-core** + + | SUBJECT | TAG | + | ------------------------------------------------- | -------- | + | libhns: Fix uninitialized qp attr when flush cqe | v41.0-21 | + | libhns: Fix reference to uninitialized cq pointer | v41.0-14 | ### ��5: �� QP �� @@ -346,17 +403,17 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� openeuler OLK-5.10�� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :---------------------------------------------------------: | :-----------------------------: | - | 926a01dc000d | RDMA/hns: Add QP operations support for hip08 SoC | Y | - | 9a4435375cd1 | IB/hns: Add driver files for hns RoCE driver | Y | - | e6ce4942dbde | RDMA/hns: Use new SQ doorbell register for HIP09 | Y | - | c746005b2800 | RDMA/hns: Create QP with selected QPN for bank load balance | Y | - | 50c11848f7c8 | RDMA/hns: Create CQ with selected CQN for bank load balance | Y | - | 56fbd51c835f | RDMA/hns: Use mutex instead of spinlock for ida allocation | Y | - | bf0eda201116 | RDMA/hns: Add support for CQ stash | Y | - | 78d048bb6136 | RDMA/hns: Add support for QP stash | Y | - | 01d06a58d6d3 | RDMA/hns: Enable stash feature of HIP09 | Y | + | COMMITID | SUBJECT | + | :----------: | :---------------------------------------------------------: | + | 926a01dc000d | RDMA/hns: Add QP operations support for hip08 SoC | + | 9a4435375cd1 | IB/hns: Add driver files for hns RoCE driver | + | e6ce4942dbde | RDMA/hns: Use new SQ doorbell register for HIP09 | + | c746005b2800 | RDMA/hns: Create QP with selected QPN for bank load balance | + | 50c11848f7c8 | RDMA/hns: Create CQ with selected CQN for bank load balance | + | 56fbd51c835f | RDMA/hns: Use mutex instead of spinlock for ida allocation | + | bf0eda201116 | RDMA/hns: Add support for CQ stash | + | 78d048bb6136 | RDMA/hns: Add support for QP stash | + | 01d06a58d6d3 | RDMA/hns: Enable stash feature of HIP09 | - **��** @@ -368,10 +425,46 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� openeuler/rdma-core �� - | COMMITID | SUBJECT | openeuler ENABLED(Y/N) | - | :----------: | :----------------------------: | :--------------------: | - | 887b78c80224 | libhns: Add initial main frame | Y | + | COMMITID | SUBJECT | + | :----------: | :----------------------------: | + | 887b78c80224 | libhns: Add initial main frame | + +- ###### **��bugfix** + + ###### linux/rdma-core + + | SUBJECT | COMMITID | + | ------------------------------------------------------------ | --------- | + | libhns: Bugfix for wrong timing of modifying ibv_qp state to err | 886cf76ed | + | libhns: Remove unnecessary QP checks | 4ea9a4f77 | + + **openEuler/rdma-core** + + | SUBJECT | TAG | + | ------------------------------------------------------------ | -------- | + | libhns: Bugfix for wrong timing of modifying ibv_qp state to err | v41.0-22 | + | libhns: Support flexible WQE buffer page size | v41.0-16 | + | libhns: Remove unnecessary QP checks | v41.0-14 | + +- **��bugfix** + + linux �� + + | COMMITID | SUBJECT | TAG | + | ------------ | ------------------------------------------------------------ | -------------- | + | 56518a603fd2 | [RDMA/hns: Modify the value of long message loopback slice](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/c… | kernel 6.4-rc1 | + | b9989ab3f61e | [RDMA/hns: Remove unnecessary QP type checks](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/… | kernel 6.5-rc1 | + | b5f9efff101b | [RDMA/hns: Fix signed-unsigned mixed comparisons](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux… | kernel 6.7-rc1 | + + openeuler OLK-5.10 �� + | COMMITID | SUBJECT | + | ------------ | :-------------------------------------------------------: | + | 64307761e707 | RDMA/hns: Modify the value of long message loopback slice | + | 603053b423d0 | RDMA/hns: Support flexible wqe buffer page size | + | ff8d74900925 | RDMA/hns: Refactor hns_roce_alloc_ucontext() | + | c475862d7cbd | RDMA/hns: Remove unnecessary QP type checks | + | 56214b3132dd | RDMA/hns: Fix signed-unsigned mixed comparisons | #### �� UD �� QP @@ -399,15 +492,15 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� openeuler OLK-5.10�� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :-------------------------------------------------: | :-----------------------------: | - | b762bf9b0516 | RDMA/hns: Add support for configuring GMV table | Y | - | 115a32e39d13 | RDMA/hns: Add support for filling GMV table | Y | - | 86d6d8ac4bb3 | RDMA/hns: Fix double free of the pointer to TSQ/TPQ | Y | - | 98912ee82a0c | RDMA/hns: Add support for QPC in size of 512 Bytes | Y | - | 396b71fba124 | RDMA/hns: Remove the portn field in UD SQ WQE | Y | - | 11703ad67174 | RDMA/hns: Simplify process of filling UD SQ WQE | Y | - | 27eee3ced4ba | RDMA/hns: Add UD support for HIP09 | Y | + | COMMITID | SUBJECT | + | :----------: | :-------------------------------------------------: | + | b762bf9b0516 | RDMA/hns: Add support for configuring GMV table | + | 115a32e39d13 | RDMA/hns: Add support for filling GMV table | + | 86d6d8ac4bb3 | RDMA/hns: Fix double free of the pointer to TSQ/TPQ | + | 98912ee82a0c | RDMA/hns: Add support for QPC in size of 512 Bytes | + | 396b71fba124 | RDMA/hns: Remove the portn field in UD SQ WQE | + | 11703ad67174 | RDMA/hns: Simplify process of filling UD SQ WQE | + | 27eee3ced4ba | RDMA/hns: Add UD support for HIP09 | - **��** @@ -430,7 +523,7 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� | ibv_open_xrcd()��ib_alloc_xrcd_user() | ��XRCD | | ibv_close_xrcd()��ib_dealloc_xrcd_user() | ��XRCD | -- **��** +- **��** linux �� @@ -442,11 +535,11 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� openeuler OLK-5.10�� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :---------------------------------------------------: | :-----------------------------: | - | ae394640bc89 | RDMA/hns: Add support for XRC on HIP09 | Y | - | d3b33dffb51a | RDMA/hns: Fix memory corruption when allocating XRCDN | Y | - | b44fac86ca3d | RDMA/hns: Add XRC subtype in QPC and XRC type in SRQC | Y | + | COMMITID | SUBJECT | + | :----------: | :---------------------------------------------------: | + | ae394640bc89 | RDMA/hns: Add support for XRC on HIP09 | + | d3b33dffb51a | RDMA/hns: Fix memory corruption when allocating XRCDN | + | b44fac86ca3d | RDMA/hns: Add XRC subtype in QPC and XRC type in SRQC | ### ��6: �� SRQ �� @@ -476,18 +569,18 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� | c7bcb13442e1 | [RDMA/hns: Add SRQ support for hip08 kernel mode](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/co… | kernel 4.20-rc6 | | 5c1f167af112 | [RDMA/hns: Init SRQ table for hip08](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/c… | kernel 4.20-rc6 | | d16da11992d4 | [RDMA/hns: Eanble SRQ capacity for hip08](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/c… | kernel 4.20-rc6 | - + openeuler OLK-5.10 �� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :---------------------------------------------------: | :------------------------------: | - | 495c24808ce7 | RDMA/hns: Add XRC subtype in QPC and XRC type in SRQC | Y | - | d3b33dffb51a | RDMA/hns: Fix memory corruption when allocating XRCDN | Y | - | 9d9d4ff78884 | RDMA/hns: Update the kernel header file of hns | Y | - | 81fce6291d99 | RDMA/hns: Add SRQ asynchronous event support | Y | - | c7bcb13442e1 | RDMA/hns: Add SRQ support for hip08 kernel mode | Y | - | 5c1f167af112 | RDMA/hns: Init SRQ table for hip08 | Y | - | d16da11992d4 | RDMA/hns: Eanble SRQ capacity for hip08 | Y | + | COMMITID | SUBJECT | + | :----------: | :---------------------------------------------------: | + | 495c24808ce7 | RDMA/hns: Add XRC subtype in QPC and XRC type in SRQC | + | d3b33dffb51a | RDMA/hns: Fix memory corruption when allocating XRCDN | + | 9d9d4ff78884 | RDMA/hns: Update the kernel header file of hns | + | 81fce6291d99 | RDMA/hns: Add SRQ asynchronous event support | + | c7bcb13442e1 | RDMA/hns: Add SRQ support for hip08 kernel mode | + | 5c1f167af112 | RDMA/hns: Init SRQ table for hip08 | + | d16da11992d4 | RDMA/hns: Eanble SRQ capacity for hip08 | - **��** @@ -504,14 +597,30 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� openeuler/rdma �� - | COMMITID | SUBJECT | openeuler ENABLED(Y/N) | - | :----------: | :--------------------------------------------------: | :---------------------: | - | 9714b12735b2 | libhns: Update poll cq for supporting srq | Y | - | 4332ae4947bb | libhns: Add the verb for posting srqwqe | Y | - | 49db5b9ac356 | libhns: Add destroy srq verbs for hip08 user mode | Y | - | 03aa74d63dd6 | libhns: Add query srq verb for hip08 user mode | Y | - | 85ce85bb594a | libhns: Add modify srq verb for hip08 user mode | Y | - | 22d53621d9b0 | libhns: Add verb of creating srq for hip08 user mode | Y | + | COMMITID | SUBJECT | + | :----------: | :--------------------------------------------------: | + | 9714b12735b2 | libhns: Update poll cq for supporting srq | + | 4332ae4947bb | libhns: Add the verb for posting srqwqe | + | 49db5b9ac356 | libhns: Add destroy srq verbs for hip08 user mode | + | 03aa74d63dd6 | libhns: Add query srq verb for hip08 user mode | + | 85ce85bb594a | libhns: Add modify srq verb for hip08 user mode | + | 22d53621d9b0 | libhns: Add verb of creating srq for hip08 user mode | + +- **��bugfix** + + linux/rdma-core + + | SUBJECT | COMMITID | + | ----------------------------------- | --------- | + | Updata kernel headers | 6ae92057b | + | libhns: Support SRQ record doorbell | 3b1b89720 | + + openEuler/rdma-core + + | SUBJECT | TAG | + | ----------------------------------- | ------- | + | Updata kernel headers | 41.0-17 | + | libhns: Support SRQ record doorbell | 41.0-17 | ### ��7: �� @@ -550,14 +659,14 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� openeuler OLK-5.10 �� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :----------------------------------------------------: | :-----------------------------: | - | 8320deb88c03 | RDMA/hns: Add enable judgement for UD vlan | Y | - | 944e64093a63 | RDMA/hns: Add CM of vlan device support | Y | - | 6c1f08b347f6 | RDMA/hns: Assign zero for pkey_index of wc in hip08 | Y | - | 7bdee4158b37 | RDMA/hns: Fill sq wqe context of ud type in hip08 | Y | - | 0fa95a9a7102 | RDMA/hns: Add gsi qp support for modifying qp in hip08 | Y | - | b66efc932067 | RDMA/hns: Create gsi qp in hip08 | Y | + | COMMITID | SUBJECT | + | :----------: | :----------------------------------------------------: | + | 8320deb88c03 | RDMA/hns: Add enable judgement for UD vlan | + | 944e64093a63 | RDMA/hns: Add CM of vlan device support | + | 6c1f08b347f6 | RDMA/hns: Assign zero for pkey_index of wc in hip08 | + | 7bdee4158b37 | RDMA/hns: Fill sq wqe context of ud type in hip08 | + | 0fa95a9a7102 | RDMA/hns: Add gsi qp support for modifying qp in hip08 | + | b66efc932067 | RDMA/hns: Create gsi qp in hip08 | ### ��8: �� @@ -592,14 +701,14 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� openeuler OLK-5.10 �� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :--------------------------------------------------------: | :-----------------------------: | - | 9a4435375cd1 | IB/hns: Add driver files for hns RoCE driver | Y | - | 84f88185112 | RDMA/hns: Add atomic support | Y | - | ace1c5416b37 | RDMA/hns: Set access flags of hip08 RoCE | Y | - | d9581bf358c0 | RDMA/hns: Bugfix for atomic operation | Y | - | 555adba6b7a5 | RDMA/hns: Fix a missing check of atomic wr length | Y | - | c0f88964aed6 | RDMA/hns: Fix inaccurate error label name in init instance | Y | + | COMMITID | SUBJECT | + | :----------: | :--------------------------------------------------------: | + | 9a4435375cd1 | IB/hns: Add driver files for hns RoCE driver | + | 84f88185112 | RDMA/hns: Add atomic support | + | ace1c5416b37 | RDMA/hns: Set access flags of hip08 RoCE | + | d9581bf358c0 | RDMA/hns: Bugfix for atomic operation | + | 555adba6b7a5 | RDMA/hns: Fix a missing check of atomic wr length | + | c0f88964aed6 | RDMA/hns: Fix inaccurate error label name in init instance | - **��** @@ -615,13 +724,13 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� openeuler/rdma �� - | COMMITID | SUBJECT | openeuler ENABLED(Y/N) | - | :----------: | :----------------------------------------------------------: | :--------------------: | - | 887b78c80224 | libhns: Add initial main frame | Y | - | b8c02c0039c4 | libhns: Add support for extended atomic | Y | - | d92b0f595439 | libhns: Add atomic support for hip08 user mode | Y | - | a95f62b7e42f | libhns: Check number of extended sge when using extended atomic | Y | - | 22edc93d4d17 | libhns: Bugfix for atomic operation in user mode | Y | + | COMMITID | SUBJECT | + | :----------: | :----------------------------------------------------------: | + | 887b78c80224 | libhns: Add initial main frame | + | b8c02c0039c4 | libhns: Add support for extended atomic | + | d92b0f595439 | libhns: Add atomic support for hip08 user mode | + | a95f62b7e42f | libhns: Check number of extended sge when using extended atomic | + | 22edc93d4d17 | libhns: Bugfix for atomic operation in user mode | ### ��9: ��inline @@ -646,17 +755,17 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� | 30b707886aeb | [RDMA/hns: Support inline data in extented sge space for RC](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… | kernel 5.10 | | 0c5e259b06a8 | [RDMA/hns: Fix incorrect sge nums calculation](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux… | kernel 6.2-rc1 | | 8eaa6f7d569b | [RDMA/hns: Fix ext_sge num error when post send](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/co… | kernel 6.2-rc1 | - + openeuler OLK-5.10 �� - - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :----------------------------------------------------------: | :-----------------------------: | - | 328d405b3d4c | RDMA/hns: Intercept illegal RDMA operation when use inline data | Y | - | e8638bded775 | RDMA/hns: Fix missing assignment of max_inline_data | Y | - | 30b707886aeb | RDMA/hns: Support inline data in extented sge space for RC | Y | - | 7f360a7e7771 | RDMA/hns: Fix ext_sge num error when post send | Y | - | 345423493ae7 | RDMA/hns: Fix the problem of sge nums | Y | - + + | COMMITID | SUBJECT | + | :----------: | :----------------------------------------------------------: | + | 328d405b3d4c | RDMA/hns: Intercept illegal RDMA operation when use inline data | + | e8638bded775 | RDMA/hns: Fix missing assignment of max_inline_data | + | 30b707886aeb | RDMA/hns: Support inline data in extented sge space for RC | + | 7f360a7e7771 | RDMA/hns: Fix ext_sge num error when post send | + | 345423493ae7 | RDMA/hns: Fix the problem of sge nums | + - **��** linux/rdma �� @@ -667,9 +776,9 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� openeuler/rdma �� - | COMMITID | SUBJECT | openeuler ENABLED(Y/N) | - | :----------: | :----------------------------------------------------------: | :--------------------: | - | 328d405b3d4c | libhns: Intercept illegal RDMA operation when use inline data | Y | + | COMMITID | SUBJECT | + | :----------: | :----------------------------------------------------------: | + | 328d405b3d4c | libhns: Intercept illegal RDMA operation when use inline data | #### ��RQ inline @@ -689,16 +798,15 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� | :----------: | :----------------------------------------------------------: | :-------------: | | 0009c2dbe8a4 | [RDMA/hns: Add rq inline data support for hip08 RoCE](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/co… | kernel 4.16-rc1 | | 2bb185c68bf4 | [RDMA/hns: Add compatibility handling for only support userspace rq inline](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/… | kernel 6.3-rc1 | - openeuler OLK-5.10 �� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :----------------------------------------------------------: | :-----------------------------: | - | ecaaf1e26a37 | RDMA/hns: Add rq inline flags judgement | Y | - | 0009c2dbe8a4 | RDMA/hns: Add rq inline data support for hip08 RoCE | Y | - | a77029a8c7e4 | RDMA/hns: Fix the inconsistency between the rq inline bit and the community | Y | - | c22b4e60d382 | RDMA/hns: Fix the compatibility flag problem | Y | + | COMMITID | SUBJECT | + | ------------ | ------------------------------------------------------------ | + | ecaaf1e26a37 | RDMA/hns: Add rq inline flags judgement | + | 0009c2dbe8a4 | RDMA/hns: Add rq inline data support for hip08 RoCE | + | a77029a8c7e4 | RDMA/hns: Fix the inconsistency between the rq inline bit and the community | + | c22b4e60d382 | RDMA/hns: Fix the compatibility flag problem | - **��** @@ -711,10 +819,50 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� openeuler/rdma �� - | COMMITID | SUBJECT | openeuler ENABLED(Y/N) | - | :----------: | :---------------------------------------------------------: | :--------------------: | - | 7011b5aedf78 | libhns: Add rq inline data support for hip08 RoCE user mode | Y | - | 86188a8810ed | RDMA/hns: Add rq inline flags judgement | Y | + | COMMITID | SUBJECT | + | :----------: | :---------------------------------------------------------: | + | 7011b5aedf78 | libhns: Add rq inline data support for hip08 RoCE user mode | + | 86188a8810ed | RDMA/hns: Add rq inline flags judgement | + +#### ��CQE inline + +- **��** + + ��RC��Send��RQ WQE��1024B��RQ inline��RQ inline�� + +- **��** + + NA + +- **��** + + linux �� + + | COMMITID | SUBJECT | TAG | + | ------------ | ------------------------------------------------------------ | -------------- | + | 1d91855304c2 | [RDMA/hns: Support cqe inline in user space]( https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ) | kernel 6.3-rc1 | + + openeuler OLK-5.10 �� + + | COMMITID | SUBJECT | + | ------------ | ------------------------------------------ | + | b3b7a525b076 | RDMA/hns: Support cqe inline in user space | + +- **��** + + linux/rdma �� + + | COMMITID | SUBJECT | + | :-------: | :------------------------: | + | 8c71685d8 | Update kernel headers | + | 22cd430c6 | libhns: Support cqe inline | + + openeuler/rdma �� + + | SUBJECT | TAG | + | :------------------------: | :-----: | + | Update kernel headers | v41.0-3 | + | libhns: Support cqe inline | v41.0-3 | ### ��10: �� @@ -740,11 +888,11 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� openeuler OLK-5.10 �� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :--------------------------------------------------------: | :-----------------------------: | - | 0e40dc2f70cd | RDMA/hns: Add timer allocation support for hip08 | Y | - | 441c88d5b3ff | RDMA/hns: Fix cmdq parameter of querying pf timer resource | Y | - | 887803db866a | RDMA/hns: Bugfix for qpc/cqc timer configuration | Y | + | COMMITID | SUBJECT | + | :----------: | :--------------------------------------------------------: | + | 0e40dc2f70cd | RDMA/hns: Add timer allocation support for hip08 | + | 441c88d5b3ff | RDMA/hns: Fix cmdq parameter of querying pf timer resource | + | 887803db866a | RDMA/hns: Bugfix for qpc/cqc timer configuration | ### ��11: �� @@ -775,12 +923,12 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� openeuler OLK-5.10 �� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLE��Y/N�� | - | :----------: | :-------------------------------------------------: | :------------------------------: | - | b762bf9b0516 | RDMA/hns: Add support for configuring GMV table | Y | - | 115a32e39d13 | RDMA/hns: Add support for filling GMV table | Y | - | 86d6d8ac4bb3 | RDMA/hns: Fix double free of the pointer to TSQ/TPQ | Y | - | 481cd35130bc | RDMA/hns: Only record vlan in | Y | + | COMMITID | SUBJECT | + | :----------: | :-------------------------------------------------: | + | b762bf9b0516 | RDMA/hns: Add support for configuring GMV table | + | 115a32e39d13 | RDMA/hns: Add support for filling GMV table | + | 86d6d8ac4bb3 | RDMA/hns: Fix double free of the pointer to TSQ/TPQ | + | 481cd35130bc | RDMA/hns: Only record vlan in | - **��** @@ -792,9 +940,11 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� openeuler/rdma �� - | COMMITID | SUBJECT | openeuler ENABLED��Y/N�� | - | :----------: | :----------------------------------------------------: | :----------------------: | - | 63b8f309c6af | libhns: Add verbs of querying device and querying port | Y | + | COMMITID | SUBJECT | + | :----------: | :----------------------------------------------------: | + | 63b8f309c6af | libhns: Add verbs of querying device and querying port | + + #### �� @@ -811,11 +961,41 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� | ibv_modify_qp() | ��modify QP��ah_attr��AH | | ibv_create_ah() | ��AH | | ibv_create_ah_from_wc()��ib_create_ah_from_wc() | ��WC��AH | - + - **��** �� +- **��bugfix** + + linux �� + + | COMMITID | SUBJECT | TAG | + | ------------ | ------------------------------------------------------------ | -------------- | + | d3f4020a213e | [RDMA/hns: Response dmac to userspace](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.g… | kernel 6.8-rc1 | + + openeuler OLK-5.10 �� + + | COMMITID | SUBJECT | + | ------------ | :----------------------------------: | + | 6f3b60e0eb4b | RDMA/hns: Response dmac to userspace | + +- ��bugfix + + linux/rdma-core + + | SUBJECT | COMMITID | + | ----------------------------------- | --------- | + | Update kernel headers | 4a2b06403 | + | libhns: Get dmac from kernel driver | bf49669f1 | + + openEuler/rdma-core + + | SUBJECT | TAG | + | ----------------------------------- | -------- | + | Update kernel headers | v41.0-20 | + | libhns: Get dmac from kernel driver | v41.0-20 | + #### ��VLAN - **��** @@ -879,11 +1059,28 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� openeuler OLK-5.10 �� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :-----------------------------------------------: | :-----------------------------: | - | 247fc16d734d | RDMA/hns: Add support for EQE in size of 64 Bytes | Y | + | COMMITID | SUBJECT | + | :----------: | :-----------------------------------------------: | + | 247fc16d734d | RDMA/hns: Add support for EQE in size of 64 Bytes | + +- **��bugfix** + + linux �� + + | COMMITID | SUBJECT | TAG | + | ------------ | ------------------------------------------------------------ | -------------- | + | 9faef73ef4f6 | [RDMA/hns: Fix printing level of asynchronous events](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/… | kernel 6.7-rc1 | + | 95f6b40082aa | [RDMA/hns: Rename the interrupts](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.… | kernel 6.8-rc1 | + + openeuler OLK-5.10�� + + | COMMITID | SUBJECT | + | ------------ | :-------------------------------------------------: | + | 497a544065a3 | RDMA/hns: Fix printing level of asynchronous events | + | 091b3a75cbc8 | RDMA/hns: Rename the interrupts | #### �� + - **��** ��/��RDMA �� @@ -902,9 +1099,9 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� openeuler OLK-5.10 �� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :------------------------------------------: | :-----------------------------: | - | 9a4435375cd1 | IB/hns: Add driver files for hns RoCE driver | Y | + | COMMITID | SUBJECT | + | :----------: | :------------------------------------------: | + | 9a4435375cd1 | IB/hns: Add driver files for hns RoCE driver | #### �� - **��** @@ -974,11 +1171,11 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� openeuler OLK-5.10�� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :------------------------------------------------------: | :-----------------------------: | - | 9a4435375cd1 | IB/hns: Add driver files for hns RoCE driver | Y | - | c7cf81b52c02 | RDMA/hns: Add support for sending port down event fastly | Y | - | 5d705e82752a | RDMA/hns: Deliver net device event to ofed | Y | + | COMMITID | SUBJECT | + | :----------: | :------------------------------------------------------: | + | 9a4435375cd1 | IB/hns: Add driver files for hns RoCE driver | + | c7cf81b52c02 | RDMA/hns: Add support for sending port down event fastly | + | 5d705e82752a | RDMA/hns: Deliver net device event to ofed | ### ��13: ��QoS @@ -1033,7 +1230,7 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� 1. DSCP��tclass��RoCE v2�� 2. VLAN.pri(SL)��DSCP(tclass)��VLAN.pri��VLAN.pri��DSCP�� 3. ��SL��TC��DSCP��SL�� - + - **��** linux �� @@ -1042,23 +1239,37 @@ HNS RoCE��1M��QP��32K��WR��Work Request�� | :----------: | :----------------------------------------------------------: | :-------------: | | cacde272dd00 | [net: hns3: Add hclge_dcb module for the support of DCB feature](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/c… | kernel 4.15-rc1 | | fba429fcf9a5 | [RDMA/hns: Fix missing fields in address vector](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/… | kernel 5.11 | - + openeuler OLK-5.10 �� - - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :----------------------------------------------------------: | :-----------------------------: | - | cacde272dd00 | net: hns3: Add hclge_dcb module for the support of DCB feature | Y | - | 6d67845961fe | RDMA/hns: Fix missing fields in address vector | Y | - | 11ef2ec6aa7c | RDMA/hns: Support DSCP of userspace | Y | - + + | COMMITID | SUBJECT | + | :----------: | :----------------------------------------------------------: | + | cacde272dd00 | net: hns3: Add hclge_dcb module for the support of DCB feature | + | 6d67845961fe | RDMA/hns: Fix missing fields in address vector | + | 11ef2ec6aa7c | RDMA/hns: Support DSCP of userspace | + - **��** openeuler/rdma �� - | COMMITID | SUBJECT | openeuler ENABLED(Y/N) | - | :----------: | :-------------------: | :--------------------: | - | 12d2a17d404e | Update kernel headers | Y | - | b88e6ae3e144 | libhns: Support DSCP | Y | + | COMMITID | SUBJECT | + | :----------: | :-------------------: | + | 12d2a17d404e | Update kernel headers | + | b88e6ae3e144 | libhns: Support DSCP | + +- **��bugfix** + + linux�� + + | COMMITID | SUBJECT | TAG | + | ------------ | ------------------------------------------------------------ | -------------- | + | 5e617c18b1f3 | [RDMA/hns: Add check for SL](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… | kernel 6.7-rc1 | + + openeuler OLK-5.10�� + + | COMMITID | SUBJECT | + | ------------ | :---------------------------------------------: | + | ebccb56b18db | RDMA/hns: Fix a missing validation check for sl | ### ��14: �� @@ -1091,7 +1302,7 @@ HNS RoCE��DCQCN��LDCP��HC3��DCQ struct ibv_qp *hnsdv_create_qp(struct ibv_context *context, struct ibv_qp_init_attr_ex *qp_attr, - struct hnsdv_qp_init_attr *hns_qp_attr); + struct hnsdv_qp_init_attr *hns_qp_attr); enum hnsdv_qp_congest_ctrl_type { HNSDV_QP_CREATE_ENABLE_DCQCN = 1 << 0, @@ -1108,7 +1319,7 @@ HNS RoCE��DCQCN��LDCP��HC3��DCQ ``` 2. �� - + ��BIOS��0��DCQCN��1��LDCP��2��HC3��3��DIP�� - **��** @@ -1121,28 +1332,47 @@ HNS RoCE��DCQCN��LDCP��HC3��DCQ | 6a157f7d1b14 | [RDMA/hns: Add SCC context allocation support for hip08](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/c… | kernel 5.1-rc1 | | 6ac16e403900 | [RDMA/hns: Bugfix for set hem of SCC](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/com… | kernel 5.1-rc7 | | 00fb67ec6b98 | [RDMA/hns: Bugfix for SCC hem free](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/co… | kernel 5.2-rc1 | - | faa63656fc36 | [RDMA/hns: Add new command to support query vf caps](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/co… | kernel 6.4-rc1 | openeuler OLK-5.10�� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :----------------------------------------------------------: | :-----------------------------: | - | aa84fa18741b | RDMA/hns: Add SCC context clr support for hip08 | Y | - | 6a157f7d1b14 | RDMA/hns: Add SCC context allocation support for hip08 | Y | - | 6ac16e403900 | RDMA/hns: Bugfix for set hem of SCC | Y | - | 00fb67ec6b98 | RDMA/hns: Bugfix for SCC hem free | Y | - | 1890b7dda6ba | RDMA/hns: Add new command to support query vf caps | Y | - | 87d0ab38d4f0 | RDMA/hns: Modify congestion abbreviation | Y | - | 09f1b7cb29b2 | RDMA/hns: Support congestion control algorithm configuration at QP granularity | Y | + | COMMITID | SUBJECT | + | :----------: | :----------------------------------------------------------: | + | aa84fa18741b | RDMA/hns: Add SCC context clr support for hip08 | + | 6a157f7d1b14 | RDMA/hns: Add SCC context allocation support for hip08 | + | 6ac16e403900 | RDMA/hns: Bugfix for set hem of SCC | + | 00fb67ec6b98 | RDMA/hns: Bugfix for SCC hem free | + | 87d0ab38d4f0 | RDMA/hns: Modify congestion abbreviation | + | 09f1b7cb29b2 | RDMA/hns: Support congestion control algorithm configuration at QP granularity | - **��** openeuler/rdma �� - | COMMITID | SUBJECT | openeuler ENABLED(Y/N) | - | :----------: | :--------------------------------------------------------: | :--------------------: | - | 39c7b8eaeb3a | Update kernel headers | Y | - | 1b3ec79e4d61 | libhns: Support congestion control algorithm configuration | Y | + | COMMITID | SUBJECT | + | :----------: | :--------------------------------------------------------: | + | 39c7b8eaeb3a | Update kernel headers | + | 1b3ec79e4d61 | libhns: Support congestion control algorithm configuration | + +- **��bugfix** + + openEuler/rdma-core + + | SUBJECT | TAG | + | ---------------------------------------------------------- | -------- | + | libhns: Add input parameter check for hnsdv_query_device() | v41.0-21 | + +- **��bugfix** + + linux �� + + NA + + openeuler OLK-5.10 �� + + | COMMITID | SUBJECT | + | ------------ | :----------------------------------------------------------: | + | dadff1bccb45 | RDMA/hns: Fix incorrect congest type configuration | + | d2fd42152664 | RDMA/hns: Fix a missing default value for invalid congest type | #### �� @@ -1195,13 +1425,25 @@ HNS RoCE��DCQCN��LDCP��HC3��DCQ ��UINT_MAX�� +- **��** + + linux �� + + NA + + openeuler OLK-5.10 �� + + | COMMITID | SUBJECT | + | ------------ | :----------------------------------------------------------: | + | 523f34d81ea7 | RDMA/hns: Support congestion control algorithm parameter configuration | + - **��** openeuler/rdma �� - | COMMITID | SUBJECT | openeuler ENABLED(Y/N) | - | :------: | :--------------------------------------------------------: | :--------------------: | - | 48ccef6 | libhns: Support congestion control algorithm configuration | Y | + | COMMITID | SUBJECT | + | :------: | :--------------------------------------------------------: | + | 48ccef6 | libhns: Support congestion control algorithm configuration | ### ��15: ��Bonding @@ -1252,30 +1494,55 @@ HNS RoCE��DCQCN��LDCP��HC3��DCQ openeuler OLK-5.10 �� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | ------------ | ------------------------------------------------------------ | :-----------------------------: | - | e62a20278f18 | RDMA/hns: support RoCE bonding | Y | - | 646b97dbb8dc | RDMA/hns: adjust the structure of RoCE bonding driver | Y | - | 6ba084e0f031 | RDMA/hns: add constraints for bonding-unsupported situations | Y | - | b6623fd2c6dc | RDMA/hns: fix possible dead lock when setting RoCE Bonding | Y | - | 4920275aafcb | RDMA/hns: fix the error of missing GID in RoCE bonding mode 1 | Y | - | a1598d8616e7 | RDMA/hns: fix the error of RoCE VF based on RoCE Bonding PF | Y | - | 8aeaa67170fe | RDMA/hns: Move bond_work from hns_roce_dev to hns_roce_bond_group | Y | - | 82ee5d30a22d | RDMA/hns: Apply XArray for Bond ID allocation | Y | - | 41adb38e9111 | RDMA/hns: Delete a useless assignment to bond_state | Y | - | 960644465622 | RDMA/hns: Initial value assignment cleanup for RoCE Bonding variables | Y | - | 9003ac2aa412 | RDMA/hns: Remove the struct member 'bond_grp' from hns_roce_dev | Y | - | bc80b7288d5c | RDMA/hns: Simplify the slave uninit logic of RoCE bonding operations | Y | - | 8d3ee0ae6b33 | RDMA/hns: Fix the driver uninit order during bond setting | Y | - | 01c810c8b67f | RDMA/hns: Fix the counting error of slave number | Y | - | b0f80ad22f96 | RDMA/hns: Support reset recovery for RoCE bonding | Y | - | e4ad37eabbdb | RDMA/hns: Get real-time port state of bonding slave | Y | - | c65db67aed44 | RDMA/hns: Set IB port state depending on upper device for RoCE bonding | Y | - | 49f27d3e0831 | RDMA/hns: Support dispatching IB event for RoCE bonding | Y | - | a37994ad169d | RDMA/hns: Fix a missing constraint for slave num in RoCE Bonding | Y | - | b5db302586ab | RDMA/hns: Rename hns_roce_bond_info_record() to make sense | Y | - | 483ccd4400f6 | RDMA/hns: Fix the repetitive workqueue mission in RoCE Bonding | Y | - | ab97048c4804 | RDMA/hns: Fix the counting error of bonding with more than 2 slaves | Y | + | COMMITID | SUBJECT | + | ------------ | ------------------------------------------------------------ | + | e62a20278f18 | RDMA/hns: support RoCE bonding | + | 646b97dbb8dc | RDMA/hns: adjust the structure of RoCE bonding driver | + | 6ba084e0f031 | RDMA/hns: add constraints for bonding-unsupported situations | + | b6623fd2c6dc | RDMA/hns: fix possible dead lock when setting RoCE Bonding | + | 4920275aafcb | RDMA/hns: fix the error of missing GID in RoCE bonding mode 1 | + | a1598d8616e7 | RDMA/hns: fix the error of RoCE VF based on RoCE Bonding PF | + | 8aeaa67170fe | RDMA/hns: Move bond_work from hns_roce_dev to hns_roce_bond_group | + | 82ee5d30a22d | RDMA/hns: Apply XArray for Bond ID allocation | + | 41adb38e9111 | RDMA/hns: Delete a useless assignment to bond_state | + | 960644465622 | RDMA/hns: Initial value assignment cleanup for RoCE Bonding variables | + | 9003ac2aa412 | RDMA/hns: Remove the struct member 'bond_grp' from hns_roce_dev | + | bc80b7288d5c | RDMA/hns: Simplify the slave uninit logic of RoCE bonding operations | + | 8d3ee0ae6b33 | RDMA/hns: Fix the driver uninit order during bond setting | + | 01c810c8b67f | RDMA/hns: Fix the counting error of slave number | + | b0f80ad22f96 | RDMA/hns: Support reset recovery for RoCE bonding | + | e4ad37eabbdb | RDMA/hns: Get real-time port state of bonding slave | + | c65db67aed44 | RDMA/hns: Set IB port state depending on upper device for RoCE bonding | + | 49f27d3e0831 | RDMA/hns: Support dispatching IB event for RoCE bonding | + | a37994ad169d | RDMA/hns: Fix a missing constraint for slave num in RoCE Bonding | + | b5db302586ab | RDMA/hns: Rename hns_roce_bond_info_record() to make sense | + | 483ccd4400f6 | RDMA/hns: Fix the repetitive workqueue mission in RoCE Bonding | + | ab97048c4804 | RDMA/hns: Fix the counting error of bonding with more than 2 slaves | + +- **��bugfix** + + linux �� + + NA + + openeuler OLK-5.10 �� + + | COMMITID | SUBJECT | + | ------------ | :----------------------------------------------------------: | + | ef71d472e4a4 | RDMA/hns: Fix a missing kfree() to hr_dev->priv | + | c0f88964aed6 | RDMA/hns: Fix inaccurate error label name in init instance | + | bbe165da7807 | RDMA/hns: Fix missing cleanup when bond_grp becomes invalid | + | 007ae19975f5 | RDMA/hns: Fix the device loss after unbinding RoCE bond resource slave | + | 79c470b1c348 | RDMA/hns: Fix wild pointer error of RoCE bonding when rmmod hns3 | + | 71c7611c1224 | RDMA/hns: Add functions to obtain netdev and bus_num from an hr_dev | + | ff235b9c62bb | RDMA/hns: Fix a memory leak error when bond clear failed | + | b927e3066992 | RDMA/hns: Fix the concurrency error between bond and reset. | + | 991fd7d3bc75 | RDMA/hns: Fix several memory issues in roce bonding | + | f6916e6d7bba | RDMA/hns: Fix incorrect bond clear during slave increase event | + | 4c5c787523a4 | RDMA/hns: Fix init check of VFs on RoCE bonding slaves | + | 8344817b5fbc | RDMA/hns: Fix incorrect print type in bond | + | d51ce28bca67 | RDMA/hns: Add more check for bonding-unsupported cases | + | 52fe3e912417 | RDMA/hns: Improve readability of check_bond_support() | ### ��16: �� SRIOV �� @@ -1305,25 +1572,27 @@ HNS RoCE��DCQCN��LDCP��HC3��DCQ linux �� - | COMMITID | SUBJECT | TAG | - | :----------: | :----------------------------------------------------------: | :---------: | - | 0b567cde9d7a | [RDMA/hns: Enable RoCE on virtual functions](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.g… | kernel 5.13 | - | accfc1affe9e | [RDMA/hns: Set parameters of all the functions belong to a PF](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… | kernel 5.13 | - | 5b03a4226c42 | [RDMA/hns: Query the number of functions supported by the PF](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… | kernel 5.13 | - | 719d13415f59 | [RDMA/hns: Remove duplicated hem page size config code](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/co… | kernel 5.13 | - | 2a424e1d112a | [RDMA/hns: Reserve the resource for the VFs](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/com… | kernel 5.13 | - | 0fb46da051ae | [RDMA/hns: Simplify function's resource related command](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git… | kernel 5.13 | + | COMMITID | SUBJECT | TAG | + | :----------: | :----------------------------------------------------------: | :------------: | + | 0b567cde9d7a | [RDMA/hns: Enable RoCE on virtual functions](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.g… | kernel 5.13 | + | accfc1affe9e | [RDMA/hns: Set parameters of all the functions belong to a PF](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… | kernel 5.13 | + | 5b03a4226c42 | [RDMA/hns: Query the number of functions supported by the PF](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… | kernel 5.13 | + | 719d13415f59 | [RDMA/hns: Remove duplicated hem page size config code](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/co… | kernel 5.13 | + | 2a424e1d112a | [RDMA/hns: Reserve the resource for the VFs](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/com… | kernel 5.13 | + | 0fb46da051ae | [RDMA/hns: Simplify function's resource related command](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git… | kernel 5.13 | + | faa63656fc36 | [RDMA/hns: Add new command to support query vf caps](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/co… | kernel 6.4-rc1 | openeuler OLK-5.10 �� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :----------------------------------------------------------: | :-----------------------------: | - | 95d776135a46 | RDMA/hns: Enable RoCE on virtual functions | Y | - | 66274aac3d95 | RDMA/hns: Set parameters of all the functions belong to a PF | Y | - | 243bdeb15f32 | RDMA/hns: Query the number of functions supported by the PF | Y | - | 0abc8a80ce09 | RDMA/hns: Remove duplicated hem page size config code | Y | - | 74e1531c3e24 | RDMA/hns: Reserve the resource for the VFs | Y | - | 22d226239a08 | RDMA/hns: Simplify function's resource related command | Y | + | COMMITID | SUBJECT | + | :----------: | :----------------------------------------------------------: | + | 95d776135a46 | RDMA/hns: Enable RoCE on virtual functions | + | 66274aac3d95 | RDMA/hns: Set parameters of all the functions belong to a PF | + | 243bdeb15f32 | RDMA/hns: Query the number of functions supported by the PF | + | 0abc8a80ce09 | RDMA/hns: Remove duplicated hem page size config code | + | 74e1531c3e24 | RDMA/hns: Reserve the resource for the VFs | + | 22d226239a08 | RDMA/hns: Simplify function's resource related command | + | 1890b7dda6ba | RDMA/hns: Add new command to support query vf caps | ### ��17: �� @@ -1368,15 +1637,36 @@ HNS RoCE��DCQCN��LDCP��HC3��DCQ openeuler OLK-5.10 �� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :----------------------------------------------------------: | :-----------------------------: | - | 89a6da3cb8f3 | RDMA/hns: reset function when removing module | Y | - | 22d226239a08 | RDMA/hns: Simplify function's resource related command | Y | - | 243bdeb15f32 | RDMA/hns: Query the number of functions supported by the PF | Y | - | 74e1531c3e24 | RDMA/hns: Reserve the resource for the VFs | Y | - | 66274aac3d95 | RDMA/hns: Set parameters of all the functions belong to a PF | Y | - | 95d776135a46 | RDMA/hns: Enable RoCE on virtual functions | Y | - | 0abc8a80ce09 | RDMA/hns: Remove duplicated hem page size config code | Y | + | COMMITID | SUBJECT | + | :----------: | :----------------------------------------------------------: | + | 89a6da3cb8f3 | RDMA/hns: reset function when removing module | + | 22d226239a08 | RDMA/hns: Simplify function's resource related command | + | 243bdeb15f32 | RDMA/hns: Query the number of functions supported by the PF | + | 74e1531c3e24 | RDMA/hns: Reserve the resource for the VFs | + | 66274aac3d95 | RDMA/hns: Set parameters of all the functions belong to a PF | + | 95d776135a46 | RDMA/hns: Enable RoCE on virtual functions | + | 0abc8a80ce09 | RDMA/hns: Remove duplicated hem page size config code | + +- **��bugfix** + + linux �� + + NA + + openeuler OLK-5.10 �� + + | COMMITID | SUBJECT | + | ------------ | :----------------------------------------------------------: | + | d08f90ea3312 | RDMA/hns: Fix missing reset notification by user space driver | + | 431c875e4b02 | RDMA/hns: Fix simultaneous reset and resource deregistration | + +- **��bugfix** + + | SUBJECT | TAG | + | -------------------------------------------------- | -------- | + | libhns: Fix missing reset notification | v41.0-15 | + | libhns: return error when post send in reset state | v41.0-15 | + ### ��18: ��RAS @@ -1407,22 +1697,22 @@ HNS RoCE��DCQCN��LDCP��HC3��DCQ | 726be12f5ca0 | [RDMA/hns: Set reset flag when hw resetting](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.g… | kernel 5.3-rc1 | | 2de949abd6a5 | [RDMA/hns: Recover 1bit-ECC error of RAM on chip](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/co… | kernel 6.0-rc1 | | e8ea058edc2b | [RDMA/hns: Add the detection for CMDQ status in the device initialization process](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git… | kernel 5.18 | - + openeuler OLK-5.10 �� - - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :----------------------------------------------------------: | :-----------------------------: | - | 626903e9355b | RDMA/hns: Add support for reporting wc as software mode | Y | - | d3743fa94ccd | RDMA/hns: Fix the chip hanging caused by sending doorbell during reset | Y | - | 6a04aed6afae | RDMA/hns: Fix the chip hanging caused by sending mailbox&CMQ during reset | Y | - | d061effc36f7 | RDMA/hns: Fix the Oops during rmmod or insmod ko when reset occurs | Y | - | 2b9acb9a97fe | RDMA/hns: Add the process of AEQ overflow for hip08 | Y | - | cb7a94c9c808 | RDMA/hns: Add reset process for RoCE in hip08 | Y | - | 3ec5f54f7a0f | RDMA/hns: Fix an cmd queue issue when resetting | Y | - | e075da5e7c47 | RDMA/hns: Add reset process for function-clear | Y | - | 726be12f5ca0 | RDMA/hns: Set reset flag when hw resetting | Y | - | 1a8c6fa4adfb | RDMA/hns: Recover 1bit-ECC error of RAM on chip | Y | - | 34e27e3f9408 | RDMA/hns: Add the detection for CMDQ status in the device initialization process | Y | + + | COMMITID | SUBJECT | + | :----------: | :----------------------------------------------------------: | + | 626903e9355b | RDMA/hns: Add support for reporting wc as software mode | + | d3743fa94ccd | RDMA/hns: Fix the chip hanging caused by sending doorbell during reset | + | 6a04aed6afae | RDMA/hns: Fix the chip hanging caused by sending mailbox&CMQ during reset | + | d061effc36f7 | RDMA/hns: Fix the Oops during rmmod or insmod ko when reset occurs | + | 2b9acb9a97fe | RDMA/hns: Add the process of AEQ overflow for hip08 | + | cb7a94c9c808 | RDMA/hns: Add reset process for RoCE in hip08 | + | 3ec5f54f7a0f | RDMA/hns: Fix an cmd queue issue when resetting | + | e075da5e7c47 | RDMA/hns: Add reset process for function-clear | + | 726be12f5ca0 | RDMA/hns: Set reset flag when hw resetting | + | 1a8c6fa4adfb | RDMA/hns: Recover 1bit-ECC error of RAM on chip | + | 34e27e3f9408 | RDMA/hns: Add the detection for CMDQ status in the device initialization process | ### ��19: ��IOPMU @@ -1502,10 +1792,12 @@ HNS RoCE��DCQCN��LDCP��HC3��DCQ rdma link show [DEV/PORT_INDEX] #��/�� rdma stat show link [ DEV/PORT_INDEX ] -p + #��scc context �� + rdma res show qp -jpr ``` - - ��context��openeuler 22.03 SP2�� - + + ��context��openeuler 22.03 SP2�� + - **��** linux �� @@ -1523,18 +1815,19 @@ HNS RoCE��DCQCN��LDCP��HC3��DCQ openeuler OLK-5.10 �� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :-------------------------------------------------------: | :-----------------------------: | - | e1c9a0dc2939 | RDMA/hns: Dump detailed driver-specific CQ | Y | - | 9c9edf689a60 | RDMA/hns: Remove redundant DFX file and DFX ops structure | Y | - | 9dd913cd565c | RDMA/hns: Add or remove CQ's restrack attributes | Y | - | 78163ff31523 | RDMA/hns: Support CQ's restrack raw ops for hns driver | Y | - | 78425b64c781 | RDMA/hns: Support QP's restrack ops for hns driver | Y | - | 0480d2ff2ed6 | RDMA/hns: Support QP's restrack raw ops for hns driver | Y | - | 98b07261a4da | RDMA/hns: Support MR's restrack ops for hns driver | Y | - | 4d20406bc210 | RDMA/hns: Support MR's restrack raw ops for hns driver | Y | - | d5a4ca75e7ca | RDMA/hns: Add dfx cnt stats | Y | - | 05491dda8e9b | RDMA/hns: Support hns HW stats | Y | + | COMMITID | SUBJECT | + | :----------: | :---------------------------------------------------------: | + | e1c9a0dc2939 | RDMA/hns: Dump detailed driver-specific CQ | + | 9c9edf689a60 | RDMA/hns: Remove redundant DFX file and DFX ops structure | + | 9dd913cd565c | RDMA/hns: Add or remove CQ's restrack attributes | + | 78163ff31523 | RDMA/hns: Support CQ's restrack raw ops for hns driver | + | 78425b64c781 | RDMA/hns: Support QP's restrack ops for hns driver | + | 0480d2ff2ed6 | RDMA/hns: Support QP's restrack raw ops for hns driver | + | 98b07261a4da | RDMA/hns: Support MR's restrack ops for hns driver | + | 4d20406bc210 | RDMA/hns: Support MR's restrack raw ops for hns driver | + | d5a4ca75e7ca | RDMA/hns: Add dfx cnt stats | + | 05491dda8e9b | RDMA/hns: Support hns HW stats | + | 0b24e733b240 | RDMA/hns: Append SCC context to the raw dump of QP Resource | ### ��22: �� DCA @@ -1663,29 +1956,65 @@ HNS RoCE��DCQCN��LDCP��HC3��DCQ openeuler OLK-5.10 �� - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :----------------------------------------------------------: | :-----------------------------: | - | 21a0d4fe7b81 | RDMA/hns: Fixes concurrent ressetting and post_recv in DCA mode | Y | - | d3caaebdbfe9 | RDMA/hns: Optimize user DCA perfermance by sharing DCA status | Y | - | d3caaebdbfe9 | RDMA/hns: Add debugfs support for DCA | Y | - | d3caaebdbfe9 | RDMA/hns: Add DCA support for kernel space | Y | - | f0384ddcf1ee | RDMA/hns: Add method to query WQE buffer's address | Y | - | 0273952c5e6e | RDMA/hns: Add method to detach WQE buffer | Y | - | 0cf17392d266 | RDMA/hns: Setup the configuration of WQE addressing to QPC | Y | - | d8cca476a8d2 | RDMA/hns: Add method for attaching WQE buffer | Y | - | 40e4b148b5bd | RDMA/hns: Configure DCA mode for the userspace QP | Y | - | bca9ff271249 | RDMA/hns: Add method for shrinking DCA memory pool | Y | - | f44a2f97d82a | RDMA/hns: Introduce DCA for RC QP | Y | + | COMMITID | SUBJECT | + | :----------: | :----------------------------------------------------------: | + | 21a0d4fe7b81 | RDMA/hns: Fixes concurrent ressetting and post_recv in DCA mode | + | d3caaebdbfe9 | RDMA/hns: Optimize user DCA perfermance by sharing DCA status | + | d3caaebdbfe9 | RDMA/hns: Add debugfs support for DCA | + | d3caaebdbfe9 | RDMA/hns: Add DCA support for kernel space | + | f0384ddcf1ee | RDMA/hns: Add method to query WQE buffer's address | + | 0273952c5e6e | RDMA/hns: Add method to detach WQE buffer | + | 0cf17392d266 | RDMA/hns: Setup the configuration of WQE addressing to QPC | + | d8cca476a8d2 | RDMA/hns: Add method for attaching WQE buffer | + | 40e4b148b5bd | RDMA/hns: Configure DCA mode for the userspace QP | + | bca9ff271249 | RDMA/hns: Add method for shrinking DCA memory pool | + | f44a2f97d82a | RDMA/hns: Introduce DCA for RC QP | + +- **��bugfix** + + linux �� + + NA + + openeuler OLK-5.10 �� + + | COMMITID | SUBJECT | + | ------------ | ------------------------------------------------------------ | + | 4fa42930c5f3 | RDMA/hns: Fix sleeping in atomic context during DCA unloading | + | 172129db8ecb | RDMA/hns: Fix unregistering device and accessing to debugfs concurrently | + | 145ea8d003a2 | RDMA/hns: Fix registering dca debugfs when dca has not been set | + | 63a0766e1652 | RDMA/hns: Fix potential NULL pointer in DCA memory query | + | 35c15b48ff2c | RDMA/hns: Fix context dca configuration | + | bcfafb498f86 | RDMA/hns: Fix a meaningless loop in free_buffer_pages_proc() | + | 6fd50c4f1706 | RDMA/hns: Fix sleeping in setup_dca_buf_to_hw() | + | bbf867973d74 | RDMA/hns: Improve readabilties for dca uverbs | + | 9ac2b25be3c6 | RDMA/hns: Fix unhandled error code in dca uverbs | + | 6e81b2e0b40b | RDMA/hns: Remove redundant address operations in print DCA logs | - **��** - openeuler/rdma �� + openeuler/rdma-core �� + + | COMMITID | SUBJECT | + | :----------: | :-----------------------------------------------: | + | c7b35a31f788 | libhns: Add direct verbs support to config DCA | + | ec87209c02c1 | libhns: Sync DCA status by shared memory | + | 339020fc889d | libhns: Use shared memory to sync DCA status | + | f96da657494a | libhns: Add support for attaching QP's WQE buffer | + | f5306beedef4 | libhns: Add support for shrinking DCA memory pool | + | 23718090bda7 | libhns: Introduce DCA for RC QP | + | 7a4ccc54c3c6 | Update kernel headers | - | COMMITID | SUBJECT | openeuler OLK-5.10 ENABLED(Y/N) | - | :----------: | :------------------: | :-----------------------------: | - | b88a370b79cd | Support hns roce DCA | Y | -### ��23: ��TD�� +- **��bugfix** + + openEuler/rdma-core + + | SUBJECT | TAG | + | ----------------------------------------- | -------- | + | libhns: Fix unnecessary dca memory detach | v41.0-21 | + +### ��23: �� - **��** @@ -1701,22 +2030,19 @@ HNS RoCE��DCQCN��LDCP��HC3��DCQ | ibv_alloc_parent_domain() | ��TD��PD��PAD | | ibv_create_cq_ex() | ��PAD��QP��CQ�� | -- **��** - - linux/rdma �� +- **��bugfix** - | COMMITID | SUBJECT | TAG | - | :----------: | :----------------------------------------------------------: | :----------: | - | 812372fadc96 | libhns: Add support for the thread domain and the parent domain | rdma-core 28 | + openEuler/rdma-core - openeuler/rdma �� + | SUBJECT | TAG | + | ---------------------------------------------------------- | -------- | + | libhns: Fix parent domain unsupported comp mask | v41.0-23 | + | libhns: Removes a repeated initialization of a spinlock | v41.0-23 | + | libhns: Add pthread_spin_destroy()/pthread_mutex_destroy() | v41.0-23 | - | COMMITID | SUBJECT | openeuler ENABLED(Y/N) | - | :----------: | :----------------------------------------------------------: | :---------------------: | - | 812372fadc96 | libhns: Add support for the thread domain and the parent domain | Y | -### ��24: ��OFED��IO�� +### ��25: ��OFED��IO�� - **��** @@ -1753,16 +2079,293 @@ HNS RoCE��DCQCN��LDCP��HC3��DCQ openeuler/rdma �� - | COMMITID | SUBJECT | openeuler ENABLED(Y/N) | - | :----------: | :-------------------------------------------------------: | :--------------------: | - | 13c10af17443 | libhns: Support ibv_create_qp_ex | Y | - | 36446a56eea5 | libhns: Extended QP supports the new post send mechanism | Y | - | d8596eff4eb4 | libhns: Add support for creating extended CQ | Y | - | 0464e0cb0416 | libhns: Extended CQ supports the new polling mechanism | Y | - | 2d48954e9b26 | libhns: Optimize the error handling of CQE | Y | - | 9dd7b55957cc | libhns: Refactor hns roce v2 poll one() and wc poll cqe() | Y | - | d8596eff4eb4 | libhns: Add support for creating extended CQ | Y | + | COMMITID | SUBJECT | + | :----------: | :-------------------------------------------------------: | + | 13c10af17443 | libhns: Support ibv_create_qp_ex | + | 36446a56eea5 | libhns: Extended QP supports the new post send mechanism | + | d8596eff4eb4 | libhns: Add support for creating extended CQ | + | 0464e0cb0416 | libhns: Extended CQ supports the new polling mechanism | + | 2d48954e9b26 | libhns: Optimize the error handling of CQE | + | 9dd7b55957cc | libhns: Refactor hns roce v2 poll one() and wc poll cqe() | + | d8596eff4eb4 | libhns: Add support for creating extended CQ | + +- **��bugfix** + + **openEuler/rdma-core** + + | SUBJECT | TAG | + | ---------------------------------------------------- | -------- | + | libhns: Fix the owner bit error of sq in new io | v41.0-12 | + | libhns: Fix owner bit when SQ wraps around in new IO | v41.0-23 | + + **Linux/rdma-core** + + | COMMITID | SUBJECT | + | --------- | ----------------------------------------------- | + | c292b7809 | libhns: Fix the owner bit error of sq in new io | + +### ��26��debugfs�� + +#### ��debugfs��SRQ Context + +- **��** + + ��debugfs��debugfs��hns_roce��srq��srqc��srqn��srqc�� + +- **��** + + ��: + + ```bash + #srq ��srqc + cat /sys/kernel/debug/hns_roce/hns_0/srq/srqc + [ { + "srqn": 0, + "ifindex": 0, + "ifname": "hns_0", + "data": [ 149,0,0,0,0,0,0,1,0,0,0,0,2,103,23,101,0,14,100,31,0,0,0,0,2,0,0,0,0,20,100,31,0,0,0,0,11,178,15,0,0,0,64,5,9,178,15,0,0,0,16,0,0,0,0,9,1,96,32,251,0,0,0,0 ] + } ] + ``` + +- **��** + + linux �� + + NA + + openeuler OLK-5.10 �� + + | COMMITID | SUBJECT | + | :----------: | :----------------------------------------------: | + | 0355dea3a834 | RDMA/hns: Support SRQ Context tracing by debugfs | + +#### ��debugfs��roce�� + +- **��** + + ��debugfs��debugfs��hns_roce��sw_stat�� + +- **��** + + �� + + ```bash + #�� + cat /sys/kernel/debug/hns_roce/hns_0/sw_stat/sw_stat + aeqe --- 3341 + ceqe --- 0 + cmds --- 6764 + cmds_err --- 0 + posted_mbx --- 3344 + polled_mbx --- 3 + mbx_event --- 3341 + qp_create_err --- 0 + qp_modify_err --- 0 + cq_create_err --- 0 + srq_create_err --- 0 + xrcd_alloc_err --- 0 + mr_reg_err --- 0 + mr_rereg_err --- 0 + ah_create_err --- 0 + mmap_err --- 0 + uctx_alloc_err --- 0 + srq_modify_err --- 0 + ``` + +- **��** + + linux �� + + | COMMITID | SUBJECT | TAG | + | ------------ | ------------------------------------------------------------ | -------------- | + | ca7ad04cd5d2 | [RDMA/hns: Add debugfs to hns RoCE](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/co… | kernel 6.8-rc1 | + | eb7854d63db5 | [RDMA/hns: Support SW stats with debugfs](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git… | kernel 6.8-rc1 | + + openeuler OLK-5.10 �� + + | COMMITID | SUBJECT | + | :----------: | :----------------------------------------------------------: | + | 5706343857ed | Revert "RDMA/hns: Fix missing dealloc_dfx_cnt() during device unregister" | + | f7a2259b1ddd | Revert "RDMA/hns: Add dfx cnt stats" | + | 34b5311652bb | RDMA/hns: Remove return value checks of debugfs functions | + | 5e7ecc38d89b | RDMA/hns: Support SW stats with debugfs | + | 2223966b006a | RDMA/hns: Don't set the HW stats ops for VF and HIP08 | + | b6643496e2b4 | RDMA/hns: Refactor hns RoCE debugfs | + +### ��27: ��WC + +- **��** + + ��(��)��WC��WC�� WC��WC�� + +- **��** + + NA + +- **��** + + linux �� + + | COMMITID | SUBJECT | TAG | + | ------------ | :----------------------------------------------------------: | -------------- | + | 626903e9355b | [RDMA/hns: Add support for reporting wc as software mode](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/co… | kernel 5.6-rc1 | + + openeuler OLK-5.10 �� + + | COMMITID | SUBJECT | + | ------------ | ------------------------------------------------------- | + | 626903e9355b | RDMA/hns: Add support for reporting wc as software mode | + +- **��** + + openEuler/rdma-core + + | SUBJECT | TAG | + | ------------------------------------------------- | -------- | + | libhns: assign doorbell to zero when allocate it | v41.0-15 | + | libhns: separate the initialization steps of lock | v41.0-15 | + | libhns: Support reporting wc as software mode | v41.0-15 | + +### **��28: ��direct wqe** + +- **��** + + Direct WQE��wqe��PCI BAR��bar�� + +- **��** + + NA + +- **��** + + linux �� + + | COMMITID | SUBJECT | TAG | + | ------------ | :----------------------------------------------------------: | --------------- | + | 01584a5edcc4 | [RDMA/hns: Add support of direct wqe](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/com… | kernel 5.12-rc1 | + | 591f762b2750 | [RDMA/hns: Remove the condition of light load for posting DWQE](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/co… | kernel 5.14-rc1 | + + openeuler OLK-5.10 �� + + | COMMITID | SUBJECT | + | ------------ | ------------------------------------------------------------ | + | 01584a5edcc4 | RDMA/hns: Add support of direct wqe | + | 591f762b2750 | RDMA/hns: Remove the condition of light load for posting DWQE | + | 2c61dcac92e8 | RDMA/hns: Add SVE DIRECT WQE flag to support libhns | + +- **��** + + **linux/rdma-core** + + | COMMITID | SUBJECT | + | --------- | -------------------------- | + | 159933c37 | Add support for direct wqe | + + **openEuler/rdma-core** + + | SUBJECT | TAG | + | -------------------------------------- | -------- | + | Update kernel headers | v41.0-10 | + | libhns: Add support for SVE Direct WQE | v41.0-10 | + +- **��bugfix** + + **openEuler/rdma-core** + + | SUBJECT | TAG | + | --------------------------------------------------------- | -------- | + | libhns: Fix missing DB when compiler does not support SVE | v41.0-24 | + + **linux/rdma-core** + + | COMMITID | SUBJECT | + | --------- | ---------------------------------------------------------- | + | 9e8e0be45 | libhns: Fix incorrect post-send with direct wqe of wr-list | + +### ��29: ��STARS�� + +- **��** + + STARS��System Task and Resource Scheduler��920��STARS��RoCEE��STARS over RDMA�� + +- **��** + + �� + + | �� | �� | + | -------------------------------- | ------------------------------ | + | rdma_register_poe_channel() | ��POE�� | + | rdma_unregister_poe_channel() | ��POE�� | + | rdma_support_stars() | ��STARS | + | rdma_query_qp_db() | ��doorbell�� | + | rdma_query_hw_id() | ��ID | + | rdma_register_notify_addr��s�� | ��notify operation��MR | + | rdma_unregister_notify_addr() | ��notify operation��MR | + + �� + + | �� | �� | + | ----------------------- | ------------------- | + | hnsdv_update_sq_ci() | ��sq��ci�� | + | hnsdv_wr_write_notify() | ��wqe��notify�� | + +- **��** + + openeuler OLK-5.10 �� + + | COMMITID | SUBJECT | + | ------------ | ------------------------------------------------------------ | + | 21cacb516f20 | RDMA/hns: Support write with notify | + | aae9bba55fae | RDMA/hns: Support kernel ULP querying HW ID | + | 85b26a97adfe | RDMA/hns: Support STARS mode QP | + | 96df01574e0c | RDMA/hns: Support configuring POE channels and creating POE CQs | + | 1470b68f21c3 | RDMA/hns: Fix print after query hw id failed. | + | 867e1e95fe12 | RDMA/hns: Support query HW ID from user space. | + | 04180b7a60b7 | RDMA/hns: Fix memory leak in POE debugfs | + +- **��** + + openEuler/rdma-core + + | SUBJECT | TAG | + | ------------------------------------------------------ | -------- | + | Update kernel headers for libhns query_device() | v41.0-19 | + | libhns: Support query HW ID by hnsdv_query_device() | v41.0-19 | + | libhns: Support query HW ID by hnsdv_query_device() | v41.0-19 | + | libhns: Add support for POE CQs | v41.0-19 | + | Update kernel headers for supporting STARS QP in HNS | v41.0-19 | + | libhns: Support STARS mode QP | v41.0-19 | + | Update kernel headers for supporting write with notify | v41.0-19 | + | libhns: Support write with notify | v41.0-19 | + +### ��30: RoCE��UB Link�� + +- **��** + + RDMA over UB link, ��RDMA��UB��port��port ��port��UBL�� + + RoUB��RoH�� + + 1. ��UBL��RDMA�� + 2. ��OFED��API�� + +- **��** + + NA + +- **��** + + openeuler OLK-5.10 �� + + | COMMITID | SUBJECT | + | ------------ | -------------------------------------------- | + | 67fc10550307 | RDMA/hns: Add support for RDMA VF over UBL | + | c6a060633ded | RDMA/core: Add support for the new ARPHRD_UB | +- **��bugfix** + openEuler/rdma-core -�� + | SUBJECT | TAG | + | ----------------------------------------------- | -------- | + | libhns: Skip resolving MAC for RDMA over UBLink | v41.0-18 | \ No newline at end of file -- 2.30.0

1 0

[PATCH openEuler-1.0-LTS 0/3] CVE-2021-47024
by Ziyang Xuan 05 Mar '24

05 Mar '24

Patchset for CVE-2021-47024. Jia He (1): virtio_vsock: Fix race condition in virtio_transport_recv_pkt Stefano Garzarella (2): vsock/virtio: discard packets only when socket is really closed vsock/virtio: free queued packets when closing socket net/vmw_vsock/virtio_transport_common.c | 38 +++++++++++++++++++------ 1 file changed, 29 insertions(+), 9 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] mm,ima,kexec,of: use memblock_free_late from ima_free_kexec_buffer
by GUO Zihua 05 Mar '24

05 Mar '24

From: Rik van Riel <riel(a)surriel.com> mainline inclusion from mainline-v5.13-rc1 commit f0362a253606e2031f8d61c74195d4d6556e12a4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I960AB CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The code calling ima_free_kexec_buffer runs long after the memblock allocator has already been torn down, potentially resulting in a use after free in memblock_isolate_range. With KASAN or KFENCE, this use after free will result in a BUG from the idle task, and a subsequent kernel panic. Switch ima_free_kexec_buffer over to memblock_free_late to avoid that issue. Fixes: fee3ff99bc67 ("powerpc: Move arch independent ima kexec functions to drivers/of/kexec.c") Cc: stable(a)kernel.org Signed-off-by: Rik van Riel <riel(a)surriel.com> Suggested-by: Mike Rappoport <rppt(a)kernel.org> Link: https://lore.kernel.org/r/20230817135759.0888e5ef@imladris.surriel.com Signed-off-by: Rob Herring <robh(a)kernel.org> Conflicts: drivers/of/kexec.c Signed-off-by: GUO Zihua <guozihua(a)huawei.com> --- drivers/of/kexec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/of/kexec.c b/drivers/of/kexec.c index d8231c34e873..2d1fd5587123 100644 --- a/drivers/of/kexec.c +++ b/drivers/of/kexec.c @@ -178,7 +178,8 @@ int ima_free_kexec_buffer(void) if (ret) return ret; - return memblock_free(addr, size); + memblock_free_late(addr, size); + return 0; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/1] powerpc/64s: Fix pte update for kernel memory on radix
by Huang Xiaojia 05 Mar '24

05 Mar '24

Jordan Niethe (1): powerpc/64s: Fix pte update for kernel memory on radix arch/powerpc/include/asm/book3s/64/radix.h | 6 ++++-- arch/powerpc/mm/pgtable-radix.c | 4 ++-- 2 files changed, 6 insertions(+), 4 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] NFC: st21nfca: Fix memory leak in device probe and remove
by Dong Chenchen 05 Mar '24

05 Mar '24

From: Wei Yongjun <weiyongjun1(a)huawei.com> stable inclusion from stable-v4.19.223 commit a1e0080a35a16ce3808f7040fe0c3a8fdb052349 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I947OW CVE: CVE-2021-46924 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1b9dadba502234eea7244879b8d5d126bfaf9f0c ] 'phy->pending_skb' is alloced when device probe, but forgot to free in the error handling path and remove path, this cause memory leak as follows: unreferenced object 0xffff88800bc06800 (size 512): comm "8", pid 11775, jiffies 4295159829 (age 9.032s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000d66c09ce>] __kmalloc_node_track_caller+0x1ed/0x450 [<00000000c93382b3>] kmalloc_reserve+0x37/0xd0 [<000000005fea522c>] __alloc_skb+0x124/0x380 [<0000000019f29f9a>] st21nfca_hci_i2c_probe+0x170/0x8f2 Fix it by freeing 'pending_skb' in error and remove. Fixes: 68957303f44a ("NFC: ST21NFCA: Add driver for STMicroelectronics ST21NFCA NFC Chip") Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/nfc/st21nfca/i2c.c | 29 ++++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-) diff --git a/drivers/nfc/st21nfca/i2c.c b/drivers/nfc/st21nfca/i2c.c index 1b347096422f..ebea3b4dd8e1 100644 --- a/drivers/nfc/st21nfca/i2c.c +++ b/drivers/nfc/st21nfca/i2c.c @@ -544,7 +544,8 @@ static int st21nfca_hci_i2c_probe(struct i2c_client *client, phy->gpiod_ena = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW); if (IS_ERR(phy->gpiod_ena)) { nfc_err(dev, "Unable to get ENABLE GPIO\n"); - return PTR_ERR(phy->gpiod_ena); + r = PTR_ERR(phy->gpiod_ena); + goto out_free; } phy->se_status.is_ese_present = @@ -555,7 +556,7 @@ static int st21nfca_hci_i2c_probe(struct i2c_client *client, r = st21nfca_hci_platform_init(phy); if (r < 0) { nfc_err(&client->dev, "Unable to reboot st21nfca\n"); - return r; + goto out_free; } r = devm_request_threaded_irq(&client->dev, client->irq, NULL, @@ -564,15 +565,23 @@ static int st21nfca_hci_i2c_probe(struct i2c_client *client, ST21NFCA_HCI_DRIVER_NAME, phy); if (r < 0) { nfc_err(&client->dev, "Unable to register IRQ handler\n"); - return r; + goto out_free; } - return st21nfca_hci_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME, - ST21NFCA_FRAME_HEADROOM, - ST21NFCA_FRAME_TAILROOM, - ST21NFCA_HCI_LLC_MAX_PAYLOAD, - &phy->hdev, - &phy->se_status); + r = st21nfca_hci_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME, + ST21NFCA_FRAME_HEADROOM, + ST21NFCA_FRAME_TAILROOM, + ST21NFCA_HCI_LLC_MAX_PAYLOAD, + &phy->hdev, + &phy->se_status); + if (r) + goto out_free; + + return 0; + +out_free: + kfree_skb(phy->pending_skb); + return r; } static int st21nfca_hci_i2c_remove(struct i2c_client *client) @@ -585,6 +594,8 @@ static int st21nfca_hci_i2c_remove(struct i2c_client *client) if (phy->powered) st21nfca_hci_i2c_disable(phy); + if (phy->pending_skb) + kfree_skb(phy->pending_skb); return 0; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ieee802154: ca8210: Fix a potential UAF in ca8210_probe
by Yu Liao 05 Mar '24

05 Mar '24

From: Dinghao Liu <dinghao.liu(a)zju.edu.cn> stable inclusion from stable-v4.19.297 commit cdb46be93c1f7bbf2c4649e9fc5fb147cfb5245d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95ASM CVE: CVE-2023-52510 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f990874b1c98fe8e57ee9385669f501822979258 ] If of_clk_add_provider() fails in ca8210_register_ext_clock(), it calls clk_unregister() to release priv->clk and returns an error. However, the caller ca8210_probe() then calls ca8210_remove(), where priv->clk is freed again in ca8210_unregister_ext_clock(). In this case, a use-after-free may happen in the second time we call clk_unregister(). Fix this by removing the first clk_unregister(). Also, priv->clk could be an error code on failure of clk_register_fixed_rate(). Use IS_ERR_OR_NULL to catch this case in ca8210_unregister_ext_clock(). Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver") Signed-off-by: Dinghao Liu <dinghao.liu(a)zju.edu.cn> Message-ID: <20231007033049.22353-1-dinghao.liu(a)zju.edu.cn> Signed-off-by: Stefan Schmidt <stefan(a)datenfreihafen.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/net/ieee802154/ca8210.c | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c index 38a41651e451..324ce317b864 100644 --- a/drivers/net/ieee802154/ca8210.c +++ b/drivers/net/ieee802154/ca8210.c @@ -2779,7 +2779,6 @@ static int ca8210_register_ext_clock(struct spi_device *spi) struct device_node *np = spi->dev.of_node; struct ca8210_priv *priv = spi_get_drvdata(spi); struct ca8210_platform_data *pdata = spi->dev.platform_data; - int ret = 0; if (!np) return -EFAULT; @@ -2796,18 +2795,8 @@ static int ca8210_register_ext_clock(struct spi_device *spi) dev_crit(&spi->dev, "Failed to register external clk\n"); return PTR_ERR(priv->clk); } - ret = of_clk_add_provider(np, of_clk_src_simple_get, priv->clk); - if (ret) { - clk_unregister(priv->clk); - dev_crit( - &spi->dev, - "Failed to register external clock as clock provider\n" - ); - } else { - dev_info(&spi->dev, "External clock set as clock provider\n"); - } - return ret; + return of_clk_add_provider(np, of_clk_src_simple_get, priv->clk); } /** @@ -2819,8 +2808,8 @@ static void ca8210_unregister_ext_clock(struct spi_device *spi) { struct ca8210_priv *priv = spi_get_drvdata(spi); - if (!priv->clk) - return + if (IS_ERR_OR_NULL(priv->clk)) + return; of_clk_del_provider(spi->dev.of_node); clk_unregister(priv->clk); -- 2.25.1

2 2

[PATCH openEuler-1.0-LTS] perf/x86/lbr: Filter vsyscall addresses
by Luo Gengkun 05 Mar '24

05 Mar '24

From: JP Kobryn <inwardvessel(a)gmail.com> mainline inclusion from mainline-v6.6-rc6 commit e53899771a02f798d436655efbd9d4b46c0f9265 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94P3R CVE: CVE-2023-52476 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- We found that a panic can occur when a vsyscall is made while LBR sampling is active. If the vsyscall is interrupted (NMI) for perf sampling, this call sequence can occur (most recent at top): __insn_get_emulate_prefix() insn_get_emulate_prefix() insn_get_prefixes() insn_get_opcode() decode_branch_type() get_branch_type() intel_pmu_lbr_filter() intel_pmu_handle_irq() perf_event_nmi_handler() Within __insn_get_emulate_prefix() at frame 0, a macro is called: peek_nbyte_next(insn_byte_t, insn, i) Within this macro, this dereference occurs: (insn)->next_byte Inspecting registers at this point, the value of the next_byte field is the address of the vsyscall made, for example the location of the vsyscall version of gettimeofday() at 0xffffffffff600000. The access to an address in the vsyscall region will trigger an oops due to an unhandled page fault. To fix the bug, filtering for vsyscalls can be done when determining the branch type. This patch will return a "none" branch if a kernel address if found to lie in the vsyscall region. Suggested-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: JP Kobryn <inwardvessel(a)gmail.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Cc: stable(a)vger.kernel.org Conflicts: arch/x86/events/utils.c Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/intel/lbr.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c index a3dc3b5bc78d..1fb1ede03c40 100644 --- a/arch/x86/events/intel/lbr.c +++ b/arch/x86/events/intel/lbr.c @@ -5,6 +5,7 @@ #include <asm/perf_event.h> #include <asm/msr.h> #include <asm/insn.h> +#include <linux/mm.h> #include "../perf_event.h" @@ -894,9 +895,9 @@ static int branch_type(unsigned long from, unsigned long to, int abort) * The LBR logs any address in the IP, even if the IP just * faulted. This means userspace can control the from address. * Ensure we don't blindy read any address by validating it is - * a known text address. + * a known text address and not a vsyscall address. */ - if (kernel_text_address(from)) { + if (kernel_text_address(from) && !in_gate_area_no_mm(from)) { addr = (void *)from; /* * Assume we can get the maximum possible size -- 2.34.1

2 1

[PATCH OLK-5.10 0/1] sched: migtate user interface from smart grid to sched bpf
by Liao Chen 05 Mar '24

05 Mar '24

Migtating user interface from smart grid to sched bpf, which allows users to set SCHED_GRID_QOS_TASK_LEVEL through: /proc/${pid}/task/${pid}/tag interface. Although arbitrary integer value could be assigned to , currnetly we clamp the value of SCHED_GRID_QOS_TASK_LEVEL to 0-7, which maintains consistency. Liao Chen (1): sched: migtate user interface from smart grid to sched bpf fs/proc/base.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS] Input: powermate - fix use-after-free in powermate_config_complete
by Xiang Yang 05 Mar '24

05 Mar '24

From: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> stable inclusion from stable-v5.10.199 commit cd2fbfd8b922b7fdd50732e47d797754ab59cb06 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94PA7 CVE: CVE-2023-52475 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5c15c60e7be615f05a45cd905093a54b11f461bc upstream. syzbot has found a use-after-free bug [1] in the powermate driver. This happens when the device is disconnected, which leads to a memory free from the powermate_device struct. When an asynchronous control message completes after the kfree and its callback is invoked, the lock does not exist anymore and hence the bug. Use usb_kill_urb() on pm->config to cancel any in-progress requests upon device disconnection. [1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e Signed-off-by: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> Reported-by: syzbot+0434ac83f907a1dbdd1e(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20230916-topic-powermate_use_after_free-v3-1-6441… Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- drivers/input/misc/powermate.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/input/misc/powermate.c b/drivers/input/misc/powermate.c index c4e0e1886061..6b1b95d58e6b 100644 --- a/drivers/input/misc/powermate.c +++ b/drivers/input/misc/powermate.c @@ -425,6 +425,7 @@ static void powermate_disconnect(struct usb_interface *intf) pm->requires_update = 0; usb_kill_urb(pm->irq); input_unregister_device(pm->input); + usb_kill_urb(pm->config); usb_free_urb(pm->irq); usb_free_urb(pm->config); powermate_free_buffers(interface_to_usbdev(intf), pm); -- 2.34.1

2 1

[PATCH OLK-6.6] apparmor: avoid crash when parsed profile name is empty
by Xiang Yang 05 Mar '24

05 Mar '24

From: Fedor Pchelkin <pchelkin(a)ispras.ru> stable inclusion from stable-v6.6.14 commit 5c0392fdafb0a2321311900be83ffa572bef8203 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932W7 CVE: CVE-2023-52443 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 55a8210c9e7d21ff2644809699765796d4bfb200 ] When processing a packed profile in unpack_profile() described like "profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}" a string ":samba-dcerpcd" is unpacked as a fully-qualified name and then passed to aa_splitn_fqname(). aa_splitn_fqname() treats ":samba-dcerpcd" as only containing a namespace. Thus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Later aa_alloc_profile() crashes as the new profile name is NULL now. general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 6 PID: 1657 Comm: apparmor_parser Not tainted 6.7.0-rc2-dirty #16 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:strlen+0x1e/0xa0 Call Trace: <TASK> ? strlen+0x1e/0xa0 aa_policy_init+0x1bb/0x230 aa_alloc_profile+0xb1/0x480 unpack_profile+0x3bc/0x4960 aa_unpack+0x309/0x15e0 aa_replace_profiles+0x213/0x33c0 policy_update+0x261/0x370 profile_replace+0x20e/0x2a0 vfs_write+0x2af/0xe00 ksys_write+0x126/0x250 do_syscall_64+0x46/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK> ---[ end trace 0000000000000000 ]--- RIP: 0010:strlen+0x1e/0xa0 It seems such behaviour of aa_splitn_fqname() is expected and checked in other places where it is called (e.g. aa_remove_profiles). Well, there is an explicit comment "a ns name without a following profile is allowed" inside. AFAICS, nothing can prevent unpacked "name" to be in form like ":samba-dcerpcd" - it is passed from userspace. Deny the whole profile set replacement in such case and inform user with EPROTO and an explaining message. Found by Linux Verification Center (linuxtesting.org) Fixes: 04dc715e24d0 ("apparmor: audit policy ns specified in policy load") Signed-off-by: Fedor Pchelkin <pchelkin(a)ispras.ru> Signed-off-by: John Johansen <john.johansen(a)canonical.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- security/apparmor/policy_unpack.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c index dbc83455d900..eb406ac595f8 100644 --- a/security/apparmor/policy_unpack.c +++ b/security/apparmor/policy_unpack.c @@ -826,6 +826,10 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name) tmpname = aa_splitn_fqname(name, strlen(name), &tmpns, &ns_len); if (tmpns) { + if (!tmpname) { + info = "empty profile name"; + goto fail; + } *ns_name = kstrndup(tmpns, ns_len, GFP_KERNEL); if (!*ns_name) { info = "out of memory"; -- 2.34.1

2 1

[PATCH OLK-5.10] apparmor: avoid crash when parsed profile name is empty
by Xiang Yang 05 Mar '24

05 Mar '24

From: Fedor Pchelkin <pchelkin(a)ispras.ru> stable inclusion from stable-v5.10.209 commit 5ff00408e5029d3550ee77f62dc15f1e15c47f87 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932W7 CVE: CVE-2023-52443 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ----------------------------------------------------- [ Upstream commit 55a8210c9e7d21ff2644809699765796d4bfb200 ] When processing a packed profile in unpack_profile() described like "profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}" a string ":samba-dcerpcd" is unpacked as a fully-qualified name and then passed to aa_splitn_fqname(). aa_splitn_fqname() treats ":samba-dcerpcd" as only containing a namespace. Thus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Later aa_alloc_profile() crashes as the new profile name is NULL now. general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 6 PID: 1657 Comm: apparmor_parser Not tainted 6.7.0-rc2-dirty #16 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:strlen+0x1e/0xa0 Call Trace: <TASK> ? strlen+0x1e/0xa0 aa_policy_init+0x1bb/0x230 aa_alloc_profile+0xb1/0x480 unpack_profile+0x3bc/0x4960 aa_unpack+0x309/0x15e0 aa_replace_profiles+0x213/0x33c0 policy_update+0x261/0x370 profile_replace+0x20e/0x2a0 vfs_write+0x2af/0xe00 ksys_write+0x126/0x250 do_syscall_64+0x46/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK> ---[ end trace 0000000000000000 ]--- RIP: 0010:strlen+0x1e/0xa0 It seems such behaviour of aa_splitn_fqname() is expected and checked in other places where it is called (e.g. aa_remove_profiles). Well, there is an explicit comment "a ns name without a following profile is allowed" inside. AFAICS, nothing can prevent unpacked "name" to be in form like ":samba-dcerpcd" - it is passed from userspace. Deny the whole profile set replacement in such case and inform user with EPROTO and an explaining message. Found by Linux Verification Center (linuxtesting.org) Fixes: 04dc715e24d0 ("apparmor: audit policy ns specified in policy load") Signed-off-by: Fedor Pchelkin <pchelkin(a)ispras.ru> Signed-off-by: John Johansen <john.johansen(a)canonical.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- security/apparmor/policy_unpack.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c index 10896d69c442..6c2a536173b5 100644 --- a/security/apparmor/policy_unpack.c +++ b/security/apparmor/policy_unpack.c @@ -696,6 +696,10 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name) tmpname = aa_splitn_fqname(name, strlen(name), &tmpns, &ns_len); if (tmpns) { + if (!tmpname) { + info = "empty profile name"; + goto fail; + } *ns_name = kstrndup(tmpns, ns_len, GFP_KERNEL); if (!*ns_name) { info = "out of memory"; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] perf/x86/lbr: Filter vsyscall addresses
by Luo Gengkun 05 Mar '24

05 Mar '24

From: JP Kobryn <inwardvessel(a)gmail.com> mainline inclusion from mainline-v6.6-rc6 commit e53899771a02f798d436655efbd9d4b46c0f9265 category: bugfix bugzilla: 189601 CVE: CVE-2023-52476 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- We found that a panic can occur when a vsyscall is made while LBR sampling is active. If the vsyscall is interrupted (NMI) for perf sampling, this call sequence can occur (most recent at top): __insn_get_emulate_prefix() insn_get_emulate_prefix() insn_get_prefixes() insn_get_opcode() decode_branch_type() get_branch_type() intel_pmu_lbr_filter() intel_pmu_handle_irq() perf_event_nmi_handler() Within __insn_get_emulate_prefix() at frame 0, a macro is called: peek_nbyte_next(insn_byte_t, insn, i) Within this macro, this dereference occurs: (insn)->next_byte Inspecting registers at this point, the value of the next_byte field is the address of the vsyscall made, for example the location of the vsyscall version of gettimeofday() at 0xffffffffff600000. The access to an address in the vsyscall region will trigger an oops due to an unhandled page fault. To fix the bug, filtering for vsyscalls can be done when determining the branch type. This patch will return a "none" branch if a kernel address if found to lie in the vsyscall region. Suggested-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: JP Kobryn <inwardvessel(a)gmail.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Cc: stable(a)vger.kernel.org Conflicts: arch/x86/events/utils.c Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/intel/lbr.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c index a3dc3b5bc78d..1fb1ede03c40 100644 --- a/arch/x86/events/intel/lbr.c +++ b/arch/x86/events/intel/lbr.c @@ -5,6 +5,7 @@ #include <asm/perf_event.h> #include <asm/msr.h> #include <asm/insn.h> +#include <linux/mm.h> #include "../perf_event.h" @@ -894,9 +895,9 @@ static int branch_type(unsigned long from, unsigned long to, int abort) * The LBR logs any address in the IP, even if the IP just * faulted. This means userspace can control the from address. * Ensure we don't blindy read any address by validating it is - * a known text address. + * a known text address and not a vsyscall address. */ - if (kernel_text_address(from)) { + if (kernel_text_address(from) && !in_gate_area_no_mm(from)) { addr = (void *)from; /* * Assume we can get the maximum possible size -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init
by Cai Xinchen 05 Mar '24

05 Mar '24

From: Tong Zhang <ztong0001(a)gmail.com> stable inclusion from stable-v4.19.191 commit 09d16cee6285d37cc76311c29add6d97a7e4acda category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94VOZ CVE: CVE-2021-47056 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 8609f5cfdc872fc3a462efa6a3eca5cb1e2f6446 ] ADF_STATUS_PF_RUNNING is (only) used and checked by adf_vf2pf_shutdown() before calling adf_iov_putmsg()->mutex_lock(vf2pf_lock), however the vf2pf_lock is initialized in adf_dev_init(), which can fail and when it fail, the vf2pf_lock is either not initialized or destroyed, a subsequent use of vf2pf_lock will cause issue. To fix this issue, only set this flag if adf_dev_init() returns 0. [ 7.178404] BUG: KASAN: user-memory-access in __mutex_lock.isra.0+0x1ac/0x7c0 [ 7.180345] Call Trace: [ 7.182576] mutex_lock+0xc9/0xd0 [ 7.183257] adf_iov_putmsg+0x118/0x1a0 [intel_qat] [ 7.183541] adf_vf2pf_shutdown+0x4d/0x7b [intel_qat] [ 7.183834] adf_dev_shutdown+0x172/0x2b0 [intel_qat] [ 7.184127] adf_probe+0x5e9/0x600 [qat_dh895xccvf] Signed-off-by: Tong Zhang <ztong0001(a)gmail.com> Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com> Fixes: 25c6ffb249f6 ("crypto: qat - check if PF is running") Acked-by: Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/crypto/qat/qat_c3xxxvf/adf_drv.c | 4 ++-- drivers/crypto/qat/qat_c62xvf/adf_drv.c | 4 ++-- drivers/crypto/qat/qat_dh895xccvf/adf_drv.c | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c index 613c7d5644ce..e87b7c466bdb 100644 --- a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c +++ b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c @@ -238,12 +238,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) if (ret) goto out_err_free_reg; - set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); - ret = adf_dev_init(accel_dev); if (ret) goto out_err_dev_shutdown; + set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); + ret = adf_dev_start(accel_dev); if (ret) goto out_err_dev_stop; diff --git a/drivers/crypto/qat/qat_c62xvf/adf_drv.c b/drivers/crypto/qat/qat_c62xvf/adf_drv.c index 278452b8ef81..a8f3f2ecae70 100644 --- a/drivers/crypto/qat/qat_c62xvf/adf_drv.c +++ b/drivers/crypto/qat/qat_c62xvf/adf_drv.c @@ -238,12 +238,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) if (ret) goto out_err_free_reg; - set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); - ret = adf_dev_init(accel_dev); if (ret) goto out_err_dev_shutdown; + set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); + ret = adf_dev_start(accel_dev); if (ret) goto out_err_dev_stop; diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c index 3da0f951cb59..1b954abf67fb 100644 --- a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c +++ b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c @@ -238,12 +238,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) if (ret) goto out_err_free_reg; - set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); - ret = adf_dev_init(accel_dev); if (ret) goto out_err_dev_shutdown; + set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); + ret = adf_dev_start(accel_dev); if (ret) goto out_err_dev_stop; -- 2.34.1

2 1

[PATCH] crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init
by Cai Xinchen 05 Mar '24

05 Mar '24

From: Tong Zhang <ztong0001(a)gmail.com> [ Upstream commit 8609f5cfdc872fc3a462efa6a3eca5cb1e2f6446 ] ADF_STATUS_PF_RUNNING is (only) used and checked by adf_vf2pf_shutdown() before calling adf_iov_putmsg()->mutex_lock(vf2pf_lock), however the vf2pf_lock is initialized in adf_dev_init(), which can fail and when it fail, the vf2pf_lock is either not initialized or destroyed, a subsequent use of vf2pf_lock will cause issue. To fix this issue, only set this flag if adf_dev_init() returns 0. [ 7.178404] BUG: KASAN: user-memory-access in __mutex_lock.isra.0+0x1ac/0x7c0 [ 7.180345] Call Trace: [ 7.182576] mutex_lock+0xc9/0xd0 [ 7.183257] adf_iov_putmsg+0x118/0x1a0 [intel_qat] [ 7.183541] adf_vf2pf_shutdown+0x4d/0x7b [intel_qat] [ 7.183834] adf_dev_shutdown+0x172/0x2b0 [intel_qat] [ 7.184127] adf_probe+0x5e9/0x600 [qat_dh895xccvf] Signed-off-by: Tong Zhang <ztong0001(a)gmail.com> Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com> Fixes: 25c6ffb249f6 ("crypto: qat - check if PF is running") Acked-by: Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/crypto/qat/qat_c3xxxvf/adf_drv.c | 4 ++-- drivers/crypto/qat/qat_c62xvf/adf_drv.c | 4 ++-- drivers/crypto/qat/qat_dh895xccvf/adf_drv.c | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c index 613c7d5644ce..e87b7c466bdb 100644 --- a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c +++ b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c @@ -238,12 +238,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) if (ret) goto out_err_free_reg; - set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); - ret = adf_dev_init(accel_dev); if (ret) goto out_err_dev_shutdown; + set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); + ret = adf_dev_start(accel_dev); if (ret) goto out_err_dev_stop; diff --git a/drivers/crypto/qat/qat_c62xvf/adf_drv.c b/drivers/crypto/qat/qat_c62xvf/adf_drv.c index 278452b8ef81..a8f3f2ecae70 100644 --- a/drivers/crypto/qat/qat_c62xvf/adf_drv.c +++ b/drivers/crypto/qat/qat_c62xvf/adf_drv.c @@ -238,12 +238,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) if (ret) goto out_err_free_reg; - set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); - ret = adf_dev_init(accel_dev); if (ret) goto out_err_dev_shutdown; + set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); + ret = adf_dev_start(accel_dev); if (ret) goto out_err_dev_stop; diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c index 3da0f951cb59..1b954abf67fb 100644 --- a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c +++ b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c @@ -238,12 +238,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) if (ret) goto out_err_free_reg; - set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); - ret = adf_dev_init(accel_dev); if (ret) goto out_err_dev_shutdown; + set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); + ret = adf_dev_start(accel_dev); if (ret) goto out_err_dev_stop; -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] vsock/virtio: free queued packets when closing socket
by Ziyang Xuan 05 Mar '24

05 Mar '24

From: Stefano Garzarella <sgarzare(a)redhat.com> mainline inclusion from mainline-v5.13-rc1 commit 8432b8114957235f42e070a16118a7f750de9d39 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94J63 CVE: CVE-2021-47024 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As reported by syzbot [1], there is a memory leak while closing the socket. We partially solved this issue with commit ac03046ece2b ("vsock/virtio: free packets during the socket release"), but we forgot to drain the RX queue when the socket is definitely closed by the scheduled work. To avoid future issues, let's use the new virtio_transport_remove_sock() to drain the RX queue before removing the socket from the af_vsock lists calling vsock_remove_sock(). [1] https://syzkaller.appspot.com/bug?extid=24452624fc4c571eedd9 Fixes: ac03046ece2b ("vsock/virtio: free packets during the socket release") Reported-and-tested-by: syzbot+24452624fc4c571eedd9(a)syzkaller.appspotmail.com Signed-off-by: Stefano Garzarella <sgarzare(a)redhat.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/vmw_vsock/virtio_transport_common.c Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/vmw_vsock/virtio_transport_common.c | 27 +++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-) diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c index 52242a148c70..f3f0a5714835 100644 --- a/net/vmw_vsock/virtio_transport_common.c +++ b/net/vmw_vsock/virtio_transport_common.c @@ -700,6 +700,23 @@ static int virtio_transport_reset_no_sock(struct virtio_vsock_pkt *pkt) return t->send_pkt(reply); } +/* This function should be called with sk_lock held and SOCK_DONE set */ +static void virtio_transport_remove_sock(struct vsock_sock *vsk) +{ + struct virtio_vsock_sock *vvs = vsk->trans; + struct virtio_vsock_pkt *pkt, *tmp; + + /* We don't need to take rx_lock, as the socket is closing and we are + * removing it. + */ + list_for_each_entry_safe(pkt, tmp, &vvs->rx_queue, list) { + list_del(&pkt->list); + virtio_transport_free_pkt(pkt); + } + + vsock_remove_sock(vsk); +} + static void virtio_transport_wait_close(struct sock *sk, long timeout) { if (timeout) { @@ -732,7 +749,7 @@ static void virtio_transport_do_close(struct vsock_sock *vsk, (!cancel_timeout || cancel_delayed_work(&vsk->close_work))) { vsk->close_work_scheduled = false; - vsock_remove_sock(vsk); + virtio_transport_remove_sock(vsk); /* Release refcnt obtained when we scheduled the timeout */ sock_put(sk); @@ -795,8 +812,6 @@ static bool virtio_transport_close(struct vsock_sock *vsk) void virtio_transport_release(struct vsock_sock *vsk) { - struct virtio_vsock_sock *vvs = vsk->trans; - struct virtio_vsock_pkt *pkt, *tmp; struct sock *sk = &vsk->sk; bool remove_sock = true; @@ -804,14 +819,10 @@ void virtio_transport_release(struct vsock_sock *vsk) if (sk->sk_type == SOCK_STREAM) remove_sock = virtio_transport_close(vsk); - list_for_each_entry_safe(pkt, tmp, &vvs->rx_queue, list) { - list_del(&pkt->list); - virtio_transport_free_pkt(pkt); - } release_sock(sk); if (remove_sock) - vsock_remove_sock(vsk); + virtio_transport_remove_sock(vsk); } EXPORT_SYMBOL_GPL(virtio_transport_release); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/1] i2c: validate user data in compat ioctl
by Hongbo Li 05 Mar '24

05 Mar '24

Fix CVE-2021-46934 Pavel Skripkin (1): i2c: validate user data in compat ioctl drivers/i2c/i2c-dev.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP2] arm64: head.S: always initialize PSTATE
by Li Zetao 05 Mar '24

05 Mar '24

From: Mark Rutland <mark.rutland(a)arm.com> mainline inclusion from mainline-v5.11-rc1 commit d87a8e65b5101123a24cddeb7a8a2c7b45f7b60c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I95U8R Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As with SCTLR_ELx and other control registers, some PSTATE bits are UNKNOWN out-of-reset, and we may not be able to rely on hardware or firmware to initialize them to our liking prior to entry to the kernel, e.g. in the primary/secondary boot paths and return from idle/suspend. It would be more robust (and easier to reason about) if we consistently initialized PSTATE to a default value, as we do with control registers. This will ensure that the kernel is not adversely affected by bits it is not aware of, e.g. when support for a feature such as PAN/UAO is disabled. This patch ensures that PSTATE is consistently initialized at boot time via an ERET. This is not intended to relax the existing requirements (e.g. DAIF bits must still be set prior to entering the kernel). For features detected dynamically (which may require system-wide support), it is still necessary to subsequently modify PSTATE. As ERET is not always a Context Synchronization Event, an ISB is placed before each exception return to ensure updates to control registers have taken effect. This handles the kernel being entered with SCTLR_ELx.EOS clear (or any future control bits being in an UNKNOWN state). Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: Christoph Hellwig <hch(a)lst.de> Cc: James Morse <james.morse(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Link: https://lore.kernel.org/r/20201113124937.20574-6-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Conflicts: arch/arm64/kernel/head.S Signed-off-by: Li Zetao <lizetao1(a)huawei.com> --- arch/arm64/include/asm/ptrace.h | 5 +++++ arch/arm64/kernel/head.S | 32 +++++++++++++++++++++----------- 2 files changed, 26 insertions(+), 11 deletions(-) diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h index 27fee85c3c2b..e58568f94b5e 100644 --- a/arch/arm64/include/asm/ptrace.h +++ b/arch/arm64/include/asm/ptrace.h @@ -16,6 +16,11 @@ #define CurrentEL_EL1 (1 << 2) #define CurrentEL_EL2 (2 << 2) +#define INIT_PSTATE_EL1 \ + (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL1h) +#define INIT_PSTATE_EL2 \ + (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL2h) + /* * PMR values used to mask/unmask interrupts. * diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S index b7a9f403ad2d..5fb9255fd5dd 100644 --- a/arch/arm64/kernel/head.S +++ b/arch/arm64/kernel/head.S @@ -486,21 +486,29 @@ EXPORT_SYMBOL(kimage_vaddr) * If we're fortunate enough to boot at EL2, ensure that the world is * sane before dropping to EL1. * + * Since we cannot always rely on ERET synchronizing writes to sysregs (e.g. if + * SCTLR_ELx.EOS is clear), we place an ISB prior to ERET. + * * Returns either BOOT_CPU_MODE_EL1 or BOOT_CPU_MODE_EL2 in w0 if * booted in EL1 or EL2 respectively. */ SYM_FUNC_START(el2_setup) - msr SPsel, #1 // We want to use SP_EL{1,2} mrs x0, CurrentEL cmp x0, #CurrentEL_EL2 - b.eq 1f + b.eq init_el2 + +SYM_INNER_LABEL(init_el1, SYM_L_LOCAL) mov_q x0, INIT_SCTLR_EL1_MMU_OFF msr sctlr_el1, x0 - mov w0, #BOOT_CPU_MODE_EL1 // This cpu booted in EL1 isb - ret + mov_q x0, INIT_PSTATE_EL1 + msr spsr_el1, x0 + msr elr_el1, lr + mov w0, #BOOT_CPU_MODE_EL1 + eret -1: mov_q x0, INIT_SCTLR_EL2_MMU_OFF +SYM_INNER_LABEL(init_el2, SYM_L_LOCAL) + mov_q x0, INIT_SCTLR_EL2_MMU_OFF msr sctlr_el2, x0 #ifdef CONFIG_ARM64_VHE @@ -609,9 +617,12 @@ set_hcr: cbz x2, install_el2_stub - mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 isb - ret + mov_q x0, INIT_PSTATE_EL2 + msr spsr_el2, x0 + msr elr_el2, lr + mov w0, #BOOT_CPU_MODE_EL2 + eret SYM_INNER_LABEL(install_el2_stub, SYM_L_LOCAL) /* @@ -643,12 +654,11 @@ SYM_INNER_LABEL(install_el2_stub, SYM_L_LOCAL) 7: adr_l x0, __hyp_stub_vectors msr vbar_el2, x0 - /* spsr */ - mov x0, #(PSR_F_BIT | PSR_I_BIT | PSR_A_BIT | PSR_D_BIT |\ - PSR_MODE_EL1h) + isb + mov x0, #INIT_PSTATE_EL1 msr spsr_el2, x0 msr elr_el2, lr - mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 + mov w0, #BOOT_CPU_MODE_EL2 eret SYM_FUNC_END(el2_setup) -- 2.34.1

2 1

[PATCH OLK-5.10] scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
by Li Lingfeng 05 Mar '24

05 Mar '24

From: Michal Grzedzicki <mge(a)meta.com> mainline inclusion from mainline-v6.6-rc2 commit c13e7331745852d0dd7c35eabbe181cbd5b01172 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B2S CVE: CVE-2023-52500 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Tags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed when we receive the response. Signed-off-by: Michal Grzedzicki <mge(a)meta.com> Link: https://lore.kernel.org/r/20230911170340.699533-2-mge@meta.com Acked-by: Jack Wang <jinpu.wang(a)ionos.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/scsi/pm8001/pm80xx_hwi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c index 51345f02383d..bb9cab064375 100644 --- a/drivers/scsi/pm8001/pm80xx_hwi.c +++ b/drivers/scsi/pm8001/pm80xx_hwi.c @@ -3731,10 +3731,12 @@ static int mpi_set_controller_config_resp(struct pm8001_hba_info *pm8001_ha, (struct set_ctrl_cfg_resp *)(piomb + 4); u32 status = le32_to_cpu(pPayload->status); u32 err_qlfr_pgcd = le32_to_cpu(pPayload->err_qlfr_pgcd); + u32 tag = le32_to_cpu(pPayload->tag); pm8001_dbg(pm8001_ha, MSG, "SET CONTROLLER RESP: status 0x%x qlfr_pgcd 0x%x\n", status, err_qlfr_pgcd); + pm8001_tag_free(pm8001_ha, tag); return 0; } -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
by Dong Chenchen 05 Mar '24

05 Mar '24

From: Tony Lindgren <tony(a)atomide.com> stable inclusion from stable-v4.19.306 commit 486218c11e8d1c8f515a3bdd70d62203609d4b6b category: bugfix bugzilla: 189592, https://gitee.com/src-openeuler/kernel/issues/I93HCX CVE: CVE-2024-26600 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7104ba0f1958adb250319e68a15eff89ec4fd36d ] If the external phy working together with phy-omap-usb2 does not implement send_srp(), we may still attempt to call it. This can happen on an idle Ethernet gadget triggering a wakeup for example: configfs-gadget.g1 gadget.0: ECM Suspend configfs-gadget.g1 gadget.0: Port suspended. Triggering wakeup ... Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute ... PC is at 0x0 LR is at musb_gadget_wakeup+0x1d4/0x254 [musb_hdrc] ... musb_gadget_wakeup [musb_hdrc] from usb_gadget_wakeup+0x1c/0x3c [udc_core] usb_gadget_wakeup [udc_core] from eth_start_xmit+0x3b0/0x3d4 [u_ether] eth_start_xmit [u_ether] from dev_hard_start_xmit+0x94/0x24c dev_hard_start_xmit from sch_direct_xmit+0x104/0x2e4 sch_direct_xmit from __dev_queue_xmit+0x334/0xd88 __dev_queue_xmit from arp_solicit+0xf0/0x268 arp_solicit from neigh_probe+0x54/0x7c neigh_probe from __neigh_event_send+0x22c/0x47c __neigh_event_send from neigh_resolve_output+0x14c/0x1c0 neigh_resolve_output from ip_finish_output2+0x1c8/0x628 ip_finish_output2 from ip_send_skb+0x40/0xd8 ip_send_skb from udp_send_skb+0x124/0x340 udp_send_skb from udp_sendmsg+0x780/0x984 udp_sendmsg from __sys_sendto+0xd8/0x158 __sys_sendto from ret_fast_syscall+0x0/0x58 Let's fix the issue by checking for send_srp() and set_vbus() before calling them. For USB peripheral only cases these both could be NULL. Fixes: 657b306a7bdf ("usb: phy: add a new driver for omap usb2 phy") Signed-off-by: Tony Lindgren <tony(a)atomide.com> Link: https://lore.kernel.org/r/20240128120556.8848-1-tony@atomide.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/phy/ti/phy-omap-usb2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/phy/ti/phy-omap-usb2.c b/drivers/phy/ti/phy-omap-usb2.c index fe909fd8144f..ae94e1e66bcc 100644 --- a/drivers/phy/ti/phy-omap-usb2.c +++ b/drivers/phy/ti/phy-omap-usb2.c @@ -64,7 +64,7 @@ static int omap_usb_set_vbus(struct usb_otg *otg, bool enabled) { struct omap_usb *phy = phy_to_omapusb(otg->usb_phy); - if (!phy->comparator) + if (!phy->comparator || !phy->comparator->set_vbus) return -ENODEV; return phy->comparator->set_vbus(phy->comparator, enabled); @@ -74,7 +74,7 @@ static int omap_usb_start_srp(struct usb_otg *otg) { struct omap_usb *phy = phy_to_omapusb(otg->usb_phy); - if (!phy->comparator) + if (!phy->comparator || !phy->comparator->start_srp) return -ENODEV; return phy->comparator->start_srp(phy->comparator); -- 2.25.1

2 1

[PATCH OLK-5.10] phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
by Dong Chenchen 05 Mar '24

05 Mar '24

From: Tony Lindgren <tony(a)atomide.com> stable inclusion from stable-v5.10.209 commit be3b82e4871ba00e9b5d0ede92d396d579d7b3b3 category: bugfix bugzilla: 189592, https://gitee.com/src-openeuler/kernel/issues/I93HCX CVE: CVE-2024-26600 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7104ba0f1958adb250319e68a15eff89ec4fd36d ] If the external phy working together with phy-omap-usb2 does not implement send_srp(), we may still attempt to call it. This can happen on an idle Ethernet gadget triggering a wakeup for example: configfs-gadget.g1 gadget.0: ECM Suspend configfs-gadget.g1 gadget.0: Port suspended. Triggering wakeup ... Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute ... PC is at 0x0 LR is at musb_gadget_wakeup+0x1d4/0x254 [musb_hdrc] ... musb_gadget_wakeup [musb_hdrc] from usb_gadget_wakeup+0x1c/0x3c [udc_core] usb_gadget_wakeup [udc_core] from eth_start_xmit+0x3b0/0x3d4 [u_ether] eth_start_xmit [u_ether] from dev_hard_start_xmit+0x94/0x24c dev_hard_start_xmit from sch_direct_xmit+0x104/0x2e4 sch_direct_xmit from __dev_queue_xmit+0x334/0xd88 __dev_queue_xmit from arp_solicit+0xf0/0x268 arp_solicit from neigh_probe+0x54/0x7c neigh_probe from __neigh_event_send+0x22c/0x47c __neigh_event_send from neigh_resolve_output+0x14c/0x1c0 neigh_resolve_output from ip_finish_output2+0x1c8/0x628 ip_finish_output2 from ip_send_skb+0x40/0xd8 ip_send_skb from udp_send_skb+0x124/0x340 udp_send_skb from udp_sendmsg+0x780/0x984 udp_sendmsg from __sys_sendto+0xd8/0x158 __sys_sendto from ret_fast_syscall+0x0/0x58 Let's fix the issue by checking for send_srp() and set_vbus() before calling them. For USB peripheral only cases these both could be NULL. Fixes: 657b306a7bdf ("usb: phy: add a new driver for omap usb2 phy") Signed-off-by: Tony Lindgren <tony(a)atomide.com> Link: https://lore.kernel.org/r/20240128120556.8848-1-tony@atomide.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/phy/ti/phy-omap-usb2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/phy/ti/phy-omap-usb2.c b/drivers/phy/ti/phy-omap-usb2.c index f77ac041d836..95e72f7a3199 100644 --- a/drivers/phy/ti/phy-omap-usb2.c +++ b/drivers/phy/ti/phy-omap-usb2.c @@ -116,7 +116,7 @@ static int omap_usb_set_vbus(struct usb_otg *otg, bool enabled) { struct omap_usb *phy = phy_to_omapusb(otg->usb_phy); - if (!phy->comparator) + if (!phy->comparator || !phy->comparator->set_vbus) return -ENODEV; return phy->comparator->set_vbus(phy->comparator, enabled); @@ -126,7 +126,7 @@ static int omap_usb_start_srp(struct usb_otg *otg) { struct omap_usb *phy = phy_to_omapusb(otg->usb_phy); - if (!phy->comparator) + if (!phy->comparator || !phy->comparator->start_srp) return -ENODEV; return phy->comparator->start_srp(phy->comparator); -- 2.25.1

2 1

[PATCH OLK-6.6] erofs: fix lz4 inplace decompression
by Zizhi Wo 05 Mar '24

05 Mar '24

From: Gao Xiang <hsiangkao(a)linux.alibaba.com> stable inclusion from stable-v6.6.15 commit f36d200a80a3ca025532ed60dd1ac21b620e14ae category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I956BV CVE: CVE-2023-52497 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3c12466b6b7bf1e56f9b32c366a3d83d87afb4de upstream. Currently EROFS can map another compressed buffer for inplace decompression, that was used to handle the cases that some pages of compressed data are actually not in-place I/O. However, like most simple LZ77 algorithms, LZ4 expects the compressed data is arranged at the end of the decompressed buffer and it explicitly uses memmove() to handle overlapping: __________________________________________________________ |_ direction of decompression --> ____ |_ compressed data _| Although EROFS arranges compressed data like this, it typically maps two individual virtual buffers so the relative order is uncertain. Previously, it was hardly observed since LZ4 only uses memmove() for short overlapped literals and x86/arm64 memmove implementations seem to completely cover it up and they don't have this issue. Juhyung reported that EROFS data corruption can be found on a new Intel x86 processor. After some analysis, it seems that recent x86 processors with the new FSRM feature expose this issue with "rep movsb". Let's strictly use the decompressed buffer for lz4 inplace decompression for now. Later, as an useful improvement, we could try to tie up these two buffers together in the correct order. Reported-and-tested-by: Juhyung Park <qkrwngud825(a)gmail.com> Closes: https://lore.kernel.org/r/CAD14+f2AVKf8Fa2OO1aAUdDNTDsVzzR6ctU_oJSmTyd6zSYR… Fixes: 0ffd71bcc3a0 ("staging: erofs: introduce LZ4 decompression inplace") Fixes: 598162d05080 ("erofs: support decompress big pcluster for lz4 backend") Cc: stable <stable(a)vger.kernel.org> # 5.4+ Tested-by: Yifan Zhao <zhaoyifan(a)sjtu.edu.cn> Signed-off-by: Gao Xiang <hsiangkao(a)linux.alibaba.com> Link: https://lore.kernel.org/r/20231206045534.3920847-1-hsiangkao@linux.alibaba.… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/erofs/decompressor.c | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c index 8d1f86487d6e..d36b3963c0bf 100644 --- a/fs/erofs/decompressor.c +++ b/fs/erofs/decompressor.c @@ -122,11 +122,11 @@ static int z_erofs_lz4_prepare_dstpages(struct z_erofs_lz4_decompress_ctx *ctx, } static void *z_erofs_lz4_handle_overlap(struct z_erofs_lz4_decompress_ctx *ctx, - void *inpage, unsigned int *inputmargin, int *maptype, - bool may_inplace) + void *inpage, void *out, unsigned int *inputmargin, + int *maptype, bool may_inplace) { struct z_erofs_decompress_req *rq = ctx->rq; - unsigned int omargin, total, i, j; + unsigned int omargin, total, i; struct page **in; void *src, *tmp; @@ -136,12 +136,13 @@ static void *z_erofs_lz4_handle_overlap(struct z_erofs_lz4_decompress_ctx *ctx, omargin < LZ4_DECOMPRESS_INPLACE_MARGIN(rq->inputsize)) goto docopy; - for (i = 0; i < ctx->inpages; ++i) { - DBG_BUGON(rq->in[i] == NULL); - for (j = 0; j < ctx->outpages - ctx->inpages + i; ++j) - if (rq->out[j] == rq->in[i]) - goto docopy; - } + for (i = 0; i < ctx->inpages; ++i) + if (rq->out[ctx->outpages - ctx->inpages + i] != + rq->in[i]) + goto docopy; + kunmap_local(inpage); + *maptype = 3; + return out + ((ctx->outpages - ctx->inpages) << PAGE_SHIFT); } if (ctx->inpages <= 1) { @@ -149,7 +150,6 @@ static void *z_erofs_lz4_handle_overlap(struct z_erofs_lz4_decompress_ctx *ctx, return inpage; } kunmap_local(inpage); - might_sleep(); src = erofs_vm_map_ram(rq->in, ctx->inpages); if (!src) return ERR_PTR(-ENOMEM); @@ -205,12 +205,12 @@ int z_erofs_fixup_insize(struct z_erofs_decompress_req *rq, const char *padbuf, } static int z_erofs_lz4_decompress_mem(struct z_erofs_lz4_decompress_ctx *ctx, - u8 *out) + u8 *dst) { struct z_erofs_decompress_req *rq = ctx->rq; bool support_0padding = false, may_inplace = false; unsigned int inputmargin; - u8 *headpage, *src; + u8 *out, *headpage, *src; int ret, maptype; DBG_BUGON(*rq->in == NULL); @@ -231,11 +231,12 @@ static int z_erofs_lz4_decompress_mem(struct z_erofs_lz4_decompress_ctx *ctx, } inputmargin = rq->pageofs_in; - src = z_erofs_lz4_handle_overlap(ctx, headpage, &inputmargin, + src = z_erofs_lz4_handle_overlap(ctx, headpage, dst, &inputmargin, &maptype, may_inplace); if (IS_ERR(src)) return PTR_ERR(src); + out = dst + rq->pageofs_out; /* legacy format could compress extra data in a pcluster. */ if (rq->partial_decoding || !support_0padding) ret = LZ4_decompress_safe_partial(src + inputmargin, out, @@ -266,7 +267,7 @@ static int z_erofs_lz4_decompress_mem(struct z_erofs_lz4_decompress_ctx *ctx, vm_unmap_ram(src, ctx->inpages); } else if (maptype == 2) { erofs_put_pcpubuf(src); - } else { + } else if (maptype != 3) { DBG_BUGON(1); return -EFAULT; } @@ -309,7 +310,7 @@ static int z_erofs_lz4_decompress(struct z_erofs_decompress_req *rq, } dstmap_out: - ret = z_erofs_lz4_decompress_mem(&ctx, dst + rq->pageofs_out); + ret = z_erofs_lz4_decompress_mem(&ctx, dst); if (!dst_maptype) kunmap_local(dst); else if (dst_maptype == 2) -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
by Li Lingfeng 05 Mar '24

05 Mar '24

From: Michal Grzedzicki <mge(a)meta.com> mainline inclusion from mainline-v6.6-rc2 commit c13e7331745852d0dd7c35eabbe181cbd5b01172 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B2S CVE: CVE-2023-52500 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Tags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed when we receive the response. Signed-off-by: Michal Grzedzicki <mge(a)meta.com> Link: https://lore.kernel.org/r/20230911170340.699533-2-mge@meta.com Acked-by: Jack Wang <jinpu.wang(a)ionos.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/scsi/pm8001/pm80xx_hwi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c index 8627feb80261..327992fbb553 100644 --- a/drivers/scsi/pm8001/pm80xx_hwi.c +++ b/drivers/scsi/pm8001/pm80xx_hwi.c @@ -3418,10 +3418,12 @@ static int mpi_set_controller_config_resp(struct pm8001_hba_info *pm8001_ha, (struct set_ctrl_cfg_resp *)(piomb + 4); u32 status = le32_to_cpu(pPayload->status); u32 err_qlfr_pgcd = le32_to_cpu(pPayload->err_qlfr_pgcd); + u32 tag = le32_to_cpu(pPayload->tag); PM8001_MSG_DBG(pm8001_ha, pm8001_printk( "SET CONTROLLER RESP: status 0x%x qlfr_pgcd 0x%x\n", status, err_qlfr_pgcd)); + pm8001_tag_free(pm8001_ha, tag); return 0; } -- 2.31.1

2 1

[PATCH OLK-5.10] drm/bridge: sii902x: Fix probing race issue
by Ye Bin 05 Mar '24

05 Mar '24

From: Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> mainline inclusion from mainline-v6.8-rc2 commit 08ac6f132dd77e40f786d8af51140c96c6d739c9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94UOT Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A null pointer dereference crash has been observed rarely on TI platforms using sii9022 bridge: [ 53.271356] sii902x_get_edid+0x34/0x70 [sii902x] [ 53.276066] sii902x_bridge_get_edid+0x14/0x20 [sii902x] [ 53.281381] drm_bridge_get_edid+0x20/0x34 [drm] [ 53.286305] drm_bridge_connector_get_modes+0x8c/0xcc [drm_kms_helper] [ 53.292955] drm_helper_probe_single_connector_modes+0x190/0x538 [drm_kms_helper] [ 53.300510] drm_client_modeset_probe+0x1f0/0xbd4 [drm] [ 53.305958] __drm_fb_helper_initial_config_and_unlock+0x50/0x510 [drm_kms_helper] [ 53.313611] drm_fb_helper_initial_config+0x48/0x58 [drm_kms_helper] [ 53.320039] drm_fbdev_dma_client_hotplug+0x84/0xd4 [drm_dma_helper] [ 53.326401] drm_client_register+0x5c/0xa0 [drm] [ 53.331216] drm_fbdev_dma_setup+0xc8/0x13c [drm_dma_helper] [ 53.336881] tidss_probe+0x128/0x264 [tidss] [ 53.341174] platform_probe+0x68/0xc4 [ 53.344841] really_probe+0x188/0x3c4 [ 53.348501] __driver_probe_device+0x7c/0x16c [ 53.352854] driver_probe_device+0x3c/0x10c [ 53.357033] __device_attach_driver+0xbc/0x158 [ 53.361472] bus_for_each_drv+0x88/0xe8 [ 53.365303] __device_attach+0xa0/0x1b4 [ 53.369135] device_initial_probe+0x14/0x20 [ 53.373314] bus_probe_device+0xb0/0xb4 [ 53.377145] deferred_probe_work_func+0xcc/0x124 [ 53.381757] process_one_work+0x1f0/0x518 [ 53.385770] worker_thread+0x1e8/0x3dc [ 53.389519] kthread+0x11c/0x120 [ 53.392750] ret_from_fork+0x10/0x20 The issue here is as follows: - tidss probes, but is deferred as sii902x is still missing. - sii902x starts probing and enters sii902x_init(). - sii902x calls drm_bridge_add(). Now the sii902x bridge is ready from DRM's perspective. - sii902x calls sii902x_audio_codec_init() and platform_device_register_data() - The registration of the audio platform device causes probing of the deferred devices. - tidss probes, which eventually causes sii902x_bridge_get_edid() to be called. - sii902x_bridge_get_edid() tries to use the i2c to read the edid. However, the sii902x driver has not set up the i2c part yet, leading to the crash. Fix this by moving the drm_bridge_add() to the end of the sii902x_init(), which is also at the very end of sii902x_probe(). Signed-off-by: Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> Fixes: 21d808405fe4 ("drm/bridge/sii902x: Fix EDID readback") Acked-by: Linus Walleij <linus.walleij(a)linaro.org> Link: https://lore.kernel.org/r/20240103-si902x-fixes-v1-1-b9fd3e448411@ideasonbo… Signed-off-by: Neil Armstrong <neil.armstrong(a)linaro.org> Link: https://patchwork.freedesktop.org/patch/msgid/20240103-si902x-fixes-v1-1-b9… Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/gpu/drm/bridge/sii902x.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/bridge/sii902x.c b/drivers/gpu/drm/bridge/sii902x.c index 89558e581530..a3e7b7edb555 100644 --- a/drivers/gpu/drm/bridge/sii902x.c +++ b/drivers/gpu/drm/bridge/sii902x.c @@ -998,11 +998,6 @@ static int sii902x_init(struct sii902x *sii902x) return ret; } - sii902x->bridge.funcs = &sii902x_bridge_funcs; - sii902x->bridge.of_node = dev->of_node; - sii902x->bridge.timings = &default_sii902x_timings; - drm_bridge_add(&sii902x->bridge); - sii902x_audio_codec_init(sii902x, dev); i2c_set_clientdata(sii902x->i2c, sii902x); @@ -1015,7 +1010,16 @@ static int sii902x_init(struct sii902x *sii902x) return -ENOMEM; sii902x->i2cmux->priv = sii902x; - return i2c_mux_add_adapter(sii902x->i2cmux, 0, 0, 0); + ret = i2c_mux_add_adapter(sii902x->i2cmux, 0, 0, 0); + if (ret) + return ret; + + sii902x->bridge.funcs = &sii902x_bridge_funcs; + sii902x->bridge.of_node = dev->of_node; + sii902x->bridge.timings = &default_sii902x_timings; + drm_bridge_add(&sii902x->bridge); + + return 0; } static int sii902x_probe(struct i2c_client *client, @@ -1079,8 +1083,8 @@ static int sii902x_remove(struct i2c_client *client) { struct sii902x *sii902x = i2c_get_clientdata(client); - i2c_mux_del_adapters(sii902x->i2cmux); drm_bridge_remove(&sii902x->bridge); + i2c_mux_del_adapters(sii902x->i2cmux); regulator_bulk_disable(ARRAY_SIZE(sii902x->supplies), sii902x->supplies); -- 2.31.1

2 1

[PATCH v2 openEuler-1.0-LTS] bpf: Annotate bpf_long_memcpy with data_race
by Pu Lehui 04 Mar '24

04 Mar '24

From: Daniel Borkmann <daniel(a)iogearbox.net> mainline inclusion from mainline-v6.6-rc1 commit 6a86b5b5cd76d2734304a0173f5f01aa8aa2025e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AWP CVE: CVE-2023-52521 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported a data race splat between two processes trying to update the same BPF map value via syscall on different CPUs: BUG: KCSAN: data-race in bpf_percpu_array_update / bpf_percpu_array_update write to 0xffffe8fffe7425d8 of 8 bytes by task 8257 on cpu 1: bpf_long_memcpy include/linux/bpf.h:428 [inline] bpf_obj_memcpy include/linux/bpf.h:441 [inline] copy_map_value_long include/linux/bpf.h:464 [inline] bpf_percpu_array_update+0x3bb/0x500 kernel/bpf/arraymap.c:380 bpf_map_update_value+0x190/0x370 kernel/bpf/syscall.c:175 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1749 bpf_map_do_batch+0x2df/0x3d0 kernel/bpf/syscall.c:4648 __sys_bpf+0x28a/0x780 __do_sys_bpf kernel/bpf/syscall.c:5241 [inline] __se_sys_bpf kernel/bpf/syscall.c:5239 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5239 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd write to 0xffffe8fffe7425d8 of 8 bytes by task 8268 on cpu 0: bpf_long_memcpy include/linux/bpf.h:428 [inline] bpf_obj_memcpy include/linux/bpf.h:441 [inline] copy_map_value_long include/linux/bpf.h:464 [inline] bpf_percpu_array_update+0x3bb/0x500 kernel/bpf/arraymap.c:380 bpf_map_update_value+0x190/0x370 kernel/bpf/syscall.c:175 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1749 bpf_map_do_batch+0x2df/0x3d0 kernel/bpf/syscall.c:4648 __sys_bpf+0x28a/0x780 __do_sys_bpf kernel/bpf/syscall.c:5241 [inline] __se_sys_bpf kernel/bpf/syscall.c:5239 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5239 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x0000000000000000 -> 0xfffffff000002788 The bpf_long_memcpy is used with 8-byte aligned pointers, power-of-8 size and forced to use long read/writes to try to atomically copy long counters. It is best-effort only and no barriers are here since it _will_ race with concurrent updates from BPF programs. The bpf_long_memcpy() is called from bpf(2) syscall. Marco suggested that the best way to make this known to KCSAN would be to use data_race() annotation. Reported-by: syzbot+97522333291430dd277f(a)syzkaller.appspotmail.com Suggested-by: Marco Elver <elver(a)google.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Marco Elver <elver(a)google.com> Link: https://lore.kernel.org/bpf/000000000000d87a7f06040c970c@google.com Link: https://lore.kernel.org/bpf/57628f7a15e20d502247c3b55fceb1cb2b31f266.169334… Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- include/linux/bpf.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 30fcf812df9d..cb0b31f5857d 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -511,7 +511,7 @@ static inline void bpf_long_memcpy(void *dst, const void *src, u32 size) size /= sizeof(long); while (size--) - *ldst++ = *lsrc++; + data_race(*ldst++ = *lsrc++); } /* verify correctness of eBPF program */ -- 2.34.1

2 1

[PATCH OLK-5.10 v2 0/2] btrfs: do not ASSERT() if the newly created subvolume already got read
by Long Li 04 Mar '24

04 Mar '24

This patch set fix CVE-2024-23850. Filipe Manana (1): btrfs: fix double free of anonymous device after snapshot creation failure Qu Wenruo (1): btrfs: do not ASSERT() if the newly created subvolume already got read fs/btrfs/disk-io.c | 29 +++++++++++++++++++---------- fs/btrfs/disk-io.h | 2 +- fs/btrfs/ioctl.c | 2 +- fs/btrfs/transaction.c | 2 +- 4 files changed, 22 insertions(+), 13 deletions(-) -- 2.31.1

2 3

[PATCH openEuler-1.0-LTS] bpf: Annotate bpf_long_memcpy with data_race
by Pu Lehui 04 Mar '24

04 Mar '24

From: Daniel Borkmann <daniel(a)iogearbox.net> mainline inclusion from mainline-v6.6-rc1 commit 6a86b5b5cd76d2734304a0173f5f01aa8aa2025e category: bugfix bugzilla: 189600 CVE: CVE-2023-52521 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported a data race splat between two processes trying to update the same BPF map value via syscall on different CPUs: BUG: KCSAN: data-race in bpf_percpu_array_update / bpf_percpu_array_update write to 0xffffe8fffe7425d8 of 8 bytes by task 8257 on cpu 1: bpf_long_memcpy include/linux/bpf.h:428 [inline] bpf_obj_memcpy include/linux/bpf.h:441 [inline] copy_map_value_long include/linux/bpf.h:464 [inline] bpf_percpu_array_update+0x3bb/0x500 kernel/bpf/arraymap.c:380 bpf_map_update_value+0x190/0x370 kernel/bpf/syscall.c:175 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1749 bpf_map_do_batch+0x2df/0x3d0 kernel/bpf/syscall.c:4648 __sys_bpf+0x28a/0x780 __do_sys_bpf kernel/bpf/syscall.c:5241 [inline] __se_sys_bpf kernel/bpf/syscall.c:5239 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5239 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd write to 0xffffe8fffe7425d8 of 8 bytes by task 8268 on cpu 0: bpf_long_memcpy include/linux/bpf.h:428 [inline] bpf_obj_memcpy include/linux/bpf.h:441 [inline] copy_map_value_long include/linux/bpf.h:464 [inline] bpf_percpu_array_update+0x3bb/0x500 kernel/bpf/arraymap.c:380 bpf_map_update_value+0x190/0x370 kernel/bpf/syscall.c:175 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1749 bpf_map_do_batch+0x2df/0x3d0 kernel/bpf/syscall.c:4648 __sys_bpf+0x28a/0x780 __do_sys_bpf kernel/bpf/syscall.c:5241 [inline] __se_sys_bpf kernel/bpf/syscall.c:5239 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5239 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x0000000000000000 -> 0xfffffff000002788 The bpf_long_memcpy is used with 8-byte aligned pointers, power-of-8 size and forced to use long read/writes to try to atomically copy long counters. It is best-effort only and no barriers are here since it _will_ race with concurrent updates from BPF programs. The bpf_long_memcpy() is called from bpf(2) syscall. Marco suggested that the best way to make this known to KCSAN would be to use data_race() annotation. Reported-by: syzbot+97522333291430dd277f(a)syzkaller.appspotmail.com Suggested-by: Marco Elver <elver(a)google.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Marco Elver <elver(a)google.com> Link: https://lore.kernel.org/bpf/000000000000d87a7f06040c970c@google.com Link: https://lore.kernel.org/bpf/57628f7a15e20d502247c3b55fceb1cb2b31f266.169334… Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- include/linux/bpf.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 30fcf812df9d..cb0b31f5857d 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -511,7 +511,7 @@ static inline void bpf_long_memcpy(void *dst, const void *src, u32 size) size /= sizeof(long); while (size--) - *ldst++ = *lsrc++; + data_race(*ldst++ = *lsrc++); } /* verify correctness of eBPF program */ -- 2.34.1

2 1

[PATCH OLK-5.10] mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()
by Ze Zuo 04 Mar '24

04 Mar '24

From: Jinjie Ruan <ruanjinjie(a)huawei.com> mainline inclusion from mainline-v6.6-rc4 commit 45120b15743fa7c0aa53d5db6dfb4c8f87be4abd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95ATG CVE: CVE-2023-52560 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When CONFIG_DAMON_VADDR_KUNIT_TEST=y and making CONFIG_DEBUG_KMEMLEAK=y and CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN=y, the below memory leak is detected. Since commit 9f86d624292c ("mm/damon/vaddr-test: remove unnecessary variables"), the damon_destroy_ctx() is removed, but still call damon_new_target() and damon_new_region(), the damon_region which is allocated by kmem_cache_alloc() in damon_new_region() and the damon_target which is allocated by kmalloc in damon_new_target() are not freed. And the damon_region which is allocated in damon_new_region() in damon_set_regions() is also not freed. So use damon_destroy_target to free all the damon_regions and damon_target. unreferenced object 0xffff888107c9a940 (size 64): comm "kunit_try_catch", pid 1069, jiffies 4294670592 (age 732.761s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 06 00 00 00 6b 6b 6b 6b ............kkkk 60 c7 9c 07 81 88 ff ff f8 cb 9c 07 81 88 ff ff `............... backtrace: [<ffffffff817e0167>] kmalloc_trace+0x27/0xa0 [<ffffffff819c11cf>] damon_new_target+0x3f/0x1b0 [<ffffffff819c7d55>] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0 [<ffffffff819c82be>] damon_test_apply_three_regions1+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff8881079cc740 (size 56): comm "kunit_try_catch", pid 1069, jiffies 4294670592 (age 732.761s) hex dump (first 32 bytes): 05 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 ................ 6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk backtrace: [<ffffffff819bc492>] damon_new_region+0x22/0x1c0 [<ffffffff819c7d91>] damon_do_test_apply_three_regions.constprop.0+0xd1/0x3e0 [<ffffffff819c82be>] damon_test_apply_three_regions1+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff888107c9ac40 (size 64): comm "kunit_try_catch", pid 1071, jiffies 4294670595 (age 732.843s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 06 00 00 00 6b 6b 6b 6b ............kkkk a0 cc 9c 07 81 88 ff ff 78 a1 76 07 81 88 ff ff ........x.v..... backtrace: [<ffffffff817e0167>] kmalloc_trace+0x27/0xa0 [<ffffffff819c11cf>] damon_new_target+0x3f/0x1b0 [<ffffffff819c7d55>] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0 [<ffffffff819c851e>] damon_test_apply_three_regions2+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff8881079ccc80 (size 56): comm "kunit_try_catch", pid 1071, jiffies 4294670595 (age 732.843s) hex dump (first 32 bytes): 05 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 ................ 6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk backtrace: [<ffffffff819bc492>] damon_new_region+0x22/0x1c0 [<ffffffff819c7d91>] damon_do_test_apply_three_regions.constprop.0+0xd1/0x3e0 [<ffffffff819c851e>] damon_test_apply_three_regions2+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff888107c9af40 (size 64): comm "kunit_try_catch", pid 1073, jiffies 4294670597 (age 733.011s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 06 00 00 00 6b 6b 6b 6b ............kkkk 20 a2 76 07 81 88 ff ff b8 a6 76 07 81 88 ff ff .v.......v..... backtrace: [<ffffffff817e0167>] kmalloc_trace+0x27/0xa0 [<ffffffff819c11cf>] damon_new_target+0x3f/0x1b0 [<ffffffff819c7d55>] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0 [<ffffffff819c877e>] damon_test_apply_three_regions3+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff88810776a200 (size 56): comm "kunit_try_catch", pid 1073, jiffies 4294670597 (age 733.011s) hex dump (first 32 bytes): 05 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 ................ 6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk backtrace: [<ffffffff819bc492>] damon_new_region+0x22/0x1c0 [<ffffffff819c7d91>] damon_do_test_apply_three_regions.constprop.0+0xd1/0x3e0 [<ffffffff819c877e>] damon_test_apply_three_regions3+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff88810776a740 (size 56): comm "kunit_try_catch", pid 1073, jiffies 4294670597 (age 733.025s) hex dump (first 32 bytes): 3d 00 00 00 00 00 00 00 3f 00 00 00 00 00 00 00 =.......?....... 6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk backtrace: [<ffffffff819bc492>] damon_new_region+0x22/0x1c0 [<ffffffff819bfcc2>] damon_set_regions+0x4c2/0x8e0 [<ffffffff819c7dbb>] damon_do_test_apply_three_regions.constprop.0+0xfb/0x3e0 [<ffffffff819c877e>] damon_test_apply_three_regions3+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff888108038240 (size 64): comm "kunit_try_catch", pid 1075, jiffies 4294670600 (age 733.022s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 03 00 00 00 6b 6b 6b 6b ............kkkk 48 ad 76 07 81 88 ff ff 98 ae 76 07 81 88 ff ff H.v.......v..... backtrace: [<ffffffff817e0167>] kmalloc_trace+0x27/0xa0 [<ffffffff819c11cf>] damon_new_target+0x3f/0x1b0 [<ffffffff819c7d55>] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0 [<ffffffff819c898d>] damon_test_apply_three_regions4+0x1cd/0x210 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff88810776ad28 (size 56): comm "kunit_try_catch", pid 1075, jiffies 4294670600 (age 733.022s) hex dump (first 32 bytes): 05 00 00 00 00 00 00 00 07 00 00 00 00 00 00 00 ................ 6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk backtrace: [<ffffffff819bc492>] damon_new_region+0x22/0x1c0 [<ffffffff819bfcc2>] damon_set_regions+0x4c2/0x8e0 [<ffffffff819c7dbb>] damon_do_test_apply_three_regions.constprop.0+0xfb/0x3e0 [<ffffffff819c898d>] damon_test_apply_three_regions4+0x1cd/0x210 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 Link: https://lkml.kernel.org/r/20230925072100.3725620-1-ruanjinjie@huawei.com Fixes: 9f86d624292c ("mm/damon/vaddr-test: remove unnecessary variables") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Reviewed-by: SeongJae Park <sj(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- mm/damon/vaddr-test.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/damon/vaddr-test.h b/mm/damon/vaddr-test.h index d4f55f349100..a2a1e182929f 100644 --- a/mm/damon/vaddr-test.h +++ b/mm/damon/vaddr-test.h @@ -152,6 +152,8 @@ static void damon_do_test_apply_three_regions(struct kunit *test, KUNIT_EXPECT_EQ(test, r->ar.start, expected[i * 2]); KUNIT_EXPECT_EQ(test, r->ar.end, expected[i * 2 + 1]); } + + damon_destroy_target(t); } /* -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] btrfs: do not ASSERT() if the newly created subvolume already got read
by Long Li 04 Mar '24

04 Mar '24

This patch set fix cve-2024-23850. Filipe Manana (1): btrfs: fix double free of anonymous device after snapshot creation failure Qu Wenruo (1): btrfs: do not ASSERT() if the newly created subvolume already got read fs/btrfs/disk-io.c | 29 +++++++++++++++++++---------- fs/btrfs/disk-io.h | 2 +- fs/btrfs/ioctl.c | 2 +- fs/btrfs/transaction.c | 2 +- 4 files changed, 22 insertions(+), 13 deletions(-) -- 2.31.1

2 3

[PATCH v1 OLK-6.6 0/4] kworker: Fix the problem of ipsan performance degradation
by jiangdongxu 04 Mar '24

04 Mar '24

From: shaodenghui <shaodenghui(a)huawei.com> When the current downstream FS tests IPSAN, it is found that the performance on ARM is much worse than that on X86, and the test data of IPSAN fluctuates greatly. After analysis, the reason is that when iscsi issues IO, the task is sent to kworker for processing by iscsi_xmitworker. The workqueue created by iscsi can automatically identify the CPU of the soft interrupt currently processed by iscsi, and automatically schedule the workqueue to the corresponding NUMA node. shaodenghui (3): iscsi: add member for NUMA aware order workqueue workqueue: implement NUMA affinity for single thread workqueue iscsi: use dynamic single thread workqueue to improve performance drivers/scsi/iscsi_tcp.c | 9 +++++++++ drivers/scsi/libiscsi.c | 17 ++++++++++++----- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + kernel/workqueue.c | 15 ++++++++++----- 5 files changed, 33 insertions(+), 10 deletions(-) -- 2.33.0

2 5

[PATCH openEuler-1.0-LTS 0/1] ARM: footbridge: remove personal server platform
by Huang Xiaojia 04 Mar '24

04 Mar '24

Russell King (1): ARM: footbridge: fix PCI interrupt mapping arch/arm/mach-footbridge/cats-pci.c | 4 ++-- arch/arm/mach-footbridge/ebsa285-pci.c | 4 ++-- arch/arm/mach-footbridge/netwinder-pci.c | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) -- 2.34.1

2 2

[PATCH v2 openEuler-1.0-LTS] HID: usbhid: fix info leak in hid_submit_ctrl
by Yu Liao 04 Mar '24

04 Mar '24

From: Anirudh Rayabharam <mail(a)anirudhrb.com> stable inclusion from stable-v4.19.196 commit 0e280502be1b003c3483ae03fc60dea554fcfa82 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93XA7 CVE: CVE-2021-46906 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6be388f4a35d2ce5ef7dbf635a8964a5da7f799f ] In hid_submit_ctrl(), the way of calculating the report length doesn't take into account that report->size can be zero. When running the syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to calculate transfer_buffer_length as 16384. When this urb is passed to the usb core layer, KMSAN reports an info leak of 16384 bytes. To fix this, first modify hid_report_len() to account for the zero report size case by using DIV_ROUND_UP for the division. Then, call it from hid_submit_ctrl(). Reported-by: syzbot+7c2bb71996f95a82524c(a)syzkaller.appspotmail.com Signed-off-by: Anirudh Rayabharam <mail(a)anirudhrb.com> Acked-by: Benjamin Tissoires <benjamin.tissoires(a)redhat.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.cz> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/hid/usbhid/hid-core.c | 2 +- include/linux/hid.h | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c index 11103efebbaa..2376740ce4d5 100644 --- a/drivers/hid/usbhid/hid-core.c +++ b/drivers/hid/usbhid/hid-core.c @@ -377,7 +377,7 @@ static int hid_submit_ctrl(struct hid_device *hid) raw_report = usbhid->ctrl[usbhid->ctrltail].raw_report; dir = usbhid->ctrl[usbhid->ctrltail].dir; - len = ((report->size - 1) >> 3) + 1 + (report->id > 0); + len = hid_report_len(report); if (dir == USB_DIR_OUT) { usbhid->urbctrl->pipe = usb_sndctrlpipe(hid_to_usb_dev(hid), 0); usbhid->urbctrl->transfer_buffer_length = len; diff --git a/include/linux/hid.h b/include/linux/hid.h index 7f321909ec58..2053f3ee4395 100644 --- a/include/linux/hid.h +++ b/include/linux/hid.h @@ -1154,8 +1154,7 @@ static inline void hid_hw_wait(struct hid_device *hdev) */ static inline u32 hid_report_len(struct hid_report *report) { - /* equivalent to DIV_ROUND_UP(report->size, 8) + !!(report->id > 0) */ - return ((report->size - 1) >> 3) + 1 + (report->id > 0); + return DIV_ROUND_UP(report->size, 8) + (report->id > 0); } int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size, -- 2.25.1

2 1

[PATCH v3 openEuler-1.0-LTS] usb: hub: Guard against accesses to uninitialized BOS descriptors
by Jinjiang Tu 04 Mar '24

04 Mar '24

From: Ricardo Cañuelo <ricardo.canuelo(a)collabora.com> stable inclusion from stable-v4.19.297 commit 8e7346bfea56453e31b7421c1c17ca2fb9ed613d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94P5J Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f74a7afc224acd5e922c7a2e52244d891bbe44ee upstream. Many functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h access fields inside udev->bos without checking if it was allocated and initialized. If usb_get_bos_descriptor() fails for whatever reason, udev->bos will be NULL and those accesses will result in a crash: BUG: kernel NULL pointer dereference, address: 0000000000000018 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 5 PID: 17818 Comm: kworker/5:1 Tainted: G W 5.15.108-18910-gab0e1cb584e1 #1 <HASH:1f9e 1> Hardware name: Google Kindred/Kindred, BIOS Google_Kindred.12672.413.0 02/03/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:hub_port_reset+0x193/0x788 Code: 89 f7 e8 20 f7 15 00 48 8b 43 08 80 b8 96 03 00 00 03 75 36 0f b7 88 92 03 00 00 81 f9 10 03 00 00 72 27 48 8b 80 a8 03 00 00 <48> 83 78 18 00 74 19 48 89 df 48 8b 75 b0 ba 02 00 00 00 4c 89 e9 RSP: 0018:ffffab740c53fcf8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffa1bc5f678000 RCX: 0000000000000310 RDX: fffffffffffffdff RSI: 0000000000000286 RDI: ffffa1be9655b840 RBP: ffffab740c53fd70 R08: 00001b7d5edaa20c R09: ffffffffb005e060 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: ffffab740c53fd3e R14: 0000000000000032 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffffa1be96540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 000000022e80c005 CR4: 00000000003706e0 Call Trace: hub_event+0x73f/0x156e ? hub_activate+0x5b7/0x68f process_one_work+0x1a2/0x487 worker_thread+0x11a/0x288 kthread+0x13a/0x152 ? process_one_work+0x487/0x487 ? kthread_associate_blkcg+0x70/0x70 ret_from_fork+0x1f/0x30 Fall back to a default behavior if the BOS descriptor isn't accessible and skip all the functionalities that depend on it: LPM support checks, Super Speed capabilitiy checks, U1/U2 states setup. Signed-off-by: Ricardo Cañuelo <ricardo.canuelo(a)collabora.com> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20230830100418.1952143-1-ricardo.canuelo@collabor… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/usb/core/hub.c | 28 ++++++++++++++++++++++++---- drivers/usb/core/hub.h | 2 +- 2 files changed, 25 insertions(+), 5 deletions(-) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index c6b16194f3cf..7750a304d7b4 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -138,6 +138,10 @@ int usb_device_supports_lpm(struct usb_device *udev) if (udev->quirks & USB_QUIRK_NO_LPM) return 0; + /* Skip if the device BOS descriptor couldn't be read */ + if (!udev->bos) + return 0; + /* USB 2.1 (and greater) devices indicate LPM support through * their USB 2.0 Extended Capabilities BOS descriptor. */ @@ -311,6 +315,10 @@ static void usb_set_lpm_parameters(struct usb_device *udev) if (!udev->lpm_capable || udev->speed < USB_SPEED_SUPER) return; + /* Skip if the device BOS descriptor couldn't be read */ + if (!udev->bos) + return; + hub = usb_hub_to_struct_hub(udev->parent); /* It doesn't take time to transition the roothub into U0, since it * doesn't have an upstream link. @@ -2616,7 +2624,8 @@ int usb_authorize_device(struct usb_device *usb_dev) } /* - * Return 1 if port speed is SuperSpeedPlus, 0 otherwise + * Return 1 if port speed is SuperSpeedPlus, 0 otherwise or if the + * capability couldn't be checked. * check it from the link protocol field of the current speed ID attribute. * current speed ID is got from ext port status request. Sublink speed attribute * table is returned with the hub BOS SSP device capability descriptor @@ -2626,8 +2635,12 @@ static int port_speed_is_ssp(struct usb_device *hdev, int speed_id) int ssa_count; u32 ss_attr; int i; - struct usb_ssp_cap_descriptor *ssp_cap = hdev->bos->ssp_cap; + struct usb_ssp_cap_descriptor *ssp_cap; + if (!hdev->bos) + return 0; + + ssp_cap = hdev->bos->ssp_cap; if (!ssp_cap) return 0; @@ -3979,8 +3992,15 @@ static void usb_enable_link_state(struct usb_hcd *hcd, struct usb_device *udev, enum usb3_link_state state) { int timeout, ret; - __u8 u1_mel = udev->bos->ss_cap->bU1devExitLat; - __le16 u2_mel = udev->bos->ss_cap->bU2DevExitLat; + __u8 u1_mel; + __le16 u2_mel; + + /* Skip if the device BOS descriptor couldn't be read */ + if (!udev->bos) + return; + + u1_mel = udev->bos->ss_cap->bU1devExitLat; + u2_mel = udev->bos->ss_cap->bU2DevExitLat; /* If the device says it doesn't have *any* exit latency to come out of * U1 or U2, it's probably lying. Assume it doesn't implement that link diff --git a/drivers/usb/core/hub.h b/drivers/usb/core/hub.h index 4accfb63f7dc..2ee899501220 100644 --- a/drivers/usb/core/hub.h +++ b/drivers/usb/core/hub.h @@ -138,7 +138,7 @@ static inline int hub_is_superspeedplus(struct usb_device *hdev) { return (hdev->descriptor.bDeviceProtocol == USB_HUB_PR_SS && le16_to_cpu(hdev->descriptor.bcdUSB) >= 0x0310 && - hdev->bos->ssp_cap); + hdev->bos && hdev->bos->ssp_cap); } static inline unsigned hub_power_on_good_delay(struct usb_hub *hub) -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP2] arm64: head.S: always initialize PSTATE
by Li Zetao 04 Mar '24

04 Mar '24

From: Mark Rutland <mark.rutland(a)arm.com> mainline inclusion from mainline-v5.11-rc1 commit d87a8e65b5101123a24cddeb7a8a2c7b45f7b60c category: bugfix bugzilla: 189556 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As with SCTLR_ELx and other control registers, some PSTATE bits are UNKNOWN out-of-reset, and we may not be able to rely on hardware or firmware to initialize them to our liking prior to entry to the kernel, e.g. in the primary/secondary boot paths and return from idle/suspend. It would be more robust (and easier to reason about) if we consistently initialized PSTATE to a default value, as we do with control registers. This will ensure that the kernel is not adversely affected by bits it is not aware of, e.g. when support for a feature such as PAN/UAO is disabled. This patch ensures that PSTATE is consistently initialized at boot time via an ERET. This is not intended to relax the existing requirements (e.g. DAIF bits must still be set prior to entering the kernel). For features detected dynamically (which may require system-wide support), it is still necessary to subsequently modify PSTATE. As ERET is not always a Context Synchronization Event, an ISB is placed before each exception return to ensure updates to control registers have taken effect. This handles the kernel being entered with SCTLR_ELx.EOS clear (or any future control bits being in an UNKNOWN state). Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: Christoph Hellwig <hch(a)lst.de> Cc: James Morse <james.morse(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Link: https://lore.kernel.org/r/20201113124937.20574-6-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Conflicts: arch/arm64/kernel/head.S Signed-off-by: Li Zetao <lizetao1(a)huawei.com> --- arch/arm64/include/asm/ptrace.h | 5 +++++ arch/arm64/kernel/head.S | 32 +++++++++++++++++++++----------- 2 files changed, 26 insertions(+), 11 deletions(-) diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h index 27fee85c3c2b..e58568f94b5e 100644 --- a/arch/arm64/include/asm/ptrace.h +++ b/arch/arm64/include/asm/ptrace.h @@ -16,6 +16,11 @@ #define CurrentEL_EL1 (1 << 2) #define CurrentEL_EL2 (2 << 2) +#define INIT_PSTATE_EL1 \ + (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL1h) +#define INIT_PSTATE_EL2 \ + (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL2h) + /* * PMR values used to mask/unmask interrupts. * diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S index b7a9f403ad2d..5fb9255fd5dd 100644 --- a/arch/arm64/kernel/head.S +++ b/arch/arm64/kernel/head.S @@ -486,21 +486,29 @@ EXPORT_SYMBOL(kimage_vaddr) * If we're fortunate enough to boot at EL2, ensure that the world is * sane before dropping to EL1. * + * Since we cannot always rely on ERET synchronizing writes to sysregs (e.g. if + * SCTLR_ELx.EOS is clear), we place an ISB prior to ERET. + * * Returns either BOOT_CPU_MODE_EL1 or BOOT_CPU_MODE_EL2 in w0 if * booted in EL1 or EL2 respectively. */ SYM_FUNC_START(el2_setup) - msr SPsel, #1 // We want to use SP_EL{1,2} mrs x0, CurrentEL cmp x0, #CurrentEL_EL2 - b.eq 1f + b.eq init_el2 + +SYM_INNER_LABEL(init_el1, SYM_L_LOCAL) mov_q x0, INIT_SCTLR_EL1_MMU_OFF msr sctlr_el1, x0 - mov w0, #BOOT_CPU_MODE_EL1 // This cpu booted in EL1 isb - ret + mov_q x0, INIT_PSTATE_EL1 + msr spsr_el1, x0 + msr elr_el1, lr + mov w0, #BOOT_CPU_MODE_EL1 + eret -1: mov_q x0, INIT_SCTLR_EL2_MMU_OFF +SYM_INNER_LABEL(init_el2, SYM_L_LOCAL) + mov_q x0, INIT_SCTLR_EL2_MMU_OFF msr sctlr_el2, x0 #ifdef CONFIG_ARM64_VHE @@ -609,9 +617,12 @@ set_hcr: cbz x2, install_el2_stub - mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 isb - ret + mov_q x0, INIT_PSTATE_EL2 + msr spsr_el2, x0 + msr elr_el2, lr + mov w0, #BOOT_CPU_MODE_EL2 + eret SYM_INNER_LABEL(install_el2_stub, SYM_L_LOCAL) /* @@ -643,12 +654,11 @@ SYM_INNER_LABEL(install_el2_stub, SYM_L_LOCAL) 7: adr_l x0, __hyp_stub_vectors msr vbar_el2, x0 - /* spsr */ - mov x0, #(PSR_F_BIT | PSR_I_BIT | PSR_A_BIT | PSR_D_BIT |\ - PSR_MODE_EL1h) + isb + mov x0, #INIT_PSTATE_EL1 msr spsr_el2, x0 msr elr_el2, lr - mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 + mov w0, #BOOT_CPU_MODE_EL2 eret SYM_FUNC_END(el2_setup) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] HID: usbhid: fix info leak in hid_submit_ctrl
by Yu Liao 04 Mar '24

04 Mar '24

From: Anirudh Rayabharam <mail(a)anirudhrb.com> stable inclusion from stable-v5.15.128 commit 0e280502be1b003c3483ae03fc60dea554fcfa82 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93XA7 CVE: CVE-2021-46906 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6be388f4a35d2ce5ef7dbf635a8964a5da7f799f ] In hid_submit_ctrl(), the way of calculating the report length doesn't take into account that report->size can be zero. When running the syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to calculate transfer_buffer_length as 16384. When this urb is passed to the usb core layer, KMSAN reports an info leak of 16384 bytes. To fix this, first modify hid_report_len() to account for the zero report size case by using DIV_ROUND_UP for the division. Then, call it from hid_submit_ctrl(). Reported-by: syzbot+7c2bb71996f95a82524c(a)syzkaller.appspotmail.com Signed-off-by: Anirudh Rayabharam <mail(a)anirudhrb.com> Acked-by: Benjamin Tissoires <benjamin.tissoires(a)redhat.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.cz> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/hid/usbhid/hid-core.c | 2 +- include/linux/hid.h | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c index 11103efebbaa..2376740ce4d5 100644 --- a/drivers/hid/usbhid/hid-core.c +++ b/drivers/hid/usbhid/hid-core.c @@ -377,7 +377,7 @@ static int hid_submit_ctrl(struct hid_device *hid) raw_report = usbhid->ctrl[usbhid->ctrltail].raw_report; dir = usbhid->ctrl[usbhid->ctrltail].dir; - len = ((report->size - 1) >> 3) + 1 + (report->id > 0); + len = hid_report_len(report); if (dir == USB_DIR_OUT) { usbhid->urbctrl->pipe = usb_sndctrlpipe(hid_to_usb_dev(hid), 0); usbhid->urbctrl->transfer_buffer_length = len; diff --git a/include/linux/hid.h b/include/linux/hid.h index 7f321909ec58..2053f3ee4395 100644 --- a/include/linux/hid.h +++ b/include/linux/hid.h @@ -1154,8 +1154,7 @@ static inline void hid_hw_wait(struct hid_device *hdev) */ static inline u32 hid_report_len(struct hid_report *report) { - /* equivalent to DIV_ROUND_UP(report->size, 8) + !!(report->id > 0) */ - return ((report->size - 1) >> 3) + 1 + (report->id > 0); + return DIV_ROUND_UP(report->size, 8) + (report->id > 0); } int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size, -- 2.25.1

2 1

[PATCH v1 OLK-6.6 0/4] kworker: Fix the problem of ipsan performance degradation
by jiangdongxu 04 Mar '24

04 Mar '24

From: shaodenghui <shaodenghui(a)huawei.com> When the current downstream FS tests IPSAN, it is found that the performance on ARM is much worse than that on X86, and the test data of IPSAN fluctuates greatly. After analysis, the reason is that when iscsi issues IO, the task is sent to kworker for processing by iscsi_xmitworker. The workqueue created by iscsi can automatically identify the CPU of the soft interrupt currently processed by iscsi, and automatically schedule the workqueue to the corresponding NUMA node. shaodenghui (3): iscsi: add member for NUMA aware order workqueue workqueue: implement NUMA affinity for single thread workqueue iscsi: use dynamic single thread workqueue to improve performance drivers/scsi/iscsi_tcp.c | 9 +++++++++ drivers/scsi/libiscsi.c | 17 ++++++++++++----- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + kernel/workqueue.c | 15 ++++++++++----- 5 files changed, 33 insertions(+), 10 deletions(-) -- 2.33.0

2 5

[PATCH v1 OLK-6.6 1/4] iscsi: add member for NUMA aware order workqueue
by jiangdongxu 04 Mar '24

04 Mar '24

From: shaodenghui <shaodenghui(a)huawei.com> euleros inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I94XYA CVE: NA ------------------------------------------------- Add member to struct iscsi_conn. Signed-off-by: shaodenghui <shaodenghui(a)huawei.com> --- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + 2 files changed, 2 insertions(+) diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h index 961909875..485c0f5b2 100644 --- a/include/linux/workqueue.h +++ b/include/linux/workqueue.h @@ -415,6 +415,7 @@ enum { __WQ_ORDERED = 1 << 17, /* internal: workqueue is ordered */ __WQ_LEGACY = 1 << 18, /* internal: create*_workqueue() */ __WQ_ORDERED_EXPLICIT = 1 << 19, /* internal: alloc_ordered_workqueue() */ + __WQ_DYNAMIC = 1 << 25, /* internal: only support single work order WQ */ WQ_MAX_ACTIVE = 512, /* I like 512, better ideas? */ WQ_UNBOUND_MAX_ACTIVE = WQ_MAX_ACTIVE, diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h index d253b82e9..ead17d222 100644 --- a/include/scsi/libiscsi.h +++ b/include/scsi/libiscsi.h @@ -266,6 +266,7 @@ struct iscsi_conn { /* custom statistics */ uint32_t eh_abort_cnt; uint32_t fmr_unalign_cnt; + int intimate_cpu; KABI_RESERVE(1) KABI_RESERVE(2) -- 2.33.0

2 4

[PATCH OLK-6.6] LoongArch: enable CONFIG_DEBUG_INFO_BTF by default
by Hongchen Zhang 04 Mar '24

04 Mar '24

CONFIG_DEBUG_INFO_BTF is required by bpftool,so enable it. LoongArch inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I95P5Y -------------------------------- Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> Signed-off-by: Tiezhu Yang <yangtiezhu(a)loongson.cn> --- arch/loongarch/configs/loongson3_defconfig | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/loongarch/configs/loongson3_defconfig b/arch/loongarch/configs/loongson3_defconfig index a60d281bb525..0a1a3e68cdb2 100644 --- a/arch/loongarch/configs/loongson3_defconfig +++ b/arch/loongarch/configs/loongson3_defconfig @@ -2185,6 +2185,8 @@ CONFIG_PRINTK_TIME=y CONFIG_PRINTK_CALLER=y CONFIG_BOOT_PRINTK_DELAY=y CONFIG_DYNAMIC_DEBUG=y +CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y +CONFIG_DEBUG_INFO_BTF=y CONFIG_FRAME_WARN=4096 CONFIG_STRIP_ASM_SYMS=y CONFIG_DEBUG_SECTION_MISMATCH=y -- 2.33.0

2 1

[PATCH OLK-5.10] arm64: head.S: always initialize PSTATE
by Li Zetao 04 Mar '24

04 Mar '24

From: Mark Rutland <mark.rutland(a)arm.com> mainline inclusion from mainline-v5.11-rc1 commit d87a8e65b5101123a24cddeb7a8a2c7b45f7b60c category: bugfix bugzilla: 189556 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As with SCTLR_ELx and other control registers, some PSTATE bits are UNKNOWN out-of-reset, and we may not be able to rely on hardware or firmware to initialize them to our liking prior to entry to the kernel, e.g. in the primary/secondary boot paths and return from idle/suspend. It would be more robust (and easier to reason about) if we consistently initialized PSTATE to a default value, as we do with control registers. This will ensure that the kernel is not adversely affected by bits it is not aware of, e.g. when support for a feature such as PAN/UAO is disabled. This patch ensures that PSTATE is consistently initialized at boot time via an ERET. This is not intended to relax the existing requirements (e.g. DAIF bits must still be set prior to entering the kernel). For features detected dynamically (which may require system-wide support), it is still necessary to subsequently modify PSTATE. As ERET is not always a Context Synchronization Event, an ISB is placed before each exception return to ensure updates to control registers have taken effect. This handles the kernel being entered with SCTLR_ELx.EOS clear (or any future control bits being in an UNKNOWN state). Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: Christoph Hellwig <hch(a)lst.de> Cc: James Morse <james.morse(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Link: https://lore.kernel.org/r/20201113124937.20574-6-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Conflicts: arch/arm64/kernel/head.S Signed-off-by: Li Zetao <lizetao1(a)huawei.com> --- arch/arm64/include/asm/ptrace.h | 5 +++++ arch/arm64/kernel/head.S | 32 +++++++++++++++++++++----------- 2 files changed, 26 insertions(+), 11 deletions(-) diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h index 27fee85c3c2b..e58568f94b5e 100644 --- a/arch/arm64/include/asm/ptrace.h +++ b/arch/arm64/include/asm/ptrace.h @@ -16,6 +16,11 @@ #define CurrentEL_EL1 (1 << 2) #define CurrentEL_EL2 (2 << 2) +#define INIT_PSTATE_EL1 \ + (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL1h) +#define INIT_PSTATE_EL2 \ + (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL2h) + /* * PMR values used to mask/unmask interrupts. * diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S index ad1e45abfe6c..91890de6cefa 100644 --- a/arch/arm64/kernel/head.S +++ b/arch/arm64/kernel/head.S @@ -531,21 +531,29 @@ EXPORT_SYMBOL(kimage_vaddr) * If we're fortunate enough to boot at EL2, ensure that the world is * sane before dropping to EL1. * + * Since we cannot always rely on ERET synchronizing writes to sysregs (e.g. if + * SCTLR_ELx.EOS is clear), we place an ISB prior to ERET. + * * Returns either BOOT_CPU_MODE_EL1 or BOOT_CPU_MODE_EL2 in w0 if * booted in EL1 or EL2 respectively. */ SYM_FUNC_START(el2_setup) - msr SPsel, #1 // We want to use SP_EL{1,2} mrs x0, CurrentEL cmp x0, #CurrentEL_EL2 - b.eq 1f + b.eq init_el2 + +SYM_INNER_LABEL(init_el1, SYM_L_LOCAL) mov_q x0, INIT_SCTLR_EL1_MMU_OFF msr sctlr_el1, x0 - mov w0, #BOOT_CPU_MODE_EL1 // This cpu booted in EL1 isb - ret + mov_q x0, INIT_PSTATE_EL1 + msr spsr_el1, x0 + msr elr_el1, lr + mov w0, #BOOT_CPU_MODE_EL1 + eret -1: mov_q x0, INIT_SCTLR_EL2_MMU_OFF +SYM_INNER_LABEL(init_el2, SYM_L_LOCAL) + mov_q x0, INIT_SCTLR_EL2_MMU_OFF msr sctlr_el2, x0 #ifdef CONFIG_ARM64_VHE @@ -657,9 +665,12 @@ set_hcr: cbz x2, install_el2_stub - mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 isb - ret + mov_q x0, INIT_PSTATE_EL2 + msr spsr_el2, x0 + msr elr_el2, lr + mov w0, #BOOT_CPU_MODE_EL2 + eret /* Disable any fine grained traps */ .macro __init_el2_fgt @@ -778,12 +789,11 @@ SYM_INNER_LABEL(install_el2_stub, SYM_L_LOCAL) 7: adr_l x0, __hyp_stub_vectors msr vbar_el2, x0 - /* spsr */ - mov x0, #(PSR_F_BIT | PSR_I_BIT | PSR_A_BIT | PSR_D_BIT |\ - PSR_MODE_EL1h) + isb + mov x0, #INIT_PSTATE_EL1 msr spsr_el2, x0 msr elr_el2, lr - mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 + mov w0, #BOOT_CPU_MODE_EL2 eret SYM_FUNC_END(el2_setup) -- 2.34.1

2 1

[PATCH v3 openEuler-1.0-LTS] usb: hub: Guard against accesses to uninitialized BOS descriptors
by Jinjiang Tu 04 Mar '24

04 Mar '24

From: Ricardo Cañuelo <ricardo.canuelo(a)collabora.com> stable inclusion from stable-v4.19.297 commit 8e7346bfea56453e31b7421c1c17ca2fb9ed613d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94P5J Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f74a7afc224acd5e922c7a2e52244d891bbe44ee upstream. Many functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h access fields inside udev->bos without checking if it was allocated and initialized. If usb_get_bos_descriptor() fails for whatever reason, udev->bos will be NULL and those accesses will result in a crash: BUG: kernel NULL pointer dereference, address: 0000000000000018 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 5 PID: 17818 Comm: kworker/5:1 Tainted: G W 5.15.108-18910-gab0e1cb584e1 #1 <HASH:1f9e 1> Hardware name: Google Kindred/Kindred, BIOS Google_Kindred.12672.413.0 02/03/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:hub_port_reset+0x193/0x788 Code: 89 f7 e8 20 f7 15 00 48 8b 43 08 80 b8 96 03 00 00 03 75 36 0f b7 88 92 03 00 00 81 f9 10 03 00 00 72 27 48 8b 80 a8 03 00 00 <48> 83 78 18 00 74 19 48 89 df 48 8b 75 b0 ba 02 00 00 00 4c 89 e9 RSP: 0018:ffffab740c53fcf8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffa1bc5f678000 RCX: 0000000000000310 RDX: fffffffffffffdff RSI: 0000000000000286 RDI: ffffa1be9655b840 RBP: ffffab740c53fd70 R08: 00001b7d5edaa20c R09: ffffffffb005e060 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: ffffab740c53fd3e R14: 0000000000000032 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffffa1be96540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 000000022e80c005 CR4: 00000000003706e0 Call Trace: hub_event+0x73f/0x156e ? hub_activate+0x5b7/0x68f process_one_work+0x1a2/0x487 worker_thread+0x11a/0x288 kthread+0x13a/0x152 ? process_one_work+0x487/0x487 ? kthread_associate_blkcg+0x70/0x70 ret_from_fork+0x1f/0x30 Fall back to a default behavior if the BOS descriptor isn't accessible and skip all the functionalities that depend on it: LPM support checks, Super Speed capabilitiy checks, U1/U2 states setup. Signed-off-by: Ricardo Cañuelo <ricardo.canuelo(a)collabora.com> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20230830100418.1952143-1-ricardo.canuelo@collabor… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/usb/core/hub.c | 28 ++++++++++++++++++++++++---- drivers/usb/core/hub.h | 2 +- 2 files changed, 25 insertions(+), 5 deletions(-) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index c6b16194f3cf..7750a304d7b4 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -138,6 +138,10 @@ int usb_device_supports_lpm(struct usb_device *udev) if (udev->quirks & USB_QUIRK_NO_LPM) return 0; + /* Skip if the device BOS descriptor couldn't be read */ + if (!udev->bos) + return 0; + /* USB 2.1 (and greater) devices indicate LPM support through * their USB 2.0 Extended Capabilities BOS descriptor. */ @@ -311,6 +315,10 @@ static void usb_set_lpm_parameters(struct usb_device *udev) if (!udev->lpm_capable || udev->speed < USB_SPEED_SUPER) return; + /* Skip if the device BOS descriptor couldn't be read */ + if (!udev->bos) + return; + hub = usb_hub_to_struct_hub(udev->parent); /* It doesn't take time to transition the roothub into U0, since it * doesn't have an upstream link. @@ -2616,7 +2624,8 @@ int usb_authorize_device(struct usb_device *usb_dev) } /* - * Return 1 if port speed is SuperSpeedPlus, 0 otherwise + * Return 1 if port speed is SuperSpeedPlus, 0 otherwise or if the + * capability couldn't be checked. * check it from the link protocol field of the current speed ID attribute. * current speed ID is got from ext port status request. Sublink speed attribute * table is returned with the hub BOS SSP device capability descriptor @@ -2626,8 +2635,12 @@ static int port_speed_is_ssp(struct usb_device *hdev, int speed_id) int ssa_count; u32 ss_attr; int i; - struct usb_ssp_cap_descriptor *ssp_cap = hdev->bos->ssp_cap; + struct usb_ssp_cap_descriptor *ssp_cap; + if (!hdev->bos) + return 0; + + ssp_cap = hdev->bos->ssp_cap; if (!ssp_cap) return 0; @@ -3979,8 +3992,15 @@ static void usb_enable_link_state(struct usb_hcd *hcd, struct usb_device *udev, enum usb3_link_state state) { int timeout, ret; - __u8 u1_mel = udev->bos->ss_cap->bU1devExitLat; - __le16 u2_mel = udev->bos->ss_cap->bU2DevExitLat; + __u8 u1_mel; + __le16 u2_mel; + + /* Skip if the device BOS descriptor couldn't be read */ + if (!udev->bos) + return; + + u1_mel = udev->bos->ss_cap->bU1devExitLat; + u2_mel = udev->bos->ss_cap->bU2DevExitLat; /* If the device says it doesn't have *any* exit latency to come out of * U1 or U2, it's probably lying. Assume it doesn't implement that link diff --git a/drivers/usb/core/hub.h b/drivers/usb/core/hub.h index 4accfb63f7dc..2ee899501220 100644 --- a/drivers/usb/core/hub.h +++ b/drivers/usb/core/hub.h @@ -138,7 +138,7 @@ static inline int hub_is_superspeedplus(struct usb_device *hdev) { return (hdev->descriptor.bDeviceProtocol == USB_HUB_PR_SS && le16_to_cpu(hdev->descriptor.bcdUSB) >= 0x0310 && - hdev->bos->ssp_cap); + hdev->bos && hdev->bos->ssp_cap); } static inline unsigned hub_power_on_good_delay(struct usb_hub *hub) -- 2.25.1

2 1