- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS v2 0/4] ACPI for MPAM 2.0
by Yu Liao 01 Nov '23

01 Nov '23

v1 -> v2: modified commit log Erik Kaneda (1): ACPICA: ACPI 6.4: PPTT: add new version of subtable type 1 Hesham Almatary (1): ACPICA: Add support for Arm's MPAM ACPI table version 2 Yu Liao (2): ACPI / PPTT: Find PPTT processor node by cache id ACPI/MPAM: Adapt to Arm's MPAM ACPI table version 2 arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/Makefile | 2 +- drivers/acpi/arm64/mpam.c | 21 +++- drivers/acpi/arm64/mpam_v2.c | 175 +++++++++++++++++++++++++++ drivers/acpi/pptt.c | 55 +++++++++ include/acpi/actbl2.h | 118 ++++++++++++++++++ include/linux/acpi.h | 5 + include/linux/arm_mpam.h | 2 +- 8 files changed, 373 insertions(+), 7 deletions(-) create mode 100644 drivers/acpi/arm64/mpam_v2.c -- 2.25.1

2 5

[PATCH openEuler-1.0-LTS v2 0/3] bugfixes for CVE-2022-45884
by liwei 01 Nov '23

01 Nov '23

bugfixes for CVE-2022-45884 Dinghao Liu (1): media: dvbdev: Fix memleak in dvb_register_device Fuqian Huang (1): media: media/dvb: Use kmemdup rather than duplicating its implementation Hyunwoo Kim (1): media: dvb-core: Fix use-after-free due to race at dvb_register_device() drivers/media/dvb-core/dvbdev.c | 86 ++++++++++++++++----- drivers/media/dvb-frontends/drx39xyj/drxj.c | 5 +- include/media/dvbdev.h | 15 ++++ 3 files changed, 82 insertions(+), 24 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10 v2 0/7] add sample sockmap code for redis
by Liu Jian 31 Oct '23

31 Oct '23

v1->v2: Move local_skb to a reserved field instead of inserting it to a structure hole. Fix a cgroup ref leak bug. Hengqi Chen (1): libbpf: Support uniform BTF-defined key/value specification across all BPF maps Liu Jian (4): cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted net: let sockops can use bpf_get_current_comm() net: add local_skb parameter to identify local tcp connection tools: add sample sockmap code for redis Xu Kuohai (1): bpf, sockmap: Fix map type error in sock_map_del_link Yosry Ahmed (1): cgroup: add cgroup_v1v2_get_from_[fd/file]() include/linux/cgroup.h | 2 + include/linux/filter.h | 1 + include/linux/skbuff.h | 2 +- include/uapi/linux/bpf.h | 1 + kernel/bpf/cgroup.c | 8 +- kernel/cgroup/cgroup.c | 72 +++++++- net/core/filter.c | 9 + net/core/sock_map.c | 10 +- net/ipv4/tcp_input.c | 4 +- net/ipv4/tcp_output.c | 4 + tools/include/uapi/linux/bpf.h | 1 + tools/lib/bpf/libbpf.c | 24 +++ tools/netacc/Makefile | 24 +++ tools/netacc/bpf_sockmap.h | 167 +++++++++++++++++++ tools/netacc/net-acc | 35 ++++ tools/netacc/netacc.c | 296 +++++++++++++++++++++++++++++++++ tools/netacc/netaccsockmap.c | 176 ++++++++++++++++++++ 17 files changed, 820 insertions(+), 16 deletions(-) create mode 100644 tools/netacc/Makefile create mode 100644 tools/netacc/bpf_sockmap.h create mode 100755 tools/netacc/net-acc create mode 100644 tools/netacc/netacc.c create mode 100644 tools/netacc/netaccsockmap.c -- 2.34.1

2 8

[PATCH openEuler-1.0-LTS v3 0/7] Fix netfilter conntrack
by Lu Wei 31 Oct '23

31 Oct '23

Florian Westphal (7): netfilter: conntrack: tell compiler to not inline nf_ct_resolve_clash netfilter: conntrack: remove two args from resolve_clash netfilter: conntrack: place confirm-bit setting in a helper netfilter: conntrack: split resolve_clash function netfilter: conntrack: allow insertion of clashing entries netfilter: conntrack: do not auto-delete clash entries on reply netfilter: conntrack: fix infinite loop on rmmod include/linux/rculist_nulls.h | 7 + .../linux/netfilter/nf_conntrack_common.h | 12 +- net/netfilter/nf_conntrack_core.c | 215 +++++++++++++++--- net/netfilter/nf_conntrack_proto_udp.c | 7 +- net/netfilter/nft_flow_offload.c | 2 +- 5 files changed, 205 insertions(+), 38 deletions(-) -- V3: modify commit message 2.34.1

2 8

[PATCH OLK-5.10 0/3] LoongArch: add 32/64 pc relative relocation type support
by Hongchen Zhang 31 Oct '23

31 Oct '23

Hongchen Zhang (3): LoongArch: Define relocation types for ABI v2.10 LoongArch: Add support for 32_PCREL relocation type LoongArch: Add support for 64_PCREL relocation type arch/loongarch/include/asm/elf.h | 9 +++++++++ arch/loongarch/kernel/module.c | 22 +++++++++++++++++++++- 2 files changed, 30 insertions(+), 1 deletion(-) -- 2.33.0

2 4

[PATCH OLK-5.10 1/3] LoongArch: Define relocation types for ABI v2.10
by Hongchen Zhang 31 Oct '23

31 Oct '23

LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8C3BV ------------------------------------------ The relocation types from 101 to 109 are used by GNU binutils >= 2.41, add their definitions to use them in later patches. Link: https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=include/elf/loongar… Cc: <stable(a)vger.kernel.org> Signed-off-by: Tiezhu Yang <yangtiezhu(a)loongson.cn> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- arch/loongarch/include/asm/elf.h | 9 +++++++++ arch/loongarch/kernel/module.c | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/arch/loongarch/include/asm/elf.h b/arch/loongarch/include/asm/elf.h index 7af0cebf28d7..b9a4ab54285c 100644 --- a/arch/loongarch/include/asm/elf.h +++ b/arch/loongarch/include/asm/elf.h @@ -111,6 +111,15 @@ #define R_LARCH_TLS_GD_HI20 98 #define R_LARCH_32_PCREL 99 #define R_LARCH_RELAX 100 +#define R_LARCH_DELETE 101 +#define R_LARCH_ALIGN 102 +#define R_LARCH_PCREL20_S2 103 +#define R_LARCH_CFA 104 +#define R_LARCH_ADD6 105 +#define R_LARCH_SUB6 106 +#define R_LARCH_ADD_ULEB128 107 +#define R_LARCH_SUB_ULEB128 108 +#define R_LARCH_64_PCREL 109 #ifndef ELF_ARCH diff --git a/arch/loongarch/kernel/module.c b/arch/loongarch/kernel/module.c index 8127df5dd0ad..0b8ce1e0f83b 100644 --- a/arch/loongarch/kernel/module.c +++ b/arch/loongarch/kernel/module.c @@ -387,7 +387,7 @@ typedef int (*reloc_rela_handler)(struct module *mod, u32 *location, Elf_Addr v, /* The handlers for known reloc types */ static reloc_rela_handler reloc_rela_handlers[] = { - [R_LARCH_NONE ... R_LARCH_RELAX] = apply_r_larch_error, + [R_LARCH_NONE ... R_LARCH_64_PCREL] = apply_r_larch_error, [R_LARCH_NONE] = apply_r_larch_none, [R_LARCH_32] = apply_r_larch_32, -- 2.33.0

2 2

[PATCH OLK-5.10 3/3] LoongArch: Add support for 64_PCREL relocation type
by Hongchen Zhang 31 Oct '23

31 Oct '23

LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8C3BV ------------------------------------------ When build and update kernel with the latest upstream binutils and loongson3_defconfig, module loader fails with: kmod: zsmalloc: Unknown relocation type 109 kmod: fuse: Unknown relocation type 109 kmod: fuse: Unknown relocation type 109 kmod: radeon: Unknown relocation type 109 kmod: nf_tables: Unknown relocation type 109 kmod: nf_tables: Unknown relocation type 109 This is because the latest upstream binutils replaces a pair of ADD64 and SUB64 with 64_PCREL, so add support for 64_PCREL relocation type. Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ecb802d02eeb Cc: <stable(a)vger.kernel.org> Signed-off-by: Tiezhu Yang <yangtiezhu(a)loongson.cn> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- arch/loongarch/kernel/module.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/loongarch/kernel/module.c b/arch/loongarch/kernel/module.c index a67f9def7927..b4cf3383a8bc 100644 --- a/arch/loongarch/kernel/module.c +++ b/arch/loongarch/kernel/module.c @@ -381,6 +381,15 @@ static int apply_r_larch_32_pcrel(struct module *mod, u32 *location, Elf_Addr v, return 0; } +static int apply_r_larch_64_pcrel(struct module *mod, u32 *location, Elf_Addr v, + s64 *rela_stack, size_t *rela_stack_top, unsigned int type) +{ + ptrdiff_t offset = (void *)v - (void *)location; + + *(u64 *)location = offset; + return 0; +} + /* * reloc_handlers_rela() - Apply a particular relocation to a module * @mod: the module to apply the reloc to @@ -414,6 +423,7 @@ static reloc_rela_handler reloc_rela_handlers[] = { [R_LARCH_PCALA_HI20...R_LARCH_PCALA64_HI12] = apply_r_larch_pcala, [R_LARCH_GOT_PC_HI20...R_LARCH_GOT_PC_LO12] = apply_r_larch_got_pc, [R_LARCH_32_PCREL] = apply_r_larch_32_pcrel, + [R_LARCH_64_PCREL] = apply_r_larch_64_pcrel, }; int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, -- 2.33.0

1 0

[PATCH OLK-5.10 2/3] LoongArch: Add support for 32_PCREL relocation type
by Hongchen Zhang 31 Oct '23

31 Oct '23

LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8C3BV ------------------------------------------ When build and update kernel with the latest upstream binutils and loongson3_defconfig, module loader fails with: kmod: zsmalloc: Unsupport relocation type 99, please add its support. kmod: fuse: Unsupport relocation type 99, please add its support. kmod: ipmi_msghandler: Unsupport relocation type 99, please add its support. kmod: ipmi_msghandler: Unsupport relocation type 99, please add its support. kmod: pstore: Unsupport relocation type 99, please add its support. kmod: drm_display_helper: Unsupport relocation type 99, please add its support. kmod: drm_display_helper: Unsupport relocation type 99, please add its support. kmod: drm_display_helper: Unsupport relocation type 99, please add its support. kmod: fuse: Unsupport relocation type 99, please add its support. kmod: fat: Unsupport relocation type 99, please add its support. This is because the latest upstream binutils replaces a pair of ADD32 and SUB32 with 32_PCREL, so add support for 32_PCREL relocation type. Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ecb802d02eeb Cc: <stable(a)vger.kernel.org> Co-developed-by: Youling Tang <tangyouling(a)loongson.cn> Signed-off-by: Youling Tang <tangyouling(a)loongson.cn> Signed-off-by: Tiezhu Yang <yangtiezhu(a)loongson.cn> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- arch/loongarch/kernel/module.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/loongarch/kernel/module.c b/arch/loongarch/kernel/module.c index 0b8ce1e0f83b..a67f9def7927 100644 --- a/arch/loongarch/kernel/module.c +++ b/arch/loongarch/kernel/module.c @@ -372,6 +372,15 @@ static int apply_r_larch_got_pc(struct module *mod, u32 *location, Elf_Addr v, return apply_r_larch_pcala(mod, location, got, rela_stack, rela_stack_top, type); } +static int apply_r_larch_32_pcrel(struct module *mod, u32 *location, Elf_Addr v, + s64 *rela_stack, size_t *rela_stack_top, unsigned int type) +{ + ptrdiff_t offset = (void *)v - (void *)location; + + *(u32 *)location = offset; + return 0; +} + /* * reloc_handlers_rela() - Apply a particular relocation to a module * @mod: the module to apply the reloc to @@ -404,6 +413,7 @@ static reloc_rela_handler reloc_rela_handlers[] = { [R_LARCH_B26] = apply_r_larch_b26, [R_LARCH_PCALA_HI20...R_LARCH_PCALA64_HI12] = apply_r_larch_pcala, [R_LARCH_GOT_PC_HI20...R_LARCH_GOT_PC_LO12] = apply_r_larch_got_pc, + [R_LARCH_32_PCREL] = apply_r_larch_32_pcrel, }; int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, -- 2.33.0

1 0

[PATCH OLK-5.10] nvmet-tcp: Fix a possible UAF in queue intialization setup
by Li Lingfeng 31 Oct '23

31 Oct '23

From: Sagi Grimberg <sagi(a)grimberg.me> mainline inclusion from mainline-v6.6-rc7 commit d920abd1e7c4884f9ecd0749d1921b7ab19ddfbd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I88DLS CVE: CVE-2023-5178 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- From Alon: "Due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel, a malicious user can cause a UAF and a double free, which may lead to RCE (may also lead to an LPE in case the attacker already has local privileges)." Hence, when a queue initialization fails after the ahash requests are allocated, it is guaranteed that the queue removal async work will be called, hence leave the deallocation to the queue removal. Also, be extra careful not to continue processing the socket, so set queue rcv_state to NVMET_TCP_RECV_ERR upon a socket error. Cc: stable(a)vger.kernel.org Reported-by: Alon Zahavi <zahavi.alon(a)gmail.com> Tested-by: Alon Zahavi <zahavi.alon(a)gmail.com> Signed-off-by: Sagi Grimberg <sagi(a)grimberg.me> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Chaitanya Kulkarni <kch(a)nvidia.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/nvme/target/tcp.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c index 2ddbd4f4f628..7ce22d173fc7 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c @@ -336,6 +336,7 @@ static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue) static void nvmet_tcp_socket_error(struct nvmet_tcp_queue *queue, int status) { + queue->rcv_state = NVMET_TCP_RECV_ERR; if (status == -EPIPE || status == -ECONNRESET) kernel_sock_shutdown(queue->sock, SHUT_RDWR); else @@ -882,15 +883,11 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue) iov.iov_len = sizeof(*icresp); ret = kernel_sendmsg(queue->sock, &msg, &iov, 1, iov.iov_len); if (ret < 0) - goto free_crypto; + return ret; /* queue removal will cleanup */ queue->state = NVMET_TCP_Q_LIVE; nvmet_prepare_receive_pdu(queue); return 0; -free_crypto: - if (queue->hdr_digest || queue->data_digest) - nvmet_tcp_free_crypto(queue); - return ret; } static void nvmet_tcp_handle_req_failure(struct nvmet_tcp_queue *queue, -- 2.31.1

2 1

[PATCH OLK-5.10] integrity: Fix possible multiple allocation in integrity_inode_get()
by felix 31 Oct '23

31 Oct '23

From: Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> mainline inclusion from mainline-v6.5-rc1 commit 9df6a4870dc371136e90330cfbbc51464ee66993 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8C2DB CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When integrity_inode_get() is querying and inserting the cache, there is a conditional race in the concurrent environment. The race condition is the result of not properly implementing "double-checked locking". In this case, it first checks to see if the iint cache record exists before taking the lock, but doesn't check again after taking the integrity_iint_lock. Fixes: bf2276d10ce5 ("ima: allocating iint improvements") Signed-off-by: Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> Cc: Dmitry Kasatkin <dmitry.kasatkin(a)gmail.com> Cc: <stable(a)vger.kernel.org> # v3.10+ Signed-off-by: Mimi Zohar <zohar(a)linux.ibm.com> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- security/integrity/iint.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/security/integrity/iint.c b/security/integrity/iint.c index 1668cfbeb671..2428037d9e14 100644 --- a/security/integrity/iint.c +++ b/security/integrity/iint.c @@ -43,12 +43,10 @@ static struct integrity_iint_cache *__integrity_iint_find(struct inode *inode) else if (inode > iint->inode) n = n->rb_right; else - break; + return iint; } - if (!n) - return NULL; - return iint; + return NULL; } /* @@ -111,10 +109,15 @@ struct integrity_iint_cache *integrity_inode_get(struct inode *inode) parent = *p; test_iint = rb_entry(parent, struct integrity_iint_cache, rb_node); - if (inode < test_iint->inode) + if (inode < test_iint->inode) { p = &(*p)->rb_left; - else + } else if (inode > test_iint->inode) { p = &(*p)->rb_right; + } else { + write_unlock(&integrity_iint_lock); + kmem_cache_free(iint_cache, iint); + return test_iint; + } } iint->inode = inode; -- 2.34.1

2 1

[PATCH OLK-5.10 0/3] LoongArch: add 32/64 pc relative relocation type support
by Hongchen Zhang 31 Oct '23

31 Oct '23

Hongchen Zhang (3): LoongArch: Define relocation types for ABI v2.10 LoongArch: Add support for 32_PCREL relocation type LoongArch: Add support for 64_PCREL relocation type arch/loongarch/include/asm/elf.h | 9 +++++++++ arch/loongarch/kernel/module.c | 22 +++++++++++++++++++++- 2 files changed, 30 insertions(+), 1 deletion(-) -- 2.33.0

2 4

[PATCH openEuler-1.0-LTS v2 0/7] Fix netfilter nf_conntrack
by Lu Wei 31 Oct '23

31 Oct '23

Florian Westphal (6): netfilter: conntrack: tell compiler to not inline nf_ct_resolve_clash netfilter: conntrack: remove two args from resolve_clash netfilter: conntrack: place confirm-bit setting in a helper netfilter: conntrack: split resolve_clash function netfilter: conntrack: allow insertion of clashing entries netfilter: conntrack: do not auto-delete clash entries on reply Zhihao Cheng (1): ubi: Refuse attaching if mtd's erasesize is 0 -- V2: add a new bugfix patch 2.34.1

2 8

[PATCH OLK-5.10 0/4] fix memcgv1 oom meminfo bug
by Lu Jialin 31 Oct '23

31 Oct '23

Sergey Senozhatsky (1): seq_buf: Add seq_buf_do_printk() helper Steven Rostedt (VMware) (1): seq_buf: Add seq_buf_terminate() API Yosry Ahmed (2): memcg: use seq_buf_do_printk() with mem_cgroup_print_oom_meminfo() memcg: dump memory.stat during cgroup OOM for v1 include/linux/seq_buf.h | 27 +++++++++++++ lib/seq_buf.c | 32 +++++++++++++++ mm/memcontrol.c | 87 +++++++++++++++++++++++------------------ 3 files changed, 108 insertions(+), 38 deletions(-) -- 2.34.1

2 5

openEuler 测试讨论
by openEuler conference 31 Oct '23

31 Oct '23

您好！ Kernel SIG 邀请您参加 2023-10-31 15:30 召开的WeLink会议会议主题：openEuler 测试讨论会议链接：https://bmeeting.huaweicloud.com:36443/#/j/980828033 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the WeLink conference will be held at 2023-10-31 15:30, The subject of the conference is openEuler 测试讨论, You can join the meeting at https://bmeeting.huaweicloud.com:36443/#/j/980828033. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH OLK-5.10 v2 00/38] Add error handling for device_add_disk
by Zhong Jinghua 31 Oct '23

31 Oct '23

Befor these paths, block is not know when drvier is add fail. Now, add error handling for drivers. Christoph Hellwig (14): block: fold register_disk into device_add_disk block: call blk_integrity_add earlier in device_add_disk block: add the events* attributes to disk_attrs block: fix error unwinding in device_add_disk block: clear ->slave_dir when dropping the main slave_dir reference block: add blk_alloc_disk and blk_cleanup_disk APIs blk-mq: add the blk_mq_alloc_disk APIs loop: use blk_mq_alloc_disk and blk_cleanup_disk loop: fix order of cleaning up the queue and freeing the tagset nbd: use blk_mq_alloc_disk and blk_cleanup_disk block: add a flag to make put_disk on partially initalized disks safer nvme: use blk_mq_alloc_disk brd: convert to blk_alloc_disk/blk_cleanup_disk ubi: use blk_mq_alloc_disk and blk_cleanup_disk Dan Carpenter (1): blk-mq: fix an IS_ERR() vs NULL bug Luis Chamberlain (11): block: return errors from blk_integrity_add block: return errors from disk_alloc_events block: add error handling for device_add_disk / add_disk block: fix device_add_disk() kobject_create_and_add() error handling loop: add error handling support for add_disk() nbd: add error handling support for add_disk() nvme: add error handling support for add_disk() block/brd: add error handling support for add_disk() scsi: sd: Add error handling support for add_disk() scsi: sr: Add error handling support for add_disk() mtd/ubi/block: add error handling support for add_disk() Tetsuo Handa (1): block: check minor range in device_add_disk() Wang Qing (1): nbd: fix order of cleaning up the queue and freeing the tagset Yu Kuai (1): block: fix memory leak for elevator on add_disk failure Zhong Jinghua (9): block: return errors from blk_register_region block: Fix the kabi change in device_add_disk block: Fix the kabi change on blk_register_region block: call blk_get_queue earlier in __device_add_disk block: Fix minor range check in device_add_disk() block: Set memalloc_noio to false in the error path scsi: sd: Clean up sdkp if device_add_disk() failed mtd/ubi/block: Fix null pointer dereference issue in error path mtd/ubi/block: Fix uaf problem in ubiblock_cleanup block/blk-integrity.c | 12 +- block/blk-mq.c | 19 +++ block/blk.h | 5 +- block/genhd.c | 286 ++++++++++++++++++++++++++------------- drivers/block/brd.c | 103 ++++++-------- drivers/block/loop.c | 26 ++-- drivers/block/nbd.c | 59 ++++---- drivers/mtd/ubi/block.c | 76 +++++------ drivers/nvme/host/core.c | 41 +++--- drivers/scsi/sd.c | 8 +- drivers/scsi/sr.c | 7 +- include/linux/blk-mq.h | 12 ++ include/linux/genhd.h | 36 +++++ 13 files changed, 417 insertions(+), 273 deletions(-) -- 2.31.1

2 39

[PATCH OLK-5.10 1/3] LoongArch: Define relocation types for ABI v2.10
by Hongchen Zhang 31 Oct '23

31 Oct '23

The relocation types from 101 to 109 are used by GNU binutils >= 2.41, add their definitions to use them in later patches. Link: https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=include/elf/loongar… Cc: <stable(a)vger.kernel.org> Signed-off-by: Tiezhu Yang <yangtiezhu(a)loongson.cn> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- arch/loongarch/include/asm/elf.h | 9 +++++++++ arch/loongarch/kernel/module.c | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/arch/loongarch/include/asm/elf.h b/arch/loongarch/include/asm/elf.h index 7af0cebf28d7..b9a4ab54285c 100644 --- a/arch/loongarch/include/asm/elf.h +++ b/arch/loongarch/include/asm/elf.h @@ -111,6 +111,15 @@ #define R_LARCH_TLS_GD_HI20 98 #define R_LARCH_32_PCREL 99 #define R_LARCH_RELAX 100 +#define R_LARCH_DELETE 101 +#define R_LARCH_ALIGN 102 +#define R_LARCH_PCREL20_S2 103 +#define R_LARCH_CFA 104 +#define R_LARCH_ADD6 105 +#define R_LARCH_SUB6 106 +#define R_LARCH_ADD_ULEB128 107 +#define R_LARCH_SUB_ULEB128 108 +#define R_LARCH_64_PCREL 109 #ifndef ELF_ARCH diff --git a/arch/loongarch/kernel/module.c b/arch/loongarch/kernel/module.c index 8127df5dd0ad..0b8ce1e0f83b 100644 --- a/arch/loongarch/kernel/module.c +++ b/arch/loongarch/kernel/module.c @@ -387,7 +387,7 @@ typedef int (*reloc_rela_handler)(struct module *mod, u32 *location, Elf_Addr v, /* The handlers for known reloc types */ static reloc_rela_handler reloc_rela_handlers[] = { - [R_LARCH_NONE ... R_LARCH_RELAX] = apply_r_larch_error, + [R_LARCH_NONE ... R_LARCH_64_PCREL] = apply_r_larch_error, [R_LARCH_NONE] = apply_r_larch_none, [R_LARCH_32] = apply_r_larch_32, -- 2.33.0

2 1

[PATCH OLK-5.10 3/3] LoongArch: Add support for 64_PCREL relocation type
by Hongchen Zhang 31 Oct '23

31 Oct '23

When build and update kernel with the latest upstream binutils and loongson3_defconfig, module loader fails with: kmod: zsmalloc: Unknown relocation type 109 kmod: fuse: Unknown relocation type 109 kmod: fuse: Unknown relocation type 109 kmod: radeon: Unknown relocation type 109 kmod: nf_tables: Unknown relocation type 109 kmod: nf_tables: Unknown relocation type 109 This is because the latest upstream binutils replaces a pair of ADD64 and SUB64 with 64_PCREL, so add support for 64_PCREL relocation type. Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ecb802d02eeb Cc: <stable(a)vger.kernel.org> Signed-off-by: Tiezhu Yang <yangtiezhu(a)loongson.cn> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- arch/loongarch/kernel/module.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/loongarch/kernel/module.c b/arch/loongarch/kernel/module.c index a67f9def7927..b4cf3383a8bc 100644 --- a/arch/loongarch/kernel/module.c +++ b/arch/loongarch/kernel/module.c @@ -381,6 +381,15 @@ static int apply_r_larch_32_pcrel(struct module *mod, u32 *location, Elf_Addr v, return 0; } +static int apply_r_larch_64_pcrel(struct module *mod, u32 *location, Elf_Addr v, + s64 *rela_stack, size_t *rela_stack_top, unsigned int type) +{ + ptrdiff_t offset = (void *)v - (void *)location; + + *(u64 *)location = offset; + return 0; +} + /* * reloc_handlers_rela() - Apply a particular relocation to a module * @mod: the module to apply the reloc to @@ -414,6 +423,7 @@ static reloc_rela_handler reloc_rela_handlers[] = { [R_LARCH_PCALA_HI20...R_LARCH_PCALA64_HI12] = apply_r_larch_pcala, [R_LARCH_GOT_PC_HI20...R_LARCH_GOT_PC_LO12] = apply_r_larch_got_pc, [R_LARCH_32_PCREL] = apply_r_larch_32_pcrel, + [R_LARCH_64_PCREL] = apply_r_larch_64_pcrel, }; int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, -- 2.33.0

1 0

[PATCH OLK-5.10 2/3] LoongArch: Add support for 32_PCREL relocation type
by Hongchen Zhang 31 Oct '23

31 Oct '23

When build and update kernel with the latest upstream binutils and loongson3_defconfig, module loader fails with: kmod: zsmalloc: Unsupport relocation type 99, please add its support. kmod: fuse: Unsupport relocation type 99, please add its support. kmod: ipmi_msghandler: Unsupport relocation type 99, please add its support. kmod: ipmi_msghandler: Unsupport relocation type 99, please add its support. kmod: pstore: Unsupport relocation type 99, please add its support. kmod: drm_display_helper: Unsupport relocation type 99, please add its support. kmod: drm_display_helper: Unsupport relocation type 99, please add its support. kmod: drm_display_helper: Unsupport relocation type 99, please add its support. kmod: fuse: Unsupport relocation type 99, please add its support. kmod: fat: Unsupport relocation type 99, please add its support. This is because the latest upstream binutils replaces a pair of ADD32 and SUB32 with 32_PCREL, so add support for 32_PCREL relocation type. Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ecb802d02eeb Cc: <stable(a)vger.kernel.org> Co-developed-by: Youling Tang <tangyouling(a)loongson.cn> Signed-off-by: Youling Tang <tangyouling(a)loongson.cn> Signed-off-by: Tiezhu Yang <yangtiezhu(a)loongson.cn> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- arch/loongarch/kernel/module.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/loongarch/kernel/module.c b/arch/loongarch/kernel/module.c index 0b8ce1e0f83b..a67f9def7927 100644 --- a/arch/loongarch/kernel/module.c +++ b/arch/loongarch/kernel/module.c @@ -372,6 +372,15 @@ static int apply_r_larch_got_pc(struct module *mod, u32 *location, Elf_Addr v, return apply_r_larch_pcala(mod, location, got, rela_stack, rela_stack_top, type); } +static int apply_r_larch_32_pcrel(struct module *mod, u32 *location, Elf_Addr v, + s64 *rela_stack, size_t *rela_stack_top, unsigned int type) +{ + ptrdiff_t offset = (void *)v - (void *)location; + + *(u32 *)location = offset; + return 0; +} + /* * reloc_handlers_rela() - Apply a particular relocation to a module * @mod: the module to apply the reloc to @@ -404,6 +413,7 @@ static reloc_rela_handler reloc_rela_handlers[] = { [R_LARCH_B26] = apply_r_larch_b26, [R_LARCH_PCALA_HI20...R_LARCH_PCALA64_HI12] = apply_r_larch_pcala, [R_LARCH_GOT_PC_HI20...R_LARCH_GOT_PC_LO12] = apply_r_larch_got_pc, + [R_LARCH_32_PCREL] = apply_r_larch_32_pcrel, }; int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, -- 2.33.0

1 0

[PATCH OLK-5.10] io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid
by Baokun Li 30 Oct '23

30 Oct '23

From: Jens Axboe <axboe(a)kernel.dk> mainline inclusion from mainline-v6.7 commit 7644b1a1c9a7ae8ab99175989bfc8676055edb46 category: bugfix bugzilla: 189322, https://gitee.com/src-openeuler/kernel/issues/I8BQSX CVE: CVE-2023-46862 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We could race with SQ thread exit, and if we do, we'll hit a NULL pointer dereference when the thread is cleared. Grab the SQPOLL data lock before attempting to get the task cpu and pid for fdinfo, this ensures we have a stable view of it. Cc: stable(a)vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=218032 Reviewed-by: Gabriel Krisman Bertazi <krisman(a)suse.de> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: io_uring/io_uring.c Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- io_uring/io_uring.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 2e61a67938a7..3fa584b0ee0a 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -10180,7 +10180,7 @@ static int io_uring_show_cred(struct seq_file *m, unsigned int id, static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m) { - struct io_sq_data *sq = NULL; + int sq_pid = -1, sq_cpu = -1; bool has_lock; int i; @@ -10193,13 +10193,19 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m) has_lock = mutex_trylock(&ctx->uring_lock); if (has_lock && (ctx->flags & IORING_SETUP_SQPOLL)) { - sq = ctx->sq_data; - if (!sq->thread) - sq = NULL; + struct io_sq_data *sq = ctx->sq_data; + + if (mutex_trylock(&sq->lock)) { + if (sq->thread) { + sq_pid = task_pid_nr(sq->thread); + sq_cpu = task_cpu(sq->thread); + } + mutex_unlock(&sq->lock); + } } - seq_printf(m, "SqThread:\t%d\n", sq ? task_pid_nr(sq->thread) : -1); - seq_printf(m, "SqThreadCpu:\t%d\n", sq ? task_cpu(sq->thread) : -1); + seq_printf(m, "SqThread:\t%d\n", sq_pid); + seq_printf(m, "SqThreadCpu:\t%d\n", sq_cpu); seq_printf(m, "UserFiles:\t%u\n", ctx->nr_user_files); for (i = 0; has_lock && i < ctx->nr_user_files; i++) { struct file *f = io_file_from_index(ctx, i); -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS 0/4] bugfixes for CVE-2022-45884
by liwei 30 Oct '23

30 Oct '23

bugfixes for CVE-2022-45884 Hyunwoo Kim (1): media: dvb-core: Fix use-after-free due to race at dvb_register_device() Keita Suzuki (1): media: dvb-core: Fix double free in dvb_register_device() Lin Ma (2): media: dvbdev: adopts refcnt to avoid UAF media: dvbdev: fix refcnt bug drivers/media/dvb-core/dvb_ca_en50221.c | 2 +- drivers/media/dvb-core/dvb_frontend.c | 2 +- drivers/media/dvb-core/dvbdev.c | 122 ++++++++++++++++++------ include/media/dvbdev.h | 46 ++++++--- 4 files changed, 128 insertions(+), 44 deletions(-) -- 2.25.1

2 5

[openeuler 0/8] libhns: Support STARS over RDMA
by Chengchang Tang 30 Oct '23

30 Oct '23

STARS is a HW scheduler. These patches support hns RoCE working in STARS mode which means RoCE will be scheduled by STARS. Chengchang Tang (8): Update kernel headers for libhns query_device() libhns: Support query HW ID by hnsdv_query_device() Update kernel headers for supporting POE CQs libhns: Add support for POE CQs Update kernel headers for supporting STARS QP in HNS libhns: Support STARS mode QP Update kernel headers for supporting write with notify libhns: Support write with notify kernel-headers/rdma/hns-abi.h | 38 ++++++- providers/hns/hns_roce_u.c | 50 ++++++--- providers/hns/hns_roce_u.h | 1 + providers/hns/hns_roce_u_abi.h | 3 + providers/hns/hns_roce_u_hw_v2.c | 65 +++++++++-- providers/hns/hns_roce_u_hw_v2.h | 1 + providers/hns/hns_roce_u_verbs.c | 229 +++++++++++++++++++++++++++++++++++---- providers/hns/hnsdv.h | 50 +++++++++ providers/hns/libhns.map | 3 + 9 files changed, 393 insertions(+), 47 deletions(-) -- 2.9.5

1 8

[openeuler 0/6] RDMA/hns: Support STARS over RDMA
by Chengchang Tang 30 Oct '23

30 Oct '23

STARS is a HW scheduler. These patches support STARS taking over HNS RoCE. Chengchang Tang (6): RDMA/hns: Support query HW ID from user space. RDMA/hns: Fix print after query hw id failed. RDMA/hns: Support configuring POE channels and creating POE CQs RDMA/hns: Support STARS mode QP RDMA/hns: Support kernel ULP querying HW ID RDMA/hns: Support write with notify drivers/infiniband/hw/hns/Makefile | 3 +- drivers/infiniband/hw/hns/hns_roce_common.h | 3 + drivers/infiniband/hw/hns/hns_roce_cq.c | 114 +++++++++++++++++- drivers/infiniband/hw/hns/hns_roce_debugfs.c | 111 ++++++++++++++++++ drivers/infiniband/hw/hns/hns_roce_device.h | 63 ++++++++++ drivers/infiniband/hw/hns/hns_roce_ext.c | 143 +++++++++++++++++++++++ drivers/infiniband/hw/hns/hns_roce_ext.h | 66 +++++++++++ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 169 +++++++++++++++++++++++++-- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 52 +++++++++ drivers/infiniband/hw/hns/hns_roce_main.c | 62 +++++++++- drivers/infiniband/hw/hns/hns_roce_poe.c | 97 +++++++++++++++ drivers/infiniband/hw/hns/hns_roce_qp.c | 62 +++++++++- include/uapi/rdma/hns-abi.h | 37 +++++- 13 files changed, 966 insertions(+), 16 deletions(-) create mode 100644 drivers/infiniband/hw/hns/hns_roce_ext.c create mode 100644 drivers/infiniband/hw/hns/hns_roce_ext.h create mode 100644 drivers/infiniband/hw/hns/hns_roce_poe.c -- 2.9.5

1 6

[PATCH OLK-5.10 v2 00/38] Add error handling for device_add_disk
by Zhong Jinghua 30 Oct '23

30 Oct '23

From: Zhong Jinghua <zhongjinghua(a)huaweicloud.com> Befor these paths, block is not know when drvier is add fail. Now, add error handling for drivers. Christoph Hellwig (14): block: fold register_disk into device_add_disk block: call blk_integrity_add earlier in device_add_disk block: add the events* attributes to disk_attrs block: fix error unwinding in device_add_disk block: clear ->slave_dir when dropping the main slave_dir reference block: add blk_alloc_disk and blk_cleanup_disk APIs blk-mq: add the blk_mq_alloc_disk APIs loop: use blk_mq_alloc_disk and blk_cleanup_disk loop: fix order of cleaning up the queue and freeing the tagset nbd: use blk_mq_alloc_disk and blk_cleanup_disk block: add a flag to make put_disk on partially initalized disks safer nvme: use blk_mq_alloc_disk brd: convert to blk_alloc_disk/blk_cleanup_disk ubi: use blk_mq_alloc_disk and blk_cleanup_disk Dan Carpenter (1): blk-mq: fix an IS_ERR() vs NULL bug Luis Chamberlain (11): block: return errors from blk_integrity_add block: return errors from disk_alloc_events block: add error handling for device_add_disk / add_disk block: fix device_add_disk() kobject_create_and_add() error handling loop: add error handling support for add_disk() nbd: add error handling support for add_disk() nvme: add error handling support for add_disk() block/brd: add error handling support for add_disk() scsi: sd: Add error handling support for add_disk() scsi: sr: Add error handling support for add_disk() mtd/ubi/block: add error handling support for add_disk() Tetsuo Handa (1): block: check minor range in device_add_disk() Wang Qing (1): nbd: fix order of cleaning up the queue and freeing the tagset Yu Kuai (1): block: fix memory leak for elevator on add_disk failure Zhong Jinghua (9): block: return errors from blk_register_region block: Fix the kabi change in device_add_disk block: Fix the kabi change on blk_register_region block: call blk_get_queue earlier in __device_add_disk block: Fix minor range check in device_add_disk() block: Set memalloc_noio to false in the error path scsi: sd: Clean up sdkp if device_add_disk() failed mtd/ubi/block: Fix null pointer dereference issue in error path mtd/ubi/block: Fix uaf problem in ubiblock_cleanup block/blk-integrity.c | 12 +- block/blk-mq.c | 19 +++ block/blk.h | 5 +- block/genhd.c | 286 ++++++++++++++++++++++++++------------- drivers/block/brd.c | 103 ++++++-------- drivers/block/loop.c | 26 ++-- drivers/block/nbd.c | 59 ++++---- drivers/mtd/ubi/block.c | 76 +++++------ drivers/nvme/host/core.c | 41 +++--- drivers/scsi/sd.c | 8 +- drivers/scsi/sr.c | 7 +- include/linux/blk-mq.h | 12 ++ include/linux/genhd.h | 36 +++++ 13 files changed, 417 insertions(+), 273 deletions(-) -- 2.31.1

1 38

[PATCH OLK-5.10 0/3] fix CVE-2023-46813
by Yu Liao 30 Oct '23

30 Oct '23

fix CVE-2023-46813 An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it. Borislav Petkov (AMD) (1): [Backport] x86/sev: Disable MMIO emulation from user mode Joerg Roedel (2): [Backport] x86/sev: Check IOBM for IOIO exceptions from user-space [Backport] x86/sev: Check for user-space IOIO pointing to kernel space arch/x86/boot/compressed/sev-es.c | 10 ++++++ arch/x86/kernel/sev-es-shared.c | 53 +++++++++++++++++++++++++------ arch/x86/kernel/sev-es.c | 30 +++++++++++++++++ 3 files changed, 84 insertions(+), 9 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10 v2 00/38] Add error handling for device_add_disk
by Zhong Jinghua 30 Oct '23

30 Oct '23

From: Zhong Jinghua <zhongjinghua(a)huaweicloud.com> Befor these paths, block is not know when drvier is add fail. Now, add error handling for drivers. Christoph Hellwig (14): block: fold register_disk into device_add_disk block: call blk_integrity_add earlier in device_add_disk block: add the events* attributes to disk_attrs block: fix error unwinding in device_add_disk block: clear ->slave_dir when dropping the main slave_dir reference block: add blk_alloc_disk and blk_cleanup_disk APIs blk-mq: add the blk_mq_alloc_disk APIs loop: use blk_mq_alloc_disk and blk_cleanup_disk loop: fix order of cleaning up the queue and freeing the tagset nbd: use blk_mq_alloc_disk and blk_cleanup_disk block: add a flag to make put_disk on partially initalized disks safer nvme: use blk_mq_alloc_disk brd: convert to blk_alloc_disk/blk_cleanup_disk ubi: use blk_mq_alloc_disk and blk_cleanup_disk Dan Carpenter (1): blk-mq: fix an IS_ERR() vs NULL bug Luis Chamberlain (11): block: return errors from blk_integrity_add block: return errors from disk_alloc_events block: add error handling for device_add_disk / add_disk block: fix device_add_disk() kobject_create_and_add() error handling loop: add error handling support for add_disk() nbd: add error handling support for add_disk() nvme: add error handling support for add_disk() block/brd: add error handling support for add_disk() scsi: sd: Add error handling support for add_disk() scsi: sr: Add error handling support for add_disk() mtd/ubi/block: add error handling support for add_disk() Tetsuo Handa (1): block: check minor range in device_add_disk() Wang Qing (1): nbd: fix order of cleaning up the queue and freeing the tagset Yu Kuai (1): block: fix memory leak for elevator on add_disk failure Zhong Jinghua (9): block: return errors from blk_register_region block: Fix the kabi change in device_add_disk block: Fix the kabi change on blk_register_region block: call blk_get_queue earlier in __device_add_disk block: Fix minor range check in device_add_disk() block: Set memalloc_noio to false in the error path scsi: sd: Clean up sdkp if device_add_disk() failed mtd/ubi/block: Fix null pointer dereference issue in error path mtd/ubi/block: Fix uaf problem in ubiblock_cleanup block/blk-integrity.c | 12 +- block/blk-mq.c | 19 +++ block/blk.h | 5 +- block/genhd.c | 286 ++++++++++++++++++++++++++------------- drivers/block/brd.c | 103 ++++++-------- drivers/block/loop.c | 26 ++-- drivers/block/nbd.c | 59 ++++---- drivers/mtd/ubi/block.c | 76 +++++------ drivers/nvme/host/core.c | 41 +++--- drivers/scsi/sd.c | 8 +- drivers/scsi/sr.c | 7 +- include/linux/blk-mq.h | 12 ++ include/linux/genhd.h | 36 +++++ 13 files changed, 417 insertions(+), 273 deletions(-) -- 2.31.1

2 39

[openEuler-1.0-LTS 00/15] Fix the UAF when task fails.
by Zhong Jinghua 30 Oct '23

30 Oct '23

The NetLlink mechanism is used to send unreliable notifications when a task fails. Bharath Ravi (1): scsi: iscsi: Perform connection failure entirely in kernel space Gabriel Krisman Bertazi (2): scsi: iscsi: Report connection state in sysfs scsi: iscsi: Fix deadlock on recovery path during GFP_IO reclaim Gulam Mohamed (1): scsi: iscsi: Fix race condition between login and sync thread Mike Christie (10): scsi: iscsi: Fix iSCSI cls conn state scsi: iscsi: Force immediate failure during shutdown scsi: iscsi: Rel ref after iscsi_lookup_endpoint() scsi: iscsi: Fix in-kernel conn failure handling scsi: iscsi: Fix set_param() handling scsi: iscsi: Move iscsi_ep_disconnect() scsi: iscsi: Fix offload conn cleanup when iscsid restarts scsi: iscsi: Fix conn cleanup and stop race during iscsid restart scsi: iscsi: Fix endpoint reuse regression scsi: iscsi: Fix unbound endpoint error handling Zhong Jinghua (1): scsi: iscsi: Fix kabi change in iscsi_cls_conn drivers/infiniband/ulp/iser/iscsi_iser.c | 1 + drivers/scsi/be2iscsi/be_iscsi.c | 19 +- drivers/scsi/bnx2i/bnx2i_iscsi.c | 23 +- drivers/scsi/cxgbi/libcxgbi.c | 12 +- drivers/scsi/libiscsi.c | 21 +- drivers/scsi/qedi/qedi_iscsi.c | 25 +- drivers/scsi/qla4xxx/ql4_os.c | 1 + drivers/scsi/scsi_transport_iscsi.c | 487 ++++++++++++++++++----- include/scsi/scsi_transport_iscsi.h | 28 ++ 9 files changed, 485 insertions(+), 132 deletions(-) -- 2.31.1

1 15

[PATCH OLK-5.10] net: xfrm: Fix xfrm_address_filter OOB read
by Dong Chenchen 30 Oct '23

30 Oct '23

From: Lin Ma <linma(a)zju.edu.cn> stable inclusion from stable-v5.10.192 commit 7e50815d29037e08d3d26f3ebc41bcec729847b7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I85DZ6 CVE: CVE-2023-39194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dfa73c17d55b921e1d4e154976de35317e43a93a ] We found below OOB crash: [ 44.211730] ================================================================== [ 44.212045] BUG: KASAN: slab-out-of-bounds in memcmp+0x8b/0xb0 [ 44.212045] Read of size 8 at addr ffff88800870f320 by task poc.xfrm/97 [ 44.212045] [ 44.212045] CPU: 0 PID: 97 Comm: poc.xfrm Not tainted 6.4.0-rc7-00072-gdad9774deaf1-dirty #4 [ 44.212045] Call Trace: [ 44.212045] <TASK> [ 44.212045] dump_stack_lvl+0x37/0x50 [ 44.212045] print_report+0xcc/0x620 [ 44.212045] ? __virt_addr_valid+0xf3/0x170 [ 44.212045] ? memcmp+0x8b/0xb0 [ 44.212045] kasan_report+0xb2/0xe0 [ 44.212045] ? memcmp+0x8b/0xb0 [ 44.212045] kasan_check_range+0x39/0x1c0 [ 44.212045] memcmp+0x8b/0xb0 [ 44.212045] xfrm_state_walk+0x21c/0x420 [ 44.212045] ? __pfx_dump_one_state+0x10/0x10 [ 44.212045] xfrm_dump_sa+0x1e2/0x290 [ 44.212045] ? __pfx_xfrm_dump_sa+0x10/0x10 [ 44.212045] ? __kernel_text_address+0xd/0x40 [ 44.212045] ? kasan_unpoison+0x27/0x60 [ 44.212045] ? mutex_lock+0x60/0xe0 [ 44.212045] ? __pfx_mutex_lock+0x10/0x10 [ 44.212045] ? kasan_save_stack+0x22/0x50 [ 44.212045] netlink_dump+0x322/0x6c0 [ 44.212045] ? __pfx_netlink_dump+0x10/0x10 [ 44.212045] ? mutex_unlock+0x7f/0xd0 [ 44.212045] ? __pfx_mutex_unlock+0x10/0x10 [ 44.212045] __netlink_dump_start+0x353/0x430 [ 44.212045] xfrm_user_rcv_msg+0x3a4/0x410 [ 44.212045] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 44.212045] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 44.212045] ? __pfx_xfrm_dump_sa+0x10/0x10 [ 44.212045] ? __pfx_xfrm_dump_sa_done+0x10/0x10 [ 44.212045] ? __stack_depot_save+0x382/0x4e0 [ 44.212045] ? filter_irq_stacks+0x1c/0x70 [ 44.212045] ? kasan_save_stack+0x32/0x50 [ 44.212045] ? kasan_save_stack+0x22/0x50 [ 44.212045] ? kasan_set_track+0x25/0x30 [ 44.212045] ? __kasan_slab_alloc+0x59/0x70 [ 44.212045] ? kmem_cache_alloc_node+0xf7/0x260 [ 44.212045] ? kmalloc_reserve+0xab/0x120 [ 44.212045] ? __alloc_skb+0xcf/0x210 [ 44.212045] ? netlink_sendmsg+0x509/0x700 [ 44.212045] ? sock_sendmsg+0xde/0xe0 [ 44.212045] ? __sys_sendto+0x18d/0x230 [ 44.212045] ? __x64_sys_sendto+0x71/0x90 [ 44.212045] ? do_syscall_64+0x3f/0x90 [ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] ? netlink_sendmsg+0x509/0x700 [ 44.212045] ? sock_sendmsg+0xde/0xe0 [ 44.212045] ? __sys_sendto+0x18d/0x230 [ 44.212045] ? __x64_sys_sendto+0x71/0x90 [ 44.212045] ? do_syscall_64+0x3f/0x90 [ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] ? kasan_save_stack+0x22/0x50 [ 44.212045] ? kasan_set_track+0x25/0x30 [ 44.212045] ? kasan_save_free_info+0x2e/0x50 [ 44.212045] ? __kasan_slab_free+0x10a/0x190 [ 44.212045] ? kmem_cache_free+0x9c/0x340 [ 44.212045] ? netlink_recvmsg+0x23c/0x660 [ 44.212045] ? sock_recvmsg+0xeb/0xf0 [ 44.212045] ? __sys_recvfrom+0x13c/0x1f0 [ 44.212045] ? __x64_sys_recvfrom+0x71/0x90 [ 44.212045] ? do_syscall_64+0x3f/0x90 [ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] ? copyout+0x3e/0x50 [ 44.212045] netlink_rcv_skb+0xd6/0x210 [ 44.212045] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 44.212045] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 44.212045] ? __pfx_sock_has_perm+0x10/0x10 [ 44.212045] ? mutex_lock+0x8d/0xe0 [ 44.212045] ? __pfx_mutex_lock+0x10/0x10 [ 44.212045] xfrm_netlink_rcv+0x44/0x50 [ 44.212045] netlink_unicast+0x36f/0x4c0 [ 44.212045] ? __pfx_netlink_unicast+0x10/0x10 [ 44.212045] ? netlink_recvmsg+0x500/0x660 [ 44.212045] netlink_sendmsg+0x3b7/0x700 [ 44.212045] ? __pfx_netlink_sendmsg+0x10/0x10 [ 44.212045] ? __pfx_netlink_sendmsg+0x10/0x10 [ 44.212045] sock_sendmsg+0xde/0xe0 [ 44.212045] __sys_sendto+0x18d/0x230 [ 44.212045] ? __pfx___sys_sendto+0x10/0x10 [ 44.212045] ? rcu_core+0x44a/0xe10 [ 44.212045] ? __rseq_handle_notify_resume+0x45b/0x740 [ 44.212045] ? _raw_spin_lock_irq+0x81/0xe0 [ 44.212045] ? __pfx___rseq_handle_notify_resume+0x10/0x10 [ 44.212045] ? __pfx_restore_fpregs_from_fpstate+0x10/0x10 [ 44.212045] ? __pfx_blkcg_maybe_throttle_current+0x10/0x10 [ 44.212045] ? __pfx_task_work_run+0x10/0x10 [ 44.212045] __x64_sys_sendto+0x71/0x90 [ 44.212045] do_syscall_64+0x3f/0x90 [ 44.212045] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] RIP: 0033:0x44b7da [ 44.212045] RSP: 002b:00007ffdc8838548 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 44.212045] RAX: ffffffffffffffda RBX: 00007ffdc8839978 RCX: 000000000044b7da [ 44.212045] RDX: 0000000000000038 RSI: 00007ffdc8838770 RDI: 0000000000000003 [ 44.212045] RBP: 00007ffdc88385b0 R08: 00007ffdc883858c R09: 000000000000000c [ 44.212045] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 44.212045] R13: 00007ffdc8839968 R14: 00000000004c37d0 R15: 0000000000000001 [ 44.212045] </TASK> [ 44.212045] [ 44.212045] Allocated by task 97: [ 44.212045] kasan_save_stack+0x22/0x50 [ 44.212045] kasan_set_track+0x25/0x30 [ 44.212045] __kasan_kmalloc+0x7f/0x90 [ 44.212045] __kmalloc_node_track_caller+0x5b/0x140 [ 44.212045] kmemdup+0x21/0x50 [ 44.212045] xfrm_dump_sa+0x17d/0x290 [ 44.212045] netlink_dump+0x322/0x6c0 [ 44.212045] __netlink_dump_start+0x353/0x430 [ 44.212045] xfrm_user_rcv_msg+0x3a4/0x410 [ 44.212045] netlink_rcv_skb+0xd6/0x210 [ 44.212045] xfrm_netlink_rcv+0x44/0x50 [ 44.212045] netlink_unicast+0x36f/0x4c0 [ 44.212045] netlink_sendmsg+0x3b7/0x700 [ 44.212045] sock_sendmsg+0xde/0xe0 [ 44.212045] __sys_sendto+0x18d/0x230 [ 44.212045] __x64_sys_sendto+0x71/0x90 [ 44.212045] do_syscall_64+0x3f/0x90 [ 44.212045] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] [ 44.212045] The buggy address belongs to the object at ffff88800870f300 [ 44.212045] which belongs to the cache kmalloc-64 of size 64 [ 44.212045] The buggy address is located 32 bytes inside of [ 44.212045] allocated 36-byte region [ffff88800870f300, ffff88800870f324) [ 44.212045] [ 44.212045] The buggy address belongs to the physical page: [ 44.212045] page:00000000e4de16ee refcount:1 mapcount:0 mapping:000000000 ... [ 44.212045] flags: 0x100000000000200(slab|node=0|zone=1) [ 44.212045] page_type: 0xffffffff() [ 44.212045] raw: 0100000000000200 ffff888004c41640 dead000000000122 0000000000000000 [ 44.212045] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 44.212045] page dumped because: kasan: bad access detected [ 44.212045] [ 44.212045] Memory state around the buggy address: [ 44.212045] ffff88800870f200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 44.212045] ffff88800870f280: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] >ffff88800870f300: 00 00 00 00 04 fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] ^ [ 44.212045] ffff88800870f380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] ffff88800870f400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] ================================================================== By investigating the code, we find the root cause of this OOB is the lack of checks in xfrm_dump_sa(). The buggy code allows a malicious user to pass arbitrary value of filter->splen/dplen. Hence, with crafted xfrm states, the attacker can achieve 8 bytes heap OOB read, which causes info leak. if (attrs[XFRMA_ADDRESS_FILTER]) { filter = kmemdup(nla_data(attrs[XFRMA_ADDRESS_FILTER]), sizeof(*filter), GFP_KERNEL); if (filter == NULL) return -ENOMEM; // NO MORE CHECKS HERE !!! } This patch fixes the OOB by adding necessary boundary checks, just like the code in pfkey_dump() function. Fixes: d3623099d350 ("ipsec: add support of limited SA dump") Signed-off-by: Lin Ma <linma(a)zju.edu.cn> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/xfrm/xfrm_user.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 138f71c67969..9956acbaffcc 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -1049,6 +1049,15 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb) sizeof(*filter), GFP_KERNEL); if (filter == NULL) return -ENOMEM; + + /* see addr_match(), (prefix length >> 5) << 2 + * will be used to compare xfrm_address_t + */ + if (filter->splen > (sizeof(xfrm_address_t) << 3) || + filter->dplen > (sizeof(xfrm_address_t) << 3)) { + kfree(filter); + return -EINVAL; + } } if (attrs[XFRMA_PROTO]) -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS v2 00/16] arm64: fix a concurrency issue in emulation_proc_handler()
by Jinjie Ruan 30 Oct '23

30 Oct '23

In linux-6.1, the related code is refactored in commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") and this issue was incidentally fixed. This patch set try to adapt the refactoring stable 5.10 patches to solve the problem of repeated addition of linked lists described below. How to reproduce: CONFIG_ARMV8_DEPRECATED=y, CONFIG_SWP_EMULATION=y, and CONFIG_DEBUG_LIST=y, then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 1 > /proc/sys/abi/swp done or "echo 1 > /proc/sys/abi/swp" and then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 0 > /proc/sys/abi/swp done In emulation_proc_handler(), read and write operations are performed on insn->current_mode. In the concurrency scenario, mutex only protects writing insn->current_mode, and not protects the read. Suppose there are two concurrent tasks, task1 updates insn->current_mode to INSN_EMULATE in the critical section, the prev_mode of task2 is still the old data INSN_UNDEF of insn->current_mode. As a result, two tasks call update_insn_emulation_mode twice with prev_mode = INSN_UNDEF and current_mode = INSN_EMULATE, then call register_emulation_hooks twice, resulting in a list_add double problem. commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") remove the dynamic registration and unregistration so remove the register_undef_hook() function, so the below problem was incidentally fixed. Call trace: __list_add_valid+0xd8/0xe4 register_undef_hook+0x94/0x13c update_insn_emulation_mode+0xd0/0x12c emulation_proc_handler+0xd8/0xf4 proc_sys_call_handler+0x140/0x250 proc_sys_write+0x1c/0x2c new_sync_write+0xec/0x18c vfs_write+0x214/0x2ac ksys_write+0x70/0xfc __arm64_sys_write+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0x94 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Call trace: __list_del_entry_valid+0xac/0x110 unregister_undef_hook+0x34/0x80 update_insn_emulation_mode+0xf0/0x180 emulation_proc_handler+0x8c/0xd8 proc_sys_call_handler+0x1d8/0x208 proc_sys_write+0x14/0x20 new_sync_write+0xf0/0x190 vfs_write+0x304/0x388 ksys_write+0x6c/0x100 __arm64_sys_write+0x1c/0x28 el0_svc_common.constprop.4+0x68/0x188 do_el0_svc+0x24/0xa0 el0_svc+0x14/0x20 el0_sync_handler+0x90/0xb8 el0_sync+0x160/0x180 The first patch is the self-developed patch, so revert it. The next 5 patches is a patch set which provides context for subsequent refactoring 9 patches, especially commit 0f2cb928a154 ("arm64: consistently pass ESR_ELx to die()") which modify do_undefinstr() to add a ESR_ELx value arg, and then commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") splits do_undefinstr() handler into separate do_el0_undef() and do_el1_undef() handlers. The 9 patches after that is another refactoring patch set, which is in preparation for the main rework commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling"). To remove struct undef_hook, commit bff8f413c71f ("arm64: factor out EL1 SSBS emulation hook") factor out EL1 SSBS emulation hook, which also avoid call call_undef_hook() in do_el1_undef(), commit f5962add74b6 ("arm64: rework EL0 MRS emulation") factor out EL0 MRS emulation hook, which also prepare for replacing call_undef_hook() in do_el0_undef(). To replace call_undef_hook() function, commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") split the do_undefinstr() into do_el0_undef() and do_el1_undef() functions, and commit dbfbd87efa79 ("arm64: factor insn read out of call_undef_hook()") factor user_insn_read() from call_undef_hook() so the main rework patch can replace the call_undef_hook() in do_el0_undef(). The last patch is a bugfix for the main rework patch. Fixes: af483947d472 ("arm64: fix oops in concurrently setting insn_emulation sysctls") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Jinjie Ruan (1): Revert "arm64: fix a concurrency issue in emulation_proc_handler()" Mark Rutland (14): arm64: report EL1 UNDEFs better arm64: die(): pass 'err' as long arm64: consistently pass ESR_ELx to die() arm64: rework FPAC exception handling arm64: rework BTI exception handling arm64: allow kprobes on EL0 handlers arm64: split EL0/EL1 UNDEF handlers arm64: factor out EL1 SSBS emulation hook arm64: factor insn read out of call_undef_hook() arm64: rework EL0 MRS emulation arm64: armv8_deprecated: fold ops into insn_emulation arm64: armv8_deprecated move emulation functions arm64: armv8_deprecated: move aarch32 helper earlier arm64: armv8_deprecated: rework deprected instruction handling Ren Zhijie (1): arm64: armv8_deprecated: fix unused-function error arch/arm64/include/asm/cpufeature.h | 3 +- arch/arm64/include/asm/exception.h | 13 +- arch/arm64/include/asm/spectre.h | 2 + arch/arm64/include/asm/system_misc.h | 2 +- arch/arm64/include/asm/traps.h | 19 +- arch/arm64/kernel/armv8_deprecated.c | 574 +++++++++++++-------------- arch/arm64/kernel/cpufeature.c | 23 +- arch/arm64/kernel/entry-common.c | 36 +- arch/arm64/kernel/proton-pack.c | 26 +- arch/arm64/kernel/traps.c | 125 +++--- 10 files changed, 396 insertions(+), 427 deletions(-) -- 2.34.1

2 17

[PATCH openEuler-22.03-LTS-SP1 00/15] arm64: fix a concurrency issue in emulation_proc_handler()
by Jinjie Ruan 30 Oct '23

30 Oct '23

In linux-6.1, the related code is refactored in commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") and this issue was incidentally fixed. This patch set try to adapt the refactoring stable 5.10 patches to solve the problem of repeated addition of linked lists described below. How to reproduce: CONFIG_ARMV8_DEPRECATED=y, CONFIG_SWP_EMULATION=y, and CONFIG_DEBUG_LIST=y, then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 1 > /proc/sys/abi/swp done or "echo 1 > /proc/sys/abi/swp" and then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 0 > /proc/sys/abi/swp done In emulation_proc_handler(), read and write operations are performed on insn->current_mode. In the concurrency scenario, mutex only protects writing insn->current_mode, and not protects the read. Suppose there are two concurrent tasks, task1 updates insn->current_mode to INSN_EMULATE in the critical section, the prev_mode of task2 is still the old data INSN_UNDEF of insn->current_mode. As a result, two tasks call update_insn_emulation_mode twice with prev_mode = INSN_UNDEF and current_mode = INSN_EMULATE, then call register_emulation_hooks twice, resulting in a list_add double problem. commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") remove the dynamic registration and unregistration so remove the register_undef_hook() function, so the below problem was incidentally fixed. Call trace: __list_add_valid+0xd8/0xe4 register_undef_hook+0x94/0x13c update_insn_emulation_mode+0xd0/0x12c emulation_proc_handler+0xd8/0xf4 proc_sys_call_handler+0x140/0x250 proc_sys_write+0x1c/0x2c new_sync_write+0xec/0x18c vfs_write+0x214/0x2ac ksys_write+0x70/0xfc __arm64_sys_write+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0x94 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Call trace: __list_del_entry_valid+0xac/0x110 unregister_undef_hook+0x34/0x80 update_insn_emulation_mode+0xf0/0x180 emulation_proc_handler+0x8c/0xd8 proc_sys_call_handler+0x1d8/0x208 proc_sys_write+0x14/0x20 new_sync_write+0xf0/0x190 vfs_write+0x304/0x388 ksys_write+0x6c/0x100 __arm64_sys_write+0x1c/0x28 el0_svc_common.constprop.4+0x68/0x188 do_el0_svc+0x24/0xa0 el0_svc+0x14/0x20 el0_sync_handler+0x90/0xb8 el0_sync+0x160/0x180 The first patch is the self-developed patch, so revert it. The next 4 patches is a patch set which provides context for subsequent refactoring 9 patches, especially commit 0f2cb928a154 ("arm64: consistently pass ESR_ELx to die()") which modify do_undefinstr() to add a ESR_ELx value arg, and then commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") splits do_undefinstr() handler into separate do_el0_undef() and do_el1_undef() handlers. The 9 patches after that is another refactoring patch set, which is in preparation for the main rework commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling"). To remove struct undef_hook, commit bff8f413c71f ("arm64: factor out EL1 SSBS emulation hook") factor out EL1 SSBS emulation hook, which also avoid call call_undef_hook() in do_el1_undef(), commit f5962add74b6 ("arm64: rework EL0 MRS emulation") factor out EL0 MRS emulation hook, which also prepare for replacing call_undef_hook() in do_el0_undef(). To replace call_undef_hook() function, commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") split the do_undefinstr() into do_el0_undef() and do_el1_undef() functions, and commit dbfbd87efa79 ("arm64: factor insn read out of call_undef_hook()") factor user_insn_read() from call_undef_hook() so the main rework patch can replace the call_undef_hook() in do_el0_undef(). The last patch is a bugfix for the main rework patch. Fixes: af483947d472 ("arm64: fix oops in concurrently setting insn_emulation sysctls") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Jinjie Ruan (1): Revert "arm64: fix a concurrency issue in emulation_proc_handler()" Mark Rutland (13): arm64: die(): pass 'err' as long arm64: consistently pass ESR_ELx to die() arm64: rework FPAC exception handling arm64: rework BTI exception handling arm64: allow kprobes on EL0 handlers arm64: split EL0/EL1 UNDEF handlers arm64: factor out EL1 SSBS emulation hook arm64: factor insn read out of call_undef_hook() arm64: rework EL0 MRS emulation arm64: armv8_deprecated: fold ops into insn_emulation arm64: armv8_deprecated move emulation functions arm64: armv8_deprecated: move aarch32 helper earlier arm64: armv8_deprecated: rework deprected instruction handling Ren Zhijie (1): arm64: armv8_deprecated: fix unused-function error arch/arm64/include/asm/cpufeature.h | 3 +- arch/arm64/include/asm/exception.h | 13 +- arch/arm64/include/asm/spectre.h | 2 + arch/arm64/include/asm/system_misc.h | 2 +- arch/arm64/include/asm/traps.h | 19 +- arch/arm64/kernel/armv8_deprecated.c | 574 +++++++++++++-------------- arch/arm64/kernel/cpufeature.c | 23 +- arch/arm64/kernel/entry-common.c | 36 +- arch/arm64/kernel/proton-pack.c | 26 +- arch/arm64/kernel/traps.c | 125 +++--- 10 files changed, 395 insertions(+), 428 deletions(-) -- 2.34.1

2 16

[PATCH openEuler-22.03-LTS 00/16] arm64: fix a concurrency issue in emulation_proc_handler()
by Jinjie Ruan 30 Oct '23

30 Oct '23

In linux-6.1, the related code is refactored in commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") and this issue was incidentally fixed. This patch set try to adapt the refactoring stable 5.10 patches to solve the problem of repeated addition of linked lists described below. How to reproduce: CONFIG_ARMV8_DEPRECATED=y, CONFIG_SWP_EMULATION=y, and CONFIG_DEBUG_LIST=y, then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 1 > /proc/sys/abi/swp done or "echo 1 > /proc/sys/abi/swp" and then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 0 > /proc/sys/abi/swp done In emulation_proc_handler(), read and write operations are performed on insn->current_mode. In the concurrency scenario, mutex only protects writing insn->current_mode, and not protects the read. Suppose there are two concurrent tasks, task1 updates insn->current_mode to INSN_EMULATE in the critical section, the prev_mode of task2 is still the old data INSN_UNDEF of insn->current_mode. As a result, two tasks call update_insn_emulation_mode twice with prev_mode = INSN_UNDEF and current_mode = INSN_EMULATE, then call register_emulation_hooks twice, resulting in a list_add double problem. commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") remove the dynamic registration and unregistration so remove the register_undef_hook() function, so the below problem was incidentally fixed. Call trace: __list_add_valid+0xd8/0xe4 register_undef_hook+0x94/0x13c update_insn_emulation_mode+0xd0/0x12c emulation_proc_handler+0xd8/0xf4 proc_sys_call_handler+0x140/0x250 proc_sys_write+0x1c/0x2c new_sync_write+0xec/0x18c vfs_write+0x214/0x2ac ksys_write+0x70/0xfc __arm64_sys_write+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0x94 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Call trace: __list_del_entry_valid+0xac/0x110 unregister_undef_hook+0x34/0x80 update_insn_emulation_mode+0xf0/0x180 emulation_proc_handler+0x8c/0xd8 proc_sys_call_handler+0x1d8/0x208 proc_sys_write+0x14/0x20 new_sync_write+0xf0/0x190 vfs_write+0x304/0x388 ksys_write+0x6c/0x100 __arm64_sys_write+0x1c/0x28 el0_svc_common.constprop.4+0x68/0x188 do_el0_svc+0x24/0xa0 el0_svc+0x14/0x20 el0_sync_handler+0x90/0xb8 el0_sync+0x160/0x180 The first patch is the self-developed patch, so revert it. The next 5 patches is a patch set which provides context for subsequent refactoring 9 patches, especially commit 0f2cb928a154 ("arm64: consistently pass ESR_ELx to die()") which modify do_undefinstr() to add a ESR_ELx value arg, and then commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") splits do_undefinstr() handler into separate do_el0_undef() and do_el1_undef() handlers. The 9 patches after that is another refactoring patch set, which is in preparation for the main rework commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling"). To remove struct undef_hook, commit bff8f413c71f ("arm64: factor out EL1 SSBS emulation hook") factor out EL1 SSBS emulation hook, which also avoid call call_undef_hook() in do_el1_undef(), commit f5962add74b6 ("arm64: rework EL0 MRS emulation") factor out EL0 MRS emulation hook, which also prepare for replacing call_undef_hook() in do_el0_undef(). To replace call_undef_hook() function, commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") split the do_undefinstr() into do_el0_undef() and do_el1_undef() functions, and commit dbfbd87efa79 ("arm64: factor insn read out of call_undef_hook()") factor user_insn_read() from call_undef_hook() so the main rework patch can replace the call_undef_hook() in do_el0_undef(). The last patch is a bugfix for the main rework patch. Fixes: af483947d472 ("arm64: fix oops in concurrently setting insn_emulation sysctls") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Jinjie Ruan (1): Revert "arm64: fix a concurrency issue in emulation_proc_handler()" Mark Rutland (14): arm64: report EL1 UNDEFs better arm64: die(): pass 'err' as long arm64: consistently pass ESR_ELx to die() arm64: rework FPAC exception handling arm64: rework BTI exception handling arm64: allow kprobes on EL0 handlers arm64: split EL0/EL1 UNDEF handlers arm64: factor out EL1 SSBS emulation hook arm64: factor insn read out of call_undef_hook() arm64: rework EL0 MRS emulation arm64: armv8_deprecated: fold ops into insn_emulation arm64: armv8_deprecated move emulation functions arm64: armv8_deprecated: move aarch32 helper earlier arm64: armv8_deprecated: rework deprected instruction handling Ren Zhijie (1): arm64: armv8_deprecated: fix unused-function error arch/arm64/include/asm/cpufeature.h | 3 +- arch/arm64/include/asm/exception.h | 13 +- arch/arm64/include/asm/spectre.h | 2 + arch/arm64/include/asm/system_misc.h | 2 +- arch/arm64/include/asm/traps.h | 19 +- arch/arm64/kernel/armv8_deprecated.c | 574 +++++++++++++-------------- arch/arm64/kernel/cpufeature.c | 23 +- arch/arm64/kernel/entry-common.c | 36 +- arch/arm64/kernel/proton-pack.c | 26 +- arch/arm64/kernel/traps.c | 125 +++--- 10 files changed, 396 insertions(+), 427 deletions(-) -- 2.34.1

2 17

[PATCH OLK-5.10 0/3] Synchronize mainline hisilicon uncore pmu driver bugfix to openEuler-OLK-5.10
by Junhao He 28 Oct '23

28 Oct '23

Synchronize mainline hisilicon uncore pmu driver bugfix to openEuler-OLK-5.10 This patchset includes 2 minor updates for the hisi_pcie_pmu: - fix issue that we may touch others events in some case - modify the event->cpu only on the success pmu::event_init() - dix use-after-free when register hisilicon ddrc pmu fails Junhao He (1): perf: hisi: Fix use-after-free when register pmu fails Yicong Yang (2): drivers/perf: hisi_pcie: Check the type first in pmu::event_init() drivers/perf: hisi_pcie: Initialize event->cpu only on success drivers/perf/hisilicon/hisi_pcie_pmu.c | 9 +++++---- drivers/perf/hisilicon/hisi_uncore_pa_pmu.c | 4 ++-- drivers/perf/hisilicon/hisi_uncore_sllc_pmu.c | 4 ++-- 3 files changed, 9 insertions(+), 8 deletions(-) -- 2.33.0

2 4

[PATCH OLK-5.10 0/7] coresight: trbe: Enable ACPI based devices
by Junhao He 28 Oct '23

28 Oct '23

This series enables detection of ACPI based TRBE devices via a stand alone purpose built representative platform device. But as a pre-requisite this changes coresight_platform_data structure assignment for the TRBE device. | commit from OLK-5.10 | patch | Conflict or Not | description | | --------------- | ------------ | --------------- | ------------ | | 003e440c95a0 | coresight: trbe: Enable ACPI based TRBE devices | No | | | c64a976a27cd | coresight: trbe: Add a representative coresight_platform_data for TRBE | No | | | eb630e5b2a47 | arm_pmu: acpi: Add a representative platform device for TRBE | Yes | Resolve code conflicts without changing functions | | a25b79f824ec | arm_pmu: acpi: Refactor arm_spe_acpi_register_device() | No | | | 54c422019d57 | Revert "coresight: Return the pointer of @pdata when not "fwnode"" | No | mainline`s patch "c64a976a27cd" fixes the issue | | 7e4acd18f0d0 | Revert "arm64/trbe: Add initial MADT/SPE probing" | No | mainline`s patch "eb630e5b2a47" adds ARM TRBE device support | | fbdfedf671b9 | Revert "coresight: trbe: Enable ACPI/Platform automatic module loading" | No | mainline`s patch "003e440c95a0" adds ARM TRBE ACPI support | Anshuman Khandual (4): arm_pmu: acpi: Refactor arm_spe_acpi_register_device() arm_pmu: acpi: Add a representative platform device for TRBE coresight: trbe: Add a representative coresight_platform_data for TRBE coresight: trbe: Enable ACPI based TRBE devices Junhao He (3): Revert "coresight: trbe: Enable ACPI/Platform automatic module loading" Revert "arm64/trbe: Add initial MADT/SPE probing" Revert "coresight: Return the pointer of @pdata when not "fwnode"" arch/arm64/configs/openeuler_defconfig | 1 - arch/arm64/kernel/Makefile | 1 - arch/arm64/kernel/acpi_trbe.c | 81 ----------- drivers/hwtracing/coresight/Kconfig | 4 - .../hwtracing/coresight/coresight-platform.c | 6 +- drivers/hwtracing/coresight/coresight-trbe.c | 26 +++- drivers/hwtracing/coresight/coresight-trbe.h | 2 + drivers/perf/arm_pmu_acpi.c | 137 +++++++++++++----- include/linux/coresight.h | 2 - include/linux/perf/arm_pmu.h | 1 + 10 files changed, 123 insertions(+), 138 deletions(-) delete mode 100644 arch/arm64/kernel/acpi_trbe.c -- 2.33.0

2 8

[PATCH OLK-5.10 v3 00/15] arm64: fix a concurrency issue in emulation_proc_handler()
by Jinjie Ruan 28 Oct '23

28 Oct '23

In linux-6.1, the related code is refactored in commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") and this issue was incidentally fixed. This patch set try to adapt the refactoring stable 5.10 patches to solve the problem of repeated addition of linked lists described below. How to reproduce: CONFIG_ARMV8_DEPRECATED=y, CONFIG_SWP_EMULATION=y, and CONFIG_DEBUG_LIST=y, then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 1 > /proc/sys/abi/swp done or "echo 1 > /proc/sys/abi/swp" and then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 0 > /proc/sys/abi/swp done In emulation_proc_handler(), read and write operations are performed on insn->current_mode. In the concurrency scenario, mutex only protects writing insn->current_mode, and not protects the read. Suppose there are two concurrent tasks, task1 updates insn->current_mode to INSN_EMULATE in the critical section, the prev_mode of task2 is still the old data INSN_UNDEF of insn->current_mode. As a result, two tasks call update_insn_emulation_mode twice with prev_mode = INSN_UNDEF and current_mode = INSN_EMULATE, then call register_emulation_hooks twice, resulting in a list_add double problem. commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") remove the dynamic registration and unregistration so remove the register_undef_hook() function, so the below problem was incidentally fixed. Call trace: __list_add_valid+0xd8/0xe4 register_undef_hook+0x94/0x13c update_insn_emulation_mode+0xd0/0x12c emulation_proc_handler+0xd8/0xf4 proc_sys_call_handler+0x140/0x250 proc_sys_write+0x1c/0x2c new_sync_write+0xec/0x18c vfs_write+0x214/0x2ac ksys_write+0x70/0xfc __arm64_sys_write+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0x94 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Call trace: __list_del_entry_valid+0xac/0x110 unregister_undef_hook+0x34/0x80 update_insn_emulation_mode+0xf0/0x180 emulation_proc_handler+0x8c/0xd8 proc_sys_call_handler+0x1d8/0x208 proc_sys_write+0x14/0x20 new_sync_write+0xf0/0x190 vfs_write+0x304/0x388 ksys_write+0x6c/0x100 __arm64_sys_write+0x1c/0x28 el0_svc_common.constprop.4+0x68/0x188 do_el0_svc+0x24/0xa0 el0_svc+0x14/0x20 el0_sync_handler+0x90/0xb8 el0_sync+0x160/0x180 The first patch is the self-developed patch, so revert it. The next 4 patches is a patch set which provides context for subsequent refactoring 9 patches, especially commit 0f2cb928a154 ("arm64: consistently pass ESR_ELx to die()") which modify do_undefinstr() to add a ESR_ELx value arg, and then commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") splits do_undefinstr() handler into separate do_el0_undef() and do_el1_undef() handlers. The 9 patches after that is another refactoring patch set, which is in preparation for the main rework commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling"). To remove struct undef_hook, commit bff8f413c71f ("arm64: factor out EL1 SSBS emulation hook") factor out EL1 SSBS emulation hook, which also avoid call call_undef_hook() in do_el1_undef(), commit f5962add74b6 ("arm64: rework EL0 MRS emulation") factor out EL0 MRS emulation hook, which also prepare for replacing call_undef_hook() in do_el0_undef(). To replace call_undef_hook() function, commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") split the do_undefinstr() into do_el0_undef() and do_el1_undef() functions, and commit dbfbd87efa79 ("arm64: factor insn read out of call_undef_hook()") factor user_insn_read() from call_undef_hook() so the main rework patch can replace the call_undef_hook() in do_el0_undef(). The last patch is a bugfix for the main rework patch. I've tested this with userspace programs which use each of the deprecated instructions on Raspberry Pi 4B KVM/Qemu, and I've concurrently modified the support level for each of the features back-and-forth between HW and emulated to check that there are no oops or above repeated addition or deletion call trace. Changes in v3: - Add conflicts message. Fixes: af483947d472 ("arm64: fix oops in concurrently setting insn_emulation sysctls") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Jinjie Ruan (1): Revert "arm64: fix a concurrency issue in emulation_proc_handler()" Mark Rutland (13): arm64: die(): pass 'err' as long arm64: consistently pass ESR_ELx to die() arm64: rework FPAC exception handling arm64: rework BTI exception handling arm64: allow kprobes on EL0 handlers arm64: split EL0/EL1 UNDEF handlers arm64: factor out EL1 SSBS emulation hook arm64: factor insn read out of call_undef_hook() arm64: rework EL0 MRS emulation arm64: armv8_deprecated: fold ops into insn_emulation arm64: armv8_deprecated move emulation functions arm64: armv8_deprecated: move aarch32 helper earlier arm64: armv8_deprecated: rework deprected instruction handling Ren Zhijie (1): arm64: armv8_deprecated: fix unused-function error arch/arm64/include/asm/cpufeature.h | 3 +- arch/arm64/include/asm/exception.h | 13 +- arch/arm64/include/asm/spectre.h | 2 + arch/arm64/include/asm/system_misc.h | 2 +- arch/arm64/include/asm/traps.h | 19 +- arch/arm64/kernel/armv8_deprecated.c | 574 +++++++++++++-------------- arch/arm64/kernel/cpufeature.c | 23 +- arch/arm64/kernel/entry-common.c | 36 +- arch/arm64/kernel/proton-pack.c | 26 +- arch/arm64/kernel/traps.c | 125 +++--- 10 files changed, 395 insertions(+), 428 deletions(-) -- 2.34.1

2 16

[PATCH openEuler-1.0-LTS] sched/membarrier: fix missing local execution of ipi_sync_rq_state()
by Xia Fukun 28 Oct '23

28 Oct '23

From: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> mainline inclusion from mainline-v6.5-rc7 commit ce29ddc47b91f97e7f69a0fb7cbb5845f52a9825 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8BN94 CVE: NA -------------------------------- The function sync_runqueues_membarrier_state() should copy the membarrier state from the @mm received as parameter to each runqueue currently running tasks using that mm. However, the use of smp_call_function_many() skips the current runqueue, which is unintended. Replace by a call to on_each_cpu_mask(). Fixes: 227a4aadc75b ("sched/membarrier: Fix p->mm->membarrier_state racy load") Reported-by: Nadav Amit <nadav.amit(a)gmail.com> Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Cc: stable(a)vger.kernel.org # 5.4.x+ Link: https://lore.kernel.org/r/74F1E842-4A84-47BF-B6C2-5407DFDD4A4A@gmail.com Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- kernel/sched/membarrier.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/kernel/sched/membarrier.c b/kernel/sched/membarrier.c index 8c4e14e6544a..1757074be994 100644 --- a/kernel/sched/membarrier.c +++ b/kernel/sched/membarrier.c @@ -255,9 +255,7 @@ static int sync_runqueues_membarrier_state(struct mm_struct *mm) } rcu_read_unlock(); - preempt_disable(); - smp_call_function_many(tmpmask, ipi_sync_rq_state, mm, 1); - preempt_enable(); + on_each_cpu_mask(tmpmask, ipi_sync_rq_state, mm, true); free_cpumask_var(tmpmask); cpus_read_unlock(); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] sched/cpuacct: Fix charge cpuacct.usage_sys
by Xia Fukun 28 Oct '23

28 Oct '23

From: Muchun Song <songmuchun(a)bytedance.com> mainline inclusion from mainline-v6.5-rc7 commit dbe9337109c2705f08e6a00392f991eb2d2570a5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8BN4B CVE: NA -------------------------------- The user_mode(task_pt_regs(tsk)) always return true for user thread, and false for kernel thread. So it means that the cpuacct.usage_sys is the time that kernel thread uses not the time that thread uses in the kernel mode. We can try get_irq_regs() first, if it is NULL, then we can fall back to task_pt_regs(). Signed-off-by: Muchun Song <songmuchun(a)bytedance.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lkml.kernel.org/r/20200420070453.76815-1-songmuchun@bytedance.com Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- kernel/sched/cpuacct.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c index 9fbb10383434..254a60c99435 100644 --- a/kernel/sched/cpuacct.c +++ b/kernel/sched/cpuacct.c @@ -5,6 +5,7 @@ * Based on the work by Paul Menage (menage(a)google.com) and Balbir Singh * (balbir(a)in.ibm.com) */ +#include <asm/irq_regs.h> #include "sched.h" /* Time spent by the tasks of the CPU accounting group executing in ... */ @@ -339,7 +340,7 @@ void cpuacct_charge(struct task_struct *tsk, u64 cputime) { struct cpuacct *ca; int index = CPUACCT_STAT_SYSTEM; - struct pt_regs *regs = task_pt_regs(tsk); + struct pt_regs *regs = get_irq_regs() ? : task_pt_regs(tsk); if (regs && user_mode(regs)) index = CPUACCT_STAT_USER; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail
by Wenyu Huang 28 Oct '23

28 Oct '23

From: Kaitao Cheng <pilgrimtao(a)gmail.com> stable inclusion from stable-4.19 commit 50f9ad607ea891a9308e67b81f774c71736d1098 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8BAW8 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In the function, if register_trace_sched_migrate_task() returns error, sched_switch/sched_wakeup_new/sched_wakeup won't unregister. That is why fail_deprobe_sched_switch was added. Link: http://lkml.kernel.org/r/20191231133530.2794-1-pilgrimtao@gmail.com Cc: stable(a)vger.kernel.org Fixes: 478142c39c8c2 ("tracing: do not grab lock in wakeup latency function tracing") Signed-off-by: Kaitao Cheng <pilgrimtao(a)gmail.com> Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org> Signed-off-by: Wenyu Huang <huangwenyu4(a)huawei.com> --- kernel/trace/trace_sched_wakeup.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c index 0db1b024e786..8041bd5e4262 100644 --- a/kernel/trace/trace_sched_wakeup.c +++ b/kernel/trace/trace_sched_wakeup.c @@ -642,7 +642,7 @@ static void start_wakeup_tracer(struct trace_array *tr) if (ret) { pr_info("wakeup trace: Couldn't activate tracepoint" " probe to kernel_sched_migrate_task\n"); - return; + goto fail_deprobe_sched_switch; } wakeup_reset(tr); @@ -660,6 +660,8 @@ static void start_wakeup_tracer(struct trace_array *tr) printk(KERN_ERR "failed to start wakeup tracer\n"); return; +fail_deprobe_sched_switch: + unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL); fail_deprobe_wake_new: unregister_trace_sched_wakeup_new(probe_wakeup, NULL); fail_deprobe: -- 2.34.1

2 1

[PATCH OLK-5.10 v5 0/6] Synchronize coresight driver bugfix patches to openEuler
by Junhao He 28 Oct '23

28 Oct '23

1. Fix memory leak coresight: Fix memory leak in acpi_buffer->pointer 2. Fix TRBE bug coresight: trbe: Fix TRBE potential sleep in atomic context coresight: trbe: Allocate platform data per device coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() 3. Fix ETR bug coresight: Fix run time warnings while reusing ETR buffer coresight: tmc-etr: Disable warnings for allocation failures | mainline commit | patch | Conflict or Not | description | | --------------- | ------------ | --------------- | ------------ | | 34149bd82c35 | coresight: Fix memory leak in acpi_buffer->pointer | No | | | 2e0fdff6f374 | coresight: Fix run time warnings while reusing ETR buffer | Yes | Resolve code conflicts without changing functions | | d3ce83b13fbd | coresight: trbe: Fix TRBE potential sleep in atomic context | Yes | Resolve code conflicts without changing functions | | 91ee6ec9039e | coresight: Fix memory leak in acpi_buffer->pointer | Yes | Dependency cleanup patch-set does not applied to OLK-5.10 | | e911e9760c77 | coresight: trbe: Allocate platform data per device | No | depend on ��c7e95621feea�� | | c7e95621feea | coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() | No | | Junhao He (2) coresight: Fix memory leak in acpi_buffer->pointer coresight: trbe: Fix TRBE potential sleep in atomic context Linu Cherian (1): coresight: Fix run time warnings while reusing ETR buffer Suzuki K Poulose (2): coresight: trbe: Allocate platform data per device coresight: tmc-etr: Disable warnings for allocation failures Wei Yongjun (1): coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() .../hwtracing/coresight/coresight-platform.c | 46 ++++++++++++------- .../hwtracing/coresight/coresight-tmc-etr.c | 23 +++++----- drivers/hwtracing/coresight/coresight-trbe.c | 41 ++++++++--------- 3 files changed, 62 insertions(+), 48 deletions(-) -- 2.33.0

2 7

[PATCH OLK-5.10 0/2] Fix CVE-2023-5717
by Yang Jihong 28 Oct '23

28 Oct '23

Peter Zijlstra (1): perf: Disallow mis-matched inherited group reads Yang Jihong (1): perf: Fix kabi breakage in struct perf_event include/linux/perf_event.h | 2 ++ kernel/events/core.c | 40 ++++++++++++++++++++++++++++++++------ 2 files changed, 36 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[PATCH v2 openEuler-1.0-LTS] kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail
by Wenyu Huang 27 Oct '23

27 Oct '23

From: Kaitao Cheng <pilgrimtao(a)gmail.com> stable inclusion from stable-v4.19.297 commit 50f9ad607ea891a9308e67b81f774c71736d1098 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8BAW8 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In the function, if register_trace_sched_migrate_task() returns error, sched_switch/sched_wakeup_new/sched_wakeup won't unregister. That is why fail_deprobe_sched_switch was added. Link: http://lkml.kernel.org/r/20191231133530.2794-1-pilgrimtao@gmail.com Cc: stable(a)vger.kernel.org Fixes: 478142c39c8c2 ("tracing: do not grab lock in wakeup latency function tracing") Signed-off-by: Kaitao Cheng <pilgrimtao(a)gmail.com> Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org> Signed-off-by: Wenyu Huang <huangwenyu4(a)huawei.com> --- kernel/trace/trace_sched_wakeup.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c index 0db1b024e786..8041bd5e4262 100644 --- a/kernel/trace/trace_sched_wakeup.c +++ b/kernel/trace/trace_sched_wakeup.c @@ -642,7 +642,7 @@ static void start_wakeup_tracer(struct trace_array *tr) if (ret) { pr_info("wakeup trace: Couldn't activate tracepoint" " probe to kernel_sched_migrate_task\n"); - return; + goto fail_deprobe_sched_switch; } wakeup_reset(tr); @@ -660,6 +660,8 @@ static void start_wakeup_tracer(struct trace_array *tr) printk(KERN_ERR "failed to start wakeup tracer\n"); return; +fail_deprobe_sched_switch: + unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL); fail_deprobe_wake_new: unregister_trace_sched_wakeup_new(probe_wakeup, NULL); fail_deprobe: -- 2.34.1

2 1

[PATCH OLK-5.10 v2 00/15] arm64: fix a concurrency issue in emulation_proc_handler()
by Jinjie Ruan 27 Oct '23

27 Oct '23

MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In linux-6.1, the related code is refactored in commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") and this issue was incidentally fixed. This patch set try to adapt the refactoring stable 5.10 patches to solve the problem of repeated addition of linked lists described below. How to reproduce: CONFIG_ARMV8_DEPRECATED=y, CONFIG_SWP_EMULATION=y, and CONFIG_DEBUG_LIST=y, then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 1 > /proc/sys/abi/swp done or "echo 1 > /proc/sys/abi/swp" and then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 0 > /proc/sys/abi/swp done In emulation_proc_handler(), read and write operations are performed on insn->current_mode. In the concurrency scenario, mutex only protects writing insn->current_mode, and not protects the read. Suppose there are two concurrent tasks, task1 updates insn->current_mode to INSN_EMULATE in the critical section, the prev_mode of task2 is still the old data INSN_UNDEF of insn->current_mode. As a result, two tasks call update_insn_emulation_mode twice with prev_mode = INSN_UNDEF and current_mode = INSN_EMULATE, then call register_emulation_hooks twice, resulting in a list_add double problem. commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") remove the dynamic registration and unregistration so remove the register_undef_hook() function, so the below problem was incidentally fixed. Call trace: __list_add_valid+0xd8/0xe4 register_undef_hook+0x94/0x13c update_insn_emulation_mode+0xd0/0x12c emulation_proc_handler+0xd8/0xf4 proc_sys_call_handler+0x140/0x250 proc_sys_write+0x1c/0x2c new_sync_write+0xec/0x18c vfs_write+0x214/0x2ac ksys_write+0x70/0xfc __arm64_sys_write+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0x94 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Call trace: __list_del_entry_valid+0xac/0x110 unregister_undef_hook+0x34/0x80 update_insn_emulation_mode+0xf0/0x180 emulation_proc_handler+0x8c/0xd8 proc_sys_call_handler+0x1d8/0x208 proc_sys_write+0x14/0x20 new_sync_write+0xf0/0x190 vfs_write+0x304/0x388 ksys_write+0x6c/0x100 __arm64_sys_write+0x1c/0x28 el0_svc_common.constprop.4+0x68/0x188 do_el0_svc+0x24/0xa0 el0_svc+0x14/0x20 el0_sync_handler+0x90/0xb8 el0_sync+0x160/0x180 The first patch is the self-developed patch, so revert it. The next 4 patches is a patch set which provides context for subsequent refactoring 9 patches, especially commit 0f2cb928a154 ("arm64: consistently pass ESR_ELx to die()") which modify do_undefinstr() to add a ESR_ELx value arg, and then commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") splits do_undefinstr() handler into separate do_el0_undef() and do_el1_undef() handlers. The 9 patches after that is another refactoring patch set, which is in preparation for the main rework commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling"). To remove struct undef_hook, commit bff8f413c71f ("arm64: factor out EL1 SSBS emulation hook") factor out EL1 SSBS emulation hook, which also avoid call call_undef_hook() in do_el1_undef(), commit f5962add74b6 ("arm64: rework EL0 MRS emulation") factor out EL0 MRS emulation hook, which also prepare for replacing call_undef_hook() in do_el0_undef(). To replace call_undef_hook() function, commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") split the do_undefinstr() into do_el0_undef() and do_el1_undef() functions, and commit dbfbd87efa79 ("arm64: factor insn read out of call_undef_hook()") factor user_insn_read() from call_undef_hook() so the main rework patch can replace the call_undef_hook() in do_el0_undef(). The last patch is a bugfix for the main rework patch. I've tested this with userspace programs which use each of the deprecated instructions on Raspberry Pi 4B KVM/Qemu, and I've concurrently modified the support level for each of the features back-and-forth between HW and emulated to check that there are no oops or above repeated addition or deletion call trace. Fixes: af483947d472 ("arm64: fix oops in concurrently setting insn_emulation sysctls") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Jinjie Ruan (1): Revert "arm64: fix a concurrency issue in emulation_proc_handler()" Mark Rutland (13): arm64: die(): pass 'err' as long arm64: consistently pass ESR_ELx to die() arm64: rework FPAC exception handling arm64: rework BTI exception handling arm64: allow kprobes on EL0 handlers arm64: split EL0/EL1 UNDEF handlers arm64: factor out EL1 SSBS emulation hook arm64: factor insn read out of call_undef_hook() arm64: rework EL0 MRS emulation arm64: armv8_deprecated: fold ops into insn_emulation arm64: armv8_deprecated move emulation functions arm64: armv8_deprecated: move aarch32 helper earlier arm64: armv8_deprecated: rework deprected instruction handling Ren Zhijie (1): arm64: armv8_deprecated: fix unused-function error arch/arm64/include/asm/cpufeature.h | 3 +- arch/arm64/include/asm/exception.h | 13 +- arch/arm64/include/asm/spectre.h | 2 + arch/arm64/include/asm/system_misc.h | 2 +- arch/arm64/include/asm/traps.h | 19 +- arch/arm64/kernel/armv8_deprecated.c | 574 +++++++++++++-------------- arch/arm64/kernel/cpufeature.c | 23 +- arch/arm64/kernel/entry-common.c | 36 +- arch/arm64/kernel/proton-pack.c | 26 +- arch/arm64/kernel/traps.c | 125 +++--- 10 files changed, 395 insertions(+), 428 deletions(-) -- 2.34.1

2 16

[PATCH openEuler-1.0-LTS] kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail
by Wenyu Huang 27 Oct '23

27 Oct '23

From: Kaitao Cheng <pilgrimtao(a)gmail.com> stable inclusion from stable-4.19.297 commit 50f9ad607ea891a9308e67b81f774c71736d1098 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8BAW8 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In the function, if register_trace_sched_migrate_task() returns error, sched_switch/sched_wakeup_new/sched_wakeup won't unregister. That is why fail_deprobe_sched_switch was added. Link: http://lkml.kernel.org/r/20191231133530.2794-1-pilgrimtao@gmail.com Cc: stable(a)vger.kernel.org Fixes: 478142c39c8c2 ("tracing: do not grab lock in wakeup latency function tracing") Signed-off-by: Kaitao Cheng <pilgrimtao(a)gmail.com> Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org> Signed-off-by: Wenyu Huang <huangwenyu4(a)huawei.com> --- kernel/trace/trace_sched_wakeup.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c index 0db1b024e786..8041bd5e4262 100644 --- a/kernel/trace/trace_sched_wakeup.c +++ b/kernel/trace/trace_sched_wakeup.c @@ -642,7 +642,7 @@ static void start_wakeup_tracer(struct trace_array *tr) if (ret) { pr_info("wakeup trace: Couldn't activate tracepoint" " probe to kernel_sched_migrate_task\n"); - return; + goto fail_deprobe_sched_switch; } wakeup_reset(tr); @@ -660,6 +660,8 @@ static void start_wakeup_tracer(struct trace_array *tr) printk(KERN_ERR "failed to start wakeup tracer\n"); return; +fail_deprobe_sched_switch: + unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL); fail_deprobe_wake_new: unregister_trace_sched_wakeup_new(probe_wakeup, NULL); fail_deprobe: -- 2.34.1

2 1

[PATCH OLK-5.10 0/6] improve pagecache PSI annotations
by Liu Shixin 27 Oct '23

27 Oct '23

Currently the VM tries to abuse the block layer submission path for the page cache PSI annotations. This series instead annotates the ->read_folio and ->readahead calls in the core VM code, and then only deals with the odd direct add_to_page_cache_lru calls manually. Christoph Hellwig (5): mm: add PSI accounting around ->read_folio and ->readahead calls sched/psi: export psi_memstall_{enter,leave} btrfs: add manual PSI accounting for compressed reads erofs: add manual PSI accounting for the compressed address space block: remove PSI accounting from the bio layer Johannes Weiner (1): fs: fix leaked psi pressure state block/bio.c | 8 -------- block/blk-core.c | 19 ------------------- fs/btrfs/compression.c | 16 ++++++++++++++-- fs/direct-io.c | 2 -- fs/erofs/zdata.c | 17 ++++++++++++++++- include/linux/blk_types.h | 1 - include/linux/pagemap.h | 2 ++ kernel/sched/psi.c | 2 ++ mm/filemap.c | 7 +++++++ mm/readahead.c | 7 +++++++ 10 files changed, 48 insertions(+), 33 deletions(-) -- 2.25.1

2 7

[PATCH OLK-5.10] ubi: Refuse attaching if mtd's erasesize is 0
by ZhaoLong Wang 27 Oct '23

27 Oct '23

From: Zhihao Cheng <chengzhihao1(a)huawei.com> mainline inclusion from mainline-v6.6-rc5 commit 017c73a34a661a861712f7cc1393a123e5b2208c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6YOAJ CVE: CVE-2023-31085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- There exists mtd devices with zero erasesize, which will trigger a divide-by-zero exception while attaching ubi device. Fix it by refusing attaching if mtd's erasesize is 0. Fixes: 801c135ce73d ("UBI: Unsorted Block Images") Reported-by: Yu Hao <yhao016(a)ucr.edu> Link: https://lore.kernel.org/lkml/977347543.226888.1682011999468.JavaMail.zimbra… Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- drivers/mtd/ubi/build.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c index 1052bb60063f..403f61c3bf73 100644 --- a/drivers/mtd/ubi/build.c +++ b/drivers/mtd/ubi/build.c @@ -896,6 +896,13 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, return -EINVAL; } + /* UBI cannot work on flashes with zero erasesize. */ + if (!mtd->erasesize) { + pr_err("ubi: refuse attaching mtd%d - zero erasesize flash is not supported\n", + mtd->index); + return -EINVAL; + } + if (ubi_num == UBI_DEV_NUM_AUTO) { /* Search for an empty slot in the @ubi_devices array */ for (ubi_num = 0; ubi_num < UBI_MAX_DEVICES; ubi_num++) -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] ubi: Refuse attaching if mtd's erasesize is 0
by ZhaoLong Wang 27 Oct '23

27 Oct '23

From: Zhihao Cheng <chengzhihao1(a)huawei.com> mainline inclusion from mainline-v6.6-rc5 commit 017c73a34a661a861712f7cc1393a123e5b2208c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6YOAJ CVE: CVE-2023-31085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- There exists mtd devices with zero erasesize, which will trigger a divide-by-zero exception while attaching ubi device. Fix it by refusing attaching if mtd's erasesize is 0. Fixes: 801c135ce73d ("UBI: Unsorted Block Images") Reported-by: Yu Hao <yhao016(a)ucr.edu> Link: https://lore.kernel.org/lkml/977347543.226888.1682011999468.JavaMail.zimbra… Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- drivers/mtd/ubi/build.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c index c120c8761fcd..93cce95287ba 100644 --- a/drivers/mtd/ubi/build.c +++ b/drivers/mtd/ubi/build.c @@ -866,6 +866,13 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, return -EINVAL; } + /* UBI cannot work on flashes with zero erasesize. */ + if (!mtd->erasesize) { + pr_err("ubi: refuse attaching mtd%d - zero erasesize flash is not supported\n", + mtd->index); + return -EINVAL; + } + if (ubi_num == UBI_DEV_NUM_AUTO) { /* Search for an empty slot in the @ubi_devices array */ for (ubi_num = 0; ubi_num < UBI_MAX_DEVICES; ubi_num++) -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail
by Wenyu Huang 27 Oct '23

27 Oct '23

From: Kaitao Cheng <pilgrimtao(a)gmail.com> stable inclusion from stable-4.19 commit 50f9ad607ea891a9308e67b81f774c71736d1098 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8BAW8 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In the function, if register_trace_sched_migrate_task() returns error, sched_switch/sched_wakeup_new/sched_wakeup won't unregister. That is why fail_deprobe_sched_switch was added. Link: http://lkml.kernel.org/r/20191231133530.2794-1-pilgrimtao@gmail.com Cc: stable(a)vger.kernel.org Fixes: 478142c39c8c2 ("tracing: do not grab lock in wakeup latency function tracing") Signed-off-by: Kaitao Cheng <pilgrimtao(a)gmail.com> Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org> Signed-off-by: Wenyu Huang <huangwenyu4(a)huawei.com> --- kernel/trace/trace_sched_wakeup.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c index 0db1b024e786..8041bd5e4262 100644 --- a/kernel/trace/trace_sched_wakeup.c +++ b/kernel/trace/trace_sched_wakeup.c @@ -642,7 +642,7 @@ static void start_wakeup_tracer(struct trace_array *tr) if (ret) { pr_info("wakeup trace: Couldn't activate tracepoint" " probe to kernel_sched_migrate_task\n"); - return; + goto fail_deprobe_sched_switch; } wakeup_reset(tr); @@ -660,6 +660,8 @@ static void start_wakeup_tracer(struct trace_array *tr) printk(KERN_ERR "failed to start wakeup tracer\n"); return; +fail_deprobe_sched_switch: + unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL); fail_deprobe_wake_new: unregister_trace_sched_wakeup_new(probe_wakeup, NULL); fail_deprobe: -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] crypto: hisilicon - fix different versions of devices driver compatibility issue
by zhongkeyi 27 Oct '23

27 Oct '23

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8BFOM CVE: NA ---------------------------------------------------------------------- In order to be compatible with devices of different versions, V1 in the accelerator driver is now isolated, and other versions are the previous V2 processing flow. Signed-off-by: zhongkeyi <zhongkeyi1(a)huawei.com> --- drivers/crypto/hisilicon/hpre/hpre_main.c | 2 +- drivers/crypto/hisilicon/qm.c | 70 +++++++++-------------- drivers/crypto/hisilicon/qm.h | 14 ++--- drivers/crypto/hisilicon/rde/rde_main.c | 12 +--- drivers/crypto/hisilicon/sec2/sec_main.c | 12 +--- drivers/crypto/hisilicon/zip/zip_main.c | 12 +--- 6 files changed, 37 insertions(+), 85 deletions(-) diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c index cbe8ea438fd2..8c71353cd4b5 100644 --- a/drivers/crypto/hisilicon/hpre/hpre_main.c +++ b/drivers/crypto/hisilicon/hpre/hpre_main.c @@ -840,7 +840,7 @@ static int hpre_pf_probe_init(struct hisi_qm *qm) { int ret; - if (qm->ver != QM_HW_V2) + if (qm->ver == QM_HW_V1) return -EINVAL; qm->ctrl_q_num = HPRE_QUEUE_NUM_V2; diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c index f2706dc0d55e..5562c63bfeeb 100644 --- a/drivers/crypto/hisilicon/qm.c +++ b/drivers/crypto/hisilicon/qm.c @@ -682,7 +682,7 @@ static int qm_irq_register(struct hisi_qm *qm) if (ret) return ret; - if (qm->ver == QM_HW_V2) { + if (qm->ver != QM_HW_V1) { ret = request_irq(pci_irq_vector(pdev, QM_AEQ_EVENT_IRQ_VECTOR), qm_aeq_irq, IRQF_SHARED, qm->dev_name, qm); if (ret) @@ -713,13 +713,12 @@ static void qm_irq_unregister(struct hisi_qm *qm) free_irq(pci_irq_vector(pdev, QM_EQ_EVENT_IRQ_VECTOR), qm); - if (qm->ver == QM_HW_V2) { - free_irq(pci_irq_vector(pdev, QM_AEQ_EVENT_IRQ_VECTOR), qm); + if (qm->ver == QM_HW_V1) + return; - if (qm->fun_type == QM_HW_PF) - free_irq(pci_irq_vector(pdev, - QM_ABNORMAL_EVENT_IRQ_VECTOR), qm); - } + free_irq(pci_irq_vector(pdev, QM_AEQ_EVENT_IRQ_VECTOR), qm); + if (qm->fun_type == QM_HW_PF) + free_irq(pci_irq_vector(pdev, QM_ABNORMAL_EVENT_IRQ_VECTOR), qm); } static void qm_init_qp_status(struct hisi_qp *qp) @@ -741,36 +740,26 @@ static void qm_vft_data_cfg(struct hisi_qm *qm, enum vft_type type, u32 base, if (number > 0) { switch (type) { case SQC_VFT: - switch (qm->ver) { - case QM_HW_V1: + if (qm->ver == QM_HW_V1) { tmp = QM_SQC_VFT_BUF_SIZE | QM_SQC_VFT_SQC_SIZE | QM_SQC_VFT_INDEX_NUMBER | QM_SQC_VFT_VALID | (u64)base << QM_SQC_VFT_START_SQN_SHIFT; - break; - case QM_HW_V2: + } else { tmp = (u64)base << QM_SQC_VFT_START_SQN_SHIFT | QM_SQC_VFT_VALID | (u64)(number - 1) << QM_SQC_VFT_SQN_SHIFT; - break; - case QM_HW_UNKNOWN: - break; } break; case CQC_VFT: - switch (qm->ver) { - case QM_HW_V1: + if (qm->ver == QM_HW_V1) { tmp = QM_CQC_VFT_BUF_SIZE | QM_CQC_VFT_SQC_SIZE | QM_CQC_VFT_INDEX_NUMBER | QM_CQC_VFT_VALID; - break; - case QM_HW_V2: + } else { tmp = QM_CQC_VFT_VALID; - break; - case QM_HW_UNKNOWN: - break; } break; } @@ -1827,7 +1816,7 @@ static int qm_sq_ctx_cfg(struct hisi_qp *qp, int qp_id, int pasid) if (ver == QM_HW_V1) { sqc->dw3 = cpu_to_le32(QM_MK_SQC_DW3_V1(0, 0, 0, qm->sqe_size)); sqc->w8 = cpu_to_le16(QM_Q_DEPTH - 1); - } else if (ver == QM_HW_V2) { + } else { sqc->dw3 = cpu_to_le32(QM_MK_SQC_DW3_V2(qm->sqe_size)); sqc->w8 = 0; /* rand_qc */ } @@ -1867,7 +1856,7 @@ static int qm_cq_ctx_cfg(struct hisi_qp *qp, int qp_id, int pasid) cqc->dw3 = cpu_to_le32(QM_MK_CQC_DW3_V1(0, 0, 0, QM_QC_CQE_SIZE)); cqc->w8 = cpu_to_le16(QM_Q_DEPTH - 1); - } else if (ver == QM_HW_V2) { + } else { cqc->dw3 = cpu_to_le32(QM_MK_CQC_DW3_V2(QM_QC_CQE_SIZE)); cqc->w8 = 0; /* rand_qc */ } @@ -2104,14 +2093,13 @@ static void hisi_qm_cache_wb(struct hisi_qm *qm) { unsigned int val; - if (qm->ver == QM_HW_V2) { - writel(0x1, qm->io_base + QM_CACHE_WB_START); - if (readl_relaxed_poll_timeout(qm->io_base + QM_CACHE_WB_DONE, - val, val & BIT(0), POLL_PERIOD, - POLL_TIMEOUT)) - dev_err(&qm->pdev->dev, - "QM writeback sqc cache fail!\n"); - } + if (qm->ver == QM_HW_V1) + return; + + writel(0x1, qm->io_base + QM_CACHE_WB_START); + if (readl_relaxed_poll_timeout(qm->io_base + QM_CACHE_WB_DONE, + val, val & BIT(0), 10, 1000)) + dev_err(&qm->pdev->dev, "QM writeback sqc cache fail!\n"); } int hisi_qm_get_free_qp_num(struct hisi_qm *qm) @@ -2212,12 +2200,12 @@ static int hisi_qm_uacce_mmap(struct uacce_queue *q, switch (qfr->type) { case UACCE_QFRT_MMIO: - if (qm->ver == QM_HW_V2) { - if (WARN_ON(sz > PAGE_SIZE * (QM_DOORBELL_PAGE_NR + - QM_V2_DOORBELL_OFFSET / PAGE_SIZE))) + if (qm->ver == QM_HW_V1) { + if (WARN_ON(sz > PAGE_SIZE * QM_DOORBELL_PAGE_NR)) return -EINVAL; } else { - if (WARN_ON(sz > PAGE_SIZE * QM_DOORBELL_PAGE_NR)) + if (WARN_ON(sz > PAGE_SIZE * (QM_DOORBELL_PAGE_NR + + QM_V2_DOORBELL_OFFSET / PAGE_SIZE))) return -EINVAL; } @@ -2691,16 +2679,10 @@ int hisi_qm_init(struct hisi_qm *qm) struct device *dev = &pdev->dev; int ret; - switch (qm->ver) { - case QM_HW_V1: + if (qm->ver == QM_HW_V1) qm->ops = &qm_hw_ops_v1; - break; - case QM_HW_V2: + else qm->ops = &qm_hw_ops_v2; - break; - default: - return -EINVAL; - } if (qm->use_uacce) { dev_info(dev, "qm register to uacce\n"); @@ -2720,7 +2702,7 @@ int hisi_qm_init(struct hisi_qm *qm) goto err_irq_register; mutex_init(&qm->mailbox_lock); - if (qm->fun_type == QM_HW_VF && qm->ver == QM_HW_V2) { + if (qm->fun_type == QM_HW_VF && qm->ver != QM_HW_V1) { /* v2 or v3 starts to support get vft by mailbox */ ret = hisi_qm_get_vft(qm, &qm->qp_base, &qm->qp_num); if (ret) diff --git a/drivers/crypto/hisilicon/qm.h b/drivers/crypto/hisilicon/qm.h index d7d23d1ec34c..211689579161 100644 --- a/drivers/crypto/hisilicon/qm.h +++ b/drivers/crypto/hisilicon/qm.h @@ -114,6 +114,7 @@ enum qm_hw_ver { QM_HW_UNKNOWN = -1, QM_HW_V1 = 0x20, QM_HW_V2 = 0x21, + QM_HW_V3 = 0x30, }; enum qm_fun_type { @@ -385,7 +386,6 @@ static inline int q_num_set(const char *val, const struct kernel_param *kp, struct pci_dev *pdev = pci_get_device(PCI_VENDOR_ID_HUAWEI, device, NULL); u32 n, q_num; - u8 rev_id; int ret; if (!val) @@ -396,17 +396,10 @@ static inline int q_num_set(const char *val, const struct kernel_param *kp, pr_info("No device found currently, suppose queue number is %d\n", q_num); } else { - rev_id = pdev->revision; - switch (rev_id) { - case QM_HW_V1: + if (pdev->revision == QM_HW_V1) q_num = QNUM_V1; - break; - case QM_HW_V2: + else q_num = QNUM_V2; - break; - default: - return -EINVAL; - } } ret = kstrtou32(val, 10, &n); @@ -474,6 +467,7 @@ static inline int hisi_qm_pre_init(struct hisi_qm *qm, switch (pdev->revision) { case QM_HW_V1: case QM_HW_V2: + case QM_HW_V3: qm->ver = pdev->revision; break; default: diff --git a/drivers/crypto/hisilicon/rde/rde_main.c b/drivers/crypto/hisilicon/rde/rde_main.c index f2e00ff891db..9fee21bfaed0 100644 --- a/drivers/crypto/hisilicon/rde/rde_main.c +++ b/drivers/crypto/hisilicon/rde/rde_main.c @@ -647,18 +647,10 @@ static int hisi_rde_pf_probe_init(struct hisi_qm *qm) hisi_rde->ctrl = ctrl; ctrl->hisi_rde = hisi_rde; - switch (qm->ver) { - case QM_HW_V1: + if (qm->ver == QM_HW_V1) qm->ctrl_q_num = HRDE_QUEUE_NUM_V1; - break; - - case QM_HW_V2: + else qm->ctrl_q_num = HRDE_QUEUE_NUM_V2; - break; - - default: - return -EINVAL; - } ret = qm->err_ini.set_usr_domain_cache(qm); if (ret) diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c index 0f32dcb69e12..2f8dd6c30cb1 100644 --- a/drivers/crypto/hisilicon/sec2/sec_main.c +++ b/drivers/crypto/hisilicon/sec2/sec_main.c @@ -738,18 +738,10 @@ static int sec_pf_probe_init(struct hisi_qm *qm) { int ret; - switch (qm->ver) { - case QM_HW_V1: + if (qm->ver == QM_HW_V1) qm->ctrl_q_num = SEC_QUEUE_NUM_V1; - break; - - case QM_HW_V2: + else qm->ctrl_q_num = SEC_QUEUE_NUM_V2; - break; - - default: - return -EINVAL; - } ret = qm->err_ini.set_usr_domain_cache(qm); if (ret) diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c index 1ca51793e26a..ce931af1007b 100644 --- a/drivers/crypto/hisilicon/zip/zip_main.c +++ b/drivers/crypto/hisilicon/zip/zip_main.c @@ -790,18 +790,10 @@ static int hisi_zip_pf_probe_init(struct hisi_qm *qm) zip->ctrl = ctrl; ctrl->hisi_zip = zip; - switch (qm->ver) { - case QM_HW_V1: + if (qm->ver == QM_HW_V1) qm->ctrl_q_num = HZIP_QUEUE_NUM_V1; - break; - - case QM_HW_V2: + else qm->ctrl_q_num = HZIP_QUEUE_NUM_V2; - break; - - default: - return -EINVAL; - } ret = qm->err_ini.set_usr_domain_cache(qm); if (ret) -- 2.27.0

2 1

[PATCH OLK-5.10 RESEND 00/15] arm64: fix a concurrency issue in emulation_proc_handler()
by Jinjie Ruan 27 Oct '23

27 Oct '23

In linux-6.1, the related code is refactored in commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") and this issue was incidentally fixed. This patch set try to adapt the refactoring stable 5.10 patches to solve the problem of repeated addition of linked lists described below. How to reproduce: CONFIG_ARMV8_DEPRECATED=y, CONFIG_SWP_EMULATION=y, and CONFIG_DEBUG_LIST=y, then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 1 > /proc/sys/abi/swp done or "echo 1 > /proc/sys/abi/swp" and then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 0 > /proc/sys/abi/swp done In emulation_proc_handler(), read and write operations are performed on insn->current_mode. In the concurrency scenario, mutex only protects writing insn->current_mode, and not protects the read. Suppose there are two concurrent tasks, task1 updates insn->current_mode to INSN_EMULATE in the critical section, the prev_mode of task2 is still the old data INSN_UNDEF of insn->current_mode. As a result, two tasks call update_insn_emulation_mode twice with prev_mode = INSN_UNDEF and current_mode = INSN_EMULATE, then call register_emulation_hooks twice, resulting in a list_add double problem. commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") remove the dynamic registration and unregistration so remove the register_undef_hook() function, so the below problem was incidentally fixed. Call trace: __list_add_valid+0xd8/0xe4 register_undef_hook+0x94/0x13c update_insn_emulation_mode+0xd0/0x12c emulation_proc_handler+0xd8/0xf4 proc_sys_call_handler+0x140/0x250 proc_sys_write+0x1c/0x2c new_sync_write+0xec/0x18c vfs_write+0x214/0x2ac ksys_write+0x70/0xfc __arm64_sys_write+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0x94 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Call trace: __list_del_entry_valid+0xac/0x110 unregister_undef_hook+0x34/0x80 update_insn_emulation_mode+0xf0/0x180 emulation_proc_handler+0x8c/0xd8 proc_sys_call_handler+0x1d8/0x208 proc_sys_write+0x14/0x20 new_sync_write+0xf0/0x190 vfs_write+0x304/0x388 ksys_write+0x6c/0x100 __arm64_sys_write+0x1c/0x28 el0_svc_common.constprop.4+0x68/0x188 do_el0_svc+0x24/0xa0 el0_svc+0x14/0x20 el0_sync_handler+0x90/0xb8 el0_sync+0x160/0x180 The first patch is the hulk self-developed patch, so revert it. The next 4 patches is a patch set which provides context for subsequent refactoring 9 patches, especially commit 0f2cb928a154 ("arm64: consistently pass ESR_ELx to die()") which modify do_undefinstr() to add a ESR_ELx value arg, and then commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") splits do_undefinstr() handler into separate do_el0_undef() and do_el1_undef() handlers. The 9 patches after that is another refactoring patch set, which is in preparation for the main rework commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling"). To remove struct undef_hook, commit bff8f413c71f ("arm64: factor out EL1 SSBS emulation hook") factor out EL1 SSBS emulation hook, which also avoid call call_undef_hook() in do_el1_undef(), commit f5962add74b6 ("arm64: rework EL0 MRS emulation") factor out EL0 MRS emulation hook, which also prepare for replacing call_undef_hook() in do_el0_undef(). To replace call_undef_hook() function, commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") split the do_undefinstr() into do_el0_undef() and do_el1_undef() functions, and commit dbfbd87efa79 ("arm64: factor insn read out of call_undef_hook()") factor user_insn_read() from call_undef_hook() so the main rework patch can replace the call_undef_hook() in do_el0_undef(). The last patch is a bugfix for the main rework patch. I've tested this with userspace programs which use each of the deprecated instructions on Raspberry Pi 4B KVM/Qemu, and I've concurrently modified the support level for each of the features back-and-forth between HW and emulated to check that there are no oops or above repeated addition or deletion call trace. Fixes: af483947d472 ("arm64: fix oops in concurrently setting insn_emulation sysctls") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Jinjie Ruan (1): Revert "arm64: fix a concurrency issue in emulation_proc_handler()" Mark Rutland (13): arm64: die(): pass 'err' as long arm64: consistently pass ESR_ELx to die() arm64: rework FPAC exception handling arm64: rework BTI exception handling arm64: allow kprobes on EL0 handlers arm64: split EL0/EL1 UNDEF handlers arm64: factor out EL1 SSBS emulation hook arm64: factor insn read out of call_undef_hook() arm64: rework EL0 MRS emulation arm64: armv8_deprecated: fold ops into insn_emulation arm64: armv8_deprecated move emulation functions arm64: armv8_deprecated: move aarch32 helper earlier arm64: armv8_deprecated: rework deprected instruction handling Ren Zhijie (1): arm64: armv8_deprecated: fix unused-function error arch/arm64/include/asm/cpufeature.h | 3 +- arch/arm64/include/asm/exception.h | 13 +- arch/arm64/include/asm/spectre.h | 2 + arch/arm64/include/asm/system_misc.h | 2 +- arch/arm64/include/asm/traps.h | 19 +- arch/arm64/kernel/armv8_deprecated.c | 574 +++++++++++++-------------- arch/arm64/kernel/cpufeature.c | 23 +- arch/arm64/kernel/entry-common.c | 36 +- arch/arm64/kernel/proton-pack.c | 26 +- arch/arm64/kernel/traps.c | 125 +++--- 10 files changed, 395 insertions(+), 428 deletions(-) -- 2.34.1

1 15

[PATCH openEuler-1.0-LTS v2 0/7] Fix netfilter conntrack
by Lu Wei 27 Oct '23

27 Oct '23

Florian Westphal (7): netfilter: conntrack: tell compiler to not inline nf_ct_resolve_clash netfilter: conntrack: remove two args from resolve_clash netfilter: conntrack: place confirm-bit setting in a helper netfilter: conntrack: split resolve_clash function netfilter: conntrack: allow insertion of clashing entries netfilter: conntrack: do not auto-delete clash entries on reply netfilter: conntrack: fix infinite loop on rmmod include/linux/rculist_nulls.h | 7 + .../linux/netfilter/nf_conntrack_common.h | 12 +- net/netfilter/nf_conntrack_core.c | 215 +++++++++++++++--- net/netfilter/nf_conntrack_proto_udp.c | 7 +- net/netfilter/nft_flow_offload.c | 2 +- 5 files changed, 205 insertions(+), 38 deletions(-) -- 2.34.1

2 8

[PATCH OLK-5.10 v4 0/8] coresight: etm4x: Migrate ACPI AMBA devices to platform drive
by Junhao He 27 Oct '23

27 Oct '23

CoreSight ETM4x devices could be accessed either via MMIO (handled via amba_driver) or CPU system instructions (handled via platform driver). But this has the following issues : - Each new CPU comes up with its own PID and thus we need to keep on adding the "known" PIDs to get it working with AMBA driver. While the ETM4 architecture (and CoreSight architecture) defines way to identify a device as ETM4. Thus older kernels won't be able to "discover" a newer CPU, unless we add the PIDs. - With ACPI, the ETM4x devices have the same HID to identify the device irrespective of the mode of access. This creates a problem where two different drivers (both AMBA based driver and platform driver) would hook into the "HID" and could conflict. e.g., if AMBA driver gets hold of a non-MMIO device, the probe fails. If we have single driver hooked into the given "HID", we could handle them seamlessly, irrespective of the mode of access. - CoreSight is heavily dependent on the runtime power management. With ACPI, amba_driver doesn't get us anywhere with handling the power and thus one need to always turn the power ON to use them. Moving to platform driver gives us the power management for free. Due to all of the above, we are moving ACPI MMIO based etm4x devices to be supported via tha platform driver. The series makes the existing platform driver generic to handle both type of the access modes. Although existing AMBA driver would still continue to support DT based etm4x MMIO devices. Although some problems still remain, such as manually adding PIDs for all new AMBA DT based devices. Anshuman Khandual (5): coresight: etm4x: Allocate and device assign 'struct etmv4_drvdata' earlier coresight: etm4x: Drop iomem 'base' argument from etm4_probe() coresight: etm4x: Drop pid argument from etm4_probe() coresight: etm4x: Change etm4_platform_driver driver for MMIO devices coresight: etm4x: Ensure valid drvdata and clock before clk_put() Junhao He (1): Revert "coresight: ete: Add acpi match id for Hip09" Suzuki K Poulose (2): coresight: platform: acpi: Ignore the absence of graph coresight: etm4x: Add ACPI support in platform driver drivers/acpi/acpi_amba.c | 1 - .../coresight/coresight-etm4x-core.c | 119 ++++++++++++++---- drivers/hwtracing/coresight/coresight-etm4x.h | 4 + .../hwtracing/coresight/coresight-platform.c | 6 +- include/linux/coresight.h | 59 +++++++++ 5 files changed, 162 insertions(+), 27 deletions(-) -- 2.33.0

2 9

[OLK-5.10 v2] RDMA/hns: Append SCC context to the raw dump of QP Resource
by Chengchang Tang 27 Oct '23

27 Oct '23

From: wenglianfa <wenglianfa(a)huawei.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8B8HH -------------------------------------------------------------------------- QP and SCC are bound one by one. Therefore, QPC and SCCC can be combined for output. When the SCC output is disabled, the QPC output is normal, and the SCCC output is all 0. The 512-byte QP context is appended with 64-byte SCC context. Example: $rdma res show qp -jpr [ { "ifindex": 0, "ifname": "hns_0", "data": [ 67,0,0,0... 512bytes 4,0,2... 64bytes] },... } ] Signed-off-by: wenglianfa <wenglianfa(a)huawei.com> --- drivers/infiniband/hw/hns/hns_roce_cmd.h | 3 +++ drivers/infiniband/hw/hns/hns_roce_device.h | 1 + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 25 +++++++++++++++++++ drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 6 +++++ drivers/infiniband/hw/hns/hns_roce_restrack.c | 24 +++++++++++++++--- 5 files changed, 56 insertions(+), 3 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_cmd.h b/drivers/infiniband/hw/hns/hns_roce_cmd.h index 052a3d60905a..11dbbabebdc9 100644 --- a/drivers/infiniband/hw/hns/hns_roce_cmd.h +++ b/drivers/infiniband/hw/hns/hns_roce_cmd.h @@ -108,6 +108,9 @@ enum { HNS_ROCE_CMD_QUERY_CEQC = 0x92, HNS_ROCE_CMD_DESTROY_CEQC = 0x93, + /* SCC CTX commands */ + HNS_ROCE_CMD_QUERY_SCCC = 0xa2, + /* SCC CTX BT commands */ HNS_ROCE_CMD_READ_SCCC_BT0 = 0xa4, HNS_ROCE_CMD_WRITE_SCCC_BT0 = 0xa5, diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h index 453c088ad92f..14bc242b6ad6 100644 --- a/drivers/infiniband/hw/hns/hns_roce_device.h +++ b/drivers/infiniband/hw/hns/hns_roce_device.h @@ -1020,6 +1020,7 @@ struct hns_roce_hw { int (*query_cqc)(struct hns_roce_dev *hr_dev, u32 cqn, void *buffer); int (*query_qpc)(struct hns_roce_dev *hr_dev, u32 qpn, void *buffer); int (*query_mpt)(struct hns_roce_dev *hr_dev, u32 key, void *buffer); + int (*query_sccc)(struct hns_roce_dev *hr_dev, u32 qpn, void *buffer); int (*get_dscp)(struct hns_roce_dev *hr_dev, u8 dscp, u8 *tc_mode, u8 *priority); int (*query_hw_counter)(struct hns_roce_dev *hr_dev, diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index 8a1b9714dafb..a9b44ebbbd25 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -5682,6 +5682,30 @@ static int hns_roce_v2_query_qpc(struct hns_roce_dev *hr_dev, u32 qpn, return ret; } +static int hns_roce_v2_query_sccc(struct hns_roce_dev *hr_dev, u32 qpn, + void *buffer) +{ + struct hns_roce_v2_scc_context *context; + struct hns_roce_cmd_mailbox *mailbox; + int ret; + + mailbox = hns_roce_alloc_cmd_mailbox(hr_dev); + if (IS_ERR(mailbox)) + return PTR_ERR(mailbox); + + ret = hns_roce_cmd_mbox(hr_dev, 0, mailbox->dma, HNS_ROCE_CMD_QUERY_SCCC, + qpn); + if (ret) + goto out; + + context = mailbox->buf; + memcpy(buffer, context, sizeof(*context)); + +out: + hns_roce_free_cmd_mailbox(hr_dev, mailbox); + return ret; +} + static u8 get_qp_timeout_attr(struct hns_roce_dev *hr_dev, struct hns_roce_v2_qp_context *context) { @@ -7162,6 +7186,7 @@ static const struct hns_roce_hw hns_roce_hw_v2 = { .query_cqc = hns_roce_v2_query_cqc, .query_qpc = hns_roce_v2_query_qpc, .query_mpt = hns_roce_v2_query_mpt, + .query_sccc = hns_roce_v2_query_sccc, .get_dscp = hns_roce_hw_v2_get_dscp, .hns_roce_dev_ops = &hns_roce_v2_dev_ops, .hns_roce_dev_srq_ops = &hns_roce_v2_dev_srq_ops, diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h index cbcd0f6531a4..4293ec92ca53 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h @@ -654,6 +654,12 @@ struct hns_roce_v2_qp_context { #define QPCEX_SQ_RQ_NOT_FORBID_EN QPCEX_FIELD_LOC(23, 23) #define QPCEX_STASH QPCEX_FIELD_LOC(82, 82) +#define SCC_CONTEXT_SIZE 16 + +struct hns_roce_v2_scc_context { + __le32 data[SCC_CONTEXT_SIZE]; +}; + #define V2_QP_RWE_S 1 /* rdma write enable */ #define V2_QP_RRE_S 2 /* rdma read enable */ #define V2_QP_ATE_S 3 /* rdma atomic enable */ diff --git a/drivers/infiniband/hw/hns/hns_roce_restrack.c b/drivers/infiniband/hw/hns/hns_roce_restrack.c index 961036b31c18..9b8b40998b2e 100644 --- a/drivers/infiniband/hw/hns/hns_roce_restrack.c +++ b/drivers/infiniband/hw/hns/hns_roce_restrack.c @@ -99,16 +99,34 @@ int hns_roce_fill_res_qp_entry_raw(struct sk_buff *msg, struct ib_qp *ib_qp) { struct hns_roce_dev *hr_dev = to_hr_dev(ib_qp->device); struct hns_roce_qp *hr_qp = to_hr_qp(ib_qp); - struct hns_roce_v2_qp_context context; + struct hns_roce_full_qp_ctx { + struct hns_roce_v2_qp_context qpc; + struct hns_roce_v2_scc_context sccc; + } context = {}; int ret; if (!hr_dev->hw->query_qpc) return -EINVAL; - ret = hr_dev->hw->query_qpc(hr_dev, hr_qp->qpn, &context); + ret = hr_dev->hw->query_qpc(hr_dev, hr_qp->qpn, &context.qpc); if (ret) - return -EINVAL; + return ret; + + if (!(hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_QP_FLOW_CTRL) || + !hr_dev->hw->query_sccc) + goto out; + + /* The scc may not exist. If the scc query fails, + * only the qpc content is displayed, and the + * scc value is all 0. + */ + ret = hr_dev->hw->query_sccc(hr_dev, hr_qp->qpn, &context.sccc); + if (ret) + ibdev_warn_ratelimited(&hr_dev->ib_dev, + "failed to query SCCC, ret = %d.\n", + ret); +out: ret = nla_put(msg, RDMA_NLDEV_ATTR_RES_RAW, sizeof(context), &context); return ret; -- 2.30.0

1 0