- Kernel - mailweb.openeuler.org

快看，内核&编译器领域 SIG组来啦！诚邀您参加 openEuler Developer Day 2023
by openEuler 14 Apr '23

14 Apr '23

1 0

[PATCH openEuler-22.03-LTS-SP1 0/5] Backport 5.10.150 LTS
by Jialin Zhang 13 Apr '23

13 Apr '23

Backport 5.10.151 LTS patches from upstream. Makefile | 3 +++ scripts/link-vmlinux.sh | 2 +- scripts/pahole-flags.sh | 21 +++++++++++++++++++++ 3 files changed, 25 insertions(+), 1 deletion(-) create mode 100755 scripts/pahole-flags.sh -- 2.25.1

1 5

[PATCH openEuler-22.03-LTS-SP1 v2 000/370] Backport 5.10.150 LTS
by Jialin Zhang 13 Apr '23

13 Apr '23

1 370

[OLK-5.10 0/2]
by zhoujiadong 13 Apr '23

13 Apr '23

*** BLURB HERE *** zhoujiadong (2): net/hinic3: Huawei Interface Card driver first commit net/hinic3: Huawei Interface Card hw driver first commit drivers/net/ethernet/huawei/Kconfig | 1 + drivers/net/ethernet/huawei/Makefile | 1 + drivers/net/ethernet/huawei/hinic3/Kconfig | 15 + drivers/net/ethernet/huawei/hinic3/Makefile | 45 + .../ethernet/huawei/hinic3/cfg_mgt_comm_pub.h | 212 ++ .../ethernet/huawei/hinic3/comm_cmdq_intf.h | 235 ++ .../net/ethernet/huawei/hinic3/comm_defs.h | 102 + .../ethernet/huawei/hinic3/comm_msg_intf.h | 663 +++++ .../ethernet/huawei/hinic3/hinic3_comm_cmd.h | 181 ++ .../ethernet/huawei/hinic3/hinic3_common.h | 125 + .../net/ethernet/huawei/hinic3/hinic3_crm.h | 1166 +++++++++ .../net/ethernet/huawei/hinic3/hinic3_dbg.c | 983 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_dcb.c | 405 +++ .../net/ethernet/huawei/hinic3/hinic3_dcb.h | 78 + .../ethernet/huawei/hinic3/hinic3_ethtool.c | 1331 ++++++++++ .../huawei/hinic3/hinic3_ethtool_stats.c | 1233 ++++++++++ .../ethernet/huawei/hinic3/hinic3_filter.c | 483 ++++ .../net/ethernet/huawei/hinic3/hinic3_hw.h | 832 +++++++ .../net/ethernet/huawei/hinic3/hinic3_irq.c | 189 ++ .../net/ethernet/huawei/hinic3/hinic3_lld.h | 205 ++ .../ethernet/huawei/hinic3/hinic3_mag_cfg.c | 953 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_main.c | 1125 +++++++++ .../huawei/hinic3/hinic3_mgmt_interface.h | 1245 ++++++++++ .../net/ethernet/huawei/hinic3/hinic3_mt.h | 665 +++++ .../huawei/hinic3/hinic3_netdev_ops.c | 1975 +++++++++++++++ .../net/ethernet/huawei/hinic3/hinic3_nic.h | 183 ++ .../ethernet/huawei/hinic3/hinic3_nic_cfg.c | 1608 ++++++++++++ .../ethernet/huawei/hinic3/hinic3_nic_cfg.h | 621 +++++ .../huawei/hinic3/hinic3_nic_cfg_vf.c | 638 +++++ .../ethernet/huawei/hinic3/hinic3_nic_cmd.h | 162 ++ .../ethernet/huawei/hinic3/hinic3_nic_dbg.c | 146 ++ .../ethernet/huawei/hinic3/hinic3_nic_dbg.h | 21 + .../ethernet/huawei/hinic3/hinic3_nic_dev.h | 387 +++ .../ethernet/huawei/hinic3/hinic3_nic_event.c | 580 +++++ .../ethernet/huawei/hinic3/hinic3_nic_io.c | 1122 +++++++++ .../ethernet/huawei/hinic3/hinic3_nic_io.h | 326 +++ .../ethernet/huawei/hinic3/hinic3_nic_prof.c | 47 + .../ethernet/huawei/hinic3/hinic3_nic_prof.h | 60 + .../ethernet/huawei/hinic3/hinic3_nic_qp.h | 385 +++ .../ethernet/huawei/hinic3/hinic3_ntuple.c | 907 +++++++ .../ethernet/huawei/hinic3/hinic3_prepare.sh | 262 ++ .../ethernet/huawei/hinic3/hinic3_profile.h | 147 ++ .../net/ethernet/huawei/hinic3/hinic3_rss.c | 978 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_rss.h | 100 + .../ethernet/huawei/hinic3/hinic3_rss_cfg.c | 384 +++ .../net/ethernet/huawei/hinic3/hinic3_rx.c | 1344 ++++++++++ .../net/ethernet/huawei/hinic3/hinic3_rx.h | 155 ++ .../ethernet/huawei/hinic3/hinic3_srv_nic.h | 213 ++ .../net/ethernet/huawei/hinic3/hinic3_tx.c | 1016 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_tx.h | 159 ++ .../net/ethernet/huawei/hinic3/hinic3_wq.h | 134 + .../huawei/hinic3/hw/hinic3_api_cmd.c | 1211 +++++++++ .../huawei/hinic3/hw/hinic3_api_cmd.h | 286 +++ .../ethernet/huawei/hinic3/hw/hinic3_cmdq.c | 1543 ++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_cmdq.h | 204 ++ .../ethernet/huawei/hinic3/hw/hinic3_common.c | 93 + .../ethernet/huawei/hinic3/hw/hinic3_csr.h | 187 ++ .../huawei/hinic3/hw/hinic3_dev_mgmt.c | 803 ++++++ .../huawei/hinic3/hw/hinic3_dev_mgmt.h | 105 + .../huawei/hinic3/hw/hinic3_devlink.c | 431 ++++ .../huawei/hinic3/hw/hinic3_devlink.h | 149 ++ .../ethernet/huawei/hinic3/hw/hinic3_eqs.c | 1385 +++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_eqs.h | 165 ++ .../ethernet/huawei/hinic3/hw/hinic3_hw_api.c | 453 ++++ .../ethernet/huawei/hinic3/hw/hinic3_hw_api.h | 141 ++ .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c | 1480 +++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h | 332 +++ .../huawei/hinic3/hw/hinic3_hw_comm.c | 1540 ++++++++++++ .../huawei/hinic3/hw/hinic3_hw_comm.h | 51 + .../ethernet/huawei/hinic3/hw/hinic3_hw_mt.c | 599 +++++ .../ethernet/huawei/hinic3/hw/hinic3_hw_mt.h | 49 + .../ethernet/huawei/hinic3/hw/hinic3_hwdev.c | 2141 ++++++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_hwdev.h | 175 ++ .../ethernet/huawei/hinic3/hw/hinic3_hwif.c | 994 ++++++++ .../ethernet/huawei/hinic3/hw/hinic3_hwif.h | 113 + .../ethernet/huawei/hinic3/hw/hinic3_lld.c | 1413 +++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_mbox.c | 1842 ++++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_mbox.h | 267 ++ .../ethernet/huawei/hinic3/hw/hinic3_mgmt.c | 1515 ++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_mgmt.h | 179 ++ .../huawei/hinic3/hw/hinic3_nictool.c | 974 ++++++++ .../huawei/hinic3/hw/hinic3_nictool.h | 35 + .../huawei/hinic3/hw/hinic3_pci_id_tbl.h | 15 + .../huawei/hinic3/hw/hinic3_prof_adap.c | 44 + .../huawei/hinic3/hw/hinic3_prof_adap.h | 111 + .../ethernet/huawei/hinic3/hw/hinic3_sm_lt.h | 160 ++ .../ethernet/huawei/hinic3/hw/hinic3_sml_lt.c | 160 ++ .../ethernet/huawei/hinic3/hw/hinic3_sriov.c | 267 ++ .../ethernet/huawei/hinic3/hw/hinic3_sriov.h | 35 + .../net/ethernet/huawei/hinic3/hw/hinic3_wq.c | 159 ++ .../huawei/hinic3/hw/ossl_knl_linux.c | 533 ++++ drivers/net/ethernet/huawei/hinic3/mag_cmd.h | 879 +++++++ .../ethernet/huawei/hinic3/mgmt_msg_base.h | 27 + .../net/ethernet/huawei/hinic3/nic_cfg_comm.h | 66 + drivers/net/ethernet/huawei/hinic3/ossl_knl.h | 38 + .../ethernet/huawei/hinic3/ossl_knl_linux.h | 2178 +++++++++++++++++ 96 files changed, 52060 insertions(+) create mode 100644 drivers/net/ethernet/huawei/hinic3/Kconfig create mode 100644 drivers/net/ethernet/huawei/hinic3/Makefile create mode 100644 drivers/net/ethernet/huawei/hinic3/cfg_mgt_comm_pub.h create mode 100644 drivers/net/ethernet/huawei/hinic3/comm_cmdq_intf.h create mode 100644 drivers/net/ethernet/huawei/hinic3/comm_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/comm_msg_intf.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_comm_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_common.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_crm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_dbg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_dcb.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_dcb.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_ethtool_stats.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_filter.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_hw.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_irq.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_lld.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_main.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_mgmt_interface.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_mt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_netdev_ops.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg_vf.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_dbg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_dbg.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_event.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_prof.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_prof.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_qp.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_ntuple.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_prepare.sh create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_profile.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rss.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rss.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rss_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rx.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rx.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_srv_nic.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_tx.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_tx.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_wq.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_cmdq.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_cmdq.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_common.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_csr.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_devlink.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_devlink.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_eqs.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_eqs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_api.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_api.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_comm.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_comm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_mt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_mt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwdev.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwdev.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mbox.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mbox.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_nictool.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_nictool.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_pci_id_tbl.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_prof_adap.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_prof_adap.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sm_lt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sml_lt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sriov.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sriov.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_wq.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/ossl_knl_linux.c create mode 100644 drivers/net/ethernet/huawei/hinic3/mag_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/mgmt_msg_base.h create mode 100644 drivers/net/ethernet/huawei/hinic3/nic_cfg_comm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/ossl_knl.h create mode 100644 drivers/net/ethernet/huawei/hinic3/ossl_knl_linux.h -- 2.24.0

1 2

[PATCH openEuler-22.03-LTS-SP1 000/371] Backport 5.10.150 LTS
by Jialin Zhang 13 Apr '23

13 Apr '23

Backport 5.10.150 LTS patches from upstream. Conflicts: Already merged(18): f039b43cbaea inet: fully convert sk->sk_rx_dst to RCU rules 45c33966759e mm: hugetlb: fix UAF in hugetlb_handle_userfault 67cbc8865a66 io_uring: correct pinned_vm accounting 904f881b5736 arm64: topology: fix possible overflow in amu_fie_setup() dbcca76435a6 HID: roccat: Fix use-after-free in roccat_read() 484400d433ca r8152: Rate limit overflow messages d88b88514ef2 crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr 657de36c72f5 arm64: ftrace: fix module PLTs with mcount 29f50bcf0f8b net: mvpp2: fix mvpp2 debugfs leak 6cc0e2afc6a1 bnx2x: fix potential memory leak in bnx2x_tpa_stop() 2a1d03632085 mISDN: fix use-after-free bugs in l1oip timer handlers 0cf6c09dafee ring-buffer: Fix race between reset page and reading page fbb0e601bd51 ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate 483831ad0440 ext4: fix check for block being out of directory size f34ab9516276 ext4: fix null-ptr-deref in ext4_write_info e50472949604 fbdev: smscufx: Fix use-after-free in ufx_ops_open() 7d551b7d6114 block: fix inflight statistics of part0 6b7ae4a904a4 quota: Check next/prev free block number after reading from quota file Context conflict(1): c13d0d2f5a48 usb: host: xhci-plat: suspend and resume clocks Total patches: 389 - 18 = 371 Adrian Hunter (1): perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc Adrián Larumbe (1): drm/meson: explicitly remove aggregate driver at module unload time Albert Briscoe (1): usb: gadget: function: fix dangling pnp_string in f_printer.c Alex Deucher (1): Revert "drm/amdgpu: make sure to init common IP before gmc" Alexander Aring (4): fs: dlm: fix race between test_bit() and queue_work() fs: dlm: handle -EBUSY first in lock arg validation net: ieee802154: return -EINVAL for unknown addr type Revert "net/ieee802154: reject zero-sized raw_sendmsg()" Alexander Coffin (1): wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() Alexander Stein (6): ARM: dts: imx6q: add missing properties for sram ARM: dts: imx6dl: add missing properties for sram ARM: dts: imx6qp: add missing properties for sram ARM: dts: imx6sl: add missing properties for sram ARM: dts: imx6sll: add missing properties for sram ARM: dts: imx6sx: add missing properties for sram Alvin Šipraga (1): drm: bridge: adv7511: fix CEC power down control register offset Andreas Pape (1): ALSA: dmaengine: increment buffer pointer atomically Andrew Bresticker (2): riscv: Allow PROT_WRITE-only mmap() riscv: Make VM_WRITE imply VM_READ Andrew Perepechko (1): jbd2: wake up journal waiters in FIFO order, not LIFO Andri Yngvason (1): HID: multitouch: Add memory barriers Anna Schumaker (1): NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data Anssi Hannula (4): can: kvaser_usb: Fix use of uninitialized completion can: kvaser_usb_leaf: Fix overread with an invalid command can: kvaser_usb_leaf: Fix TX queue out of sync after restart can: kvaser_usb_leaf: Fix CAN state after restart Ard Biesheuvel (1): efi: libstub: drop pointless get_memory_map() call Aric Cyr (1): drm/amd/display: Remove interface for periodic interrupt 1 Arnd Bergmann (1): Bluetooth: btusb: fix excessive stack usage Arvid Norlander (1): ACPI: video: Add Toshiba Satellite/Portege Z830 quirk Asmaa Mnebhi (1): i2c: mlxbf: support lock mechanism Bernard Metzler (1): RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall. Bitterblue Smith (4): wifi: rtl8xxxu: Fix skb misuse in TX queue selection wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration wifi: rtl8xxxu: Remove copy-paste leftover in gen2_update_rate_mask wifi: rtl8xxxu: Fix AIFS written to REG_EDCA_*_PARAM Callum Osmotherly (1): ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530 Carlos Llamas (1): mm/mmap: undo ->mmap() when arch_validate_flags() fails Chao Qin (1): powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue Chao Yu (5): f2fs: fix to do sanity check on destination blkaddr during recovery f2fs: fix to do sanity check on summary info f2fs: fix to avoid REQ_TIME and CP_TIME collision f2fs: fix to account FS_CP_DATA_IO correctly f2fs: fix wrong condition to trigger background checkpoint correctly Chen-Yu Tsai (2): drm/bridge: parade-ps8640: Fix regulator supply order clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent Christophe JAILLET (11): MIPS: SGI-IP27: Free some unused memory nfsd: Fix a memory leak in an error handling path spi: mt7621: Fix an error message in mt7621_spi_probe() mmc: au1xmmc: Fix an error handling path in au1xmmc_probe() ASoC: da7219: Fix an error handling path in da7219_register_dai_clks() mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe() serial: 8250: Add an empty line and remove some useless {} mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe() mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq() mfd: lp8788: Fix an error handling path in lp8788_probe() mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init() Chunfeng Yun (2): usb: common: add function to get interval expressed in us unit usb: common: move function's kerneldoc next to its definition Claudiu Beznea (4): iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX iio: adc: at91-sama5d2_adc: check return status for pressure and touch iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq iio: adc: at91-sama5d2_adc: disable/prepare buffer on suspend/resume Coly Li (1): bcache: fix set_at_max_writeback_rate() for multiple attached devices Dai Ngo (1): NFSD: fix use-after-free on source server when doing inter-server copy Daisuke Matsuda (1): IB: Set IOVA/LENGTH on IB_MR in core/uverbs layers Damian Muszynski (1): crypto: qat - fix DMA transfer direction Dan Carpenter (10): wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse() drm/bridge: Avoid uninitialized variable warning platform/chrome: fix memory corruption in ioctl fpga: prevent integer overflow in dfl_feature_ioctl_set_irq() mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct() drivers: serial: jsm: fix some leaks in probe mfd: fsl-imx25: Fix check for platform_get_irq() errors iommu/omap: Fix buffer overflow in debugfs crypto: marvell/octeontx - prevent integer overflows crypto: cavium - prevent integer overflow loading firmware Daniel Golle (5): wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620 wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620 wifi: rt2x00: set VGC gain for both chains of MT7620 wifi: rt2x00: set SoC wmac clock register wifi: rt2x00: correctly set BBP register 86 for MT7620 Dave Jiang (1): dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup() David Collins (1): spmi: pmic-arb: correct duplicate APID to PPID mapping logic David Gow (1): drm/amd/display: fix overflow on MIN_I64 definition Dmitry Baryshkov (1): drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx Dmitry Osipenko (3): drm/virtio: Check whether transferred 2D BO is shmem media: cedrus: Set the platform driver data earlier soc/tegra: fuse: Drop Kconfig dependency on TEGRA20_APB_DMA Dmitry Torokhov (2): ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family ARM: dts: exynos: fix polarity of VBUS GPIO of Origen Dongliang Mu (2): phy: qualcomm: call clk_disable_unprepare in the error handling usb: idmouse: fix an uninit-value in idmouse_open Duoming Zhou (1): scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() Eddie James (2): iio: pressure: dps310: Refactor startup procedure iio: pressure: dps310: Reset chip after timeout Eric Dumazet (2): once: add DO_ONCE_SLOW() for sleepable contexts tcp: annotate data-race around tcp_md5sig_pool_populated Fangrui Song (1): riscv: Pass -mno-relax only on lld < 15.0.0 Filipe Manana (1): btrfs: fix race between quota enable and quota rescan ioctl Geert Uytterhoeven (1): ARM: Drop CMDLINE_* dependency on ATAGS Giovanni Cabiddu (1): crypto: qat - use pre-allocated buffers in datapath Greg Kroah-Hartman (2): staging: greybus: audio_helper: remove unused and wrong debugfs usage selinux: use "grep -E" instead of "egrep" Guilherme G. Piccoli (1): firmware: google: Test spinlock on panic path to avoid lockups Haibo Chen (1): ARM: dts: imx7d-sdb: config the max pressure for tsc2046 Hangyu Hua (1): misc: ocxl: fix possible refcount leak in afu_ioctl() Hans de Goede (3): platform/x86: msi-laptop: Fix old-ec check for backlight registering platform/x86: msi-laptop: Fix resource cleanup platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading Hari Chandrakanthan (1): wifi: mac80211: allow bw change during channel switch in mesh Helge Deller (1): parisc: fbdev/stifb: Align graphics memory size to 4MB Huacai Chen (1): UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK Hui Tang (1): crypto: qat - fix use of 'dma_map_single' Ian Nam (1): clk: zynqmp: Fix stack-out-of-bounds in strncpy` Ian Rogers (1): selftests/xsk: Avoid use-after-free on ctx Ignat Korchagin (1): crypto: akcipher - default implementation for setting a private key Ilpo Järvinen (1): serial: 8250: Toggle IER bits on only after irq has been set up Jack Wang (2): HSI: omap_ssi_port: Fix dma_map_sg error check mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg Jaegeuk Kim (1): f2fs: increase the limit for reserve_root Jairaj Arava (1): ASoC: SOF: pci: Change DMI match info to support all Chrome platforms Jameson Thies (1): platform/chrome: cros_ec: Notify the PM of wake events during resume Jan Kara (1): ext4: avoid crash when inline data creation follows DIO write Janis Schoetterl-Glausch (1): kbuild: rpm-pkg: fix breakage when V=1 is used Javier Martinez Canillas (2): drm: Use size_t type for len variable in drm_copy_field() drm: Prevent drm_copy_field() to attempt copying a NULL pointer Jean-Francois Le Fillatre (1): usb: add quirks for Lenovo OneLink+ Dock Jerry Lee 李修賢 (1): ext4: continue to expand file system when the target size doesn't reach Jesus Fernandez Manzano (1): wifi: ath11k: fix number of VHT beamformee spatial streams Jianglei Nie (3): drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table() drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc() usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() Jiasheng Jiang (3): ASoC: rsnd: Add check for rsnd_mod_power_on fsi: core: Check error number after calling ida_simple_get mfd: sm501: Add check for platform_driver_register() Jie Hai (3): dmaengine: hisilicon: Disable channels when unregister hisi_dma dmaengine: hisilicon: Fix CQ head update dmaengine: hisilicon: Add multi-thread support for a DMA channel Jim Cromie (4): dyndbg: fix static_branch manipulation dyndbg: fix module.dyndbg handling dyndbg: let query-modname override actual module name dyndbg: drop EXPORTed dynamic_debug_exec_queries Jinke Han (1): ext4: place buffer head allocation before handle start Joel Stanley (1): clk: ast2600: BCLK comes from EPLL Jonathan Cameron (1): iio: ABI: Fix wrong format of differential capacitance channel ABI. Junichi Uekawa (1): vhost/vsock: Use kvmalloc/kvfree for larger packets. Justin Chen (2): usb: host: xhci-plat: suspend and resume clocks usb: host: xhci-plat: suspend/resume clks for brcm Kees Cook (7): hardening: Clarify Kconfig text for auto-var-init hardening: Avoid harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO hardening: Remove Clang's enable flag for -ftrivial-auto-var-init=zero sh: machvec: Use char[] for section boundaries x86/microcode/AMD: Track patch allocation size explicitly MIPS: BCM47XX: Cast memcmp() of function to (void *) x86/entry: Work around Clang __bdos() bug Keith Busch (1): nvme: copy firmware_rev on each init Khaled Almahallawy (1): drm/dp: Don't rewrite link config when setting phy test pattern Khalid Masum (1): xfrm: Update ipcomp_scratches with NULL when freed Koba Ko (1): crypto: ccp - Release dma channels before dmaengine unrgister Kohei Tarumizu (1): x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register Krzysztof Kozlowski (2): ASoC: wcd9335: fix order of Slimbus unprepare/disable ASoC: wcd934x: fix order of Slimbus unprepare/disable Kshitiz Varshney (1): hwrng: imx-rngc - Moving IRQ handler registering after imx_rngc_irq_mask_clear() Kuogee Hsieh (1): drm/msm/dp: correct 1.62G link rate at dp_catalog_ctrl_config_msa() Lalith Rajendran (1): ext4: make ext4_lazyinit_thread freezable Lam Thai (1): bpftool: Fix a wrong type cast in btf_dumper_int Lee Jones (1): bpf: Ensure correct locking around vulnerable function find_vpid() Letu Ren (1): scsi: 3w-9xxx: Avoid disabling device if failing to enable it Liang He (17): hwmon: (gsc-hwmon) Call of_node_get() before of_find_xxx API drm:pl111: Add of_node_put() when breaking out of for_each_available_child_of_node() drm/omap: dss: Fix refcount leak bugs ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe() memory: of: Fix refcount leak bug in of_get_ddr_timings() memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings() soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe() soc: qcom: smem_state: Add refcounting for the 'state->of_node' clk: meson: Hold reference returned by of_get_parent() clk: oxnas: Hold reference returned by of_get_parent() clk: qoriq: Hold reference returned by of_get_parent() clk: berlin: Add of_node_put() for of_get_parent() clk: sprd: Hold reference returned by of_get_parent() media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop powerpc/sysdev/fsl_msi: Add missing of_node_put() powerpc/pci_dn: Add missing of_node_put() Lin Yujun (1): MIPS: SGI-IP27: Fix platform-device leak in bridge_platform_create() Linus Walleij (1): regulator: qcom_rpm: Fix circular deferral regression Liu Jian (1): net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory Logan Gunthorpe (2): md/raid5: Ensure stripe_fill happens on non-read IO with journal md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d Lorenz Bauer (1): bpf: btf: fix truncated last_member_type_id in btf_struct_resolve Lucas Stach (1): drm: bridge: dw_hdmi: only trigger hotplug event on link change Luciano Leão (1): x86/cpu: Include the header of init_ia32_feat_ctl()'s prototype Luiz Augusto von Dentz (3): Bluetooth: hci_core: Fix not handling link timeouts propertly Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times Bluetooth: L2CAP: Fix user-after-free Lukas Czerner (1): ext4: don't increase iversion counter for ea_inodes Luke D. Jones (2): ALSA: hda/realtek: Correct pin configs for ASUS G533Z ALSA: hda/realtek: Add quirk for ASUS GV601R laptop Lyude Paul (1): drm/nouveau/kms/nv140-: Disable interlacing Maciej W. Rozycki (2): RISC-V: Make port I/O string accessors actually work PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge Marek Behún (1): ARM: dts: turris-omnia: Fix mpp26 pin name and comment Marek Szyprowski (1): spi: Ensure that sg_table won't be used after being freed Mario Limonciello (2): thunderbolt: Explicitly enable lane adapter hotplug events at startup xhci: Don't show warning for reinit on known broken suspend Mark Brown (1): kselftest/arm64: Fix validatation termination record after EXTRA_CONTEXT Mark Chen (1): Bluetooth: btusb: Fine-tune mt7663 mechanism. Mark Zhang (1): RDMA/cm: Use SLID in the work completion as the DLID in responder side Martin Liska (1): gcov: support GCC 12.1 and newer compilers Martin Povišer (3): ASoC: tas2764: Allow mono streams ASoC: tas2764: Drop conflicting set_bias_level power setting ASoC: tas2764: Fix mute/unmute Masahiro Yamada (1): kbuild: remove the target in signal traps when interrupted Mateusz Kwiatkowski (1): drm/vc4: vec: Fix timings for VEC modes Maxime Ripard (2): drm/mipi-dsi: Detach devices when removing the host clk: bcm2835: Make peripheral PLLC critical Maya Matuszczyk (1): drm: panel-orientation-quirks: Add quirk for Anbernic Win600 Miaoqian Lin (6): clk: tegra: Fix refcount leak in tegra210_clock_init clk: tegra: Fix refcount leak in tegra114_clock_init clk: tegra20: Fix refcount leak in tegra20_clock_init HSI: omap_ssi: Fix refcount leak in ssi_probe media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe Michael Hennerich (1): iio: dac: ad5593r: Fix i2c read protocol requirements Michael Walle (2): ARM: dts: kirkwood: lsxl: fix serial line ARM: dts: kirkwood: lsxl: remove first ethernet port Michal Hocko (1): rcu: Back off upon fill_page_cache_func() allocation failure Michal Luczaj (1): KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility Mike Christie (1): scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() Mike Pattrick (2): openvswitch: Fix double reporting of drops in dropwatch openvswitch: Fix overreporting of drops in dropwatch Nam Cao (2): staging: vt6655: fix some erroneous memory clean-up loops staging: vt6655: fix potential memory leak Nathan Chancellor (1): powerpc/math_emu/efp: Include module.h Neal Cardwell (1): tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited Neil Armstrong (1): spi: meson-spicc: do not rely on busy flag in pow2 clk ops Nicholas Piggin (1): powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5 Niklas Cassel (4): ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting() ata: fix ata_id_has_devslp() ata: fix ata_id_has_ncq_autosense() ata: fix ata_id_has_dipm() Nuno Sá (2): iio: adc: ad7923: fix channel readings for some variants iio: inkern: only release the device node when done with it Ondrej Mosnacek (1): userfaultfd: open userfaultfds with O_RDONLY Pali Rohár (4): powerpc/boot: Explicitly disable usage of SPE instructions mtd: rawnand: fsl_elbc: Fix none ECC mode serial: 8250: Fix restoring termios speed after suspend powerpc: Fix SPE Power ISA properties for e500v1 platforms Patrick Rudolph (1): regulator: core: Prevent integer underflow Patryk Duda (1): platform/chrome: cros_ec_proto: Update version on GET_NEXT_EVENT failure Pavel Begunkov (1): io_uring/af_unix: defer registered files gc to io_uring release Peter Harliman Liem (1): crypto: inside-secure - Change swab to swab32 Phil Sutter (1): netfilter: nft_fib: Fix for rpath check with VRF devices Pierre-Louis Bossart (1): soundwire: intel: fix error handling on dai registration issues Qu Wenruo (1): btrfs: scrub: try to fix super block errors Quanyang Wang (1): clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate Quentin Monnet (1): bpftool: Clear errno after libcap's checks Rafael J. Wysocki (1): thermal: intel_powerclamp: Use first online CPU as control_cpu Randy Dunlap (2): drm: fix drm_mipi_dbi build errors ia64: export memory_add_physaddr_to_nid to fix cxl build error Richard Acayan (1): mmc: sdhci-msm: add compatible string check for sdm670 Richard Fitzgerald (1): soundwire: cadence: Don't overwrite msg->buf during write commands Rik van Riel (1): livepatch: fix race between fork and KLP transition Rishabh Bhatnagar (1): nvme-pci: set min_align_mask before calculating max_hw_sectors Robert Marko (1): clk: qcom: apss-ipq6018: mark apcs_alias0_core_clk as critical Robin Guo (1): usb: musb: Fix musb_gadget.c rxstate overflow bug Robin Murphy (1): iommu/iova: Fix module config properly Ronnie Sahlberg (1): cifs: destage dirty pages before re-reading them for cache=none Rustam Subkhankulov (1): platform/chrome: fix double-free in chromeos_laptop_prepare() Sami Tolvanen (1): objtool: Preserve special st_shndx indexes in elf_update_symbol Saranya Gopal (1): ALSA: hda/realtek: Add Intel Reference SSID to support headset keys Saurabh Sengar (1): md: Replace snprintf with scnprintf Saurav Kashyap (1): scsi: qedf: Populate sysfs attributes for vport Sean Christopherson (2): KVM: nVMX: Unconditionally purge queued/injected events on nested "exit" KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS Sean Wang (1): Bluetooth: btusb: mediatek: fix WMT failure during runtime suspend Sebastian Krzyszkowiak (1): arm64: dts: imx8mq-librem5: Add bq25895 as max17055's power supply Serge Semin (5): clk: vc5: Fix 5P49V6901 outputs disabling when enabling FOD clk: baikal-t1: Fix invalid xGMAC PTP clock divider clk: baikal-t1: Add shared xGMAC ref/ptp clocks internal parent clk: baikal-t1: Add SATA internal ref clock buffer ata: libahci_platform: Sanity check the DT child nodes number Sherry Sun (1): tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown Shigeru Yoshida (1): nbd: Fix hung when signal interrupts nbd_start_device_ioctl() Shuah Khan (2): Revert "drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega" Revert "drm/amdgpu: use dirty framebuffer helper" Shuai Xue (1): ACPI: APEI: do not add task_work to kernel thread to avoid memory leak Shubhrajyoti Datta (1): tty: xilinx_uartps: Fix the ignore_status Simon Ser (1): drm/dp_mst: fix drm_dp_dpcd_read return value checks Srinivas Pandruvada (1): thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash Stefan Berger (1): selftest: tpm2: Add Client.__del__() to close /dev/tpm* handle Stefan Wahren (1): clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration Steve French (1): smb3: must initialize two ACL struct fields to zero Steven Rostedt (Google) (4): ring-buffer: Allow splice to read previous partially read pages ring-buffer: Have the shortest_full queue be the shortest not longest ring-buffer: Check pending waiters when doing wake ups as well ring-buffer: Add ring_buffer_wake_waiters() Takashi Iwai (7): ALSA: oss: Fix potential deadlock at unregistration ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free() ALSA: usb-audio: Fix potential memory leaks ALSA: usb-audio: Fix NULL dererence at error path drm/udl: Restore display mode on resume ALSA: hda: beep: Simplify keep-power-at-enable behavior ALSA: hda/hdmi: Don't skip notification handling during PM operation Tetsuo Handa (6): Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() net/ieee802154: reject zero-sized raw_sendmsg() wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create() net/ieee802154: don't warn zero-sized raw_sendmsg() Thinh Nguyen (3): usb: ch9: Add USB 3.2 SSP attributes usb: common: Parse for USB SSP genXxY usb: common: debug: Check non-standard control requests Tudor Ambarus (1): mtd: rawnand: atmel: Unmap streaming DMA mappings Uwe Kleine-König (2): iio: ltc2497: Fix reading conversion results leds: lm3601x: Don't use mutex after it was destroyed Varun Prakash (1): nvmet-tcp: add bounds check on Transfer Tag Ville Syrjälä (2): drm/i915: Fix watermark calculations for gen12+ RC CCS modifier drm/i915: Fix watermark calculations for gen12+ MC CCS modifier Vincent Knecht (1): thermal/drivers/qcom/tsens-v0_1: Fix MSM8939 fourth sensor hw_id Vincent Whitchurch (1): spi: s3c64xx: Fix large transfers with DMA Vitaly Kuznetsov (1): x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition Vivek Kasireddy (1): udmabuf: Set ubuf->sg = NULL if the creation of sg table fails Waiman Long (2): tracing: Disable interrupt or preemption before acquiring arch_spinlock_t cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset Wang Kefeng (2): ARM: 9244/1: dump: Fix wrong pg_level in walk_pmd() ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE Wei Yongjun (1): power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type() Wen Gong (1): wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() Wenchao Chen (1): mmc: sdhci-sprd: Fix minimum clock limit William Dean (1): mtd: devices: docg3: check the return value of devm_ioremap() in the probe Wright Feng (1): wifi: brcmfmac: fix invalid address access when enabling SCAN log level Xiaoke Wang (1): staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv() Xin Long (1): sctp: handle the error returned from sctp_auth_asoc_init_active_key Xu Qiang (3): spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume() spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime() media: meson: vdec: add missing clk_disable_unprepare on error in vdec_hevc_start() Ye Bin (7): jbd2: fix potential buffer head reference count leak jbd2: fix potential use-after-free in jbd2_fc_wait_bufs jbd2: add miss release buffer head in fc_do_one_pass() ext4: fix miss release buffer head in ext4_fc_write_inode ext4: fix potential memory leak in ext4_fc_record_modified_inode() ext4: fix potential memory leak in ext4_fc_record_regions() ext4: update 'state->fc_regions_size' after successful memory allocation Yipeng Zou (2): tracing: kprobe: Fix kprobe event gen test module on exit tracing: kprobe: Make gen test module work in arm and riscv Yu Kuai (1): blk-throttle: prevent overflow while calculating wait time Zeng Jingxiang (1): gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init() Zhang Qilong (7): spi: dw: Fix PM disable depth imbalance in dw_spi_bt1_probe spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe ASoC: mt6660: Fix PM disable depth imbalance in mt6660_i2c_probe f2fs: fix race condition on setting FI_NO_EXTENT flag Zhang Rui (1): powercap: intel_rapl: Use standard Energy Unit for SPR Dram RAPL domain Zhang Xiaoxu (1): cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message Zheng Yejian (1): ftrace: Properly unset FTRACE_HASH_FL_MOD Zheng Yongjun (2): net: fs_enet: Fix wrong check in do_pd_setup powerpc/powernv: add missing of_node_put() in opal_export_attrs() Zhengchao Shao (1): crypto: sahara - don't sleep when in softirq Zheyu Ma (2): drm/bridge: megachips: Fix a null pointer dereference bug media: cx88: Fix a null-ptr-deref bug in buffer_prepare() Zhu Yanjun (2): RDMA/rxe: Fix "kernel NULL pointer dereference" error RDMA/rxe: Fix the error caused by qp->sk Ziyang Xuan (1): can: bcm: check the result of can_send() in bcm_can_tx() Zqiang (1): rcu-tasks: Convert RCU_LOCKDEP_WARN() to WARN_ONCE() hongao (1): drm/amdgpu: fix initial connector audio value sunghwan jung (1): Revert "usb: storage: Add quirk for Samsung Fit flash" Documentation/ABI/testing/sysfs-bus-iio | 2 +- Makefile | 6 +- arch/arm/Kconfig | 1 - arch/arm/boot/dts/armada-385-turris-omnia.dts | 4 +- arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +- arch/arm/boot/dts/exynos4412-origen.dts | 2 +- arch/arm/boot/dts/imx6dl.dtsi | 3 + arch/arm/boot/dts/imx6q.dtsi | 3 + arch/arm/boot/dts/imx6qp.dtsi | 6 + arch/arm/boot/dts/imx6sl.dtsi | 3 + arch/arm/boot/dts/imx6sll.dtsi | 3 + arch/arm/boot/dts/imx6sx.dtsi | 6 + arch/arm/boot/dts/imx7d-sdb.dts | 7 +- arch/arm/boot/dts/kirkwood-lsxl.dtsi | 16 +- arch/arm/mm/dump.c | 2 +- arch/arm/mm/mmu.c | 4 + .../boot/dts/freescale/imx8mq-librem5.dtsi | 1 + arch/ia64/mm/numa.c | 1 + arch/mips/bcm47xx/prom.c | 4 +- arch/mips/sgi-ip27/ip27-xtalk.c | 74 +++-- arch/powerpc/Makefile | 2 +- arch/powerpc/boot/Makefile | 1 + .../boot/dts/fsl/e500v1_power_isa.dtsi | 51 ++++ arch/powerpc/boot/dts/fsl/mpc8540ads.dts | 2 +- arch/powerpc/boot/dts/fsl/mpc8541cds.dts | 2 +- arch/powerpc/boot/dts/fsl/mpc8555cds.dts | 2 +- arch/powerpc/boot/dts/fsl/mpc8560ads.dts | 2 +- arch/powerpc/kernel/pci_dn.c | 1 + arch/powerpc/math-emu/math_efp.c | 1 + arch/powerpc/platforms/powernv/opal.c | 1 + arch/powerpc/sysdev/fsl_msi.c | 2 + arch/riscv/Makefile | 2 + arch/riscv/include/asm/io.h | 16 +- arch/riscv/kernel/sys_riscv.c | 3 - arch/riscv/mm/fault.c | 3 +- arch/sh/include/asm/sections.h | 2 +- arch/sh/kernel/machvec.c | 10 +- arch/um/kernel/um_arch.c | 2 +- arch/x86/include/asm/hyperv-tlfs.h | 4 +- arch/x86/include/asm/microcode.h | 1 + arch/x86/kernel/cpu/feat_ctl.c | 2 +- arch/x86/kernel/cpu/microcode/amd.c | 3 +- arch/x86/kernel/cpu/resctrl/pseudo_lock.c | 12 +- arch/x86/kvm/emulate.c | 2 +- arch/x86/kvm/vmx/nested.c | 30 +- arch/x86/kvm/vmx/vmx.c | 12 +- arch/x86/xen/enlighten_pv.c | 3 +- block/blk-throttle.c | 8 +- crypto/akcipher.c | 8 + drivers/acpi/acpi_video.c | 16 ++ drivers/acpi/apei/ghes.c | 2 +- drivers/ata/libahci_platform.c | 14 +- drivers/block/nbd.c | 6 +- drivers/bluetooth/btusb.c | 47 +++- drivers/bluetooth/hci_ldisc.c | 7 +- drivers/bluetooth/hci_serdev.c | 10 +- drivers/char/hw_random/imx-rngc.c | 14 +- drivers/clk/baikal-t1/ccu-div.c | 65 +++++ drivers/clk/baikal-t1/ccu-div.h | 10 + drivers/clk/baikal-t1/clk-ccu-div.c | 26 +- drivers/clk/bcm/clk-bcm2835.c | 8 +- drivers/clk/berlin/bg2.c | 5 +- drivers/clk/berlin/bg2q.c | 6 +- drivers/clk/clk-ast2600.c | 2 +- drivers/clk/clk-oxnas.c | 6 +- drivers/clk/clk-qoriq.c | 10 +- drivers/clk/clk-versaclock5.c | 2 +- drivers/clk/mediatek/clk-mt8183-mfgcfg.c | 6 +- drivers/clk/meson/meson-aoclk.c | 5 +- drivers/clk/meson/meson-eeclk.c | 5 +- drivers/clk/meson/meson8b.c | 5 +- drivers/clk/qcom/apss-ipq6018.c | 2 +- drivers/clk/sprd/common.c | 9 +- drivers/clk/tegra/clk-tegra114.c | 1 + drivers/clk/tegra/clk-tegra20.c | 1 + drivers/clk/tegra/clk-tegra210.c | 1 + drivers/clk/ti/clk-dra7-atl.c | 9 +- drivers/clk/zynqmp/clkc.c | 7 + drivers/clk/zynqmp/pll.c | 31 +-- drivers/crypto/cavium/cpt/cptpf_main.c | 6 +- drivers/crypto/ccp/ccp-dmaengine.c | 6 +- drivers/crypto/inside-secure/safexcel_hash.c | 8 +- .../crypto/marvell/octeontx/otx_cptpf_ucode.c | 18 +- drivers/crypto/qat/qat_common/qat_algs.c | 109 +++++--- drivers/crypto/qat/qat_common/qat_crypto.h | 24 ++ drivers/crypto/sahara.c | 18 +- drivers/dma-buf/udmabuf.c | 9 +- drivers/dma/hisi_dma.c | 28 +- drivers/dma/ioat/dma.c | 6 +- drivers/firmware/efi/libstub/fdt.c | 8 - drivers/firmware/google/gsmi.c | 9 + drivers/fpga/dfl.c | 2 +- drivers/fsi/fsi-core.c | 3 + drivers/gpu/drm/Kconfig | 1 + .../gpu/drm/amd/amdgpu/amdgpu_connectors.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 14 +- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 2 - drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 5 - drivers/gpu/drm/amd/amdgpu/soc15.c | 25 ++ .../gpu/drm/amd/display/dc/calcs/bw_fixed.c | 6 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 16 +- drivers/gpu/drm/amd/display/dc/dc_stream.h | 6 +- .../amd/display/dc/dcn10/dcn10_hw_sequencer.c | 35 +-- .../amd/display/dc/dcn10/dcn10_hw_sequencer.h | 3 +- .../gpu/drm/amd/display/dc/inc/hw_sequencer.h | 8 +- drivers/gpu/drm/bridge/adv7511/adv7511.h | 5 +- drivers/gpu/drm/bridge/adv7511/adv7511_cec.c | 4 +- drivers/gpu/drm/bridge/lontium-lt9611.c | 3 +- .../bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 4 +- drivers/gpu/drm/bridge/parade-ps8640.c | 4 +- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 13 +- drivers/gpu/drm/drm_bridge.c | 4 +- drivers/gpu/drm/drm_dp_helper.c | 9 - drivers/gpu/drm/drm_dp_mst_topology.c | 6 +- drivers/gpu/drm/drm_ioctl.c | 8 +- drivers/gpu/drm/drm_mipi_dsi.c | 1 + .../gpu/drm/drm_panel_orientation_quirks.c | 6 + drivers/gpu/drm/i915/intel_pm.c | 8 +- drivers/gpu/drm/meson/meson_drv.c | 8 + drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 12 +- drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c | 29 +- drivers/gpu/drm/msm/dp/dp_catalog.c | 2 +- drivers/gpu/drm/nouveau/nouveau_bo.c | 4 +- drivers/gpu/drm/nouveau/nouveau_connector.c | 3 +- drivers/gpu/drm/nouveau/nouveau_prime.c | 1 - drivers/gpu/drm/omapdrm/dss/dss.c | 3 + drivers/gpu/drm/pl111/pl111_versatile.c | 1 + drivers/gpu/drm/udl/udl_modeset.c | 3 - drivers/gpu/drm/vc4/vc4_vec.c | 4 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 2 +- drivers/hid/hid-multitouch.c | 8 +- drivers/hsi/controllers/omap_ssi_core.c | 1 + drivers/hsi/controllers/omap_ssi_port.c | 8 +- drivers/hwmon/gsc-hwmon.c | 1 + drivers/i2c/busses/i2c-mlxbf.c | 44 ++- drivers/iio/adc/ad7923.c | 4 +- drivers/iio/adc/at91-sama5d2_adc.c | 28 +- drivers/iio/adc/ltc2497.c | 13 + drivers/iio/dac/ad5593r.c | 46 +-- drivers/iio/inkern.c | 6 +- drivers/iio/pressure/dps310.c | 262 +++++++++++------- drivers/infiniband/core/cm.c | 14 +- drivers/infiniband/core/uverbs_cmd.c | 5 +- drivers/infiniband/core/verbs.c | 2 + drivers/infiniband/hw/hns/hns_roce_mr.c | 1 - drivers/infiniband/hw/mlx4/mr.c | 1 - drivers/infiniband/sw/rxe/rxe_qp.c | 10 +- drivers/infiniband/sw/siw/siw_qp_rx.c | 27 +- drivers/iommu/omap-iommu-debug.c | 6 +- drivers/leds/leds-lm3601x.c | 2 - drivers/mailbox/bcm-flexrm-mailbox.c | 8 +- drivers/md/bcache/writeback.c | 73 +++-- drivers/md/raid0.c | 2 +- drivers/md/raid5.c | 14 +- drivers/media/pci/cx88/cx88-vbi.c | 9 +- drivers/media/pci/cx88/cx88-video.c | 43 +-- drivers/media/platform/exynos4-is/fimc-is.c | 1 + drivers/media/platform/xilinx/xilinx-vipp.c | 9 +- drivers/memory/of_memory.c | 2 + drivers/memory/pl353-smc.c | 1 + drivers/mfd/fsl-imx25-tsadc.c | 34 ++- drivers/mfd/intel_soc_pmic_core.c | 1 + drivers/mfd/lp8788-irq.c | 3 + drivers/mfd/lp8788.c | 12 +- drivers/mfd/sm501.c | 7 +- drivers/misc/ocxl/file.c | 2 + drivers/mmc/host/au1xmmc.c | 3 +- drivers/mmc/host/sdhci-msm.c | 1 + drivers/mmc/host/sdhci-sprd.c | 2 +- drivers/mmc/host/wmt-sdmmc.c | 5 +- drivers/mtd/devices/docg3.c | 7 +- drivers/mtd/nand/raw/atmel/nand-controller.c | 1 + drivers/mtd/nand/raw/fsl_elbc_nand.c | 28 +- drivers/mtd/nand/raw/meson_nand.c | 4 +- drivers/net/can/usb/kvaser_usb/kvaser_usb.h | 2 + .../net/can/usb/kvaser_usb/kvaser_usb_core.c | 3 +- .../net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 2 +- .../net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 79 ++++++ .../net/ethernet/freescale/fs_enet/mac-fec.c | 2 +- drivers/net/wireless/ath/ath10k/mac.c | 54 ++-- drivers/net/wireless/ath/ath11k/mac.c | 25 +- drivers/net/wireless/ath/ath9k/htc_hst.c | 43 ++- .../broadcom/brcm80211/brcmfmac/core.c | 3 +- .../broadcom/brcm80211/brcmfmac/pno.c | 12 +- .../net/wireless/ralink/rt2x00/rt2800lib.c | 34 ++- .../wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 75 ++++- drivers/nvme/host/core.c | 3 +- drivers/nvme/host/pci.c | 3 +- drivers/nvme/target/tcp.c | 11 +- drivers/pci/setup-res.c | 11 + drivers/phy/qualcomm/phy-qcom-usb-hsic.c | 6 +- drivers/platform/chrome/chromeos_laptop.c | 24 +- drivers/platform/chrome/cros_ec.c | 8 +- drivers/platform/chrome/cros_ec_chardev.c | 3 + drivers/platform/chrome/cros_ec_proto.c | 32 +++ drivers/platform/x86/msi-laptop.c | 14 +- drivers/power/supply/adp5061.c | 6 +- drivers/powercap/intel_rapl_common.c | 4 +- drivers/regulator/core.c | 2 +- drivers/regulator/qcom_rpm-regulator.c | 24 +- drivers/scsi/3w-9xxx.c | 2 +- drivers/scsi/iscsi_tcp.c | 73 +++-- drivers/scsi/iscsi_tcp.h | 2 + drivers/scsi/libsas/sas_expander.c | 2 +- drivers/scsi/qedf/qedf_main.c | 21 ++ drivers/soc/qcom/smem_state.c | 3 +- drivers/soc/qcom/smsm.c | 20 +- drivers/soc/tegra/Kconfig | 1 - drivers/soundwire/cadence_master.c | 9 +- drivers/soundwire/intel.c | 1 - drivers/spi/spi-dw-bt1.c | 4 +- drivers/spi/spi-meson-spicc.c | 6 +- drivers/spi/spi-mt7621.c | 8 +- drivers/spi/spi-omap-100k.c | 1 + drivers/spi/spi-qup.c | 21 +- drivers/spi/spi-s3c64xx.c | 9 + drivers/spi/spi.c | 2 + drivers/spmi/spmi-pmic-arb.c | 13 +- drivers/staging/greybus/audio_helper.c | 11 - drivers/staging/media/meson/vdec/vdec_hevc.c | 6 +- drivers/staging/media/sunxi/cedrus/cedrus.c | 4 +- drivers/staging/rtl8723bs/core/rtw_cmd.c | 16 +- drivers/staging/vt6655/device_main.c | 8 +- drivers/thermal/intel/intel_powerclamp.c | 4 +- drivers/thermal/qcom/tsens-v0_1.c | 2 +- drivers/thunderbolt/switch.c | 24 ++ drivers/thunderbolt/tb.h | 1 + drivers/thunderbolt/tb_regs.h | 1 + drivers/thunderbolt/usb4.c | 20 ++ drivers/tty/serial/8250/8250_core.c | 19 +- drivers/tty/serial/8250/8250_port.c | 15 +- drivers/tty/serial/fsl_lpuart.c | 2 + drivers/tty/serial/jsm/jsm_driver.c | 3 +- drivers/tty/serial/xilinx_uartps.c | 2 + drivers/usb/common/common.c | 102 ++++++- drivers/usb/common/debug.c | 78 +++++- drivers/usb/core/devices.c | 21 +- drivers/usb/core/endpoint.c | 35 +-- drivers/usb/core/quirks.c | 4 + drivers/usb/gadget/function/f_printer.c | 12 +- drivers/usb/host/xhci-mem.c | 7 +- drivers/usb/host/xhci-plat.c | 18 +- drivers/usb/host/xhci.c | 3 +- drivers/usb/host/xhci.h | 1 + drivers/usb/misc/idmouse.c | 8 +- drivers/usb/musb/musb_gadget.c | 3 + drivers/usb/storage/unusual_devs.h | 6 - drivers/vhost/vsock.c | 2 +- drivers/video/fbdev/stifb.c | 2 +- fs/btrfs/qgroup.c | 15 + fs/btrfs/scrub.c | 36 +++ fs/cifs/file.c | 9 + fs/cifs/smb2pdu.c | 7 +- fs/dlm/ast.c | 6 +- fs/dlm/lock.c | 16 +- fs/ext4/fast_commit.c | 40 +-- fs/ext4/file.c | 6 + fs/ext4/inode.c | 14 +- fs/ext4/resize.c | 2 +- fs/ext4/super.c | 1 + fs/f2fs/checkpoint.c | 23 +- fs/f2fs/data.c | 4 +- fs/f2fs/extent_cache.c | 3 +- fs/f2fs/f2fs.h | 27 +- fs/f2fs/gc.c | 10 +- fs/f2fs/recovery.c | 23 +- fs/f2fs/segment.c | 47 ++-- fs/f2fs/super.c | 4 +- fs/jbd2/commit.c | 2 +- fs/jbd2/journal.c | 10 +- fs/jbd2/recovery.c | 1 + fs/jbd2/transaction.c | 6 +- fs/nfsd/nfs4recover.c | 4 +- fs/nfsd/nfs4state.c | 5 + fs/nfsd/nfs4xdr.c | 2 +- fs/userfaultfd.c | 4 +- include/linux/ata.h | 39 +-- include/linux/dynamic_debug.h | 11 +- include/linux/iova.h | 2 +- include/linux/once.h | 28 ++ include/linux/ring_buffer.h | 2 +- include/linux/serial_8250.h | 1 + include/linux/skbuff.h | 2 + include/linux/tcp.h | 2 +- include/linux/usb/ch9.h | 62 +---- include/net/ieee802154_netdev.h | 12 +- include/net/tcp.h | 5 +- include/uapi/linux/usb/ch9.h | 13 + kernel/bpf/btf.c | 2 +- kernel/bpf/syscall.c | 2 + kernel/cgroup/cpuset.c | 18 +- kernel/gcov/gcc_4_7.c | 18 +- kernel/livepatch/transition.c | 18 +- kernel/rcu/tasks.h | 2 +- kernel/rcu/tree.c | 17 +- kernel/trace/ftrace.c | 8 +- kernel/trace/kprobe_event_gen_test.c | 49 +++- kernel/trace/ring_buffer.c | 54 +++- kernel/trace/trace.c | 23 ++ lib/dynamic_debug.c | 45 +-- lib/once.c | 30 ++ mm/mmap.c | 5 +- net/bluetooth/hci_core.c | 34 ++- net/bluetooth/hci_sysfs.c | 3 + net/bluetooth/l2cap_core.c | 17 +- net/can/bcm.c | 7 +- net/core/stream.c | 3 +- net/ieee802154/socket.c | 4 + net/ipv4/inet_hashtables.c | 4 +- net/ipv4/netfilter/nft_fib_ipv4.c | 3 + net/ipv4/tcp.c | 16 +- net/ipv4/tcp_output.c | 19 +- net/ipv6/netfilter/nft_fib_ipv6.c | 6 +- net/mac80211/cfg.c | 3 - net/openvswitch/datapath.c | 18 +- net/rds/tcp.c | 2 +- net/sctp/auth.c | 18 +- net/vmw_vsock/virtio_transport_common.c | 2 +- net/xfrm/xfrm_ipcomp.c | 1 + scripts/Kbuild.include | 23 +- scripts/package/mkspec | 4 +- scripts/selinux/install_policy.sh | 2 +- security/Kconfig.hardening | 63 +++-- sound/core/pcm_dmaengine.c | 8 +- sound/core/rawmidi.c | 2 - sound/core/sound_oss.c | 13 +- sound/pci/hda/hda_beep.c | 15 +- sound/pci/hda/hda_beep.h | 1 + sound/pci/hda/patch_hdmi.c | 6 - sound/pci/hda/patch_realtek.c | 11 +- sound/pci/hda/patch_sigmatel.c | 25 +- sound/soc/codecs/da7219.c | 5 +- sound/soc/codecs/mt6660.c | 8 +- sound/soc/codecs/tas2764.c | 78 ++---- sound/soc/codecs/wcd9335.c | 2 +- sound/soc/codecs/wcd934x.c | 2 +- sound/soc/codecs/wm5102.c | 6 +- sound/soc/codecs/wm5110.c | 6 +- sound/soc/codecs/wm8997.c | 6 +- sound/soc/fsl/eukrea-tlv320.c | 8 +- sound/soc/sh/rcar/ctu.c | 6 +- sound/soc/sh/rcar/dvc.c | 6 +- sound/soc/sh/rcar/mix.c | 6 +- sound/soc/sh/rcar/src.c | 5 +- sound/soc/sh/rcar/ssi.c | 4 +- sound/soc/sof/sof-pci-dev.c | 2 +- sound/usb/endpoint.c | 6 +- tools/bpf/bpftool/btf_dumper.c | 2 +- tools/bpf/bpftool/main.c | 10 + tools/lib/bpf/xsk.c | 6 +- tools/objtool/elf.c | 7 +- tools/perf/util/intel-pt.c | 9 +- .../arm64/signal/testcases/testcases.c | 2 +- tools/testing/selftests/tpm2/tpm2.py | 4 + 354 files changed, 3018 insertions(+), 1399 deletions(-) create mode 100644 arch/powerpc/boot/dts/fsl/e500v1_power_isa.dtsi -- 2.25.1

1 371

[PATCH v2] eulerfs: fix wrong dereferencing in eufs_lookup
by Kang Chen 12 Apr '23

12 Apr '23

uniontech inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6TN56 CVE: NA -------------------------------- smatch report: fs/eulerfs/namei.c:118 eufs_lookup() error: 'inode' dereferencing possible ERR_PTR() fix it by using the ino above in eufs_err. Signed-off-by: Kang Chen <void0red(a)hust.edu.cn> --- v2 -> v1: use correct string format fs/eulerfs/namei.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/eulerfs/namei.c b/fs/eulerfs/namei.c index e4c6c36575f2..dd3bbc0b453c 100644 --- a/fs/eulerfs/namei.c +++ b/fs/eulerfs/namei.c @@ -115,8 +115,8 @@ static struct dentry *eufs_lookup(struct inode *dir, struct dentry *dentry, inode = eufs_iget(dir->i_sb, s2p(dir->i_sb, de->inode)); if (inode == ERR_PTR(-ESTALE)) { - eufs_err(dir->i_sb, "deleted inode referenced: 0x%lx", - inode->i_ino); + eufs_err(dir->i_sb, "deleted inode referenced: 0x%llx", + le64_to_cpu(de->inode)); return ERR_PTR(-EIO); } not_found: -- 2.34.1

3 7

[PATCH rdma-core v4 0/2] Support congestion control algorithm
by Chengchang Tang 12 Apr '23

12 Apr '23

From: Juan Zhou <zhoujuan51(a)h-partners.com> Yixing Liu (2): Update kernel headers libhns: Support congestion control algorithm configuration kernel-headers/rdma/hns-abi.h | 18 ++++- providers/hns/hns_roce_u.c | 1 + providers/hns/hns_roce_u.h | 6 ++ providers/hns/hns_roce_u_verbs.c | 114 +++++++++++++++++++++++++++++-- providers/hns/hnsdv.h | 24 ++++++- providers/hns/libhns.map | 1 + 6 files changed, 156 insertions(+), 8 deletions(-) -- 2.30.0

1 2

[OLK-5.10 v5 0/2] Support congestion control algorithm
by Chengchang Tang 12 Apr '23

12 Apr '23

From: Juan Zhou <zhoujuan51(a)h-partners.com> This group of patches implements the congestion control algorithm configuration. Yixing Liu (2): RDMA/hns: Modify congestion abbreviation RDMA/hns: Support congestion control algorithm configuration at QP granularity drivers/infiniband/hw/hns/hns_roce_device.h | 16 +-- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 113 ++++++++++---------- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 11 +- drivers/infiniband/hw/hns/hns_roce_main.c | 4 + drivers/infiniband/hw/hns/hns_roce_qp.c | 46 ++++++++ drivers/infiniband/hw/hns/hns_roce_sysfs.c | 2 +- include/uapi/rdma/hns-abi.h | 18 +++- 7 files changed, 142 insertions(+), 68 deletions(-) -- 2.30.0

1 2

[PATCH openEuler-5.10-LTS 01/27] xfs: log worker needs to start before intent/unlink recovery
by Jialin Zhang 12 Apr '23

12 Apr '23

From: Dave Chinner <dchinner(a)redhat.com> mainline inclusion from mainline-v5.17-rc6 commit a9a4bc8c76d747aa40b30e2dfc176c781f353a08 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4KIAO CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- After 963 iterations of generic/530, it deadlocked during recovery on a pinned inode cluster buffer like so: XFS (pmem1): Starting recovery (logdev: internal) INFO: task kworker/8:0:306037 blocked for more than 122 seconds. Not tainted 5.17.0-rc6-dgc+ #975 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/8:0 state:D stack:13024 pid:306037 ppid: 2 flags:0x00004000 Workqueue: xfs-inodegc/pmem1 xfs_inodegc_worker Call Trace: <TASK> __schedule+0x30d/0x9e0 schedule+0x55/0xd0 schedule_timeout+0x114/0x160 __down+0x99/0xf0 down+0x5e/0x70 xfs_buf_lock+0x36/0xf0 xfs_buf_find+0x418/0x850 xfs_buf_get_map+0x47/0x380 xfs_buf_read_map+0x54/0x240 xfs_trans_read_buf_map+0x1bd/0x490 xfs_imap_to_bp+0x4f/0x70 xfs_iunlink_map_ino+0x66/0xd0 xfs_iunlink_map_prev.constprop.0+0x148/0x2f0 xfs_iunlink_remove_inode+0xf2/0x1d0 xfs_inactive_ifree+0x1a3/0x900 xfs_inode_unlink+0xcc/0x210 xfs_inodegc_worker+0x1ac/0x2f0 process_one_work+0x1ac/0x390 worker_thread+0x56/0x3c0 kthread+0xf6/0x120 ret_from_fork+0x1f/0x30 </TASK> task:mount state:D stack:13248 pid:324509 ppid:324233 flags:0x00004000 Call Trace: <TASK> __schedule+0x30d/0x9e0 schedule+0x55/0xd0 schedule_timeout+0x114/0x160 __down+0x99/0xf0 down+0x5e/0x70 xfs_buf_lock+0x36/0xf0 xfs_buf_find+0x418/0x850 xfs_buf_get_map+0x47/0x380 xfs_buf_read_map+0x54/0x240 xfs_trans_read_buf_map+0x1bd/0x490 xfs_imap_to_bp+0x4f/0x70 xfs_iget+0x300/0xb40 xlog_recover_process_one_iunlink+0x4c/0x170 xlog_recover_process_iunlinks.isra.0+0xee/0x130 xlog_recover_finish+0x57/0x110 xfs_log_mount_finish+0xfc/0x1e0 xfs_mountfs+0x540/0x910 xfs_fs_fill_super+0x495/0x850 get_tree_bdev+0x171/0x270 xfs_fs_get_tree+0x15/0x20 vfs_get_tree+0x24/0xc0 path_mount+0x304/0xba0 __x64_sys_mount+0x108/0x140 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae </TASK> task:xfsaild/pmem1 state:D stack:14544 pid:324525 ppid: 2 flags:0x00004000 Call Trace: <TASK> __schedule+0x30d/0x9e0 schedule+0x55/0xd0 io_schedule+0x4b/0x80 xfs_buf_wait_unpin+0x9e/0xf0 __xfs_buf_submit+0x14a/0x230 xfs_buf_delwri_submit_buffers+0x107/0x280 xfs_buf_delwri_submit_nowait+0x10/0x20 xfsaild+0x27e/0x9d0 kthread+0xf6/0x120 ret_from_fork+0x1f/0x30 We have the mount process waiting on an inode cluster buffer read, inodegc doing unlink waiting on the same inode cluster buffer, and the AIL push thread blocked in writeback waiting for the inode cluster buffer to become unpinned. What has happened here is that the AIL push thread has raced with the inodegc process modifying, committing and pinning the inode cluster buffer here in xfs_buf_delwri_submit_buffers() here: blk_start_plug(&plug); list_for_each_entry_safe(bp, n, buffer_list, b_list) { if (!wait_list) { if (xfs_buf_ispinned(bp)) { pinned++; continue; } Here >>>>>> if (!xfs_buf_trylock(bp)) continue; Basically, the AIL has found the buffer wasn't pinned and got the lock without blocking, but then the buffer was pinned. This implies the processing here was pre-empted between the pin check and the lock, because the pin count can only be increased while holding the buffer locked. Hence when it has gone to submit the IO, it has blocked waiting for the buffer to be unpinned. With all executing threads now waiting on the buffer to be unpinned, we normally get out of situations like this via the background log worker issuing a log force which will unpinned stuck buffers like this. But at this point in recovery, we haven't started the log worker. In fact, the first thing we do after processing intents and unlinked inodes is *start the log worker*. IOWs, we start it too late to have it break deadlocks like this. Avoid this and any other similar deadlock vectors in intent and unlinked inode recovery by starting the log worker before we recover intents and unlinked inodes. This part of recovery runs as though the filesystem is fully active, so we really should have the same infrastructure running as we normally do at runtime. Signed-off-by: Dave Chinner <dchinner(a)redhat.com> Reviewed-by: Darrick J. Wong <djwong(a)kernel.org> Reviewed-by: Chandan Babu R <chandan.babu(a)oracle.com> Signed-off-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- fs/xfs/xfs_log.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c index 92c5d6ef47d6..e154c0d44f9c 100644 --- a/fs/xfs/xfs_log.c +++ b/fs/xfs/xfs_log.c @@ -782,10 +782,9 @@ xfs_log_mount_finish( * mount failure occurs. */ mp->m_super->s_flags |= SB_ACTIVE; + xfs_log_work_queue(mp); if (xlog_recovery_needed(log)) error = xlog_recover_finish(log); - if (!error) - xfs_log_work_queue(mp); mp->m_super->s_flags &= ~SB_ACTIVE; evict_inodes(mp->m_super); -- 2.25.1

1 26

[PATCH openEuler-5.10-LTS-SP1 01/33] xfs: log worker needs to start before intent/unlink recovery
by Jialin Zhang 12 Apr '23

12 Apr '23

From: Dave Chinner <dchinner(a)redhat.com> mainline inclusion from mainline-v5.17-rc6 commit a9a4bc8c76d747aa40b30e2dfc176c781f353a08 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4KIAO CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- After 963 iterations of generic/530, it deadlocked during recovery on a pinned inode cluster buffer like so: XFS (pmem1): Starting recovery (logdev: internal) INFO: task kworker/8:0:306037 blocked for more than 122 seconds. Not tainted 5.17.0-rc6-dgc+ #975 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/8:0 state:D stack:13024 pid:306037 ppid: 2 flags:0x00004000 Workqueue: xfs-inodegc/pmem1 xfs_inodegc_worker Call Trace: <TASK> __schedule+0x30d/0x9e0 schedule+0x55/0xd0 schedule_timeout+0x114/0x160 __down+0x99/0xf0 down+0x5e/0x70 xfs_buf_lock+0x36/0xf0 xfs_buf_find+0x418/0x850 xfs_buf_get_map+0x47/0x380 xfs_buf_read_map+0x54/0x240 xfs_trans_read_buf_map+0x1bd/0x490 xfs_imap_to_bp+0x4f/0x70 xfs_iunlink_map_ino+0x66/0xd0 xfs_iunlink_map_prev.constprop.0+0x148/0x2f0 xfs_iunlink_remove_inode+0xf2/0x1d0 xfs_inactive_ifree+0x1a3/0x900 xfs_inode_unlink+0xcc/0x210 xfs_inodegc_worker+0x1ac/0x2f0 process_one_work+0x1ac/0x390 worker_thread+0x56/0x3c0 kthread+0xf6/0x120 ret_from_fork+0x1f/0x30 </TASK> task:mount state:D stack:13248 pid:324509 ppid:324233 flags:0x00004000 Call Trace: <TASK> __schedule+0x30d/0x9e0 schedule+0x55/0xd0 schedule_timeout+0x114/0x160 __down+0x99/0xf0 down+0x5e/0x70 xfs_buf_lock+0x36/0xf0 xfs_buf_find+0x418/0x850 xfs_buf_get_map+0x47/0x380 xfs_buf_read_map+0x54/0x240 xfs_trans_read_buf_map+0x1bd/0x490 xfs_imap_to_bp+0x4f/0x70 xfs_iget+0x300/0xb40 xlog_recover_process_one_iunlink+0x4c/0x170 xlog_recover_process_iunlinks.isra.0+0xee/0x130 xlog_recover_finish+0x57/0x110 xfs_log_mount_finish+0xfc/0x1e0 xfs_mountfs+0x540/0x910 xfs_fs_fill_super+0x495/0x850 get_tree_bdev+0x171/0x270 xfs_fs_get_tree+0x15/0x20 vfs_get_tree+0x24/0xc0 path_mount+0x304/0xba0 __x64_sys_mount+0x108/0x140 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae </TASK> task:xfsaild/pmem1 state:D stack:14544 pid:324525 ppid: 2 flags:0x00004000 Call Trace: <TASK> __schedule+0x30d/0x9e0 schedule+0x55/0xd0 io_schedule+0x4b/0x80 xfs_buf_wait_unpin+0x9e/0xf0 __xfs_buf_submit+0x14a/0x230 xfs_buf_delwri_submit_buffers+0x107/0x280 xfs_buf_delwri_submit_nowait+0x10/0x20 xfsaild+0x27e/0x9d0 kthread+0xf6/0x120 ret_from_fork+0x1f/0x30 We have the mount process waiting on an inode cluster buffer read, inodegc doing unlink waiting on the same inode cluster buffer, and the AIL push thread blocked in writeback waiting for the inode cluster buffer to become unpinned. What has happened here is that the AIL push thread has raced with the inodegc process modifying, committing and pinning the inode cluster buffer here in xfs_buf_delwri_submit_buffers() here: blk_start_plug(&plug); list_for_each_entry_safe(bp, n, buffer_list, b_list) { if (!wait_list) { if (xfs_buf_ispinned(bp)) { pinned++; continue; } Here >>>>>> if (!xfs_buf_trylock(bp)) continue; Basically, the AIL has found the buffer wasn't pinned and got the lock without blocking, but then the buffer was pinned. This implies the processing here was pre-empted between the pin check and the lock, because the pin count can only be increased while holding the buffer locked. Hence when it has gone to submit the IO, it has blocked waiting for the buffer to be unpinned. With all executing threads now waiting on the buffer to be unpinned, we normally get out of situations like this via the background log worker issuing a log force which will unpinned stuck buffers like this. But at this point in recovery, we haven't started the log worker. In fact, the first thing we do after processing intents and unlinked inodes is *start the log worker*. IOWs, we start it too late to have it break deadlocks like this. Avoid this and any other similar deadlock vectors in intent and unlinked inode recovery by starting the log worker before we recover intents and unlinked inodes. This part of recovery runs as though the filesystem is fully active, so we really should have the same infrastructure running as we normally do at runtime. Signed-off-by: Dave Chinner <dchinner(a)redhat.com> Reviewed-by: Darrick J. Wong <djwong(a)kernel.org> Reviewed-by: Chandan Babu R <chandan.babu(a)oracle.com> Signed-off-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- fs/xfs/xfs_log.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c index 92c5d6ef47d6..e154c0d44f9c 100644 --- a/fs/xfs/xfs_log.c +++ b/fs/xfs/xfs_log.c @@ -782,10 +782,9 @@ xfs_log_mount_finish( * mount failure occurs. */ mp->m_super->s_flags |= SB_ACTIVE; + xfs_log_work_queue(mp); if (xlog_recovery_needed(log)) error = xlog_recover_finish(log); - if (!error) - xfs_log_work_queue(mp); mp->m_super->s_flags &= ~SB_ACTIVE; evict_inodes(mp->m_super); -- 2.25.1

1 32

[PATCH openEuler-1.0-LTS] hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
by Yongqiang Liu 11 Apr '23

11 Apr '23

From: Zheng Wang <zyytlz.wz(a)163.com> mainline inclusion from mainline-v6.3-rc3 commit cb090e64cf25602b9adaf32d5dfc9c8bec493cd1 category: bugfix bugzilla: 188657, https://gitee.com/src-openeuler/kernel/issues/I6T36A CVE: CVE-2023-1855 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In xgene_hwmon_probe, &ctx->workq is bound with xgene_hwmon_evt_work. Then it will be started. If we remove the driver which will call xgene_hwmon_remove to clean up, there may be unfinished work. The possible sequence is as follows: Fix it by finishing the work before cleanup in xgene_hwmon_remove. CPU0 CPU1 |xgene_hwmon_evt_work xgene_hwmon_remove | kfifo_free(&ctx->async_msg_fifo);| | |kfifo_out_spinlocked |//use &ctx->async_msg_fifo Fixes: 2ca492e22cb7 ("hwmon: (xgene) Fix crash when alarm occurs before driver probe") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Link: https://lore.kernel.org/r/20230310084007.1403388-1-zyytlz.wz@163.com Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> Reviewed-by: songping yu <yusongping(a)huawei.com> Reviewed-by: Zhang Qiao <zhangqiao22(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/hwmon/xgene-hwmon.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/hwmon/xgene-hwmon.c b/drivers/hwmon/xgene-hwmon.c index a3cd91f23267..2dd19a420305 100644 --- a/drivers/hwmon/xgene-hwmon.c +++ b/drivers/hwmon/xgene-hwmon.c @@ -780,6 +780,7 @@ static int xgene_hwmon_remove(struct platform_device *pdev) { struct xgene_hwmon_dev *ctx = platform_get_drvdata(pdev); + cancel_work_sync(&ctx->workq); hwmon_device_unregister(ctx->hwmon_dev); kfifo_free(&ctx->async_msg_fifo); if (acpi_disabled) -- 2.25.1

1 0

[Dev] Kernel SIG邀请您参加2023年4月20日~21日 openEuler Developer Day SIG组开放工作会议
by Zhengzengkai 11 Apr '23

11 Apr '23

��ã� openEuler Developer Day 2023(�� ODD 2023�� openEuler��ȶ��飬 �ǿ��ԭ�ӿ�Դ�� openEuler ��Ŀ��߷�ᡣ ODD 2023��2023��4��20��~21��Ϻ��ֶ��Ƶ��У��ӭ��ұ��λᡣ ��̼��Ϣ�ɲο��ӣ�https://www.openeuler.org/zh/interaction/summit-list/devday2023/ ��ӣ�https://e-campaign.huawei.com/m/RNN3Yz ��openEuler Kernel SIG��μ�4��21��16��00 �C 17��30��е�ODD 2023 Kernel SIG��¿��Ź��飬 ��ʱ��ߣ��潻�� ¿��Ź��ǰ�ռ��⣬�밴��+��+��ˡ��ʽ�ύ��etherpad�� https://etherpad.openeuler.org/p/ODD2023_Kernel_SIG

1 0

[PATCH] fs: eulerfs: fix wrong dereferencing in eufs_lookup
by Kang Chen 10 Apr '23

10 Apr '23

inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6TN56 -------------------------------- smatch report: fs/eulerfs/namei.c:118 eufs_lookup() error: 'inode' dereferencing possible ERR_PTR() Signed-off-by: Kang Chen <void0red(a)hust.edu.cn> --- I run smatch on the openEuler-2203-sp1 source and find some bugs. But I have on idea on the fields of the commit message template. Please let me know if there is anything that can be improved. fs/eulerfs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/eulerfs/namei.c b/fs/eulerfs/namei.c index e4c6c36575f2..cfba6eefbcc8 100644 --- a/fs/eulerfs/namei.c +++ b/fs/eulerfs/namei.c @@ -116,7 +116,7 @@ static struct dentry *eufs_lookup(struct inode *dir, struct dentry *dentry, inode = eufs_iget(dir->i_sb, s2p(dir->i_sb, de->inode)); if (inode == ERR_PTR(-ESTALE)) { eufs_err(dir->i_sb, "deleted inode referenced: 0x%lx", - inode->i_ino); + le64_to_cpu(de->inode)); return ERR_PTR(-EIO); } not_found: -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] xirc2ps_cs: Fix use after free bug in xirc2ps_detach
by Yongqiang Liu 10 Apr '23

10 Apr '23

From: Zheng Wang <zyytlz.wz(a)163.com> stable inclusion from stable-v4.19.279 commit 526660c25d3b93b1232a525b75469048388f0928 category: bugfix bugzilla: 188641, https://gitee.com/src-openeuler/kernel/issues/I6R4MM CVE: CVE-2023-1670 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e8d20c3ded59a092532513c9bd030d1ea66f5f44 ] In xirc2ps_probe, the local->tx_timeout_task was bounded with xirc2ps_tx_timeout_task. When timeout occurs, it will call xirc_tx_timeout->schedule_work to start the work. When we call xirc2ps_detach to remove the driver, there may be a sequence as follows: Stop responding to timeout tasks and complete scheduled tasks before cleanup in xirc2ps_detach, which will fix the problem. CPU0 CPU1 |xirc2ps_tx_timeout_task xirc2ps_detach | free_netdev | kfree(dev); | | | do_reset | //use dev Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/ethernet/xircom/xirc2ps_cs.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ethernet/xircom/xirc2ps_cs.c b/drivers/net/ethernet/xircom/xirc2ps_cs.c index fd5288ff53b5..e3438cef5f9c 100644 --- a/drivers/net/ethernet/xircom/xirc2ps_cs.c +++ b/drivers/net/ethernet/xircom/xirc2ps_cs.c @@ -503,6 +503,11 @@ static void xirc2ps_detach(struct pcmcia_device *link) { struct net_device *dev = link->priv; + struct local_info *local = netdev_priv(dev); + + netif_carrier_off(dev); + netif_tx_disable(dev); + cancel_work_sync(&local->tx_timeout_task); dev_dbg(&link->dev, "detach\n"); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
by Yongqiang Liu 10 Apr '23

10 Apr '23

From: Zheng Wang <zyytlz.wz(a)163.com> maillist inclusion category: bugfix bugzilla: 188655, https://gitee.com/src-openeuler/kernel/issues/I6T36H CVE: CVE-2023-1859 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/… ---------------------------------------- In xen_9pfs_front_probe, it calls xen_9pfs_front_alloc_dataring to init priv->rings and bound &ring->work with p9_xen_response. When it calls xen_9pfs_front_event_handler to handle IRQ requests, it will finally call schedule_work to start the work. When we call xen_9pfs_front_remove to remove the driver, there may be a sequence as follows: Fix it by finishing the work before cleanup in xen_9pfs_front_free. Note that, this bug is found by static analysis, which might be false positive. CPU0 CPU1 |p9_xen_response xen_9pfs_front_remove| xen_9pfs_front_free| kfree(priv) | //free priv | |p9_tag_lookup |//use priv->client Fixes: 71ebd71921e4 ("xen/9pfs: connect to the backend") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Reviewed-by: Michal Swiatkowski <michal.swiatkowski(a)linux.intel.com> Signed-off-by: Eric Van Hensbergen <ericvh(a)kernel.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/9p/trans_xen.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c index 81002cba88b3..8e158f09cba8 100644 --- a/net/9p/trans_xen.c +++ b/net/9p/trans_xen.c @@ -290,6 +290,10 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv) write_unlock(&xen_9pfs_lock); for (i = 0; i < priv->num_rings; i++) { + struct xen_9pfs_dataring *ring = &priv->rings[i]; + + cancel_work_sync(&ring->work); + if (!priv->rings[i].intf) break; if (priv->rings[i].irq > 0) -- 2.25.1

1 0

[PATCH OLK-5.10] KVM: nVMX: Set LDTR to its architecturally defined value on nested VM-Exit
by 任敏敏(联通集团联通数字科技有限公司本部) 10 Apr '23

10 Apr '23

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v5.15 commit afc8de0118be84f4058b9977d481aeb3e0758dbb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6SN2F CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ commit afc8de0118be84f4058b9977d481aeb3e0758dbb upstream Set L1's LDTR on VM-Exit per the Intel SDM: The host-state area does not contain a selector field for LDTR. LDTR is established as follows on all VM exits: the selector is cleared to 0000H, the segment is marked unusable and is otherwise undefined (although the base address is always canonical). This is likely a benign bug since the LDTR is unusable, as it means the L1 VMM is conditioned to reload its LDTR in order to function properly on bare metal. Fixes: 4704d0befb07 ("KVM: nVMX: Exiting from L2 to L1") Reviewed-by: Reiji Watanabe <reijiw(a)google.com> Signed-off-by: Sean Christopherson <seanjc(a)google.com> Message-Id: <20210713163324.627647-3-seanjc(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: rminmin <renmm6(a)chinaunicom.cn> --- arch/x86/kvm/vmx/nested.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c index 9003b14d72ca..05284589c14d 100644 --- a/arch/x86/kvm/vmx/nested.c +++ b/arch/x86/kvm/vmx/nested.c @@ -4326,6 +4326,10 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu, }; vmx_set_segment(vcpu, &seg, VCPU_SREG_TR); + memset(&seg, 0, sizeof(seg)); + seg.unusable = 1; + vmx_set_segment(vcpu, &seg, VCPU_SREG_LDTR); + kvm_set_dr(vcpu, 7, 0x400); vmcs_write64(GUEST_IA32_DEBUGCTL, 0); -- 2.33.0 Èç¹ûÄúŽíÎóœÓÊÕÁËžÃÓÊŒþ£¬ÇëÍš¹ýµç×ÓÓÊŒþÁ¢ŒŽÍšÖªÎÒÃÇ¡£Çë»ØžŽÓÊŒþµœ hqs-spmc@chinaunicom.cn£¬ŒŽ¿ÉÒÔÍË¶©ŽËÓÊŒþ¡£ÎÒÃÇœ«Á¢ŒŽœ«ÄúµÄÐÅÏ¢ŽÓÎÒÃÇµÄ·¢ËÍÄ¿ÂŒÖÐÉŸ³ý¡£ If you have received this email in error please notify us immediately by e-mail. Please reply to hqs-spmc(a)chinaunicom.cn ,you can unsubscribe from this mail. We will immediately remove your information from send catalogue of our.

1 0

[PATCH 0/2] support dynamic affinity
by Hui Tang 08 Apr '23

08 Apr '23

test report: [root@localhost at]# bash -x dyn_affinity_interface.sh + ret=0 ++ cat /proc/sys/kernel/sched_util_low_pct + default_sched_util_low_pct=85 + read_default_val /proc/sys/kernel/sched_util_low_pct 85 + local interface=/proc/sys/kernel/sched_util_low_pct + local expect_val=85 + echo 'TINFO: test /proc/sys/kernel/sched_util_low_pct default value is 85' TINFO: test /proc/sys/kernel/sched_util_low_pct default value is 85 + '[' '!' -f /proc/sys/kernel/sched_util_low_pct ']' ++ cat /proc/sys/kernel/sched_util_low_pct + '[' 85 '!=' 85 ']' + '[' 0 -ne 0 ']' + echo 'TPASS: dyn_affinity_interface test success' TPASS: dyn_affinity_interface test success + write_some_val /proc/sys/kernel/sched_util_low_pct -1 1 + write_some_val /proc/sys/kernel/sched_util_low_pct 101 1 + write_some_val /proc/sys/kernel/sched_util_low_pct abc 1 + write_some_val /proc/sys/kernel/sched_util_low_pct 100 0 + local interface=/proc/sys/kernel/sched_util_low_pct + local write_val=100 + local expect_ret=0 + echo 'TINFO: write 100 to /proc/sys/kernel/sched_util_low_pct, expect ret: 0' TINFO: write 100 to /proc/sys/kernel/sched_util_low_pct, expect ret: 0 + echo 100 + '[' 0 -ne 0 ']' + echo 'TPASS: write 100 to /proc/sys/kernel/sched_util_low_pct success' TPASS: write 100 to /proc/sys/kernel/sched_util_low_pct success + write_some_val /proc/sys/kernel/sched_util_low_pct 0 0 + local interface=/proc/sys/kernel/sched_util_low_pct + local write_val=0 + local expect_ret=0 + echo 'TINFO: write 0 to /proc/sys/kernel/sched_util_low_pct, expect ret: 0' TINFO: write 0 to /proc/sys/kernel/sched_util_low_pct, expect ret: 0 + echo 0 + '[' 0 -ne 0 ']' + echo 'TPASS: write 0 to /proc/sys/kernel/sched_util_low_pct success' TPASS: write 0 to /proc/sys/kernel/sched_util_low_pct success + cleanup + echo 85 + exit 0 [root@localhost at]# [root@localhost at]# bash -x dyn_affinity_low_load.sh + TEST_CPUSET_PATH=/sys/fs/cgroup/cpuset/cloud + TEST_CPU_PATH=/sys/fs/cgroup/cpu/cloud + ret=0 ++ seq 1 1 + for i in $(seq 1 1) + setup + '[' -d /sys/fs/cgroup/cpuset/cloud ']' + mkdir -p /sys/fs/cgroup/cpuset/cloud /sys/fs/cgroup/cpu/cloud + echo 0 + echo 0-7 + echo 1 + do_test + echo 4166 + echo 4166 + local pid=0 ++ seq 1 3 + for i in $(seq 1 3) + pid=4170 + echo 4170 + echo 4170 + for i in $(seq 1 3) + pid=4171 + echo 4171 + echo 4171 + ./cpu_load_not_while + for i in $(seq 1 3) + pid=4172 + ./cpu_load_not_while + echo 4172 + ./cpu_load_not_while + echo 4172 + echo 4166 + echo 4166 + sleep 0.1 ++ seq 1 100 + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ egrep 1 -w ++ grep load ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ wc -l ++ egrep 1 -w + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ egrep 1 -w ++ wc -l ++ grep load + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + '[' 0 -eq 0 ']' + ps -o psr,comm,pid + grep cpu_load 1 cpu_load_not_wh 4170 1 cpu_load_not_wh 4171 1 cpu_load_not_wh 4172 + echo 'TPASS: test success' TPASS: test success + cleanup + killall cpu_load_not_while + sleep 0.1 + rmdir /sys/fs/cgroup/cpuset/cloud /sys/fs/cgroup/cpu/cloud + exit 0 [root@localhost at]# bash -x dyn_affinity_high_load.sh + TEST_CPUSET_PATH=/sys/fs/cgroup/cpuset/cloud + TEST_CPU_PATH=/sys/fs/cgroup/cpu/cloud + ret=0 ++ seq 1 1 + for i in $(seq 1 1) + setup + '[' -d /sys/fs/cgroup/cpuset/cloud ']' + mkdir -p /sys/fs/cgroup/cpuset/cloud /sys/fs/cgroup/cpu/cloud + echo 0 + echo 0-7 + echo 1 + do_test + echo 4121 + echo 4121 + local pid=0 ++ seq 1 30 + for i in $(seq 1 30) + pid=4125 + echo 4125 + echo 4125 + for i in $(seq 1 30) + pid=4126 + echo 4126 + ./cpu_load_not_while + echo 4126 + for i in $(seq 1 30) + pid=4127 + echo 4127 + ./cpu_load_not_while + ./cpu_load_not_while + echo 4127 + for i in $(seq 1 30) + pid=4128 + ./cpu_load_not_while + echo 4128 + echo 4128 + for i in $(seq 1 30) + pid=4129 + echo 4129 + echo 4129 + for i in $(seq 1 30) + ./cpu_load_not_while + pid=4130 + echo 4130 + ./cpu_load_not_while + echo 4130 + for i in $(seq 1 30) + pid=4131 + ./cpu_load_not_while + echo 4131 + echo 4131 + for i in $(seq 1 30) + pid=4132 + echo 4132 + echo 4132 + ./cpu_load_not_while + for i in $(seq 1 30) + pid=4133 + ./cpu_load_not_while + echo 4133 + echo 4133 + for i in $(seq 1 30) + pid=4134 + ./cpu_load_not_while + echo 4134 + echo 4134 + for i in $(seq 1 30) + pid=4135 + ./cpu_load_not_while + echo 4135 + echo 4135 + for i in $(seq 1 30) + pid=4136 + ./cpu_load_not_while + echo 4136 + echo 4136 + for i in $(seq 1 30) + pid=4137 + ./cpu_load_not_while + echo 4137 + echo 4137 + for i in $(seq 1 30) + pid=4138 + echo 4138 + ./cpu_load_not_while + echo 4138 + for i in $(seq 1 30) + pid=4139 + ./cpu_load_not_while + echo 4139 + echo 4139 + for i in $(seq 1 30) + pid=4140 + ./cpu_load_not_while + echo 4140 + echo 4140 + for i in $(seq 1 30) + pid=4141 + echo 4141 + ./cpu_load_not_while + echo 4141 + for i in $(seq 1 30) + pid=4142 + echo 4142 + ./cpu_load_not_while + echo 4142 + for i in $(seq 1 30) + pid=4143 + echo 4143 + ./cpu_load_not_while + echo 4143 + for i in $(seq 1 30) + pid=4144 + ./cpu_load_not_while + echo 4144 + echo 4144 + for i in $(seq 1 30) + pid=4145 + ./cpu_load_not_while + echo 4145 + echo 4145 + for i in $(seq 1 30) + pid=4146 + echo 4146 + echo 4146 + ./cpu_load_not_while + for i in $(seq 1 30) + pid=4147 + echo 4147 + echo 4147 + ./cpu_load_not_while + for i in $(seq 1 30) + pid=4148 + echo 4148 + echo 4148 + ./cpu_load_not_while + for i in $(seq 1 30) + pid=4149 + echo 4149 + echo 4149 + ./cpu_load_not_while + for i in $(seq 1 30) + pid=4150 + echo 4150 + echo 4150 + ./cpu_load_not_while + for i in $(seq 1 30) + pid=4151 + echo 4151 + echo 4151 + ./cpu_load_not_while + for i in $(seq 1 30) + pid=4152 + echo 4152 + ./cpu_load_not_while + echo 4152 + for i in $(seq 1 30) + pid=4153 + ./cpu_load_not_while + echo 4153 + echo 4153 + for i in $(seq 1 30) + pid=4154 + ./cpu_load_not_while + echo 4154 + echo 4154 + echo 4121 + echo 4121 + sleep 0.1 ++ seq 1 100 + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=19 + '[' 19 -ne 30 ']' + ps -o psr,comm,pid + grep cpu_load 1 cpu_load_not_wh 4125 6 cpu_load_not_wh 4126 1 cpu_load_not_wh 4127 1 cpu_load_not_wh 4128 1 cpu_load_not_wh 4129 1 cpu_load_not_wh 4130 1 cpu_load_not_wh 4131 1 cpu_load_not_wh 4132 1 cpu_load_not_wh 4133 1 cpu_load_not_wh 4134 7 cpu_load_not_wh 4135 1 cpu_load_not_wh 4136 1 cpu_load_not_wh 4137 4 cpu_load_not_wh 4138 1 cpu_load_not_wh 4139 1 cpu_load_not_wh 4140 1 cpu_load_not_wh 4141 5 cpu_load_not_wh 4142 1 cpu_load_not_wh 4143 1 cpu_load_not_wh 4144 1 cpu_load_not_wh 4145 1 cpu_load_not_wh 4146 1 cpu_load_not_wh 4147 3 cpu_load_not_wh 4148 5 cpu_load_not_wh 4149 1 cpu_load_not_wh 4150 1 cpu_load_not_wh 4151 1 cpu_load_not_wh 4152 5 cpu_load_not_wh 4153 6 cpu_load_not_wh 4154 + echo 'TPASS: test success' TPASS: test success + exit tanghui (2): sched: Add statistics for scheduler dynamic affinity config: enable CONFIG_QOS_SCHED_DYNAMIC_AFFINITY by default arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/sched.h | 6 ++++++ kernel/sched/debug.c | 4 ++++ kernel/sched/fair.c | 11 +++++++++-- 5 files changed, 21 insertions(+), 2 deletions(-) -- 2.17.1

1 2

[PATCH openEuler-1.0-LTS] bpf: add missing header file include
by Yongqiang Liu 08 Apr '23

08 Apr '23

From: Linus Torvalds <torvalds(a)linux-foundation.org> stable inclusion from stable-v4.19.274 commit c7603df97635954165fb599e64e197efc353979b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6TIG1 CVE: NA -------------------------------- commit f3dd0c53370e70c0f9b7e931bbec12916f3bb8cc upstream. Commit 74e19ef0ff80 ("uaccess: Add speculation barrier to copy_from_user()") built fine on x86-64 and arm64, and that's the extent of my local build testing. It turns out those got the <linux/nospec.h> include incidentally through other header files (<linux/kvm_host.h> in particular), but that was not true of other architectures, resulting in build errors kernel/bpf/core.c: In function ‘___bpf_prog_run’: kernel/bpf/core.c:1913:3: error: implicit declaration of function ‘barrier_nospec’ so just make sure to explicitly include the proper <linux/nospec.h> header file to make everybody see it. Fixes: 74e19ef0ff80 ("uaccess: Add speculation barrier to copy_from_user()") Reported-by: kernel test robot <lkp(a)intel.com> Reported-by: Viresh Kumar <viresh.kumar(a)linaro.org> Reported-by: Huacai Chen <chenhuacai(a)loongson.cn> Tested-by: Geert Uytterhoeven <geert(a)linux-m68k.org> Tested-by: Dave Hansen <dave.hansen(a)linux.intel.com> Acked-by: Alexei Starovoitov <alexei.starovoitov(a)gmail.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/bpf/core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index abf30609e0d9..56a60d483c8d 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -32,6 +32,7 @@ #include <linux/kallsyms.h> #include <linux/rcupdate.h> #include <linux/perf_event.h> +#include <linux/nospec.h> #include <asm/barrier.h> #include <asm/unaligned.h> -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 00/19] linux-4.19.y inclusion
by Yongqiang Liu 07 Apr '23

07 Apr '23

*** BLURB HERE *** Armin Wolf (1): ACPI: battery: Fix missing NUL-termination with large strings Baokun Li (1): ext4: fail ext4_iget if special inode unallocated Breno Leitao (1): x86/bugs: Reset speculation control settings on init Daniil Tatianin (1): ACPICA: nsrepair: handle cases without a return value correctly Dave Hansen (1): uaccess: Add speculation barrier to copy_from_user() Herbert Xu (2): crypto: seqiv - Handle EBUSY correctly crypto: rsa-pkcs1pad - Use akcipher_request_complete Jann Horn (1): timers: Prevent union confusion from unexpected restart_syscall() Jason A. Donenfeld (1): random: always mix cycle counter in add_latent_entropy() Johan Hovold (3): irqdomain: Fix association race irqdomain: Fix disassociation race irqdomain: Drop bogus fwspec-mapping error handling Nikita Zhandarovich (1): x86/mm: Fix use of uninitialized buffer in sme_enable() Thomas Gleixner (1): alarmtimer: Prevent starvation by small intervals and SIG_IGN Vishal Verma (1): ACPI: NFIT: fix a potential deadlock during NFIT teardown Yang Jihong (2): x86/kprobes: Fix __recover_optprobed_insn check optimizing logic x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range Zhen Lei (1): genirq: Fix the return type of kstat_cpu_irqs_sum() Zhihao Cheng (1): ext4: zero i_disksize when initializing the bootloader inode arch/x86/include/asm/msr-index.h | 4 ++++ arch/x86/kernel/cpu/bugs.c | 10 ++++++++- arch/x86/kernel/kprobes/opt.c | 6 +++--- arch/x86/mm/mem_encrypt_identity.c | 3 ++- crypto/rsa-pkcs1pad.c | 34 +++++++++++++----------------- crypto/seqiv.c | 2 +- drivers/acpi/acpica/nsrepair.c | 12 ++++++----- drivers/acpi/battery.c | 2 +- drivers/acpi/nfit/core.c | 2 +- fs/ext4/inode.c | 18 +++++++--------- fs/ext4/ioctl.c | 1 + include/linux/kernel_stat.h | 2 +- include/linux/kprobes.h | 2 ++ include/linux/nospec.h | 4 ++++ include/linux/random.h | 6 +++--- kernel/bpf/core.c | 2 -- kernel/irq/irqdomain.c | 31 +++++++++++++++++---------- kernel/kprobes.c | 6 +++--- kernel/time/alarmtimer.c | 33 +++++++++++++++++++++++++---- kernel/time/hrtimer.c | 2 ++ kernel/time/posix-stubs.c | 2 ++ kernel/time/posix-timers.c | 2 ++ lib/usercopy.c | 7 ++++++ 23 files changed, 127 insertions(+), 66 deletions(-) -- 2.25.1

1 19

[PATCH openEuler-1.0-LTS 01/19] alarmtimer: Prevent starvation by small intervals and SIG_IGN
by Yongqiang Liu 07 Apr '23

07 Apr '23

From: Thomas Gleixner <tglx(a)linutronix.de> stable inclusion from stable-v4.19.274 commit d6a300076d11a6e27b4d4f7fd986ec66ee97a3e1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6TIG1 CVE: NA -------------------------------- commit d125d1349abeb46945dc5e98f7824bf688266f13 upstream. syzbot reported a RCU stall which is caused by setting up an alarmtimer with a very small interval and ignoring the signal. The reproducer arms the alarm timer with a relative expiry of 8ns and an interval of 9ns. Not a problem per se, but that's an issue when the signal is ignored because then the timer is immediately rearmed because there is no way to delay that rearming to the signal delivery path. See posix_timer_fn() and commit 58229a189942 ("posix-timers: Prevent softirq starvation by small intervals and SIG_IGN") for details. The reproducer does not set SIG_IGN explicitely, but it sets up the timers signal with SIGCONT. That has the same effect as explicitely setting SIG_IGN for a signal as SIGCONT is ignored if there is no handler set and the task is not ptraced. The log clearly shows that: [pid 5102] --- SIGCONT {si_signo=SIGCONT, si_code=SI_TIMER, si_timerid=0, si_overrun=316014, si_int=0, si_ptr=NULL} --- It works because the tasks are traced and therefore the signal is queued so the tracer can see it, which delays the restart of the timer to the signal delivery path. But then the tracer is killed: [pid 5087] kill(-5102, SIGKILL <unfinished ...> ... ./strace-static-x86_64: Process 5107 detached and after it's gone the stall can be observed: syzkaller login: [ 79.439102][ C0] hrtimer: interrupt took 68471 ns [ 184.460538][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: ... [ 184.658237][ C1] rcu: Stack dump where RCU GP kthread last ran: [ 184.664574][ C1] Sending NMI from CPU 1 to CPUs 0: [ 184.669821][ C0] NMI backtrace for cpu 0 [ 184.669831][ C0] CPU: 0 PID: 5108 Comm: syz-executor192 Not tainted 6.2.0-rc6-next-20230203-syzkaller #0 ... [ 184.670036][ C0] Call Trace: [ 184.670041][ C0] <IRQ> [ 184.670045][ C0] alarmtimer_fired+0x327/0x670 posix_timer_fn() prevents that by checking whether the interval for timers which have the signal ignored is smaller than a jiffie and artifically delay it by shifting the next expiry out by a jiffie. That's accurate vs. the overrun accounting, but slightly inaccurate vs. timer_gettimer(2). The comment in that function says what needs to be done and there was a fix available for the regular userspace induced SIG_IGN mechanism, but that did not work due to the implicit ignore for SIGCONT and similar signals. This needs to be worked on, but for now the only available workaround is to do exactly what posix_timer_fn() does: Increase the interval of self-rearming timers, which have their signal ignored, to at least a jiffie. Interestingly this has been fixed before via commit ff86bf0c65f1 ("alarmtimer: Rate limit periodic intervals") already, but that fix got lost in a later rework. Reported-by: syzbot+b9564ba6e8e00694511b(a)syzkaller.appspotmail.com Fixes: f2c45807d399 ("alarmtimer: Switch over to generic set/get/rearm routine") Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Acked-by: John Stultz <jstultz(a)google.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/87k00q1no2.ffs@tglx Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/time/alarmtimer.c | 33 +++++++++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 4 deletions(-) diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c index 6a2ba39889bd..56af8a97cf2d 100644 --- a/kernel/time/alarmtimer.c +++ b/kernel/time/alarmtimer.c @@ -476,11 +476,35 @@ u64 alarm_forward(struct alarm *alarm, ktime_t now, ktime_t interval) } EXPORT_SYMBOL_GPL(alarm_forward); -u64 alarm_forward_now(struct alarm *alarm, ktime_t interval) +static u64 __alarm_forward_now(struct alarm *alarm, ktime_t interval, bool throttle) { struct alarm_base *base = &alarm_bases[alarm->type]; + ktime_t now = base->gettime(); + + if (IS_ENABLED(CONFIG_HIGH_RES_TIMERS) && throttle) { + /* + * Same issue as with posix_timer_fn(). Timers which are + * periodic but the signal is ignored can starve the system + * with a very small interval. The real fix which was + * promised in the context of posix_timer_fn() never + * materialized, but someone should really work on it. + * + * To prevent DOS fake @now to be 1 jiffie out which keeps + * the overrun accounting correct but creates an + * inconsistency vs. timer_gettime(2). + */ + ktime_t kj = NSEC_PER_SEC / HZ; + + if (interval < kj) + now = ktime_add(now, kj); + } + + return alarm_forward(alarm, now, interval); +} - return alarm_forward(alarm, base->gettime(), interval); +u64 alarm_forward_now(struct alarm *alarm, ktime_t interval) +{ + return __alarm_forward_now(alarm, interval, false); } EXPORT_SYMBOL_GPL(alarm_forward_now); @@ -554,9 +578,10 @@ static enum alarmtimer_restart alarm_handle_timer(struct alarm *alarm, if (posix_timer_event(ptr, si_private) && ptr->it_interval) { /* * Handle ignored signals and rearm the timer. This will go - * away once we handle ignored signals proper. + * away once we handle ignored signals proper. Ensure that + * small intervals cannot starve the system. */ - ptr->it_overrun += alarm_forward_now(alarm, ptr->it_interval); + ptr->it_overrun += __alarm_forward_now(alarm, ptr->it_interval, true); ++ptr->it_requeue_pending; ptr->it_active = 1; result = ALARMTIMER_RESTART; -- 2.25.1

1 18

[PATCH openEuler-1.0-LTS 1/7] Revert "cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()"
by Yongqiang Liu 07 Apr '23

07 Apr '23

From: Cai Xinchen <caixinchen1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6TI3Y CVE: NA -------------------------------- This reverts commit c2d8355618485dd9108ee9077799a227771af307. Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/cgroup/cgroup-internal.h | 2 -- kernel/cgroup/cgroup-v1.c | 4 ++-- kernel/cgroup/cgroup.c | 4 ++-- 3 files changed, 4 insertions(+), 6 deletions(-) diff --git a/kernel/cgroup/cgroup-internal.h b/kernel/cgroup/cgroup-internal.h index edb45e2f7f54..2e65e4c4d6e7 100644 --- a/kernel/cgroup/cgroup-internal.h +++ b/kernel/cgroup/cgroup-internal.h @@ -226,8 +226,6 @@ int cgroup_migrate(struct task_struct *leader, bool threadgroup, int cgroup_attach_task(struct cgroup *dst_cgrp, struct task_struct *leader, bool threadgroup); -void cgroup_attach_lock(void); -void cgroup_attach_unlock(void); struct task_struct *cgroup_procs_write_start(char *buf, bool threadgroup) __acquires(&cgroup_threadgroup_rwsem); void cgroup_procs_write_finish(struct task_struct *task) diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c index 8bd36f2143eb..c4cc6c1ddacd 100644 --- a/kernel/cgroup/cgroup-v1.c +++ b/kernel/cgroup/cgroup-v1.c @@ -55,7 +55,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk) int retval = 0; mutex_lock(&cgroup_mutex); - cgroup_attach_lock(); + percpu_down_write(&cgroup_threadgroup_rwsem); for_each_root(root) { struct cgroup *from_cgrp; @@ -70,7 +70,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk) if (retval) break; } - cgroup_attach_unlock(); + percpu_up_write(&cgroup_threadgroup_rwsem); mutex_unlock(&cgroup_mutex); return retval; diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 4a4d8a3f06ab..6487df9a6be0 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -2236,7 +2236,7 @@ EXPORT_SYMBOL_GPL(task_cgroup_path); * write-locking cgroup_threadgroup_rwsem. This allows ->attach() to assume that * CPU hotplug is disabled on entry. */ -void cgroup_attach_lock(void) +static void cgroup_attach_lock(void) { cpus_read_lock(); percpu_down_write(&cgroup_threadgroup_rwsem); @@ -2246,7 +2246,7 @@ void cgroup_attach_lock(void) * cgroup_attach_unlock - Undo cgroup_attach_lock() * @lock_threadgroup: whether to up_write cgroup_threadgroup_rwsem */ -void cgroup_attach_unlock(void) +static void cgroup_attach_unlock(void) { percpu_up_write(&cgroup_threadgroup_rwsem); cpus_read_unlock(); -- 2.25.1

1 6

[PATCH openEuler-22.03-LTS] net/smc: align the connect behaviour with TCP
by Litao Jiao 07 Apr '23

07 Apr '23

mainline inclusion from mainline-v5.19.rc1 commit 3aba103006bcc4a7472b7c9506b3bc065ffb7992 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6TK1U CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Connect with O_NONBLOCK will not be completed immediately and returns -EINPROGRESS. It is possible to use selector/poll for completion by selecting the socket for writing. After select indicates writability, a second connect function call will return 0 to indicate connected successfully as TCP does, but smc returns -EISCONN. Use socket state for smc to indicate connect state, which can help smc aligning the connect behaviour with TCP. Signed-off-by: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> Acked-by: Karsten Graul <kgraul(a)linux.ibm.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Litao Jiao <jiaolitao(a)sangfor.com.cn> --- net/smc/af_smc.c | 51 ++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 47 insertions(+), 4 deletions(-) diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 5d7710dd9514..8f73da1ee7b4 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -1097,9 +1097,29 @@ static int smc_connect(struct socket *sock, struct sockaddr *addr, goto out_err; lock_sock(sk); + switch (sock->state) { + default: + rc = -EINVAL; + goto out; + case SS_CONNECTED: + rc = sk->sk_state == SMC_ACTIVE ? -EISCONN : -EINVAL; + goto out; + case SS_CONNECTING: + if (sk->sk_state == SMC_ACTIVE) + goto connected; + break; + case SS_UNCONNECTED: + sock->state = SS_CONNECTING; + break; + } + switch (sk->sk_state) { default: goto out; + case SMC_CLOSED: + rc = sock_error(sk) ? : -ECONNABORTED; + sock->state = SS_UNCONNECTED; + goto out; case SMC_ACTIVE: rc = -EISCONN; goto out; @@ -1118,21 +1138,26 @@ static int smc_connect(struct socket *sock, struct sockaddr *addr, if (rc && rc != -EINPROGRESS) goto out; - if (smc->use_fallback) + if (smc->use_fallback) { + sock->state = rc ? SS_CONNECTING : SS_CONNECTED; goto out; + } sock_hold(&smc->sk); /* sock put in passive closing */ + if (flags & O_NONBLOCK) { if (queue_work(smc_hs_wq, &smc->connect_work)) smc->connect_nonblock = 1; rc = -EINPROGRESS; + goto out; } else { rc = __smc_connect(smc); if (rc < 0) goto out; - else - rc = 0; /* success cases including fallback */ } +connected: + rc = 0; + sock->state = SS_CONNECTED; out: release_sock(sk); out_err: @@ -1234,6 +1259,7 @@ struct sock *smc_accept_dequeue(struct sock *parent, } if (new_sock) { sock_graft(new_sk, new_sock); + new_sock->state = SS_CONNECTED; if (isk->use_fallback) { smc_sk(new_sk)->clcsock->file = new_sock->file; isk->clcsock->file->private_data = isk->clcsock; @@ -1865,7 +1891,7 @@ static int smc_listen(struct socket *sock, int backlog) rc = -EINVAL; if ((sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) || - smc->connect_nonblock) + smc->connect_nonblock || sock->state != SS_UNCONNECTED) goto out; rc = 0; @@ -2135,6 +2161,17 @@ static int smc_shutdown(struct socket *sock, int how) lock_sock(sk); + if (sock->state == SS_CONNECTING) { + if (sk->sk_state == SMC_ACTIVE) + sock->state = SS_CONNECTED; + else if (sk->sk_state == SMC_PEERCLOSEWAIT1 || + sk->sk_state == SMC_PEERCLOSEWAIT2 || + sk->sk_state == SMC_APPCLOSEWAIT1 || + sk->sk_state == SMC_APPCLOSEWAIT2 || + sk->sk_state == SMC_APPFINCLOSEWAIT) + sock->state = SS_DISCONNECTING; + } + rc = -ENOTCONN; if ((sk->sk_state != SMC_ACTIVE) && (sk->sk_state != SMC_PEERCLOSEWAIT1) && @@ -2148,6 +2185,7 @@ static int smc_shutdown(struct socket *sock, int how) sk->sk_shutdown = smc->clcsock->sk->sk_shutdown; if (sk->sk_shutdown == SHUTDOWN_MASK) { sk->sk_state = SMC_CLOSED; + sk->sk_socket->state = SS_UNCONNECTED; sock_put(sk); } goto out; @@ -2173,6 +2211,10 @@ static int smc_shutdown(struct socket *sock, int how) /* map sock_shutdown_cmd constants to sk_shutdown value range */ sk->sk_shutdown |= how + 1; + if (sk->sk_state == SMC_CLOSED) + sock->state = SS_UNCONNECTED; + else + sock->state = SS_DISCONNECTING; out: release_sock(sk); return rc ? rc : rc1; @@ -2464,6 +2506,7 @@ static int smc_create(struct net *net, struct socket *sock, int protocol, rc = -ENOBUFS; sock->ops = &smc_sock_ops; + sock->state = SS_UNCONNECTED; sk = smc_sock_alloc(net, sock, protocol); if (!sk) goto out; -- 2.18.0.windows.1

1 0

[PATCH openEuler-1.0-LTS 01/13] mm: mem_reliable: Initialize reliable_nr_page when mm_init()
by Yongqiang Liu 07 Apr '23

07 Apr '23

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6RKHX CVE: NA -------------------------------- After the fork operation, it is erroneous for the child process to have a reliable page size twice that of its parent process. Upon examining the mm_struct structure, it was discovered that reliable_nr_page should be initialized to 0, similar to how RSS is initialized during mm_init(). This particular problem that arises during forking is merely one such example. To resolve this issue, it is recommended to set reliable_nr_page to 0 during the mm_init() operation. Fixes: 094eaabb3fe8 ("proc: Count reliable memory usage of reliable tasks") Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- include/linux/mem_reliable.h | 8 ++++++++ kernel/fork.c | 1 + 2 files changed, 9 insertions(+) diff --git a/include/linux/mem_reliable.h b/include/linux/mem_reliable.h index 6d57c36fb676..aa3fe77c8a72 100644 --- a/include/linux/mem_reliable.h +++ b/include/linux/mem_reliable.h @@ -123,6 +123,13 @@ static inline bool mem_reliable_shmem_limit_check(void) shmem_reliable_nr_page; } +static inline void reliable_clear_page_counter(struct mm_struct *mm) +{ + if (!mem_reliable_is_enabled()) + return; + + atomic_long_set(&mm->reliable_nr_page, 0); +} #else #define reliable_enabled 0 #define reliable_allow_fb_enabled() false @@ -171,6 +178,7 @@ static inline void reliable_lru_add_batch(int zid, enum lru_list lru, int val) {} static inline bool mem_reliable_counter_initialized(void) { return false; } +static inline void reliable_clear_page_counter(struct mm_struct *mm) {} #endif #endif diff --git a/kernel/fork.c b/kernel/fork.c index b5453a26655e..c256525d4ce5 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1007,6 +1007,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p, atomic_long_set(&mm->locked_vm, 0); mm->pinned_vm = 0; memset(&mm->rss_stat, 0, sizeof(mm->rss_stat)); + reliable_clear_page_counter(mm); spin_lock_init(&mm->page_table_lock); spin_lock_init(&mm->arg_lock); mm_init_cpumask(mm); -- 2.25.1

1 12

[PATCH openEuler-1.0-LTS 1/5] loop: Add parm check in loop_control_ioctl
by Yongqiang Liu 07 Apr '23

07 Apr '23

From: Zhong Jinghua <zhongjinghua(a)huawei.com> hulk inclusion category: bugfix bugzilla: 188586, https://gitee.com/openeuler/kernel/issues/I6TFPJ CVE: NA ---------------------------------------- We found that in loop_control_ioctl, the kernel panic can be easily caused: 1. syscall(__NR_ioctl, r[1], 0x4c80, 0x80000200000ul); Create a loop device 0x80000200000ul. In fact, in the code, it is used as the first_minor number, and the first_minor number is 0. So the created loop device number is 7:0. 2. syscall(__NR_ioctl, r[2], 0x4c80, 0ul); Create a loop device 0x0ul. Since the 7:0 device has been created in 1, add_disk will fail because the major and first_minor numbers are consistent. 3. syscall(__NR_ioctl, r[5], 0x4c81, 0ul); Delete the device that failed to create, the kernel panics. Panic like below: BUG: KASAN: null-ptr-deref in device_del+0xb3/0x840 drivers/base/core.c:3107 Call Trace: kill_device drivers/base/core.c:3079 [inline] device_del+0xb3/0x840 drivers/base/core.c:3107 del_gendisk+0x463/0x5f0 block/genhd.c:971 loop_remove drivers/block/loop.c:2190 [inline] loop_control_ioctl drivers/block/loop.c:2289 [inline] The stack like below: Create loop device: loop_control_ioctl loop_add add_disk device_add_disk bdi_register bdi_register_va device_create device_create_groups_vargs device_add kfree(dev->p); dev->p = NULL; Remove loop device: loop_control_ioctl loop_remove del_gendisk device_del kill_device if (dev->p->dead) // p is null Fix it by adding a check for parm. Fixes: 770fe30a46a1 ("loop: add management interface for on-demand device allocation") Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/block/loop.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index 108a4ff27bcd..826633aa328c 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -1972,6 +1972,17 @@ static int loop_add(struct loop_device **l, int i) struct gendisk *disk; int err; + /* + * i << part_shift is actually used as the first_minor. + * So here should avoid i << part_shift overflow. + * And, MKDEV() expect that the max bits of + * first_minor is 20. + */ + if (i > 0 && i > MINORMASK >> part_shift) { + err = -EINVAL; + goto out; + } + err = -ENOMEM; lo = kzalloc(sizeof(*lo), GFP_KERNEL); if (!lo) @@ -1985,7 +1996,8 @@ static int loop_add(struct loop_device **l, int i) if (err == -ENOSPC) err = -EEXIST; } else { - err = idr_alloc(&loop_index_idr, lo, 0, 0, GFP_KERNEL); + err = idr_alloc(&loop_index_idr, lo, 0, + (MINORMASK >> part_shift) + 1, GFP_KERNEL); } if (err < 0) goto out_free_dev; -- 2.25.1

1 4

[PATCH openEuler-1.0-LTS] block/wbt: enable wbt after switching cfq to other schedulers
by Zhang Changzhong 07 Apr '23

07 Apr '23

From: Li Lingfeng <lilingfeng3(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6LH5K CVE: NA -------------------------------- Commit 80061216078b ("block/wbt: fix negative inflight counter when remove scsi device") move wbt_enable_default() from elv_unregister_queue() to bfq_exit_queue(). As the result of it, wbt can't be enabled when we switch cfq to other schedulers. Fixes: 80061216078b ("block/wbt: fix negative inflight counter when remove scsi device") Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- block/cfq-iosched.c | 1 + 1 file changed, 1 insertion(+) diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c index 88bae55..130854a 100644 --- a/block/cfq-iosched.c +++ b/block/cfq-iosched.c @@ -4563,6 +4563,7 @@ static void cfq_exit_queue(struct elevator_queue *e) kfree(cfqd->root_group); #endif kfree(cfqd); + wbt_enable_default(q); } static int cfq_init_queue(struct request_queue *q, struct elevator_type *e) -- 2.9.5

1 0

[PATCH openEuler-1.0-LTS] Fix double fget() in vhost_net_set_backend()
by Yongqiang Liu 06 Apr '23

06 Apr '23

From: Al Viro <viro(a)zeniv.linux.org.uk> stable inclusion from stable-v4.19.245 commit 6ca70982c646cc32e458150ee7f2530a24369b8c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6T1EY CVE: CVE-2023-1838 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fb4554c2232e44d595920f4d5c66cf8f7d13f9bc upstream. Descriptor table is a shared resource; two fget() on the same descriptor may return different struct file references. get_tap_ptr_ring() is called after we'd found (and pinned) the socket we'll be using and it tries to find the private tun/tap data structures associated with it. Redoing the lookup by the same file descriptor we'd used to get the socket is racy - we need to same struct file. Thanks to Jason for spotting a braino in the original variant of patch - I'd missed the use of fd == -1 for disabling backend, and in that case we can end up with sock == NULL and sock != oldsock. Cc: stable(a)kernel.org Acked-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Jason Wang <jasowang(a)redhat.com> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/vhost/net.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c index 1d99f5c443ee..4b9151474a24 100644 --- a/drivers/vhost/net.c +++ b/drivers/vhost/net.c @@ -1211,13 +1211,9 @@ static struct socket *get_raw_socket(int fd) return ERR_PTR(r); } -static struct ptr_ring *get_tap_ptr_ring(int fd) +static struct ptr_ring *get_tap_ptr_ring(struct file *file) { struct ptr_ring *ring; - struct file *file = fget(fd); - - if (!file) - return NULL; ring = tun_get_tx_ring(file); if (!IS_ERR(ring)) goto out; @@ -1226,7 +1222,6 @@ static struct ptr_ring *get_tap_ptr_ring(int fd) goto out; ring = NULL; out: - fput(file); return ring; } @@ -1313,8 +1308,12 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd) r = vhost_net_enable_vq(n, vq); if (r) goto err_used; - if (index == VHOST_NET_VQ_RX) - nvq->rx_ring = get_tap_ptr_ring(fd); + if (index == VHOST_NET_VQ_RX) { + if (sock) + nvq->rx_ring = get_tap_ptr_ring(sock->file); + else + nvq->rx_ring = NULL; + } oldubufs = nvq->ubufs; nvq->ubufs = ubufs; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/4] btrfs: fix race between quota disable and quota assign ioctls
by Yongqiang Liu 06 Apr '23

06 Apr '23

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.2-rc8 commit 2f1a6be12ab6c8470d5776e68644726c94257c54 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6PQCT CVE: CVE-2023-1611 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The quota assign ioctl can currently run in parallel with a quota disable ioctl call. The assign ioctl uses the quota root, while the disable ioctl frees that root, and therefore we can have a use-after-free triggered in the assign ioctl, leading to a trace like the following when KASAN is enabled: [672.723][T736] BUG: KASAN: slab-use-after-free in btrfs_search_slot+0x2962/0x2db0 [672.723][T736] Read of size 8 at addr ffff888022ec0208 by task btrfs_search_sl/27736 [672.724][T736] [672.725][T736] CPU: 1 PID: 27736 Comm: btrfs_search_sl Not tainted 6.3.0-rc3 #37 [672.723][T736] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [672.727][T736] Call Trace: [672.728][T736] <TASK> [672.728][T736] dump_stack_lvl+0xd9/0x150 [672.725][T736] print_report+0xc1/0x5e0 [672.720][T736] ? __virt_addr_valid+0x61/0x2e0 [672.727][T736] ? __phys_addr+0xc9/0x150 [672.725][T736] ? btrfs_search_slot+0x2962/0x2db0 [672.722][T736] kasan_report+0xc0/0xf0 [672.729][T736] ? btrfs_search_slot+0x2962/0x2db0 [672.724][T736] btrfs_search_slot+0x2962/0x2db0 [672.723][T736] ? fs_reclaim_acquire+0xba/0x160 [672.722][T736] ? split_leaf+0x13d0/0x13d0 [672.726][T736] ? rcu_is_watching+0x12/0xb0 [672.723][T736] ? kmem_cache_alloc+0x338/0x3c0 [672.722][T736] update_qgroup_status_item+0xf7/0x320 [672.724][T736] ? add_qgroup_rb+0x3d0/0x3d0 [672.739][T736] ? do_raw_spin_lock+0x12d/0x2b0 [672.730][T736] ? spin_bug+0x1d0/0x1d0 [672.737][T736] btrfs_run_qgroups+0x5de/0x840 [672.730][T736] ? btrfs_qgroup_rescan_worker+0xa70/0xa70 [672.738][T736] ? __del_qgroup_relation+0x4ba/0xe00 [672.738][T736] btrfs_ioctl+0x3d58/0x5d80 [672.735][T736] ? tomoyo_path_number_perm+0x16a/0x550 [672.737][T736] ? tomoyo_execute_permission+0x4a0/0x4a0 [672.731][T736] ? btrfs_ioctl_get_supported_features+0x50/0x50 [672.737][T736] ? __sanitizer_cov_trace_switch+0x54/0x90 [672.734][T736] ? do_vfs_ioctl+0x132/0x1660 [672.730][T736] ? vfs_fileattr_set+0xc40/0xc40 [672.730][T736] ? _raw_spin_unlock_irq+0x2e/0x50 [672.732][T736] ? sigprocmask+0xf2/0x340 [672.737][T736] ? __fget_files+0x26a/0x480 [672.732][T736] ? bpf_lsm_file_ioctl+0x9/0x10 [672.738][T736] ? btrfs_ioctl_get_supported_features+0x50/0x50 [672.736][T736] __x64_sys_ioctl+0x198/0x210 [672.736][T736] do_syscall_64+0x39/0xb0 [672.731][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd [672.739][T736] RIP: 0033:0x4556ad [672.742][T736] </TASK> [672.743][T736] [672.748][T736] Allocated by task 27677: [672.743][T736] kasan_save_stack+0x22/0x40 [672.741][T736] kasan_set_track+0x25/0x30 [672.741][T736] __kasan_kmalloc+0xa4/0xb0 [672.749][T736] btrfs_alloc_root+0x48/0x90 [672.746][T736] btrfs_create_tree+0x146/0xa20 [672.744][T736] btrfs_quota_enable+0x461/0x1d20 [672.743][T736] btrfs_ioctl+0x4a1c/0x5d80 [672.747][T736] __x64_sys_ioctl+0x198/0x210 [672.749][T736] do_syscall_64+0x39/0xb0 [672.744][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd [672.756][T736] [672.757][T736] Freed by task 27677: [672.759][T736] kasan_save_stack+0x22/0x40 [672.759][T736] kasan_set_track+0x25/0x30 [672.756][T736] kasan_save_free_info+0x2e/0x50 [672.751][T736] ____kasan_slab_free+0x162/0x1c0 [672.758][T736] slab_free_freelist_hook+0x89/0x1c0 [672.752][T736] __kmem_cache_free+0xaf/0x2e0 [672.752][T736] btrfs_put_root+0x1ff/0x2b0 [672.759][T736] btrfs_quota_disable+0x80a/0xbc0 [672.752][T736] btrfs_ioctl+0x3e5f/0x5d80 [672.756][T736] __x64_sys_ioctl+0x198/0x210 [672.753][T736] do_syscall_64+0x39/0xb0 [672.765][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd [672.769][T736] [672.768][T736] The buggy address belongs to the object at ffff888022ec0000 [672.768][T736] which belongs to the cache kmalloc-4k of size 4096 [672.769][T736] The buggy address is located 520 bytes inside of [672.769][T736] freed 4096-byte region [ffff888022ec0000, ffff888022ec1000) [672.760][T736] [672.764][T736] The buggy address belongs to the physical page: [672.761][T736] page:ffffea00008bb000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x22ec0 [672.766][T736] head:ffffea00008bb000 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [672.779][T736] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [672.770][T736] raw: 00fff00000010200 ffff888012842140 ffffea000054ba00 dead000000000002 [672.770][T736] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [672.771][T736] page dumped because: kasan: bad access detected [672.778][T736] page_owner tracks the page as allocated [672.777][T736] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 88 [672.779][T736] get_page_from_freelist+0x119c/0x2d50 [672.779][T736] __alloc_pages+0x1cb/0x4a0 [672.776][T736] alloc_pages+0x1aa/0x270 [672.773][T736] allocate_slab+0x260/0x390 [672.771][T736] ___slab_alloc+0xa9a/0x13e0 [672.778][T736] __slab_alloc.constprop.0+0x56/0xb0 [672.771][T736] __kmem_cache_alloc_node+0x136/0x320 [672.789][T736] __kmalloc+0x4e/0x1a0 [672.783][T736] tomoyo_realpath_from_path+0xc3/0x600 [672.781][T736] tomoyo_path_perm+0x22f/0x420 [672.782][T736] tomoyo_path_unlink+0x92/0xd0 [672.780][T736] security_path_unlink+0xdb/0x150 [672.788][T736] do_unlinkat+0x377/0x680 [672.788][T736] __x64_sys_unlink+0xca/0x110 [672.789][T736] do_syscall_64+0x39/0xb0 [672.783][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd [672.784][T736] page last free stack trace: [672.787][T736] free_pcp_prepare+0x4e5/0x920 [672.787][T736] free_unref_page+0x1d/0x4e0 [672.784][T736] __unfreeze_partials+0x17c/0x1a0 [672.797][T736] qlist_free_all+0x6a/0x180 [672.796][T736] kasan_quarantine_reduce+0x189/0x1d0 [672.797][T736] __kasan_slab_alloc+0x64/0x90 [672.793][T736] kmem_cache_alloc+0x17c/0x3c0 [672.799][T736] getname_flags.part.0+0x50/0x4e0 [672.799][T736] getname_flags+0x9e/0xe0 [672.792][T736] vfs_fstatat+0x77/0xb0 [672.791][T736] __do_sys_newlstat+0x84/0x100 [672.798][T736] do_syscall_64+0x39/0xb0 [672.796][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd [672.790][T736] [672.791][T736] Memory state around the buggy address: [672.799][T736] ffff888022ec0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [672.805][T736] ffff888022ec0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [672.802][T736] >ffff888022ec0200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [672.809][T736] ^ [672.809][T736] ffff888022ec0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [672.809][T736] ffff888022ec0300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fix this by having the qgroup assign ioctl take the qgroup ioctl mutex before calling btrfs_run_qgroups(), which is what all qgroup ioctls should call. Reported-by: butt3rflyh4ck <butterflyhuangxx(a)gmail.com> Link: https://lore.kernel.org/linux-btrfs/CAFcO6XN3VD8ogmHwqRk4kbiwtpUSNySu2VAxN8… CC: stable(a)vger.kernel.org # 5.10+ Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/qgroup.c Signed-off-by: Long Li <leo.lilong(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/btrfs/ioctl.c | 2 ++ fs/btrfs/qgroup.c | 11 ++++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index a5ae02bf3652..00424d3f3464 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -5240,7 +5240,9 @@ static long btrfs_ioctl_qgroup_assign(struct file *file, void __user *arg) } /* update qgroup status and info */ + mutex_lock(&fs_info->qgroup_ioctl_lock); err = btrfs_run_qgroups(trans); + mutex_unlock(&fs_info->qgroup_ioctl_lock); if (err < 0) btrfs_handle_fs_error(fs_info, err, "failed to update qgroup status and info"); diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c index 7916f711daf5..8e58c58f73a3 100644 --- a/fs/btrfs/qgroup.c +++ b/fs/btrfs/qgroup.c @@ -2196,7 +2196,8 @@ int btrfs_qgroup_account_extents(struct btrfs_trans_handle *trans) } /* - * called from commit_transaction. Writes all changed qgroups to disk. + * Writes all changed qgroups to disk. + * Called by the transaction commit path and the qgroup assign ioctl. */ int btrfs_run_qgroups(struct btrfs_trans_handle *trans) { @@ -2204,6 +2205,14 @@ int btrfs_run_qgroups(struct btrfs_trans_handle *trans) struct btrfs_root *quota_root = fs_info->quota_root; int ret = 0; + /* + * In case we are called from the qgroup assign ioctl, assert that we + * are holding the qgroup_ioctl_lock, otherwise we can race with a quota + * disable operation (ioctl) and access a freed quota root. + */ + if (trans->transaction->state != TRANS_STATE_COMMIT_DOING) + lockdep_assert_held(&fs_info->qgroup_ioctl_lock); + if (!quota_root) return ret; -- 2.25.1

1 3

Kernel sig 4.7 14:00-15:30 例会议题情况//答复: openEuler Kernel SIG双周例会
by liaotao (C) 06 Apr '23

06 Apr '23

当前例会议题：议题一：进展update --- 张伽琳 & 郑增凯议题二：openEuler-22.03-LTS-SP2需求评审 ---张伽琳欢迎大家继续申报~ -----原始约会----- 发件人: openEuler conference <public(a)openeuler.org> 发送时间: 2023年4月7日 9:30 收件人: dev@openeuler.org,kernel-discuss@openeuler.org,kernel@openeuler.org 主题: openEuler Kernel SIG双周例会时间: 2023年4月7日星期五 14:00-15:30(UTC+08:00) 北京，重庆，香港特别行政区，乌鲁木齐。地点: 您好！ Kernel SIG 邀请您参加 2023-04-07 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1.进展update 2.议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板）会议链接：https://us06web.zoom.us/j/88353599877?pwd=aFZtMjJwUHl1UmNTZFV4eUJQM2xVdz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-04-07 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1.进展update 2.议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板） You can join the meeting at https://us06web.zoom.us/j/88353599877?pwd=aFZtMjJwUHl1UmNTZFV4eUJQM2xVdz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS 1/4] ext4: fix race between writepages and remount
by Yongqiang Liu 04 Apr '23

04 Apr '23

From: Baokun Li <libaokun1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 188500, https://gitee.com/openeuler/kernel/issues/I6RJ0V CVE: NA -------------------------------- We got a WARNING in ext4_add_complete_io: ================================================================== WARNING: at fs/ext4/page-io.c:231 ext4_put_io_end_defer+0x182/0x250 CPU: 10 PID: 77 Comm: ksoftirqd/10 Tainted: 6.3.0-rc2 #85 RIP: 0010:ext4_put_io_end_defer+0x182/0x250 [ext4] [...] Call Trace: <TASK> ext4_end_bio+0xa8/0x240 [ext4] bio_endio+0x195/0x310 blk_update_request+0x184/0x770 scsi_end_request+0x2f/0x240 scsi_io_completion+0x75/0x450 scsi_finish_command+0xef/0x160 scsi_complete+0xa3/0x180 blk_complete_reqs+0x60/0x80 blk_done_softirq+0x25/0x40 __do_softirq+0x119/0x4c8 run_ksoftirqd+0x42/0x70 smpboot_thread_fn+0x136/0x3c0 kthread+0x140/0x1a0 ret_from_fork+0x2c/0x50 ================================================================== Above issue may happen as follows: cpu1 cpu2 ----------------------------|---------------------------- mount -o dioread_lock ext4_writepages ext4_do_writepages *if (ext4_should_dioread_nolock(inode))* // rsv_blocks is not assigned here mount -o remount,dioread_nolock ext4_journal_start_with_reserve __ext4_journal_start __ext4_journal_start_sb jbd2__journal_start *if (rsv_blocks)* // h_rsv_handle is not initialized here mpage_map_and_submit_extent mpage_map_one_extent dioread_nolock = ext4_should_dioread_nolock(inode) if (dioread_nolock && (map->m_flags & EXT4_MAP_UNWRITTEN)) mpd->io_submit.io_end->handle = handle->h_rsv_handle ext4_set_io_unwritten_flag io_end->flag |= EXT4_IO_END_UNWRITTEN // now io_end->handle is NULL but has EXT4_IO_END_UNWRITTEN flag scsi_finish_command scsi_io_completion scsi_io_completion_action scsi_end_request blk_update_request req_bio_endio bio_endio bio->bi_end_io > ext4_end_bio ext4_put_io_end_defer ext4_add_complete_io // trigger WARN_ON(!io_end->handle && sbi->s_journal); The immediate cause of this problem is that ext4_should_dioread_nolock() function returns inconsistent values in the ext4_do_writepages() and mpage_map_one_extent(). There are four conditions in this function that can be changed at mount time to cause this problem. These four conditions can be divided into two categories: (1) journal_data and EXT4_EXTENTS_FL, which can be changed by ioctl (2) DELALLOC and DIOREAD_NOLOCK, which can be changed by remount The two in the first category have been fixed by commit c8585c6fcaf2 ("ext4: fix races between changing inode journal mode and ext4_writepages") and commit cb85f4d23f79 ("ext4: fix race between writepages and enabling EXT4_EXTENTS_FL") respectively. Two cases in the other category have not yet been fixed, and the above issue is caused by this situation. We refer to the fix for the first category, when applying options during remount, we grab s_writepages_rwsem to avoid racing with writepages ops to trigger this problem. Fixes: 6b523df4fb5a ("ext4: use transaction reservation for extent conversion in ext4_end_io") Cc: stable(a)vger.kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/ext4.h | 3 ++- fs/ext4/super.c | 13 +++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h index 4c88e75180a2..6df919b154b4 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -1530,7 +1530,8 @@ struct ext4_sb_info { /* * Barrier between writepages ops and changing any inode's JOURNAL_DATA - * or EXTENTS flag. + * or EXTENTS flag or between writepages ops and changing DIOREAD_NOLOCK + * mount option on remount. */ struct percpu_rw_semaphore s_writepages_rwsem; struct dax_device *s_daxdev; diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 8029a6f6471c..df07222f1cc5 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5605,10 +5605,20 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) vfs_flags = SB_LAZYTIME | SB_I_VERSION; sb->s_flags = (sb->s_flags & ~vfs_flags) | (*flags & vfs_flags); + /* + * Changing the DIOREAD_NOLOCK mount option may cause two calls to + * ext4_should_dioread_nolock() to return inconsistent values, + * triggering WARN_ON in ext4_add_complete_io(). we grab here + * s_writepages_rwsem to avoid race between writepages ops and + * remount. + */ + percpu_down_write(&sbi->s_writepages_rwsem); if (!parse_options(data, sb, NULL, &journal_ioprio, 1)) { err = -EINVAL; + percpu_up_write(&sbi->s_writepages_rwsem); goto restore_opts; } + percpu_up_write(&sbi->s_writepages_rwsem); if ((old_opts.s_mount_opt & EXT4_MOUNT_JOURNAL_CHECKSUM) ^ test_opt(sb, JOURNAL_CHECKSUM)) { @@ -5833,6 +5843,7 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) return 0; restore_opts: + percpu_down_write(&sbi->s_writepages_rwsem); sb->s_flags = old_sb_flags; sbi->s_mount_opt = old_opts.s_mount_opt; sbi->s_mount_opt2 = old_opts.s_mount_opt2; @@ -5841,6 +5852,8 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) sbi->s_commit_interval = old_opts.s_commit_interval; sbi->s_min_batch_time = old_opts.s_min_batch_time; sbi->s_max_batch_time = old_opts.s_max_batch_time; + percpu_up_write(&sbi->s_writepages_rwsem); + if (!test_opt(sb, BLOCK_VALIDITY) && sbi->system_blks) ext4_release_system_zone(sb); #ifdef CONFIG_QUOTA -- 2.25.1

1 6

[PATCH openEuler-5.10-LTS 01/15] scsi: scsi_dh_alua: fix memleak for 'qdata' in alua_activate()
by Jialin Zhang 04 Apr '23

04 Apr '23

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6NBAZ CVE: NA -------------------------------- If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not freed, which will cause following memleak: unreferenced object 0xffff88810b2c6980 (size 32): comm "kworker/u16:2", pid 635322, jiffies 4355801099 (age 1216426.076s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff @9$............. backtrace: [<0000000098f3a26d>] alua_activate+0xb0/0x320 [<000000003b529641>] scsi_dh_activate+0xb2/0x140 [<000000007b296db3>] activate_path_work+0xc6/0xe0 [dm_multipath] [<000000007adc9ace>] process_one_work+0x3c5/0x730 [<00000000c457a985>] worker_thread+0x93/0x650 [<00000000cb80e628>] kthread+0x1ba/0x210 [<00000000a1e61077>] ret_from_fork+0x22/0x30 Fix the problem by freeing 'qdata' in error path. Fixes: 625fe857e4fa ("scsi: scsi_dh_alua: Check scsi_device_get() return value") Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/scsi/device_handler/scsi_dh_alua.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c index fe8a5e5c0df8..bf0b3178f84d 100644 --- a/drivers/scsi/device_handler/scsi_dh_alua.c +++ b/drivers/scsi/device_handler/scsi_dh_alua.c @@ -1036,10 +1036,12 @@ static int alua_activate(struct scsi_device *sdev, rcu_read_unlock(); mutex_unlock(&h->init_mutex); - if (alua_rtpg_queue(pg, sdev, qdata, true)) + if (alua_rtpg_queue(pg, sdev, qdata, true)) { fn = NULL; - else + } else { + kfree(qdata); err = SCSI_DH_DEV_OFFLINED; + } kref_put(&pg->kref, release_port_group); out: if (fn) -- 2.25.1

1 14

[PATCH openEuler-5.10-LTS-SP1 01/16] scsi: scsi_dh_alua: fix memleak for 'qdata' in alua_activate()
by Jialin Zhang 04 Apr '23

04 Apr '23

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6NBAZ CVE: NA -------------------------------- If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not freed, which will cause following memleak: unreferenced object 0xffff88810b2c6980 (size 32): comm "kworker/u16:2", pid 635322, jiffies 4355801099 (age 1216426.076s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff @9$............. backtrace: [<0000000098f3a26d>] alua_activate+0xb0/0x320 [<000000003b529641>] scsi_dh_activate+0xb2/0x140 [<000000007b296db3>] activate_path_work+0xc6/0xe0 [dm_multipath] [<000000007adc9ace>] process_one_work+0x3c5/0x730 [<00000000c457a985>] worker_thread+0x93/0x650 [<00000000cb80e628>] kthread+0x1ba/0x210 [<00000000a1e61077>] ret_from_fork+0x22/0x30 Fix the problem by freeing 'qdata' in error path. Fixes: 625fe857e4fa ("scsi: scsi_dh_alua: Check scsi_device_get() return value") Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/scsi/device_handler/scsi_dh_alua.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c index fe8a5e5c0df8..bf0b3178f84d 100644 --- a/drivers/scsi/device_handler/scsi_dh_alua.c +++ b/drivers/scsi/device_handler/scsi_dh_alua.c @@ -1036,10 +1036,12 @@ static int alua_activate(struct scsi_device *sdev, rcu_read_unlock(); mutex_unlock(&h->init_mutex); - if (alua_rtpg_queue(pg, sdev, qdata, true)) + if (alua_rtpg_queue(pg, sdev, qdata, true)) { fn = NULL; - else + } else { + kfree(qdata); err = SCSI_DH_DEV_OFFLINED; + } kref_put(&pg->kref, release_port_group); out: if (fn) -- 2.25.1

1 15

openEuler Kernel SIG双周例会
by openEuler conference 04 Apr '23

04 Apr '23

您好！ Kernel SIG 邀请您参加 2023-04-07 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1.进展update 2.议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板）会议链接：https://us06web.zoom.us/j/88353599877?pwd=aFZtMjJwUHl1UmNTZFV4eUJQM2xVdz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-04-07 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1.进展update 2.议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板） You can join the meeting at https://us06web.zoom.us/j/88353599877?pwd=aFZtMjJwUHl1UmNTZFV4eUJQM2xVdz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS 1/4] ext4: fix race between writepages and remount
by Yongqiang Liu 03 Apr '23

03 Apr '23

From: Baokun Li <libaokun1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 188500, https://gitee.com/openeuler/kernel/issues/I6RJ0V CVE: NA -------------------------------- We got a WARNING in ext4_add_complete_io: ================================================================== WARNING: at fs/ext4/page-io.c:231 ext4_put_io_end_defer+0x182/0x250 CPU: 10 PID: 77 Comm: ksoftirqd/10 Tainted: 6.3.0-rc2 #85 RIP: 0010:ext4_put_io_end_defer+0x182/0x250 [ext4] [...] Call Trace: <TASK> ext4_end_bio+0xa8/0x240 [ext4] bio_endio+0x195/0x310 blk_update_request+0x184/0x770 scsi_end_request+0x2f/0x240 scsi_io_completion+0x75/0x450 scsi_finish_command+0xef/0x160 scsi_complete+0xa3/0x180 blk_complete_reqs+0x60/0x80 blk_done_softirq+0x25/0x40 __do_softirq+0x119/0x4c8 run_ksoftirqd+0x42/0x70 smpboot_thread_fn+0x136/0x3c0 kthread+0x140/0x1a0 ret_from_fork+0x2c/0x50 ================================================================== Above issue may happen as follows: cpu1 cpu2 ----------------------------|---------------------------- mount -o dioread_lock ext4_writepages ext4_do_writepages *if (ext4_should_dioread_nolock(inode))* // rsv_blocks is not assigned here mount -o remount,dioread_nolock ext4_journal_start_with_reserve __ext4_journal_start __ext4_journal_start_sb jbd2__journal_start *if (rsv_blocks)* // h_rsv_handle is not initialized here mpage_map_and_submit_extent mpage_map_one_extent dioread_nolock = ext4_should_dioread_nolock(inode) if (dioread_nolock && (map->m_flags & EXT4_MAP_UNWRITTEN)) mpd->io_submit.io_end->handle = handle->h_rsv_handle ext4_set_io_unwritten_flag io_end->flag |= EXT4_IO_END_UNWRITTEN // now io_end->handle is NULL but has EXT4_IO_END_UNWRITTEN flag scsi_finish_command scsi_io_completion scsi_io_completion_action scsi_end_request blk_update_request req_bio_endio bio_endio bio->bi_end_io > ext4_end_bio ext4_put_io_end_defer ext4_add_complete_io // trigger WARN_ON(!io_end->handle && sbi->s_journal); The immediate cause of this problem is that ext4_should_dioread_nolock() function returns inconsistent values in the ext4_do_writepages() and mpage_map_one_extent(). There are four conditions in this function that can be changed at mount time to cause this problem. These four conditions can be divided into two categories: (1) journal_data and EXT4_EXTENTS_FL, which can be changed by ioctl (2) DELALLOC and DIOREAD_NOLOCK, which can be changed by remount The two in the first category have been fixed by commit c8585c6fcaf2 ("ext4: fix races between changing inode journal mode and ext4_writepages") and commit cb85f4d23f79 ("ext4: fix race between writepages and enabling EXT4_EXTENTS_FL") respectively. Two cases in the other category have not yet been fixed, and the above issue is caused by this situation. We refer to the fix for the first category, when applying options during remount, we grab s_writepages_rwsem to avoid racing with writepages ops to trigger this problem. Fixes: 6b523df4fb5a ("ext4: use transaction reservation for extent conversion in ext4_end_io") Cc: stable(a)vger.kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/ext4.h | 3 ++- fs/ext4/super.c | 13 +++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h index 4c88e75180a2..6df919b154b4 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -1530,7 +1530,8 @@ struct ext4_sb_info { /* * Barrier between writepages ops and changing any inode's JOURNAL_DATA - * or EXTENTS flag. + * or EXTENTS flag or between writepages ops and changing DIOREAD_NOLOCK + * mount option on remount. */ struct percpu_rw_semaphore s_writepages_rwsem; struct dax_device *s_daxdev; diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 8029a6f6471c..df07222f1cc5 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5605,10 +5605,20 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) vfs_flags = SB_LAZYTIME | SB_I_VERSION; sb->s_flags = (sb->s_flags & ~vfs_flags) | (*flags & vfs_flags); + /* + * Changing the DIOREAD_NOLOCK mount option may cause two calls to + * ext4_should_dioread_nolock() to return inconsistent values, + * triggering WARN_ON in ext4_add_complete_io(). we grab here + * s_writepages_rwsem to avoid race between writepages ops and + * remount. + */ + percpu_down_write(&sbi->s_writepages_rwsem); if (!parse_options(data, sb, NULL, &journal_ioprio, 1)) { err = -EINVAL; + percpu_up_write(&sbi->s_writepages_rwsem); goto restore_opts; } + percpu_up_write(&sbi->s_writepages_rwsem); if ((old_opts.s_mount_opt & EXT4_MOUNT_JOURNAL_CHECKSUM) ^ test_opt(sb, JOURNAL_CHECKSUM)) { @@ -5833,6 +5843,7 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) return 0; restore_opts: + percpu_down_write(&sbi->s_writepages_rwsem); sb->s_flags = old_sb_flags; sbi->s_mount_opt = old_opts.s_mount_opt; sbi->s_mount_opt2 = old_opts.s_mount_opt2; @@ -5841,6 +5852,8 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) sbi->s_commit_interval = old_opts.s_commit_interval; sbi->s_min_batch_time = old_opts.s_min_batch_time; sbi->s_max_batch_time = old_opts.s_max_batch_time; + percpu_up_write(&sbi->s_writepages_rwsem); + if (!test_opt(sb, BLOCK_VALIDITY) && sbi->system_blks) ext4_release_system_zone(sb); #ifdef CONFIG_QUOTA -- 2.25.1

1 3

[PATCH] ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
by Hui Tang 31 Mar '23

31 Mar '23

From: Clement Lecigne <clecigne(a)google.com> stable inclusion from stable-v5.10.162 commit df02234e6b87d2a9a82acd3198e44bdeff8488c6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6AOWP CVE: CVE-2023-0266 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Note: this is a fix that works around the bug equivalently as the two upstream commits: 1fa4445f9adf ("ALSA: control - introduce snd_ctl_notify_one() helper") 56b88b50565c ("ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF") but in a simpler way to fit with older stable trees -- tiwai ] Add missing locking in ctl_elem_read_user/ctl_elem_write_user which can be easily triggered and turned into an use-after-free. Example code paths with SNDRV_CTL_IOCTL_ELEM_READ: 64-bits: snd_ctl_ioctl snd_ctl_elem_read_user [takes controls_rwsem] snd_ctl_elem_read [lock properly held, all good] [drops controls_rwsem] 32-bits (compat): snd_ctl_ioctl_compat snd_ctl_elem_write_read_compat ctl_elem_write_read snd_ctl_elem_read [missing lock, not good] CVE-2023-0266 was assigned for this issue. Signed-off-by: Clement Lecigne <clecigne(a)google.com> Cc: stable(a)kernel.org # 5.12 and older Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Reviewed-by: Jaroslav Kysela <perex(a)perex.cz> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- sound/core/control_compat.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c index 507fd5210c1c..f5e51f5e3437 100644 --- a/sound/core/control_compat.c +++ b/sound/core/control_compat.c @@ -316,7 +316,9 @@ static int ctl_elem_read_user(struct snd_card *card, err = snd_power_wait(card, SNDRV_CTL_POWER_D0); if (err < 0) goto error; + down_read(&card->controls_rwsem); err = snd_ctl_elem_read(card, data); + up_read(&card->controls_rwsem); if (err < 0) goto error; err = copy_ctl_value_to_user(userdata, valuep, data, type, count); @@ -344,7 +346,9 @@ static int ctl_elem_write_user(struct snd_ctl_file *file, err = snd_power_wait(card, SNDRV_CTL_POWER_D0); if (err < 0) goto error; + down_write(&card->controls_rwsem); err = snd_ctl_elem_write(card, file, data); + up_write(&card->controls_rwsem); if (err < 0) goto error; err = copy_ctl_value_to_user(userdata, valuep, data, type, count); -- 2.17.1

1 0

[PATCH openEuler-1.0-LTS] ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
by Zhang Changzhong 31 Mar '23

31 Mar '23

From: Clement Lecigne <clecigne(a)google.com> stable inclusion from stable-v5.10.162 commit df02234e6b87d2a9a82acd3198e44bdeff8488c6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6AOWP CVE: CVE-2023-0266 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Note: this is a fix that works around the bug equivalently as the two upstream commits: 1fa4445f9adf ("ALSA: control - introduce snd_ctl_notify_one() helper") 56b88b50565c ("ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF") but in a simpler way to fit with older stable trees -- tiwai ] Add missing locking in ctl_elem_read_user/ctl_elem_write_user which can be easily triggered and turned into an use-after-free. Example code paths with SNDRV_CTL_IOCTL_ELEM_READ: 64-bits: snd_ctl_ioctl snd_ctl_elem_read_user [takes controls_rwsem] snd_ctl_elem_read [lock properly held, all good] [drops controls_rwsem] 32-bits (compat): snd_ctl_ioctl_compat snd_ctl_elem_write_read_compat ctl_elem_write_read snd_ctl_elem_read [missing lock, not good] CVE-2023-0266 was assigned for this issue. Signed-off-by: Clement Lecigne <clecigne(a)google.com> Cc: stable(a)kernel.org # 5.12 and older Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Reviewed-by: Jaroslav Kysela <perex(a)perex.cz> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hui Tang <tanghui20(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: songping yu <yusongping(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- sound/core/control_compat.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c index 507fd52..f5e51f5 100644 --- a/sound/core/control_compat.c +++ b/sound/core/control_compat.c @@ -316,7 +316,9 @@ static int ctl_elem_read_user(struct snd_card *card, err = snd_power_wait(card, SNDRV_CTL_POWER_D0); if (err < 0) goto error; + down_read(&card->controls_rwsem); err = snd_ctl_elem_read(card, data); + up_read(&card->controls_rwsem); if (err < 0) goto error; err = copy_ctl_value_to_user(userdata, valuep, data, type, count); @@ -344,7 +346,9 @@ static int ctl_elem_write_user(struct snd_ctl_file *file, err = snd_power_wait(card, SNDRV_CTL_POWER_D0); if (err < 0) goto error; + down_write(&card->controls_rwsem); err = snd_ctl_elem_write(card, file, data); + up_write(&card->controls_rwsem); if (err < 0) goto error; err = copy_ctl_value_to_user(userdata, valuep, data, type, count); -- 2.9.5

1 0

【重要】openEuler-22.03-LTS-SP2需求收集
by zhangjialin (F) 30 Mar '23

30 Mar '23

openEuler-22.03-LTS-SP2需求收集截止日期：2023年4月7日星期五 openEuler-22.03-LTS-SP2需求合入截止日期：2023年5月19日星期五目前是需求收集阶段，如果您有合入openEuler-22.03-LTS-SP2的需求，请您尽快向openEuler社区提交需求issue 需求issue提交链接：https://gitee.com/openeuler/kernel/issues，issue类型选择需求，issue标题以[… 我们将在2023年4月7日kernel sig双周例会上集中讨论，采纳的需求将纳入里程碑规划

1 0

[PATCH openEuler-1.0-LTS 1/4] RDMA/core: Don't infoleak GRH fields
by Yongqiang Liu 30 Mar '23

30 Mar '23

From: Leon Romanovsky <leonro(a)nvidia.com> stable inclusion from stable-v4.19.225 commit 153843e270459b08529f80a0a0d8258d91597594 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6Q364 CVE: CVE-2021-3923 -------------------------------- commit b35a0f4dd544eaa6162b6d2f13a2557a121ae5fd upstream. If dst->is_global field is not set, the GRH fields are not cleared and the following infoleak is reported. ===================================================== BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 instrument_copy_to_user include/linux/instrumented.h:121 [inline] _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 copy_to_user include/linux/uaccess.h:209 [inline] ucma_init_qp_attr+0x8c7/0xb10 drivers/infiniband/core/ucma.c:1242 ucma_write+0x637/0x6c0 drivers/infiniband/core/ucma.c:1732 vfs_write+0x8ce/0x2030 fs/read_write.c:588 ksys_write+0x28b/0x510 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __ia32_sys_write+0xdb/0x120 fs/read_write.c:652 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline] __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c Local variable resp created at: ucma_init_qp_attr+0xa4/0xb10 drivers/infiniband/core/ucma.c:1214 ucma_write+0x637/0x6c0 drivers/infiniband/core/ucma.c:1732 Bytes 40-59 of 144 are uninitialized Memory access of size 144 starts at ffff888167523b00 Data copied to user address 0000000020000100 CPU: 1 PID: 25910 Comm: syz-executor.1 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ===================================================== Fixes: 4ba66093bdc6 ("IB/core: Check for global flag when using ah_attr") Link: https://lore.kernel.org/r/0e9dd51f93410b7b2f4f5562f52befc878b71afa.16412988… Reported-by: syzbot+6d532fa8f9463da290bc(a)syzkaller.appspotmail.com Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baisong Zhong <zhongbaisong(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/infiniband/core/uverbs_marshall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/core/uverbs_marshall.c b/drivers/infiniband/core/uverbs_marshall.c index b8d715c68ca4..11a080646916 100644 --- a/drivers/infiniband/core/uverbs_marshall.c +++ b/drivers/infiniband/core/uverbs_marshall.c @@ -66,7 +66,7 @@ void ib_copy_ah_attr_to_user(struct ib_device *device, struct rdma_ah_attr *src = ah_attr; struct rdma_ah_attr conv_ah; - memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved)); + memset(&dst->grh, 0, sizeof(dst->grh)); if ((ah_attr->type == RDMA_AH_ATTR_TYPE_OPA) && (rdma_ah_get_dlid(ah_attr) > be16_to_cpu(IB_LID_PERMISSIVE)) && -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS 1/2] RDMA/core: Don't infoleak GRH fields
by Yongqiang Liu 30 Mar '23

30 Mar '23

From: Leon Romanovsky <leonro(a)nvidia.com> stable inclusion from stable-v4.19.225 commit 153843e270459b08529f80a0a0d8258d91597594 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6Q364 CVE: CVE-2021-3923 -------------------------------- commit b35a0f4dd544eaa6162b6d2f13a2557a121ae5fd upstream. If dst->is_global field is not set, the GRH fields are not cleared and the following infoleak is reported. ===================================================== BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 instrument_copy_to_user include/linux/instrumented.h:121 [inline] _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 copy_to_user include/linux/uaccess.h:209 [inline] ucma_init_qp_attr+0x8c7/0xb10 drivers/infiniband/core/ucma.c:1242 ucma_write+0x637/0x6c0 drivers/infiniband/core/ucma.c:1732 vfs_write+0x8ce/0x2030 fs/read_write.c:588 ksys_write+0x28b/0x510 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __ia32_sys_write+0xdb/0x120 fs/read_write.c:652 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline] __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c Local variable resp created at: ucma_init_qp_attr+0xa4/0xb10 drivers/infiniband/core/ucma.c:1214 ucma_write+0x637/0x6c0 drivers/infiniband/core/ucma.c:1732 Bytes 40-59 of 144 are uninitialized Memory access of size 144 starts at ffff888167523b00 Data copied to user address 0000000020000100 CPU: 1 PID: 25910 Comm: syz-executor.1 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ===================================================== Fixes: 4ba66093bdc6 ("IB/core: Check for global flag when using ah_attr") Link: https://lore.kernel.org/r/0e9dd51f93410b7b2f4f5562f52befc878b71afa.16412988… Reported-by: syzbot+6d532fa8f9463da290bc(a)syzkaller.appspotmail.com Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baisong Zhong <zhongbaisong(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/infiniband/core/uverbs_marshall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/core/uverbs_marshall.c b/drivers/infiniband/core/uverbs_marshall.c index b8d715c68ca4..11a080646916 100644 --- a/drivers/infiniband/core/uverbs_marshall.c +++ b/drivers/infiniband/core/uverbs_marshall.c @@ -66,7 +66,7 @@ void ib_copy_ah_attr_to_user(struct ib_device *device, struct rdma_ah_attr *src = ah_attr; struct rdma_ah_attr conv_ah; - memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved)); + memset(&dst->grh, 0, sizeof(dst->grh)); if ((ah_attr->type == RDMA_AH_ATTR_TYPE_OPA) && (rdma_ah_get_dlid(ah_attr) > be16_to_cpu(IB_LID_PERMISSIVE)) && -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/3] cgroup/cpuset: Change cpuset_rwsem and hotplug lock order
by Yongqiang Liu 29 Mar '23

29 Mar '23

From: Juri Lelli <juri.lelli(a)redhat.com> mainline inclusion from mainline-v5.4-rc1 commit d74b27d63a8bebe2fe634944e4ebdc7b10db7a39 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6L46J CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- cpuset_rwsem is going to be acquired from sched_setscheduler() with a following patch. There are however paths (e.g., spawn_ksoftirqd) in which sched_scheduler() is eventually called while holding hotplug lock; this creates a dependecy between hotplug lock (to be always acquired first) and cpuset_rwsem (to be always acquired after hotplug lock). Fix paths which currently take the two locks in the wrong order (after a following patch is applied). Tested-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> Signed-off-by: Juri Lelli <juri.lelli(a)redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: Linus Torvalds <torvalds(a)linux-foundation.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: bristot(a)redhat.com Cc: claudio(a)evidence.eu.com Cc: lizefan(a)huawei.com Cc: longman(a)redhat.com Cc: luca.abeni(a)santannapisa.it Cc: mathieu.poirier(a)linaro.org Cc: rostedt(a)goodmis.org Cc: tj(a)kernel.org Cc: tommaso.cucinotta(a)santannapisa.it Link: https://lkml.kernel.org/r/20190719140000.31694-7-juri.lelli@redhat.com Signed-off-by: Ingo Molnar <mingo(a)kernel.org> conflicts: kernel/cgroup/cpuset.c Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- include/linux/cpuset.h | 8 ++++---- kernel/cgroup/cpuset.c | 24 +++++++++++++++++------- 2 files changed, 21 insertions(+), 11 deletions(-) diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h index 934633a05d20..7f1478c26a33 100644 --- a/include/linux/cpuset.h +++ b/include/linux/cpuset.h @@ -40,14 +40,14 @@ static inline bool cpusets_enabled(void) static inline void cpuset_inc(void) { - static_branch_inc(&cpusets_pre_enable_key); - static_branch_inc(&cpusets_enabled_key); + static_branch_inc_cpuslocked(&cpusets_pre_enable_key); + static_branch_inc_cpuslocked(&cpusets_enabled_key); } static inline void cpuset_dec(void) { - static_branch_dec(&cpusets_enabled_key); - static_branch_dec(&cpusets_pre_enable_key); + static_branch_dec_cpuslocked(&cpusets_enabled_key); + static_branch_dec_cpuslocked(&cpusets_pre_enable_key); } extern int cpuset_init(void); diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 55bfbc4cdb16..def36c3fc524 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -914,8 +914,8 @@ static void rebuild_sched_domains_locked(void) cpumask_var_t *doms; int ndoms; + lockdep_assert_cpus_held(); lockdep_assert_held(&cpuset_mutex); - get_online_cpus(); /* * We have raced with CPU hotplug. Don't do anything to avoid @@ -923,15 +923,13 @@ static void rebuild_sched_domains_locked(void) * Anyways, hotplug work item will rebuild sched domains. */ if (!cpumask_equal(top_cpuset.effective_cpus, cpu_active_mask)) - goto out; + return; /* Generate domain masks and attrs */ ndoms = generate_sched_domains(&doms, &attr); /* Have scheduler rebuild the domains */ partition_sched_domains(ndoms, doms, attr); -out: - put_online_cpus(); } #else /* !CONFIG_SMP */ static void rebuild_sched_domains_locked(void) @@ -941,9 +939,11 @@ static void rebuild_sched_domains_locked(void) void rebuild_sched_domains(void) { + get_online_cpus(); mutex_lock(&cpuset_mutex); rebuild_sched_domains_locked(); mutex_unlock(&cpuset_mutex); + put_online_cpus(); } /** @@ -1612,13 +1612,13 @@ static void cpuset_attach(struct cgroup_taskset *tset) cgroup_taskset_first(tset, &css); cs = css_cs(css); - mutex_lock(&cpuset_mutex); - /* * It should hold cpus lock because a cpu offline event can * cause set_cpus_allowed_ptr() failed. */ get_online_cpus(); + mutex_lock(&cpuset_mutex); + /* prepare for attach */ if (cs == &top_cpuset) cpumask_copy(cpus_attach, cpu_possible_mask); @@ -1644,7 +1644,6 @@ static void cpuset_attach(struct cgroup_taskset *tset) cpuset_change_task_nodemask(task, &cpuset_attach_nodemask_to); cpuset_update_task_spread_flag(cs, task); } - put_online_cpus(); /* * Change mm for all threadgroup leaders. This is expensive and may @@ -1680,6 +1679,7 @@ static void cpuset_attach(struct cgroup_taskset *tset) wake_up(&cpuset_attach_wq); mutex_unlock(&cpuset_mutex); + put_online_cpus(); } /* The various types of files and directories in a cpuset file system */ @@ -1711,6 +1711,7 @@ static int cpuset_write_u64(struct cgroup_subsys_state *css, struct cftype *cft, cpuset_filetype_t type = cft->private; int retval = 0; + get_online_cpus(); mutex_lock(&cpuset_mutex); if (!is_cpuset_online(cs)) { retval = -ENODEV; @@ -1748,6 +1749,7 @@ static int cpuset_write_u64(struct cgroup_subsys_state *css, struct cftype *cft, } out_unlock: mutex_unlock(&cpuset_mutex); + put_online_cpus(); return retval; } @@ -1758,6 +1760,7 @@ static int cpuset_write_s64(struct cgroup_subsys_state *css, struct cftype *cft, cpuset_filetype_t type = cft->private; int retval = -ENODEV; + get_online_cpus(); mutex_lock(&cpuset_mutex); if (!is_cpuset_online(cs)) goto out_unlock; @@ -1772,6 +1775,7 @@ static int cpuset_write_s64(struct cgroup_subsys_state *css, struct cftype *cft, } out_unlock: mutex_unlock(&cpuset_mutex); + put_online_cpus(); return retval; } @@ -1810,6 +1814,7 @@ static ssize_t cpuset_write_resmask(struct kernfs_open_file *of, kernfs_break_active_protection(of->kn); flush_work(&cpuset_hotplug_work); + get_online_cpus(); mutex_lock(&cpuset_mutex); if (!is_cpuset_online(cs)) goto out_unlock; @@ -1840,6 +1845,7 @@ static ssize_t cpuset_write_resmask(struct kernfs_open_file *of, free_trial_cpuset(trialcs); out_unlock: mutex_unlock(&cpuset_mutex); + put_online_cpus(); kernfs_unbreak_active_protection(of->kn); css_put(&cs->css); flush_workqueue(cpuset_migrate_mm_wq); @@ -2108,6 +2114,7 @@ static int cpuset_css_online(struct cgroup_subsys_state *css) if (!parent) return 0; + get_online_cpus(); mutex_lock(&cpuset_mutex); set_bit(CS_ONLINE, &cs->flags); @@ -2161,6 +2168,7 @@ static int cpuset_css_online(struct cgroup_subsys_state *css) spin_unlock_irq(&callback_lock); out_unlock: mutex_unlock(&cpuset_mutex); + put_online_cpus(); return 0; } @@ -2174,6 +2182,7 @@ static void cpuset_css_offline(struct cgroup_subsys_state *css) { struct cpuset *cs = css_cs(css); + get_online_cpus(); mutex_lock(&cpuset_mutex); if (is_sched_load_balance(cs)) @@ -2183,6 +2192,7 @@ static void cpuset_css_offline(struct cgroup_subsys_state *css) clear_bit(CS_ONLINE, &cs->flags); mutex_unlock(&cpuset_mutex); + put_online_cpus(); } static void cpuset_css_free(struct cgroup_subsys_state *css) -- 2.25.1

1 2

[PATCH openEuler-5.10-LTS-SP1 01/36] bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()
by Jialin Zhang 29 Mar '23

29 Mar '23

From: Liu Jian <liujian56(a)huawei.com> mainline inclusion from mainline-v6.3-rc2 commit d900f3d20cc3169ce42ec72acc850e662a4d4db2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I65HYE CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- When the buffer length of the recvmsg system call is 0, we got the flollowing soft lockup problem: watchdog: BUG: soft lockup - CPU#3 stuck for 27s! [a.out:6149] CPU: 3 PID: 6149 Comm: a.out Kdump: loaded Not tainted 6.2.0+ #30 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP: 0010:remove_wait_queue+0xb/0xc0 Code: 5e 41 5f c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 57 <41> 56 41 55 41 54 55 48 89 fd 53 48 89 f3 4c 8d 6b 18 4c 8d 73 20 RSP: 0018:ffff88811b5978b8 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff88811a7d3780 RCX: ffffffffb7a4d768 RDX: dffffc0000000000 RSI: ffff88811b597908 RDI: ffff888115408040 RBP: 1ffff110236b2f1b R08: 0000000000000000 R09: ffff88811a7d37e7 R10: ffffed10234fa6fc R11: 0000000000000001 R12: ffff88811179b800 R13: 0000000000000001 R14: ffff88811a7d38a8 R15: ffff88811a7d37e0 FS: 00007f6fb5398740(0000) GS:ffff888237180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000000 CR3: 000000010b6ba002 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tcp_msg_wait_data+0x279/0x2f0 tcp_bpf_recvmsg_parser+0x3c6/0x490 inet_recvmsg+0x280/0x290 sock_recvmsg+0xfc/0x120 ____sys_recvmsg+0x160/0x3d0 ___sys_recvmsg+0xf0/0x180 __sys_recvmsg+0xea/0x1a0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc The logic in tcp_bpf_recvmsg_parser is as follows: msg_bytes_ready: copied = sk_msg_recvmsg(sk, psock, msg, len, flags); if (!copied) { wait data; goto msg_bytes_ready; } In this case, "copied" always is 0, the infinite loop occurs. According to the Linux system call man page, 0 should be returned in this case. Therefore, in tcp_bpf_recvmsg_parser(), if the length is 0, directly return. Also modify several other functions with the same problem. Fixes: 1f5be6b3b063 ("udp: Implement udp_bpf_recvmsg() for sockmap") Fixes: 9825d866ce0d ("af_unix: Implement unix_dgram_bpf_recvmsg()") Fixes: c5d2177a72a1 ("bpf, sockmap: Fix race in ingress receive verdict with redirect to self") Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: Liu Jian <liujian56(a)huawei.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: John Fastabend <john.fastabend(a)gmail.com> Cc: Jakub Sitnicki <jakub(a)cloudflare.com> Link: https://lore.kernel.org/bpf/20230303080946.1146638-1-liujian56@huawei.com (cherry picked from commit d900f3d20cc3169ce42ec72acc850e662a4d4db2) Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: net/ipv4/udp_bpf.c net/unix/unix_bpf.c net/ipv4/tcp_bpf.c Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- net/ipv4/tcp_bpf.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index 1a8f129fb309..89bbb8ee1634 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -275,6 +275,9 @@ static int tcp_bpf_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, if (unlikely(flags & MSG_ERRQUEUE)) return inet_recv_error(sk, msg, len, addr_len); + if (!len) + return 0; + psock = sk_psock_get(sk); if (unlikely(!psock)) return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len); -- 2.25.1

1 35

[PATCH openEuler-5.10-LTS 01/36] bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()
by Jialin Zhang 29 Mar '23

29 Mar '23

From: Liu Jian <liujian56(a)huawei.com> mainline inclusion from mainline-v6.3-rc2 commit d900f3d20cc3169ce42ec72acc850e662a4d4db2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I65HYE CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- When the buffer length of the recvmsg system call is 0, we got the flollowing soft lockup problem: watchdog: BUG: soft lockup - CPU#3 stuck for 27s! [a.out:6149] CPU: 3 PID: 6149 Comm: a.out Kdump: loaded Not tainted 6.2.0+ #30 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP: 0010:remove_wait_queue+0xb/0xc0 Code: 5e 41 5f c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 57 <41> 56 41 55 41 54 55 48 89 fd 53 48 89 f3 4c 8d 6b 18 4c 8d 73 20 RSP: 0018:ffff88811b5978b8 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff88811a7d3780 RCX: ffffffffb7a4d768 RDX: dffffc0000000000 RSI: ffff88811b597908 RDI: ffff888115408040 RBP: 1ffff110236b2f1b R08: 0000000000000000 R09: ffff88811a7d37e7 R10: ffffed10234fa6fc R11: 0000000000000001 R12: ffff88811179b800 R13: 0000000000000001 R14: ffff88811a7d38a8 R15: ffff88811a7d37e0 FS: 00007f6fb5398740(0000) GS:ffff888237180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000000 CR3: 000000010b6ba002 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tcp_msg_wait_data+0x279/0x2f0 tcp_bpf_recvmsg_parser+0x3c6/0x490 inet_recvmsg+0x280/0x290 sock_recvmsg+0xfc/0x120 ____sys_recvmsg+0x160/0x3d0 ___sys_recvmsg+0xf0/0x180 __sys_recvmsg+0xea/0x1a0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc The logic in tcp_bpf_recvmsg_parser is as follows: msg_bytes_ready: copied = sk_msg_recvmsg(sk, psock, msg, len, flags); if (!copied) { wait data; goto msg_bytes_ready; } In this case, "copied" always is 0, the infinite loop occurs. According to the Linux system call man page, 0 should be returned in this case. Therefore, in tcp_bpf_recvmsg_parser(), if the length is 0, directly return. Also modify several other functions with the same problem. Fixes: 1f5be6b3b063 ("udp: Implement udp_bpf_recvmsg() for sockmap") Fixes: 9825d866ce0d ("af_unix: Implement unix_dgram_bpf_recvmsg()") Fixes: c5d2177a72a1 ("bpf, sockmap: Fix race in ingress receive verdict with redirect to self") Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: Liu Jian <liujian56(a)huawei.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: John Fastabend <john.fastabend(a)gmail.com> Cc: Jakub Sitnicki <jakub(a)cloudflare.com> Link: https://lore.kernel.org/bpf/20230303080946.1146638-1-liujian56@huawei.com (cherry picked from commit d900f3d20cc3169ce42ec72acc850e662a4d4db2) Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: net/ipv4/udp_bpf.c net/unix/unix_bpf.c net/ipv4/tcp_bpf.c Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- net/ipv4/tcp_bpf.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index eaf2308c355a..ddb1730cdf9b 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -273,6 +273,9 @@ static int tcp_bpf_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, if (unlikely(flags & MSG_ERRQUEUE)) return inet_recv_error(sk, msg, len, addr_len); + if (!len) + return 0; + psock = sk_psock_get(sk); if (unlikely(!psock)) return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len); -- 2.25.1

1 35

[PATCH openEuler-22.03-LTS-SP1 00/39] ascend features send to
by Zhang Zekun 29 Mar '23

29 Mar '23

Push some of ascend features to openEuler Bixuan Cui (1): open modules for sig Chen Jun (4): mm/sharepool: Fix a double free problem caused by init_local_group mm/sharepool: use delete_spg_node to replace some repetitive code mm/sharepool: extract group_add_task mm/sharepool: check permission of task to operate spg_node->proc_node Fang Lijun (2): enable fdm in panic HZ 12 Jian Zhang (5): drivers: add RAS support for multiple die cpu bugfix for RAS acpi map add SDMA support for 1980B using mm's pasid rather than a random value when using SDMA kernel/sdei: enable SDEI for nmi Lijun Fang (1): modify ascend910 ARCH_NR_GPIOS Wang Wensheng (11): char/sdma: Add driver framework for sdma char/sdma: Implement probe function for sdma device char/sdma: Implement sdma_memcpy for kernel-space usage char/sdma: Export the sdma features to userspace via ioctl char/sdma: Add support for ACPI char/sdma: Support multiple sdma devices char/sdma: Add deffer probe feature char/sdma: Add discrete memcpy interface for userspace char/sdma: Pin pages when copying user memory memcg/ascend: Support not account pages of cdm for memcg mm/cdm: Extend cdm-nodes to support more nodes than 64 Xiang Rui (1): Add kernel securec support for 1980. Xingang Wang (1): ascend_mpam: Add dts driver to traverse accelerators Xu Qiang (1): Fix kernel boot failed in fpga. Yuan Can (4): driver/iommu: Introduce IOMMU_SVA_FEAT_SVSP feature driver/svm: save svsp_mm in mm and release it in __mmput Add bootdot support for ascend 310B Set bootdot base to 10 Zhang Jian (2): drivers: apci parse apei table drivers: acpi register irq Zhou Guanghui (5): Modify memblock number driver/svm: support SVSP feature, interface definition driver/svm: reserve address range for svsp efi: when kaslr is enabled, restrict the random address range. mm/hugetlb: support disable clear hugepage chenjunwei (1): ascend310B_defconfig .../admin-guide/kernel-parameters.txt | 1 + arch/arm64/Kconfig | 30 + arch/arm64/configs/ascend310B_defconfig | 7040 +++++++++++++++++ arch/arm64/kernel/acpi.c | 5 + arch/arm64/kernel/sdei.c | 11 - arch/arm64/mm/init.c | 5 + arch/arm64/mm/numa.c | 39 +- certs/Makefile | 3 +- drivers/Kconfig | 3 + drivers/Makefile | 2 + drivers/acpi/Kconfig | 11 + drivers/acpi/Makefile | 1 + drivers/acpi/apei/ghes.c | 47 +- drivers/acpi/apei/hest.c | 35 + drivers/acpi/dt_apei.c | 201 + drivers/bootdot/Kconfig | 7 + drivers/bootdot/Makefile | 2 + drivers/bootdot/bootdot.c | 447 ++ drivers/char/Kconfig | 6 + drivers/char/Makefile | 1 + drivers/char/sdma.c | 1088 +++ .../firmware/efi/libstub/efi-stub-helper.c | 3 + drivers/firmware/efi/libstub/efistub.h | 1 + drivers/firmware/efi/libstub/randomalloc.c | 11 + drivers/gpio/gpiolib.c | 45 +- drivers/hisi/Kconfig | 16 + drivers/hisi/Makefile | 1 + drivers/hisi/securec/Kconfig | 1 + drivers/hisi/securec/Makefile | 1 + drivers/hisi/securec/src | 1 + drivers/iommu/Kconfig | 7 + drivers/iommu/Makefile | 1 + .../iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c | 35 + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 16 + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 8 + drivers/iommu/ascend_mpam.c | 286 + drivers/irqchip/irq-gic-v3-its.c | 13 +- fs/hugetlbfs/inode.c | 12 +- include/acpi/apei.h | 7 + include/acpi/dt_apei.h | 31 + include/asm-generic/gpio.h | 13 + include/linux/ascend_smmu.h | 38 + include/linux/bootdot.h | 40 + include/linux/hisi_sdma.h | 42 + include/linux/init.h | 1 + include/linux/iommu.h | 1 + include/linux/kernel.h | 6 + include/linux/mm_types.h | 4 + include/linux/mman.h | 46 + include/linux/securec.h | 1 + include/linux/securectype.h | 1 + include/uapi/asm-generic/mman-common.h | 1 + kernel/Kconfig.hz | 6 + kernel/fork.c | 13 + kernel/panic.c | 31 + mm/hugetlb.c | 2 + mm/memblock.c | 2 +- mm/memcontrol.c | 8 + mm/mmap.c | 32 +- mm/share_pool.c | 105 +- 60 files changed, 9806 insertions(+), 68 deletions(-) create mode 100644 arch/arm64/configs/ascend310B_defconfig create mode 100644 drivers/acpi/dt_apei.c create mode 100644 drivers/bootdot/Kconfig create mode 100644 drivers/bootdot/Makefile create mode 100644 drivers/bootdot/bootdot.c create mode 100644 drivers/char/sdma.c create mode 100644 drivers/hisi/Kconfig create mode 100644 drivers/hisi/Makefile create mode 100644 drivers/hisi/securec/Kconfig create mode 100644 drivers/hisi/securec/Makefile create mode 120000 drivers/hisi/securec/src create mode 100644 drivers/iommu/ascend_mpam.c create mode 100644 include/acpi/dt_apei.h create mode 100644 include/linux/bootdot.h create mode 100644 include/linux/hisi_sdma.h create mode 120000 include/linux/securec.h create mode 120000 include/linux/securectype.h -- 2.17.1

1 39

[PATCH openEuler-1.0-LTS 0/3] CVE-2023-1281
by Zhang Changzhong 28 Mar '23

28 Mar '23

Paul E. McKenney (1): rcu: Upgrade rcu_swap_protected() to rcu_replace_pointer() Pedro Tammela (2): net/sched: tcindex: update imperfect hash filters respecting rcu net/sched: tcindex: search key must be 16 bits include/linux/rcupdate.h | 18 ++++++++++++++++++ net/sched/cls_tcindex.c | 34 ++++++++++++++++++++++++++++++---- 2 files changed, 48 insertions(+), 4 deletions(-) -- 2.9.5

1 3

[PATCH OLK-5.10 v2 00/14] test patchwork->PR function v2
by Jialin Zhang 27 Mar '23

27 Mar '23

Send 14 patches to test patchwork->PR function Baisong Zhong (1): media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() Chen Zhongjin (1): ftrace: Fix invalid address access in lookup_rec() when index is 0 Darrick J. Wong (1): ext4: fix another off-by-one fsmap error on 1k block filesystems David Hildenbrand (2): mm: optimize do_wp_page() for exclusive pages in the swapcache mm: optimize do_wp_page() for fresh pages in local LRU pagevecs Kuniyuki Iwashima (1): seccomp: Move copy_seccomp() to no failure path. Luke D. Jones (1): HID: asus: Remove check for same LED brightness on set Nicholas Piggin (1): mm/vmalloc: huge vmalloc backing pages should be split rather than compound Pietro Borrello (2): HID: asus: use spinlock to protect concurrent accesses HID: asus: use spinlock to safely schedule workers Xin Long (2): tipc: set con sock in tipc_conn_alloc tipc: add an extra conn_get in tipc_conn_alloc Zheng Yejian (1): livepatch/core: Fix hungtask against cpu hotplug on x86 Zhihao Cheng (1): jbd2: fix data missing when reusing bh which is ready to be checkpointed drivers/hid/hid-asus.c | 38 ++++++++++++++++++----- drivers/media/usb/dvb-usb/az6027.c | 4 +++ fs/ext4/fsmap.c | 2 ++ fs/jbd2/transaction.c | 50 +++++++++++++++++------------- kernel/fork.c | 17 ++++++---- kernel/livepatch/core.c | 36 ++++++++++++++------- kernel/trace/ftrace.c | 3 +- mm/memory.c | 28 +++++++++++++---- mm/vmalloc.c | 22 ++++++++++--- net/tipc/topsrv.c | 20 ++++++------ 10 files changed, 154 insertions(+), 66 deletions(-) -- 2.25.1

1 14

[PATCH openEuler-1.0-LTS 00/35] CVE-2022-29901
by Yongqiang Liu 25 Mar '23

25 Mar '23

CVE-2022-29901 Alexandre Chartre (2): x86/bugs: Report AMD retbleed vulnerability x86/bugs: Add AMD retbleed= boot parameter Andrew Cooper (1): x86/cpu/amd: Enumerate BTC_NO Daniel Sneddon (1): x86/speculation: Add RSB VM Exit protections Ingo Molnar (1): x86/cpufeature: Fix various quality problems in the <asm/cpu_device_hd.h> header Josh Poimboeuf (8): x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n x86/speculation: Fix firmware entry SPEC_CTRL handling x86/speculation: Fix SPEC_CTRL write on SMT state change x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit x86/speculation: Remove x86_spec_ctrl_mask KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS KVM: VMX: Fix IBRS handling after vmexit x86/speculation: Fill RSB on vmexit for IBRS Kan Liang (1): x86/cpufeature: Add facility to check for min microcode revisions Mark Gross (1): x86/cpu: Add a steppings field to struct x86_cpu_id Nathan Chancellor (1): x86/speculation: Use DECLARE_PER_CPU for x86_spec_ctrl_current Pawan Gupta (4): x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS x86/bugs: Add Cannon lake to RETBleed affected CPU list x86/speculation: Disable RRSBA behavior x86/bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS parts Peter Zijlstra (11): x86/nospec: Fix i386 RSB stuffing x86/cpufeatures: Move RETPOLINE flags to word 11 x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value x86/entry: Remove skip_r11rcx x86/entry: Add kernel IBRS implementation x86/bugs: Optimize SPEC_CTRL MSR writes x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() x86/bugs: Report Intel retbleed vulnerability intel_idle: Disable IBRS during long idle x86/speculation: Change FILL_RETURN_BUFFER to work with objtool x86/common: Stamp out the stepping madness Suleiman Souhlal (2): Revert "x86/speculation: Add RSB VM Exit protections" Revert "x86/cpu: Add a steppings field to struct x86_cpu_id" Thomas Gleixner (2): x86/devicetable: Move x86 specific macro out of generic code x86/cpu: Add consistent CPU match macros .../admin-guide/kernel-parameters.txt | 13 + arch/x86/entry/calling.h | 68 +++- arch/x86/entry/entry_32.S | 2 - arch/x86/entry/entry_64.S | 34 +- arch/x86/entry/entry_64_compat.S | 11 +- arch/x86/include/asm/cpu_device_id.h | 168 +++++++- arch/x86/include/asm/cpufeatures.h | 18 +- arch/x86/include/asm/intel-family.h | 6 + arch/x86/include/asm/msr-index.h | 10 + arch/x86/include/asm/nospec-branch.h | 67 ++-- arch/x86/kernel/cpu/amd.c | 21 +- arch/x86/kernel/cpu/bugs.c | 368 ++++++++++++++---- arch/x86/kernel/cpu/common.c | 72 ++-- arch/x86/kernel/cpu/match.c | 44 ++- arch/x86/kernel/cpu/scattered.c | 1 + arch/x86/kernel/process.c | 2 +- arch/x86/kvm/svm.c | 1 + arch/x86/kvm/vmx.c | 53 ++- arch/x86/kvm/x86.c | 2 +- drivers/base/cpu.c | 8 + drivers/cpufreq/acpi-cpufreq.c | 1 + drivers/cpufreq/amd_freq_sensitivity.c | 1 + drivers/idle/intel_idle.c | 43 +- include/linux/cpu.h | 2 + include/linux/kvm_host.h | 2 +- include/linux/mod_devicetable.h | 4 +- tools/arch/x86/include/asm/cpufeatures.h | 2 +- 27 files changed, 832 insertions(+), 192 deletions(-) -- 2.25.1

1 35

[PATCH openEuler-1.0-LTS 1/2] ext4: commit super block if fs record error when journal record without error
by Yongqiang Liu 25 Mar '23

25 Mar '23

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v6.3-rc2 commit eee00237fa5ec8f704f7323b54e48cc34e2d9168 category: bugfix bugzilla: 188471,https://gitee.com/openeuler/kernel/issues/I6MR1V CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Now, 'es->s_state' maybe covered by recover journal. And journal errno maybe not recorded in journal sb as IO error. ext4_update_super() only update error information when 'sbi->s_add_error_count' large than zero. Then 'EXT4_ERROR_FS' flag maybe lost. To solve above issue just recover 'es->s_state' error flag after journal replay like error info. Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20230307061703.245965-2-yebin@huaweicloud.com Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/super.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 594fc6dd0e9f..31a4725da745 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5161,6 +5161,7 @@ static int ext4_load_journal(struct super_block *sb, err = jbd2_journal_wipe(journal, !really_read_only); if (!err) { char *save = kmalloc(EXT4_S_ERR_LEN, GFP_KERNEL); + if (save) memcpy(save, ((char *) es) + EXT4_S_ERR_START, EXT4_S_ERR_LEN); @@ -5169,6 +5170,14 @@ static int ext4_load_journal(struct super_block *sb, memcpy(((char *) es) + EXT4_S_ERR_START, save, EXT4_S_ERR_LEN); kfree(save); + es->s_state |= cpu_to_le16(EXT4_SB(sb)->s_mount_state & + EXT4_ERROR_FS); + /* Write out restored error information to the superblock */ + if (!bdev_read_only(sb->s_bdev)) { + int err2; + err2 = ext4_commit_super(sb); + err = err ? : err2; + } } if (err) { -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 01/10] scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list
by Yongqiang Liu 25 Mar '23

25 Mar '23

From: Xingui Yang <yangxingui(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6J1SI CVE: NA ---------------------------- When the IO complete and free slot in function slot_complete_v3_hw(), it is possible that sas_dev.list is being traversed elsewhere, and it may trigger a null pointer exception, such as follows: ==>cq thread ==>scsi_eh_6 ==>scsi_error_handler() ==>sas_eh_handle_sas_errors() ==>sas_scsi_find_task() ==>lldd_abort_task() ==>slot_complete_v3_hw() ==>hisi_sas_abort_task() ==>hisi_sas_slot_task_free() ==>dereg_device_v3_hw() ==>list_del_init() ==>list_for_each_entry_safe() [ 7165.434918] sas: Enter sas_scsi_recover_host busy: 32 failed: 32 [ 7165.434926] sas: trying to find task 0x00000000769b5ba5 [ 7165.434927] sas: sas_scsi_find_task: aborting task 0x00000000769b5ba5 [ 7165.434940] hisi_sas_v3_hw 0000:b4:02.0: slot complete: task(00000000769b5ba5) aborted [ 7165.434964] hisi_sas_v3_hw 0000:b4:02.0: slot complete: task(00000000c9f7aa07) ignored [ 7165.434965] hisi_sas_v3_hw 0000:b4:02.0: slot complete: task(00000000e2a1cf01) ignored [ 7165.434968] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 7165.434972] hisi_sas_v3_hw 0000:b4:02.0: slot complete: task(0000000022d52d93) ignored [ 7165.434975] hisi_sas_v3_hw 0000:b4:02.0: slot complete: task(0000000066a7516c) ignored [ 7165.434976] Mem abort info: [ 7165.434982] ESR = 0x96000004 [ 7165.434991] Exception class = DABT (current EL), IL = 32 bits [ 7165.434992] SET = 0, FnV = 0 [ 7165.434993] EA = 0, S1PTW = 0 [ 7165.434994] Data abort info: [ 7165.434994] ISV = 0, ISS = 0x00000004 [ 7165.434995] CM = 0, WnR = 0 [ 7165.434997] user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000f29543f2 [ 7165.434998] [0000000000000000] pgd=0000000000000000 [ 7165.435003] Internal error: Oops: 96000004 [#1] SMP [ 7165.439863] Process scsi_eh_6 (pid: 4109, stack limit = 0x00000000c43818d5) [ 7165.468862] pstate: 00c00009 (nzcv daif +PAN +UAO) [ 7165.473637] pc : dereg_device_v3_hw+0x68/0xa8 [hisi_sas_v3_hw] [ 7165.479443] lr : dereg_device_v3_hw+0x2c/0xa8 [hisi_sas_v3_hw] [ 7165.485247] sp : ffff00001d623bc0 [ 7165.488546] x29: ffff00001d623bc0 x28: ffffa027d03b9508 [ 7165.493835] x27: ffff80278ed50af0 x26: ffffa027dd31e0a8 [ 7165.499123] x25: ffffa027d9b27f88 x24: ffffa027d9b209f8 [ 7165.504411] x23: ffffa027c45b0d60 x22: ffff80278ec07c00 [ 7165.509700] x21: 0000000000000008 x20: ffffa027d9b209f8 [ 7165.514988] x19: ffffa027d9b27f88 x18: ffffffffffffffff [ 7165.520276] x17: 0000000000000000 x16: 0000000000000000 [ 7165.525564] x15: ffff0000091d9708 x14: ffff0000093b7dc8 [ 7165.530852] x13: ffff0000093b7a23 x12: 6e7265746e692067 [ 7165.536140] x11: 0000000000000000 x10: 0000000000000bb0 [ 7165.541429] x9 : ffff00001d6238f0 x8 : ffffa027d877af00 [ 7165.546718] x7 : ffffa027d6329600 x6 : ffff7e809f58ca00 [ 7165.552006] x5 : 0000000000001f8a x4 : 000000000000088e [ 7165.557295] x3 : ffffa027d9b27fa8 x2 : 0000000000000000 [ 7165.562583] x1 : 0000000000000000 x0 : 000000003000188e [ 7165.567872] Call trace: [ 7165.570309] dereg_device_v3_hw+0x68/0xa8 [hisi_sas_v3_hw] [ 7165.575775] hisi_sas_abort_task+0x248/0x358 [hisi_sas_main] [ 7165.581415] sas_eh_handle_sas_errors+0x258/0x8e0 [libsas] [ 7165.586876] sas_scsi_recover_host+0x134/0x458 [libsas] [ 7165.592082] scsi_error_handler+0xb4/0x488 [ 7165.596163] kthread+0x134/0x138 [ 7165.599380] ret_from_fork+0x10/0x18 [ 7165.602940] Code: d5033e9f b9000040 aa0103e2 eb03003f (f9400021) [ 7165.609004] kernel fault(0x1) notification starting on CPU 75 [ 7165.700728] ---[ end trace fc042cbbea224efc ]--- [ 7165.705326] Kernel panic - not syncing: Fatal exception So grab sas_dev lock when traversing the members of sas_dev.list in dereg_device_v3_hw() and hisi_sas_release_tasks() to avoid concurrency of adding and deleting member, which may cause an exception. And when hisi_sas_release_tasks() call hisi_sas_do_release_task() to free slot, the lock cannot be grabbed again in hisi_sas_slot_task_free(), then a bool parameter need_lock is added. Signed-off-by: Xingui Yang <yangxingui(a)huawei.com> Reviewed-by: kang fenglong <kangfenglong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/scsi/hisi_sas/hisi_sas.h | 3 ++- drivers/scsi/hisi_sas/hisi_sas_main.c | 26 +++++++++++++++++--------- drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 2 +- drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 2 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 5 ++++- 5 files changed, 25 insertions(+), 13 deletions(-) diff --git a/drivers/scsi/hisi_sas/hisi_sas.h b/drivers/scsi/hisi_sas/hisi_sas.h index 533408277156..2880e4e22a73 100644 --- a/drivers/scsi/hisi_sas/hisi_sas.h +++ b/drivers/scsi/hisi_sas/hisi_sas.h @@ -601,7 +601,8 @@ extern void hisi_sas_phy_enable(struct hisi_hba *hisi_hba, int phy_no, extern void hisi_sas_phy_down(struct hisi_hba *hisi_hba, int phy_no, int rdy); extern void hisi_sas_slot_task_free(struct hisi_hba *hisi_hba, struct sas_task *task, - struct hisi_sas_slot *slot); + struct hisi_sas_slot *slot, + bool need_lock); extern void hisi_sas_init_mem(struct hisi_hba *hisi_hba); extern void hisi_sas_rst_work_handler(struct work_struct *work); extern void hisi_sas_sync_rst_work_handler(struct work_struct *work); diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c index e6ccaedcd8b9..b00bf3b0f418 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_main.c +++ b/drivers/scsi/hisi_sas/hisi_sas_main.c @@ -229,7 +229,7 @@ static void hisi_sas_slot_index_init(struct hisi_hba *hisi_hba) } void hisi_sas_slot_task_free(struct hisi_hba *hisi_hba, struct sas_task *task, - struct hisi_sas_slot *slot) + struct hisi_sas_slot *slot, bool need_lock) { unsigned long flags; int device_id = slot->device_id; @@ -260,9 +260,13 @@ void hisi_sas_slot_task_free(struct hisi_hba *hisi_hba, struct sas_task *task, } } - spin_lock_irqsave(&sas_dev->lock, flags); - list_del_init(&slot->entry); - spin_unlock_irqrestore(&sas_dev->lock, flags); + if (need_lock) { + spin_lock_irqsave(&sas_dev->lock, flags); + list_del_init(&slot->entry); + spin_unlock_irqrestore(&sas_dev->lock, flags); + } else { + list_del_init(&slot->entry); + } memset(slot, 0, offsetof(struct hisi_sas_slot, buf)); @@ -989,7 +993,7 @@ static void hisi_sas_port_notify_formed(struct asd_sas_phy *sas_phy) } static void hisi_sas_do_release_task(struct hisi_hba *hisi_hba, struct sas_task *task, - struct hisi_sas_slot *slot) + struct hisi_sas_slot *slot, bool need_lock) { if (task) { unsigned long flags; @@ -1011,7 +1015,7 @@ static void hisi_sas_do_release_task(struct hisi_hba *hisi_hba, struct sas_task task->task_done(task); } - hisi_sas_slot_task_free(hisi_hba, task, slot); + hisi_sas_slot_task_free(hisi_hba, task, slot, need_lock); } static void hisi_sas_release_task(struct hisi_hba *hisi_hba, @@ -1019,9 +1023,13 @@ static void hisi_sas_release_task(struct hisi_hba *hisi_hba, { struct hisi_sas_slot *slot, *slot2; struct hisi_sas_device *sas_dev = device->lldd_dev; + unsigned long flags; + spin_lock_irqsave(&sas_dev->lock, flags); list_for_each_entry_safe(slot, slot2, &sas_dev->list, entry) - hisi_sas_do_release_task(hisi_hba, slot->task, slot); + hisi_sas_do_release_task(hisi_hba, slot->task, slot, false); + + spin_unlock_irqrestore(&sas_dev->lock, flags); } void hisi_sas_release_tasks(struct hisi_hba *hisi_hba) @@ -1701,7 +1709,7 @@ static int hisi_sas_abort_task(struct sas_task *task) */ if (rc == TMF_RESP_FUNC_COMPLETE && rc2 != TMF_RESP_FUNC_SUCC) { if (task->lldd_task) - hisi_sas_do_release_task(hisi_hba, task, slot); + hisi_sas_do_release_task(hisi_hba, task, slot, true); } } else if (task->task_proto & SAS_PROTOCOL_SATA || task->task_proto & SAS_PROTOCOL_STP) { @@ -1722,7 +1730,7 @@ static int hisi_sas_abort_task(struct sas_task *task) */ if ((sas_dev->dev_status == HISI_SAS_DEV_NCQ_ERR) && qc && qc->scsicmd) { - hisi_sas_do_release_task(hisi_hba, task, slot); + hisi_sas_do_release_task(hisi_hba, task, slot, true); rc = TMF_RESP_FUNC_COMPLETE; } else { rc = hisi_sas_softreset_ata_disk(device); diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c index 452665c641a6..6485e2b6456c 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c @@ -1320,7 +1320,7 @@ static int slot_complete_v1_hw(struct hisi_hba *hisi_hba, } out: - hisi_sas_slot_task_free(hisi_hba, task, slot); + hisi_sas_slot_task_free(hisi_hba, task, slot, true); sts = ts->stat; if (task->task_done) diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c index 46d274582684..2df70c4873f5 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c @@ -2480,7 +2480,7 @@ slot_complete_v2_hw(struct hisi_hba *hisi_hba, struct hisi_sas_slot *slot) } task->task_state_flags |= SAS_TASK_STATE_DONE; spin_unlock_irqrestore(&task->task_state_lock, flags); - hisi_sas_slot_task_free(hisi_hba, task, slot); + hisi_sas_slot_task_free(hisi_hba, task, slot, true); if (!is_internal && (task->task_proto != SAS_PROTOCOL_SMP)) { spin_lock_irqsave(&device->done_lock, flags); diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c index 77f451040c4c..de88dead4b72 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c @@ -914,9 +914,11 @@ static void dereg_device_v3_hw(struct hisi_hba *hisi_hba, struct hisi_sas_slot *slot, *slot2; struct hisi_sas_device *sas_dev = device->lldd_dev; u32 cfg_abt_set_query_iptt; + unsigned long flags; cfg_abt_set_query_iptt = hisi_sas_read32(hisi_hba, CFG_ABT_SET_QUERY_IPTT); + spin_lock_irqsave(&sas_dev->lock, flags); list_for_each_entry_safe(slot, slot2, &sas_dev->list, entry) { cfg_abt_set_query_iptt &= ~CFG_SET_ABORTED_IPTT_MSK; cfg_abt_set_query_iptt |= (1 << CFG_SET_ABORTED_EN_OFF) | @@ -924,6 +926,7 @@ static void dereg_device_v3_hw(struct hisi_hba *hisi_hba, hisi_sas_write32(hisi_hba, CFG_ABT_SET_QUERY_IPTT, cfg_abt_set_query_iptt); } + spin_unlock_irqrestore(&sas_dev->lock, flags); cfg_abt_set_query_iptt &= ~(1 << CFG_SET_ABORTED_EN_OFF); hisi_sas_write32(hisi_hba, CFG_ABT_SET_QUERY_IPTT, cfg_abt_set_query_iptt); @@ -2558,7 +2561,7 @@ slot_complete_v3_hw(struct hisi_hba *hisi_hba, struct hisi_sas_slot *slot) } task->task_state_flags |= SAS_TASK_STATE_DONE; spin_unlock_irqrestore(&task->task_state_lock, flags); - hisi_sas_slot_task_free(hisi_hba, task, slot); + hisi_sas_slot_task_free(hisi_hba, task, slot, true); if (!is_internal && (task->task_proto != SAS_PROTOCOL_SMP)) { spin_lock_irqsave(&device->done_lock, flags); -- 2.25.1

1 9

[PATCH openEuler-1.0-LTS 1/6] net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
by Yongqiang Liu 25 Mar '23

25 Mar '23

From: Hangyu Hua <hbh25y(a)gmail.com> mainline inclusion from mainline-v6.3-rc2 commit 49c47cc21b5b7a3d8deb18fc57b0aa2ab1286962 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6NIUR CVE: CVE-2023-28466 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- ctx->crypto_send.info is not protected by lock_sock in do_tls_getsockopt_conf(). A race condition between do_tls_getsockopt_conf() and error paths of do_tls_setsockopt_conf() may lead to a use-after-free or null-deref. More discussion: https://lore.kernel.org/all/Y/ht6gQL+u6fj3dG@hog/ Fixes: 3c4d7559159b ("tls: kernel TLS support") Signed-off-by: Hangyu Hua <hbh25y(a)gmail.com> Link: https://lore.kernel.org/r/20230228023344.9623-1-hbh25y@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: net/tls/tls_main.c Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/tls/tls_main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c index 3cf4916c541b..19646ef9f6f6 100644 --- a/net/tls/tls_main.c +++ b/net/tls/tls_main.c @@ -364,13 +364,11 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval, rc = -EINVAL; goto out; } - lock_sock(sk); memcpy(crypto_info_aes_gcm_128->iv, ctx->tx.iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE, TLS_CIPHER_AES_GCM_128_IV_SIZE); memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->tx.rec_seq, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE); - release_sock(sk); if (copy_to_user(optval, crypto_info_aes_gcm_128, sizeof(*crypto_info_aes_gcm_128))) @@ -390,6 +388,8 @@ static int do_tls_getsockopt(struct sock *sk, int optname, { int rc = 0; + lock_sock(sk); + switch (optname) { case TLS_TX: rc = do_tls_getsockopt_tx(sk, optval, optlen); @@ -398,6 +398,9 @@ static int do_tls_getsockopt(struct sock *sk, int optname, rc = -ENOPROTOOPT; break; } + + release_sock(sk); + return rc; } -- 2.25.1

1 5

[PATCH openEuler-1.0-LTS] wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
by Yongqiang Liu 23 Mar '23

23 Mar '23

From: Jisoo Jang <jisoo.jang(a)yonsei.ac.kr> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6NCVX CVE: CVE-2023-1380 Reference: https://patchwork.kernel.org/project/linux-wireless/patch/20230309104457.22… -------------------------------- Fix a slab-out-of-bounds read that occurs in kmemdup() called from brcmf_get_assoc_ies(). The bug could occur when assoc_info->req_len, data from a URB provided by a USB device, is bigger than the size of buffer which is defined as WL_EXTRA_BUF_MAX. Add the size check for req_len/resp_len of assoc_info. Found by a modified version of syzkaller. [ 46.592467][ T7] ================================================================== [ 46.594687][ T7] BUG: KASAN: slab-out-of-bounds in kmemdup+0x3e/0x50 [ 46.596572][ T7] Read of size 3014656 at addr ffff888019442000 by task kworker/0:1/7 [ 46.598575][ T7] [ 46.599157][ T7] CPU: 0 PID: 7 Comm: kworker/0:1 Tainted: G O 5.14.0+ #145 [ 46.601333][ T7] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 46.604360][ T7] Workqueue: events brcmf_fweh_event_worker [ 46.605943][ T7] Call Trace: [ 46.606584][ T7] dump_stack_lvl+0x8e/0xd1 [ 46.607446][ T7] print_address_description.constprop.0.cold+0x93/0x334 [ 46.608610][ T7] ? kmemdup+0x3e/0x50 [ 46.609341][ T7] kasan_report.cold+0x79/0xd5 [ 46.610151][ T7] ? kmemdup+0x3e/0x50 [ 46.610796][ T7] kasan_check_range+0x14e/0x1b0 [ 46.611691][ T7] memcpy+0x20/0x60 [ 46.612323][ T7] kmemdup+0x3e/0x50 [ 46.612987][ T7] brcmf_get_assoc_ies+0x967/0xf60 [ 46.613904][ T7] ? brcmf_notify_vif_event+0x3d0/0x3d0 [ 46.614831][ T7] ? lock_chain_count+0x20/0x20 [ 46.615683][ T7] ? mark_lock.part.0+0xfc/0x2770 [ 46.616552][ T7] ? lock_chain_count+0x20/0x20 [ 46.617409][ T7] ? mark_lock.part.0+0xfc/0x2770 [ 46.618244][ T7] ? lock_chain_count+0x20/0x20 [ 46.619024][ T7] brcmf_bss_connect_done.constprop.0+0x241/0x2e0 [ 46.620019][ T7] ? brcmf_parse_configure_security.isra.0+0x2a0/0x2a0 [ 46.620818][ T7] ? __lock_acquire+0x181f/0x5790 [ 46.621462][ T7] brcmf_notify_connect_status+0x448/0x1950 [ 46.622134][ T7] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 46.622736][ T7] ? brcmf_cfg80211_join_ibss+0x7b0/0x7b0 [ 46.623390][ T7] ? find_held_lock+0x2d/0x110 [ 46.623962][ T7] ? brcmf_fweh_event_worker+0x19f/0xc60 [ 46.624603][ T7] ? mark_held_locks+0x9f/0xe0 [ 46.625145][ T7] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 46.625871][ T7] ? brcmf_cfg80211_join_ibss+0x7b0/0x7b0 [ 46.626545][ T7] brcmf_fweh_call_event_handler.isra.0+0x90/0x100 [ 46.627338][ T7] brcmf_fweh_event_worker+0x557/0xc60 [ 46.627962][ T7] ? brcmf_fweh_call_event_handler.isra.0+0x100/0x100 [ 46.628736][ T7] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 46.629396][ T7] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 46.629970][ T7] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 46.630649][ T7] process_one_work+0x92b/0x1460 [ 46.631205][ T7] ? pwq_dec_nr_in_flight+0x330/0x330 [ 46.631821][ T7] ? rwlock_bug.part.0+0x90/0x90 [ 46.632347][ T7] worker_thread+0x95/0xe00 [ 46.632832][ T7] ? __kthread_parkme+0x115/0x1e0 [ 46.633393][ T7] ? process_one_work+0x1460/0x1460 [ 46.633957][ T7] kthread+0x3a1/0x480 [ 46.634369][ T7] ? set_kthread_struct+0x120/0x120 [ 46.634933][ T7] ret_from_fork+0x1f/0x30 [ 46.635431][ T7] [ 46.635687][ T7] Allocated by task 7: [ 46.636151][ T7] kasan_save_stack+0x1b/0x40 [ 46.636628][ T7] __kasan_kmalloc+0x7c/0x90 [ 46.637108][ T7] kmem_cache_alloc_trace+0x19e/0x330 [ 46.637696][ T7] brcmf_cfg80211_attach+0x4a0/0x4040 [ 46.638275][ T7] brcmf_attach+0x389/0xd40 [ 46.638739][ T7] brcmf_usb_probe+0x12de/0x1690 [ 46.639279][ T7] usb_probe_interface+0x2aa/0x760 [ 46.639820][ T7] really_probe+0x205/0xb70 [ 46.640342][ T7] __driver_probe_device+0x311/0x4b0 [ 46.640876][ T7] driver_probe_device+0x4e/0x150 [ 46.641445][ T7] __device_attach_driver+0x1cc/0x2a0 [ 46.642000][ T7] bus_for_each_drv+0x156/0x1d0 [ 46.642543][ T7] __device_attach+0x23f/0x3a0 [ 46.643065][ T7] bus_probe_device+0x1da/0x290 [ 46.643644][ T7] device_add+0xb7b/0x1eb0 [ 46.644130][ T7] usb_set_configuration+0xf59/0x16f0 [ 46.644720][ T7] usb_generic_driver_probe+0x82/0xa0 [ 46.645295][ T7] usb_probe_device+0xbb/0x250 [ 46.645786][ T7] really_probe+0x205/0xb70 [ 46.646258][ T7] __driver_probe_device+0x311/0x4b0 [ 46.646804][ T7] driver_probe_device+0x4e/0x150 [ 46.647387][ T7] __device_attach_driver+0x1cc/0x2a0 [ 46.647926][ T7] bus_for_each_drv+0x156/0x1d0 [ 46.648454][ T7] __device_attach+0x23f/0x3a0 [ 46.648939][ T7] bus_probe_device+0x1da/0x290 [ 46.649478][ T7] device_add+0xb7b/0x1eb0 [ 46.649936][ T7] usb_new_device.cold+0x49c/0x1029 [ 46.650526][ T7] hub_event+0x1c98/0x3950 [ 46.650975][ T7] process_one_work+0x92b/0x1460 [ 46.651535][ T7] worker_thread+0x95/0xe00 [ 46.651991][ T7] kthread+0x3a1/0x480 [ 46.652413][ T7] ret_from_fork+0x1f/0x30 [ 46.652885][ T7] [ 46.653131][ T7] The buggy address belongs to the object at ffff888019442000 [ 46.653131][ T7] which belongs to the cache kmalloc-2k of size 2048 [ 46.654669][ T7] The buggy address is located 0 bytes inside of [ 46.654669][ T7] 2048-byte region [ffff888019442000, ffff888019442800) [ 46.656137][ T7] The buggy address belongs to the page: [ 46.656720][ T7] page:ffffea0000651000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x19440 [ 46.657792][ T7] head:ffffea0000651000 order:3 compound_mapcount:0 compound_pincount:0 [ 46.658673][ T7] flags: 0x100000000010200(slab|head|node=0|zone=1) [ 46.659422][ T7] raw: 0100000000010200 0000000000000000 dead000000000122 ffff888100042000 [ 46.660363][ T7] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 [ 46.661236][ T7] page dumped because: kasan: bad access detected [ 46.661956][ T7] page_owner tracks the page as allocated [ 46.662588][ T7] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 7, ts 31136961085, free_ts 0 [ 46.664271][ T7] prep_new_page+0x1aa/0x240 [ 46.664763][ T7] get_page_from_freelist+0x159a/0x27c0 [ 46.665340][ T7] __alloc_pages+0x2da/0x6a0 [ 46.665847][ T7] alloc_pages+0xec/0x1e0 [ 46.666308][ T7] allocate_slab+0x380/0x4e0 [ 46.666770][ T7] ___slab_alloc+0x5bc/0x940 [ 46.667264][ T7] __slab_alloc+0x6d/0x80 [ 46.667712][ T7] kmem_cache_alloc_trace+0x30a/0x330 [ 46.668299][ T7] brcmf_usbdev_qinit.constprop.0+0x50/0x470 [ 46.668885][ T7] brcmf_usb_probe+0xc97/0x1690 [ 46.669438][ T7] usb_probe_interface+0x2aa/0x760 [ 46.669988][ T7] really_probe+0x205/0xb70 [ 46.670487][ T7] __driver_probe_device+0x311/0x4b0 [ 46.671031][ T7] driver_probe_device+0x4e/0x150 [ 46.671604][ T7] __device_attach_driver+0x1cc/0x2a0 [ 46.672192][ T7] bus_for_each_drv+0x156/0x1d0 [ 46.672739][ T7] page_owner free stack trace missing [ 46.673335][ T7] [ 46.673620][ T7] Memory state around the buggy address: [ 46.674213][ T7] ffff888019442700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 46.675083][ T7] ffff888019442780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 46.675994][ T7] >ffff888019442800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.676875][ T7] ^ [ 46.677323][ T7] ffff888019442880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.678190][ T7] ffff888019442900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.679052][ T7] ================================================================== [ 46.679945][ T7] Disabling lock debugging due to kernel taint [ 46.680725][ T7] Kernel panic - not syncing: Reviewed-by: Arend van Spriel <arend.vanspriel(a)broadcom.com> Signed-off-by: Jisoo Jang <jisoo.jang(a)yonsei.ac.kr> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://lore.kernel.org/r/20230309104457.22628-1-jisoo.jang@yonsei.ac.kr Signed-off-by: Baisong Zhong <zhongbaisong(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c index bbdc6000afb9..4e1bd049dd06 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -5356,6 +5356,11 @@ static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg, (struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf; req_len = le32_to_cpu(assoc_info->req_len); resp_len = le32_to_cpu(assoc_info->resp_len); + if (req_len > WL_EXTRA_BUF_MAX || resp_len > WL_EXTRA_BUF_MAX) { + brcmf_err("invalid lengths in assoc info: req %u resp %u\n", + req_len, resp_len); + return -EINVAL; + } if (req_len) { err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies", cfg->extra_buf, -- 2.25.1

1 0

[RFC PATCH openEuler-1.0-LTS v2] sched: memqos: add memqos for dynamic affinity
by Wang ShaoBo 23 Mar '23

23 Mar '23

Add debug memband interface to dynamic affinity, this would be useful for those threads sensitive to memory bandwidth. Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> v2: Fix update thread's mpamid failed. --- arch/arm64/include/asm/mpam.h | 2 + arch/arm64/include/asm/mpam_sched.h | 2 + arch/arm64/kernel/mpam/mpam_device.c | 58 ++- arch/arm64/kernel/mpam/mpam_resctrl.c | 37 ++ arch/arm64/kernel/process.c | 2 +- include/linux/memqos.h | 142 +++++++ include/linux/sched.h | 15 +- include/linux/sysctl.h | 2 + kernel/cgroup/cpuset.c | 1 + kernel/exit.c | 3 + kernel/fork.c | 4 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 52 ++- kernel/sched/fair.c | 14 +- kernel/sched/memqos/Makefile | 6 + kernel/sched/memqos/memqos.c | 297 +++++++++++++++ kernel/sched/memqos/phase_feature_sysctl.c | 183 +++++++++ kernel/sched/memqos/phase_memband.c | 179 +++++++++ kernel/sched/memqos/phase_perf.c | 412 +++++++++++++++++++++ kernel/sched/memqos/phase_sim_knn.c | 92 +++++ kernel/sysctl.c | 7 + mm/mempolicy.c | 10 +- 22 files changed, 1500 insertions(+), 21 deletions(-) create mode 100644 include/linux/memqos.h create mode 100644 kernel/sched/memqos/Makefile create mode 100644 kernel/sched/memqos/memqos.c create mode 100644 kernel/sched/memqos/phase_feature_sysctl.c create mode 100644 kernel/sched/memqos/phase_memband.c create mode 100644 kernel/sched/memqos/phase_perf.c create mode 100644 kernel/sched/memqos/phase_sim_knn.c diff --git a/arch/arm64/include/asm/mpam.h b/arch/arm64/include/asm/mpam.h index 6338eab817e75..269a91d8ca907 100644 --- a/arch/arm64/include/asm/mpam.h +++ b/arch/arm64/include/asm/mpam.h @@ -4,6 +4,8 @@ #ifdef CONFIG_MPAM extern int mpam_rmid_to_partid_pmg(int rmid, int *partid, int *pmg); + +void mpam_component_config_mbwu_mon(int partid, int pmg, int monitor, int *result, int nr); #endif #endif /* _ASM_ARM64_MPAM_H */ diff --git a/arch/arm64/include/asm/mpam_sched.h b/arch/arm64/include/asm/mpam_sched.h index 08ed349b6efa1..32d08cf654b31 100644 --- a/arch/arm64/include/asm/mpam_sched.h +++ b/arch/arm64/include/asm/mpam_sched.h @@ -40,6 +40,8 @@ static inline void mpam_sched_in(void) __mpam_sched_in(); } +void __mpam_sched_in_v2(struct task_struct *tsk); + #else static inline void mpam_sched_in(void) {} diff --git a/arch/arm64/kernel/mpam/mpam_device.c b/arch/arm64/kernel/mpam/mpam_device.c index 6455c69f132fd..48de3982a0b9a 100644 --- a/arch/arm64/kernel/mpam/mpam_device.c +++ b/arch/arm64/kernel/mpam/mpam_device.c @@ -84,14 +84,14 @@ void mpam_class_list_lock_held(void) static inline u32 mpam_read_reg(struct mpam_device *dev, u16 reg) { WARN_ON_ONCE(reg > SZ_MPAM_DEVICE); - assert_spin_locked(&dev->lock); + //assert_spin_locked(&dev->lock); /* * If we touch a device that isn't accessible from this CPU we may get * an external-abort. */ - WARN_ON_ONCE(preemptible()); - WARN_ON_ONCE(!cpumask_test_cpu(smp_processor_id(), &dev->fw_affinity)); + //WARN_ON_ONCE(preemptible()); + //WARN_ON_ONCE(!cpumask_test_cpu(smp_processor_id(), &dev->fw_affinity)); return readl_relaxed(dev->mapped_hwpage + reg); } @@ -99,14 +99,14 @@ static inline u32 mpam_read_reg(struct mpam_device *dev, u16 reg) static inline void mpam_write_reg(struct mpam_device *dev, u16 reg, u32 val) { WARN_ON_ONCE(reg > SZ_MPAM_DEVICE); - assert_spin_locked(&dev->lock); + //assert_spin_locked(&dev->lock); /* * If we touch a device that isn't accessible from this CPU we may get * an external-abort. If we're lucky, we corrupt another mpam:component. */ - WARN_ON_ONCE(preemptible()); - WARN_ON_ONCE(!cpumask_test_cpu(smp_processor_id(), &dev->fw_affinity)); + //WARN_ON_ONCE(preemptible()); + //WARN_ON_ONCE(!cpumask_test_cpu(smp_processor_id(), &dev->fw_affinity)); writel_relaxed(val, dev->mapped_hwpage + reg); } @@ -1208,6 +1208,7 @@ static u32 mpam_device_read_mbwu_mon(struct mpam_device *dev, { u16 mon; u32 clt, flt, cur_clt, cur_flt; + u32 total = 0; mon = args->mon; @@ -1249,7 +1250,12 @@ static u32 mpam_device_read_mbwu_mon(struct mpam_device *dev, wmb(); } - return mpam_read_reg(dev, MSMON_MBWU); + total += mpam_read_reg(dev, MSMON_MBWU); + total += mpam_read_reg(dev, MSMON_MBWU); + total += mpam_read_reg(dev, MSMON_MBWU); + total += mpam_read_reg(dev, MSMON_MBWU); + total += mpam_read_reg(dev, MSMON_MBWU); + return total / 5; } static int mpam_device_frob_mon(struct mpam_device *dev, @@ -1470,6 +1476,44 @@ static void mpam_component_device_sync(void *__ctx) cpumask_set_cpu(smp_processor_id(), &ctx->updated_on); } +static DEFINE_SPINLOCK(mpam_tmp_lock); + +void mpam_component_config_mbwu_mon(int partid, int pmg, int monitor, int *result, int nr) +{ + struct mpam_class *class; + struct mpam_component *comp; + struct mpam_device *dev; + struct sync_args args; + int i = 0; + + args.pmg = pmg; + args.mon = monitor; + args.closid.reqpartid = partid; + args.match_pmg = 1; + + spin_lock(&mpam_tmp_lock); + list_for_each_entry(class, &mpam_classes, classes_list) { + if (class->type != MPAM_CLASS_MEMORY) + continue; + + list_for_each_entry(comp, &class->components, class_list) { + if (i >= nr) { + pr_err_once("error, i > result nr"); + break; + } + result[i] = 0; + list_for_each_entry(dev, &comp->devices, comp_list) { + result[i] += mpam_device_read_mbwu_mon(dev, &args); + } + i++; + } + break; + } + spin_unlock(&mpam_tmp_lock); + +} +EXPORT_SYMBOL(mpam_component_config_mbwu_mon); + /** * in some cases/platforms the MSC register access is only possible with * the associated CPUs. And need to check if those CPUS are online before diff --git a/arch/arm64/kernel/mpam/mpam_resctrl.c b/arch/arm64/kernel/mpam/mpam_resctrl.c index 60d3d8706a38b..26258f7508ac4 100644 --- a/arch/arm64/kernel/mpam/mpam_resctrl.c +++ b/arch/arm64/kernel/mpam/mpam_resctrl.c @@ -2226,6 +2226,43 @@ int mpam_resctrl_init(void) return resctrl_group_init(); } + +void __mpam_sched_in_v2(struct task_struct *tsk) +{ + struct intel_pqr_state *state = this_cpu_ptr(&pqr_state); + u64 rmid = state->default_rmid; + u64 closid = state->default_closid; + + /* + * If this task has a closid/rmid assigned, use it. + * Else use the closid/rmid assigned to this cpu. + */ + if (tsk->closid) + closid = tsk->closid; + + if (tsk->rmid) + rmid = tsk->rmid; + + if (closid != state->cur_closid || rmid != state->cur_rmid) { + u64 reg; + + /* set in EL0 */ + reg = mpam_read_sysreg_s(SYS_MPAM0_EL1, "SYS_MPAM0_EL1"); + reg = PARTID_SET(reg, closid); + reg = PMG_SET(reg, rmid); + mpam_write_sysreg_s(reg, SYS_MPAM0_EL1, "SYS_MPAM0_EL1"); + + /* set in EL1 */ + reg = mpam_read_sysreg_s(SYS_MPAM1_EL1, "SYS_MPAM1_EL1"); + reg = PARTID_SET(reg, closid); + reg = PMG_SET(reg, rmid); + mpam_write_sysreg_s(reg, SYS_MPAM1_EL1, "SYS_MPAM1_EL1"); + + state->cur_rmid = rmid; + state->cur_closid = closid; + } +} + /* * __intel_rdt_sched_in() - Writes the task's CLOSid/RMID to IA32_PQR_MSR * diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c index e5be78915632c..7896bb74ecc49 100644 --- a/arch/arm64/kernel/process.c +++ b/arch/arm64/kernel/process.c @@ -531,7 +531,7 @@ __notrace_funcgraph struct task_struct *__switch_to(struct task_struct *prev, /* the actual thread switch */ last = cpu_switch_to(prev, next); - mpam_sched_in(); + //mpam_sched_in(); return last; } diff --git a/include/linux/memqos.h b/include/linux/memqos.h new file mode 100644 index 0000000000000..814e9935590d3 --- /dev/null +++ b/include/linux/memqos.h @@ -0,0 +1,142 @@ +#ifndef _MEMQOS_H +#define _MEMQOS_H + +#include <linux/vmstat.h> +#include <linux/rbtree.h> +//#include <linux/sched.h> + +struct task_struct; + +struct memqos_domain { + int dom_id; + int total_memband_div_10; + int total_out_memband_div_10; + + //record 10 timers + int memband_ringpos; + int memband_div_10_history[4][10]; +}; + +struct memqos_mpam_profile { + int partid; + int pmg; + int monitor; + + struct task_struct *tsk; + int used; +}; + +struct memqos_wait_profile { + struct memqos_mpam_profile *profile; + struct list_head wait_list; +}; + +struct memqos_class { + struct list_head turbo_list; + struct list_head tasks_list; +}; + +#include <linux/topology.h> +//embed in task_struct + +struct task_memqos { + int ipc_ringpos; + int ipcx10; + int ipcx10_total[4]; + int ipcx10_history[10]; + + int memband_div_10; + int memband_ringpos; + int memband_div_10_total[4]; + int memband_div_10_history[4][10]; + + u32 sample_times; + int account_ready; + int numa_score[4]; + int turbo; + + struct memqos_wait_profile mpam_profile; + + struct list_head turbo_list; + struct list_head task_list; + + struct cpumask *advise_mem_node_mask; + int preferred_nid; + + int class_id; + + int corrupt; +}; + +#define PHASE_PEVENT_NUM 10 + +struct phase_event_pcount { + u64 data[PHASE_PEVENT_NUM]; +}; + +struct phase_event_count { + struct phase_event_pcount pcount; +}; + +void phase_update_mpam_label(struct task_struct *tsk); + +void phase_release_mpam_label(struct task_struct *tsk); + +static inline void memqos_update_mpam_label(struct task_struct *tsk) +{ + phase_update_mpam_label(tsk); +} + +static inline void memqos_release_mpam_label(struct task_struct *tsk) +{ + phase_release_mpam_label(tsk); +} + +void phase_destroy_waitqueue(struct task_struct *tsk); + +void phase_get_memband(struct memqos_mpam_profile *pm, int *result, int nr); + +DECLARE_STATIC_KEY_FALSE(sched_phase); +DECLARE_STATIC_KEY_FALSE(sched_phase_printk); + +int phase_perf_create(void); + +void phase_perf_release(void); + +void memqos_account_task(struct task_struct *p, int cpu); + +void memqos_drop_class(struct task_struct *p); + +void phase_account_task(struct task_struct *p, int cpu); + +static inline void memqos_task_collect_data(struct task_struct *p, int cpu) +{ + phase_account_task(p, cpu); +} + +static inline void memqos_task_account(struct task_struct *p, int cpu) +{ + memqos_account_task(p, cpu); +} + +static inline void memqos_task_exit(struct task_struct *p) +{ + + memqos_drop_class(p); + phase_destroy_waitqueue(p); +} + +void memqos_select_nicest_cpus(struct task_struct *p); + +void memqos_exclude_low_level_task_single(struct task_struct *p); + +int knn_get_tag(int ipcx10, int memband_div_10); + +void memqos_init_class(struct task_struct *p); + +void phase_trace_printk(struct task_struct *p); +static inline void memqos_trace_printk(struct task_struct *p) +{ + phase_trace_printk(p); +} +#endif diff --git a/include/linux/sched.h b/include/linux/sched.h index 928186f161000..c5b74cd0c5830 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -29,6 +29,7 @@ #include <linux/task_io_accounting.h> #include <linux/rseq.h> #include <linux/thread_bits.h> +#include <linux/memqos.h> /* task_struct member predeclarations (sorted alphabetically): */ struct audit_context; @@ -1268,7 +1269,7 @@ struct task_struct { #if !defined(__GENKSYMS__) #if defined(CONFIG_QOS_SCHED_DYNAMIC_AFFINITY) cpumask_t *prefer_cpus; - const cpumask_t *select_cpus; + cpumask_t *select_cpus; #else KABI_RESERVE(6) KABI_RESERVE(7) @@ -1279,6 +1280,10 @@ struct task_struct { #endif KABI_RESERVE(8) +#ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY + struct task_memqos sched_memqos; +#endif + /* CPU-specific state of this task: */ struct thread_struct thread; @@ -1998,6 +2003,14 @@ int set_prefer_cpus_ptr(struct task_struct *p, const struct cpumask *new_mask); int sched_prefer_cpus_fork(struct task_struct *p, struct task_struct *orig); void sched_prefer_cpus_free(struct task_struct *p); +static inline bool prefer_cpus_valid(struct task_struct *p) +{ + return p->prefer_cpus && + !cpumask_empty(p->prefer_cpus) && + !cpumask_equal(p->prefer_cpus, &p->cpus_allowed) && + cpumask_subset(p->prefer_cpus, &p->cpus_allowed); +} +void sched_memqos_task_collect_data_range(int start_cpu, int end_cpu); #endif #endif diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h index b769ecfcc3bd4..73bce39107cb3 100644 --- a/include/linux/sysctl.h +++ b/include/linux/sysctl.h @@ -230,6 +230,8 @@ static inline void setup_sysctl_set(struct ctl_table_set *p, #endif /* CONFIG_SYSCTL */ +extern struct ctl_table phase_table[]; + int sysctl_max_threads(struct ctl_table *table, int write, void __user *buffer, size_t *lenp, loff_t *ppos); diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 55bfbc4cdb16c..d94a9065a5605 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -106,6 +106,7 @@ struct cpuset { nodemask_t mems_allowed; #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY cpumask_var_t prefer_cpus; + int mem_turbo; #endif /* effective CPUs and Memory Nodes allow to tasks */ diff --git a/kernel/exit.c b/kernel/exit.c index 2a32d32bdc03d..b731c19618176 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -699,6 +699,8 @@ static void check_stack_usage(void) static inline void check_stack_usage(void) {} #endif +#include <linux/memqos.h> + void __noreturn do_exit(long code) { struct task_struct *tsk = current; @@ -806,6 +808,7 @@ void __noreturn do_exit(long code) * because of cgroup mode, must be called before cgroup_exit() */ perf_event_exit_task(tsk); + memqos_task_exit(tsk); sched_autogroup_exit_task(tsk); cgroup_exit(tsk); diff --git a/kernel/fork.c b/kernel/fork.c index b5453a26655e2..0a762b92dc814 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -841,6 +841,8 @@ void set_task_stack_end_magic(struct task_struct *tsk) *stackend = STACK_END_MAGIC; /* for overflow detection */ } + +#include <linux/memqos.h> static struct task_struct *dup_task_struct(struct task_struct *orig, int node) { struct task_struct *tsk; @@ -923,6 +925,8 @@ static struct task_struct *dup_task_struct(struct task_struct *orig, int node) kcov_task_init(tsk); + memqos_init_class(tsk); + #ifdef CONFIG_FAULT_INJECTION tsk->fail_nth = 0; #endif diff --git a/kernel/sched/Makefile b/kernel/sched/Makefile index 7fe183404c383..471380d6686e3 100644 --- a/kernel/sched/Makefile +++ b/kernel/sched/Makefile @@ -29,3 +29,4 @@ obj-$(CONFIG_CPU_FREQ) += cpufreq.o obj-$(CONFIG_CPU_FREQ_GOV_SCHEDUTIL) += cpufreq_schedutil.o obj-$(CONFIG_MEMBARRIER) += membarrier.o obj-$(CONFIG_CPU_ISOLATION) += isolation.o +obj-$(CONFIG_QOS_SCHED_DYNAMIC_AFFINITY) += memqos/ diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 970616070da86..15c7e1e3408cb 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -2787,6 +2787,8 @@ asmlinkage __visible void schedule_tail(struct task_struct *prev) calculate_sigpending(); } +#include <linux/memqos.h> + /* * context_switch - switch to the new MM and the new thread's register state. */ @@ -2794,6 +2796,8 @@ static __always_inline struct rq * context_switch(struct rq *rq, struct task_struct *prev, struct task_struct *next, struct rq_flags *rf) { + struct rq *ret; + prepare_task_switch(rq, prev, next); /* @@ -2837,6 +2841,18 @@ context_switch(struct rq *rq, struct task_struct *prev, } } + //account and release + memqos_task_account(prev, smp_processor_id()); + + if (prefer_cpus_valid(prev)) + memqos_trace_printk(prev); + + memqos_release_mpam_label(prev); + + //label new task's mpamid + if (prefer_cpus_valid(next)) + memqos_update_mpam_label(next); + rq->clock_update_flags &= ~(RQCF_ACT_SKIP|RQCF_REQ_SKIP); prepare_lock_switch(rq, next, rf); @@ -2845,7 +2861,9 @@ context_switch(struct rq *rq, struct task_struct *prev, switch_to(prev, next, prev); barrier(); - return finish_task_switch(prev); + ret = finish_task_switch(prev); + + return ret; } /* @@ -3051,6 +3069,20 @@ unsigned long long task_sched_runtime(struct task_struct *p) return ns; } +void sched_memqos_task_collect_data_range(int start_cpu, int end_cpu) +{ + int cpu; + struct task_struct *curr; + struct rq *rq_curr; + + for (cpu = start_cpu; cpu <= end_cpu; cpu++) { + rq_curr = cpu_rq(cpu); + curr = rq_curr->curr; + if (curr && prefer_cpus_valid(curr)) + memqos_task_collect_data(curr, cpu); + } +} + /* * This function gets called by the timer code, with HZ frequency. * We call it with interrupts disabled. @@ -3058,8 +3090,12 @@ unsigned long long task_sched_runtime(struct task_struct *p) void scheduler_tick(void) { int cpu = smp_processor_id(); + //memqos clooect next cpu's memband and perf + //int cpu_memqos = (cpu + 1) % nr_cpu_ids; struct rq *rq = cpu_rq(cpu); + //struct rq *rq_next = cpu_rq(cpu_memqos); struct task_struct *curr = rq->curr; + //struct task_struct *curr_memqos = rq_next->curr; struct rq_flags rf; sched_clock_tick(); @@ -3075,6 +3111,10 @@ void scheduler_tick(void) perf_event_task_tick(); + //only monitor task enabled dynamic affinity + //if (curr_memqos && prefer_cpus_valid(curr_memqos)) + // memqos_task_collect_data(curr_memqos, cpu_memqos); + #ifdef CONFIG_SMP rq->idle_balance = idle_cpu(cpu); trigger_load_balance(rq); @@ -3524,6 +3564,16 @@ static void __sched notrace __schedule(bool preempt) /* Also unlocks the rq: */ rq = context_switch(rq, prev, next, &rf); } else { + memqos_task_account(prev, smp_processor_id()); + + if (prefer_cpus_valid(prev)) + memqos_trace_printk(prev); + + memqos_release_mpam_label(prev); + //relabel this task's mpamid + if (prefer_cpus_valid(prev)) + memqos_update_mpam_label(prev); + rq->clock_update_flags &= ~(RQCF_ACT_SKIP|RQCF_REQ_SKIP); rq_unlock_irq(rq, &rf); } diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index af55a26d11fcb..12e9675495d2c 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -6675,6 +6675,7 @@ static int wake_cap(struct task_struct *p, int cpu, int prev_cpu) } #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY +#include <linux/memqos.h> /* * Low utilization threshold for CPU * @@ -6749,14 +6750,6 @@ static inline int cpu_vutil_of(int cpu) return cputime->vutil; } -static inline bool prefer_cpus_valid(struct task_struct *p) -{ - return p->prefer_cpus && - !cpumask_empty(p->prefer_cpus) && - !cpumask_equal(p->prefer_cpus, &p->cpus_allowed) && - cpumask_subset(p->prefer_cpus, &p->cpus_allowed); -} - /* * set_task_select_cpus: select the cpu range for task * @p: the task whose available cpu range will to set @@ -6828,8 +6821,13 @@ static void set_task_select_cpus(struct task_struct *p, int *idlest_cpu, if (util_avg_sum < sysctl_sched_util_low_pct * cpumask_weight(p->prefer_cpus)) { p->select_cpus = p->prefer_cpus; + memqos_select_nicest_cpus(p); if (sd_flag & SD_BALANCE_WAKE) schedstat_inc(p->se.dyn_affi_stats->nr_wakeups_preferred_cpus); + } else { + //select trubo task + //select low class task + memqos_exclude_low_level_task_single(p); } } #endif diff --git a/kernel/sched/memqos/Makefile b/kernel/sched/memqos/Makefile new file mode 100644 index 0000000000000..ed8f42649a8a7 --- /dev/null +++ b/kernel/sched/memqos/Makefile @@ -0,0 +1,6 @@ +# SPDX-License-Identifier: GPL-2.0 +# These files are disabled because they produce non-interesting flaky coverage +# that is not a function of syscall inputs. E.g. involuntary context switches. +KCOV_INSTRUMENT := n + +obj-y := memqos.o phase_feature_sysctl.o phase_memband.o phase_perf.o phase_sim_knn.o diff --git a/kernel/sched/memqos/memqos.c b/kernel/sched/memqos/memqos.c new file mode 100644 index 0000000000000..29fc6af1f02c1 --- /dev/null +++ b/kernel/sched/memqos/memqos.c @@ -0,0 +1,297 @@ +#include <linux/memqos.h> +#include <linux/cpumask.h> +#include <linux/sched.h> + +static void memqos_set_task_classid(struct task_struct *p) +{ + int class_id; + int memband_div_10 = p->sched_memqos.memband_div_10; + int ipcx10 = p->sched_memqos.ipcx10; + + class_id = knn_get_tag((u64)ipcx10, (u64)memband_div_10); + p->sched_memqos.class_id = class_id; +} + +//static memqos_domain mq_domains[] = { +// {.dom_id = 0, .total_memband = 0, .total_out_memband = 0,}, +// {.dom_id = 1, .total_memband = 0, .total_out_memband = 0,}, +// {.dom_id = 2, .total_memband = 0, .total_out_memband = 0,}, +// {.dom_id = 3, .total_memband = 0, .total_out_memband = 0,}, +//}; + +static DEFINE_PER_CPU(struct memqos_class, memqos_classes[8]); +//static DEFINE_PER_CPU(spinlock_t, memqos_class_lock); +static DEFINE_SPINLOCK(memqos_class_lock); + +static int memqos_class_online(unsigned int cpu) +{ + int class_id = 0; + struct memqos_class *class; + + for (class_id = 0; class_id < 8; class_id++) { + class = &per_cpu(memqos_classes, cpu)[class_id]; + INIT_LIST_HEAD(&class->tasks_list); + INIT_LIST_HEAD(&class->turbo_list); + } + return 0; +} + +static int memqos_class_offline(unsigned int cpu) +{ + return 0; +} + +#include <linux/cpu.h> +#include <linux/cacheinfo.h> + +static void memqos_init(void) +{ + int cpuhp_state = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, + "memqos:online", memqos_class_online, + memqos_class_offline); + if (cpuhp_state <= 0) { + pr_err("Failed to register 'dyn' cpuhp callbacks"); + return; + } +} +late_initcall(memqos_init); + +static void memqos_insert_to_class(struct task_struct *p, int cpu) +{ + unsigned long flag; + int class_id = p->sched_memqos.class_id; + struct memqos_class *class; + struct task_memqos *memqos; + + if (class_id >= 8) + return; + + memqos = &p->sched_memqos; + + class = &per_cpu(memqos_classes, cpu)[class_id]; + + spin_lock_irqsave(&memqos_class_lock, flag); + if (p->sched_memqos.corrupt) { + spin_unlock_irqrestore(&memqos_class_lock, flag); + return; + } + + list_move_tail(&p->sched_memqos.task_list, &class->tasks_list); + if (memqos->turbo) + list_move_tail(&p->sched_memqos.turbo_list, &class->turbo_list); + spin_unlock_irqrestore(&memqos_class_lock, flag); +} + +static void memqos_drop_class_without_lock(struct task_struct *p) +{ + list_del_init(&p->sched_memqos.task_list); + list_del_init(&p->sched_memqos.turbo_list); +} + +static void memqos_score(struct task_struct *p) +{ + int total_n1 = p->sched_memqos.memband_div_10_total[0]; + int total_n2 = p->sched_memqos.memband_div_10_total[1]; + int total_n3 = p->sched_memqos.memband_div_10_total[2]; + int total_n4 = p->sched_memqos.memband_div_10_total[3]; + + p->sched_memqos.numa_score[0] = (total_n1 - (total_n2 + total_n3 + total_n4)) * 10 / total_n1; + p->sched_memqos.numa_score[1] = (total_n2 - (total_n1 + total_n3 + total_n4)) * 10 / total_n2; + p->sched_memqos.numa_score[2] = (total_n3 - (total_n1 + total_n2 + total_n4)) * 10 / total_n3; + p->sched_memqos.numa_score[3] = (total_n4 - (total_n1 + total_n2 + total_n3)) * 10 / total_n4; + + //over x% percent + if (p->sched_memqos.numa_score[0] > 0) + p->sched_memqos.turbo = 1; + else if (p->sched_memqos.numa_score[1] > 0) + p->sched_memqos.turbo = 2; + else if (p->sched_memqos.numa_score[2] > 0) + p->sched_memqos.turbo = 3; + else if (p->sched_memqos.numa_score[3] > 0) + p->sched_memqos.turbo = 4; + else + p->sched_memqos.turbo = 0; +} + +void memqos_account_task(struct task_struct *p, int cpu) +{ + if (!p->sched_memqos.account_ready || + p->sched_memqos.corrupt) + return; + memqos_set_task_classid(p); + memqos_insert_to_class(p, cpu); + memqos_score(p); + p->sched_memqos.account_ready = 0; +} + +void memqos_init_class(struct task_struct *p) +{ + memset(&p->sched_memqos, 0, sizeof(struct task_memqos)); + spin_lock(&memqos_class_lock); + INIT_LIST_HEAD(&p->sched_memqos.task_list); + INIT_LIST_HEAD(&p->sched_memqos.turbo_list); + INIT_LIST_HEAD(&p->sched_memqos.mpam_profile.wait_list); + spin_unlock(&memqos_class_lock); + + p->closid = 0; + p->rmid = 0; +} + +//destroy ? +void memqos_drop_class(struct task_struct *p) +{ + spin_lock(&memqos_class_lock); + memqos_drop_class_without_lock(p); + p->sched_memqos.corrupt = 1; + spin_unlock(&memqos_class_lock); +} + +void memqos_select_nicest_cpus(struct task_struct *p) +{ + int i = 0; + int max_score = -10000; + int select_node = 0; + struct task_memqos *memqos = &p->sched_memqos; + + if (!memqos->turbo) { + for (i = 0; i < 4; i++) { + if (!cpumask_intersects(cpumask_of_node(i), p->select_cpus)) + continue; + + if (memqos->numa_score[i] > max_score) { + select_node = i; + max_score = memqos->numa_score[i]; + } + } + + cpumask_and(p->select_cpus, p->select_cpus, cpumask_of_node(select_node)); + //p->sched_memqos.advise_mem_node_mask = cpumask_of_node(select_node); + p->sched_memqos.preferred_nid = memqos->turbo; + return; + } + + select_node = memqos->turbo - 1; + if (cpumask_intersects(cpumask_of_node(select_node), p->select_cpus)) { + cpumask_and(p->select_cpus, p->select_cpus, cpumask_of_node(select_node)); + //p->sched_memqos.advise_mem_node_mask = cpumask_of_node(select_node); + p->sched_memqos.preferred_nid = memqos->turbo; + } + + //if turbo another cpus, wait... + return; +} + +void memqos_exclude_low_level_task_single(struct task_struct *p) +{ + int i, j, cpu; + int find = 0; + int select_node = 0; + const struct cpumask *cpumask; + struct cpumask cpumask_med; + struct memqos_class *class; + struct task_memqos *memqos = &p->sched_memqos;; + struct task_struct *tsk = NULL; + int max_score = -100000; + + if (memqos->turbo) { + select_node = memqos->turbo - 1; + cpumask = cpumask_of_node(select_node); + if (!cpumask_intersects(cpumask, p->prefer_cpus) && + (cpumask_intersects(&p->cpus_allowed, cpumask))) { + cpumask_and(p->select_cpus, &p->cpus_allowed, cpumask); + //go out! + spin_lock(&memqos_class_lock); + memqos_drop_class_without_lock(p); + spin_unlock(&memqos_class_lock); + //p->sched_memqos.advise_mem_node_mask = cpumask_of_node(select_node); + p->sched_memqos.preferred_nid = memqos->turbo; + return; + } else if (cpumask_intersects(p->prefer_cpus, cpumask)) { + cpumask_and(p->select_cpus, p->prefer_cpus, cpumask); + //p->sched_memqos.advise_mem_node_mask = cpumask_of_node(select_node); + p->sched_memqos.preferred_nid = memqos->turbo; + } + } + + //select turbo one + for (cpu = 0; cpu < nr_cpu_ids; cpu++) { + if (!cpumask_test_cpu(cpu, p->prefer_cpus)) + continue; + + spin_lock(&memqos_class_lock); + for (i = 7; i >= 0; i--) { + class = &per_cpu(memqos_classes, cpu)[i]; + list_for_each_entry(memqos, &class->turbo_list, turbo_list) { + if (!memqos->turbo) + continue; + select_node = memqos->turbo - 1; + cpumask = cpumask_of_node(select_node); + if (!cpumask_intersects(cpumask, p->prefer_cpus)) { + tsk = container_of(memqos, struct task_struct, sched_memqos); + if (!cpumask_intersects(cpumask, &tsk->cpus_allowed)) + continue; + cpumask_and(tsk->select_cpus, &tsk->cpus_allowed, cpumask); + //mem prefered + //tsk->sched_memqos.advise_mem_node_mask = cpumask_of_node(select_node); + tsk->sched_memqos.preferred_nid = memqos->turbo; + find = 1; + break; + } + } + if (find) { + memqos_drop_class_without_lock(tsk); + spin_unlock(&memqos_class_lock); + return; + } + } + spin_unlock(&memqos_class_lock); + } + + find = 0; + + //if not, select lower class's tsk + for (cpu = 0; cpu < nr_cpu_ids; cpu++) { + if (!cpumask_test_cpu(cpu, p->prefer_cpus)) + continue; + + spin_lock(&memqos_class_lock); + //only find below class tsk + for (i = 0; i < memqos->class_id; i++) { + class = &per_cpu(memqos_classes, cpu)[i]; + list_for_each_entry(memqos, &class->tasks_list, task_list) { + if (memqos->turbo) + continue; + + tsk = container_of(memqos, struct task_struct, sched_memqos); + for (j = 0; j < 4; j++) { + if (!cpumask_intersects(cpumask_of_node(i), &tsk->cpus_allowed)) + continue; + if (memqos->numa_score[j] > max_score) { + select_node = j; + max_score = memqos->numa_score[j]; + } + find = 1; + } + if (!find) + continue; + + cpumask_and(&cpumask_med, cpumask_of_node(select_node), &tsk->cpus_allowed); + cpumask_andnot(&cpumask_med, &cpumask_med, p->prefer_cpus); + if (cpumask_empty(&cpumask_med)) + continue; + cpumask_copy(tsk->select_cpus, &cpumask_med); + //mem prefered + //tsk->sched_memqos.advise_mem_node_mask = cpumask_of_node(select_node); + tsk->sched_memqos.preferred_nid = memqos->turbo; + memqos_drop_class_without_lock(tsk); + spin_unlock(&memqos_class_lock); + return; + } + } + spin_unlock(&memqos_class_lock); + } + + //do not care, this task may out + return; +} + diff --git a/kernel/sched/memqos/phase_feature_sysctl.c b/kernel/sched/memqos/phase_feature_sysctl.c new file mode 100644 index 0000000000000..9106a90868a3d --- /dev/null +++ b/kernel/sched/memqos/phase_feature_sysctl.c @@ -0,0 +1,183 @@ +#include <linux/sched.h> +#include <linux/sysctl.h> +#include <linux/capability.h> +#include <linux/cpumask.h> +#include <linux/topology.h> +#include <linux/sched/task.h> + +#include <linux/memqos.h> + +#ifdef CONFIG_PROC_SYSCTL + +//setup timer for counting +#include <linux/sched.h> +#include <linux/timer.h> +#include <asm/ioctl.h> + +//at least 2 cpu +static enum hrtimer_restart timer_fn_twin_a(struct hrtimer *timer_data) +{ + sched_memqos_task_collect_data_range(0, nr_cpu_ids / 2 - 1); + hrtimer_forward_now(timer_data, 1 * NSEC_PER_MSEC); + return HRTIMER_RESTART; +} + +static enum hrtimer_restart timer_fn_twin_b(struct hrtimer *timer_data) +{ + sched_memqos_task_collect_data_range(nr_cpu_ids / 2, nr_cpu_ids - 1); + hrtimer_forward_now(timer_data, 1 * NSEC_PER_MSEC); + return HRTIMER_RESTART; +} + +static struct hrtimer timer_twin_a; +static struct hrtimer timer_twin_b; + +static void memqos_timer_init_func_a(void *info) { + hrtimer_init(&timer_twin_a, CLOCK_MONOTONIC, HRTIMER_MODE_ABS); + timer_twin_a.function = timer_fn_twin_a; + hrtimer_start(&timer_twin_a, ktime_add_ns(ktime_get(), 10000000), HRTIMER_MODE_ABS); +} + +static void memqos_timer_init_func_b(void *info) { + hrtimer_init(&timer_twin_b, CLOCK_MONOTONIC, HRTIMER_MODE_ABS); + timer_twin_b.function = timer_fn_twin_b; + hrtimer_start(&timer_twin_b, ktime_add_ns(ktime_get(), 10000000), HRTIMER_MODE_ABS); +} + +static void memqos_timer_init_a(void) +{ + smp_call_function_single(0, memqos_timer_init_func_b, NULL, 0); +} + +static void memqos_timer_init_b(void) +{ + smp_call_function_single(nr_cpu_ids / 2, memqos_timer_init_func_a, NULL, 0); +} + +static void memqos_timer_twin_init(void) { + memqos_timer_init_a(); + memqos_timer_init_b(); +} + +static void memqos_timer_twin_exit(void) { + hrtimer_cancel(&timer_twin_a); + hrtimer_cancel(&timer_twin_b); +} + +DEFINE_STATIC_KEY_FALSE(sched_phase); +DEFINE_STATIC_KEY_FALSE(sched_phase_printk); + +static int set_phase_state(bool enabled) +{ + int err; + int state = static_branch_likely(&sched_phase); + + if (enabled == state) { + pr_warn("phase has already %s\n", state ? "enabled" : "disabled"); + return 0; + } + + if (enabled) { + err = phase_perf_create(); + if (err) { + pr_err("phase enable failed\n"); + return err; + } + static_branch_enable(&sched_phase); + pr_info("phase enabled\n"); + memqos_timer_twin_init(); + } else { + static_branch_disable(&sched_phase); + phase_perf_release(); + pr_info("phase disabled\n"); + memqos_timer_twin_exit(); + } + + return 0; +} + +/* + * the other procfs files of phase cannot be modified if sched_phase is already enabled + */ +static int phase_proc_state(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) +{ + struct ctl_table t; + int err; + int state = static_branch_likely(&sched_phase); + + if (write && !capable(CAP_SYS_ADMIN)) + return -EPERM; + + t = *table; + t.data = &state; + err = proc_dointvec_minmax(&t, write, buffer, lenp, ppos); + if (err < 0) + return err; + if (write) + err = set_phase_state(state); + + return err; +} + +static int set_phase_state_printk(bool enabled) +{ + if (enabled) { + static_branch_enable(&sched_phase_printk); + } else { + static_branch_disable(&sched_phase_printk); + } + + return 0; +} + +/* + * the other procfs files of phase cannot be modified if sched_phase is already enabled + */ +static int phase_proc_state_printk(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) +{ + struct ctl_table t; + int err; + int state = static_branch_likely(&sched_phase); + + if (write && !capable(CAP_SYS_ADMIN)) + return -EPERM; + + t = *table; + t.data = &state; + err = proc_dointvec_minmax(&t, write, buffer, lenp, ppos); + if (err < 0) + return err; + if (write) + err = set_phase_state_printk(state); + + return err; +} + + +static int __maybe_unused zero; +static int __maybe_unused one = 1; + +struct ctl_table phase_table[] = { + { + .procname = "enabled", + .data = NULL, + .maxlen = sizeof(unsigned int), + .mode = 0644, + .proc_handler = phase_proc_state, + .extra1 = &zero, + .extra2 = &one, + }, + { + .procname = "trace_enabled", + .data = NULL, + .maxlen = sizeof(unsigned int), + .mode = 0644, + .proc_handler = phase_proc_state_printk, + .extra1 = &zero, + .extra2 = &one, + }, + { } +}; +#endif /* CONFIG_PROC_SYSCTL */ diff --git a/kernel/sched/memqos/phase_memband.c b/kernel/sched/memqos/phase_memband.c new file mode 100644 index 0000000000000..df8b2811f6ab7 --- /dev/null +++ b/kernel/sched/memqos/phase_memband.c @@ -0,0 +1,179 @@ +#include <linux/types.h> +#include <linux/cpu.h> +#include <linux/memqos.h> + +#include <asm/cpu.h> +#include <asm/cputype.h> +#include <asm/cpufeature.h> +#include <asm/mpam_sched.h> + +static const int nr_partid = 15; +static const int nr_monitor = 4; + +static LIST_HEAD(phase_mpam_waitqueue); + +//mpam_profile_res[0] not used +struct memqos_mpam_profile mpam_profile_res[16] = { + { .partid = 0, .monitor = 0, .used = 1}, + { .partid = 1, .monitor = 0,}, + { .partid = 2, .monitor = 1,}, + { .partid = 3, .monitor = 2,}, + { .partid = 4, .monitor = 3,}, + { .partid = 5, .monitor = 0,}, + { .partid = 6, .monitor = 1,}, + { .partid = 7, .monitor = 2,}, + { .partid = 8, .monitor = 3,}, + { .partid = 9, .monitor = 0,}, + { .partid = 10, .monitor = 1,}, + { .partid = 11, .monitor = 2,}, + { .partid = 12, .monitor = 3,}, + { .partid = 13, .monitor = 0,}, + { .partid = 14, .monitor = 1,}, + { .partid = 15, .monitor = 2,}, +}; + +static DEFINE_SPINLOCK(phase_partid_lock); + +void phase_update_mpam_label(struct task_struct *tsk) +{ + int i = 0; + //unsigned long flag; + + WARN_ON_ONCE(tsk->closid); + + if (tsk->sched_memqos.corrupt) { + phase_release_mpam_label(tsk); + return; + } + + spin_lock(&phase_partid_lock); + if (tsk->sched_memqos.mpam_profile.profile != &mpam_profile_res[0] && + tsk->sched_memqos.mpam_profile.profile != NULL) { + tsk->closid = tsk->sched_memqos.mpam_profile.profile->partid; + tsk->sched_memqos.mpam_profile.profile->tsk = tsk; + //tsk->sched_memqos.mpam_profile.profile->used = 1; + tsk->rmid = 0; + spin_unlock(&phase_partid_lock); + //if (static_branch_unlikely(&sched_phase_printk)) { + // trace_printk("task pid:%d get partid%d succeed\n", tsk->pid, tsk->closid); + //} + __mpam_sched_in_v2(tsk); + return; + } + + //is in profile queue, wait... + if (tsk->sched_memqos.mpam_profile.profile == &mpam_profile_res[0]) { + spin_unlock(&phase_partid_lock); + return; + } + + for (i = 1; i < 16; i++) { + if (mpam_profile_res[i].used) { + if (static_branch_unlikely(&sched_phase_printk)) { + //if (mpam_profile_res[i].tsk) + // trace_printk("i%d want get partid, butpartid:%d get by pid:%d closid:%d\n", + //tsk->pid, i, mpam_profile_res[i].tsk->pid, mpam_profile_res[i].tsk->closid); + //else + // trace_printk("i%d want get partid, butpartid:%d get by pid:%d(NULL)\n", + //tsk->pid, i, tsk->pid); + } + + continue; + } + + tsk->sched_memqos.mpam_profile.profile = NULL; + break; + } + + if (i == 16) { + list_move_tail(&tsk->sched_memqos.mpam_profile.wait_list, &phase_mpam_waitqueue); + tsk->sched_memqos.mpam_profile.profile = &mpam_profile_res[0]; + spin_unlock(&phase_partid_lock); + //if (static_branch_unlikely(&sched_phase_printk)) { + // trace_printk("task pid:%d no partid found, go to list\n", tsk->pid); + //} + //wait... + return; + } + + mpam_profile_res[i].used = 1; + tsk->closid = mpam_profile_res[i].partid; + mpam_profile_res[i].tsk = tsk; + tsk->sched_memqos.mpam_profile.profile = &mpam_profile_res[i]; + tsk->rmid = 0; + spin_unlock(&phase_partid_lock); + //if (static_branch_unlikely(&sched_phase_printk)) { + //trace_printk("task pid:%d get partid%d succeed\n", tsk->pid, i); + //} + + __mpam_sched_in_v2(tsk); +} + +static void phase_release_mpam_label_without_lock(struct task_struct *tsk) +{ + int closid; + struct memqos_wait_profile *next; + + //assert locked + + if (tsk->sched_memqos.mpam_profile.profile && + tsk->sched_memqos.mpam_profile.profile->partid) { + closid = tsk->sched_memqos.mpam_profile.profile->partid; + } else if (tsk->closid == 0) { + return; + } else { + closid = tsk->closid; + } + + tsk->closid = 0; + tsk->sched_memqos.mpam_profile.profile = NULL; + mpam_profile_res[closid].used = 0; + mpam_profile_res[closid].tsk = NULL; + + //if (static_branch_unlikely(&sched_phase_printk)) { + // trace_printk("task pid:%d release partid%d, list empty:%d\n", tsk->pid, closid, list_empty(&phase_mpam_waitqueue)); + //} + + next = list_first_entry_or_null(&phase_mpam_waitqueue, struct memqos_wait_profile, wait_list); + if (next) { + list_del_init(&next->wait_list); + mpam_profile_res[closid].used = 1; + next->profile = &mpam_profile_res[closid]; + } + + return; +} + +//task shutdown +void phase_destroy_waitqueue(struct task_struct *tsk) +{ + spin_lock(&phase_partid_lock); + + //if (tsk->sched_memqos.mpam_profile.profile == &mpam_profile_res[0]) { + list_del_init(&tsk->sched_memqos.mpam_profile.wait_list); + //} else { + phase_release_mpam_label_without_lock(tsk); + //} + spin_unlock(&phase_partid_lock); +} + +void phase_release_mpam_label(struct task_struct *tsk) +{ + spin_lock(&phase_partid_lock); + phase_release_mpam_label_without_lock(tsk); + spin_unlock(&phase_partid_lock); +} + +#include <asm/mpam.h> +void phase_get_memband(struct memqos_mpam_profile *pm, int *result, int nr) +{ + if (pm == &mpam_profile_res[0] || pm == NULL) { + result[0] = 0; + result[1] = 0; + result[2] = 0; + result[3] = 0; + return; + } + + mpam_component_config_mbwu_mon(pm->partid, pm->pmg, pm->monitor, result, nr); +} diff --git a/kernel/sched/memqos/phase_perf.c b/kernel/sched/memqos/phase_perf.c new file mode 100644 index 0000000000000..7b7f37e46f76c --- /dev/null +++ b/kernel/sched/memqos/phase_perf.c @@ -0,0 +1,412 @@ +#include <linux/kernel.h> +#include <linux/perf_event.h> +#include <linux/percpu-defs.h> +#include <linux/slab.h> +#include <linux/stop_machine.h> +#include <linux/memqos.h> +#include <linux/sched.h> + +#define PHASE_FEVENT_NUM 3 + +int *phase_perf_pevents = NULL; + +static DEFINE_PER_CPU(__typeof__(struct perf_event *)[PHASE_PEVENT_NUM], cpu_phase_perf_events); + +/****************************************** + * Helpers for phase perf event + *****************************************/ +static inline struct perf_event *perf_event_of_cpu(int cpu, int index) +{ + return per_cpu(cpu_phase_perf_events, cpu)[index]; +} + +static inline struct perf_event **perf_events_of_cpu(int cpu) +{ + return per_cpu(cpu_phase_perf_events, cpu); +} + +static inline u64 perf_event_local_pmu_read(struct perf_event *event) +{ + return 0; + if (event->state == PERF_EVENT_STATE_ACTIVE) + event->pmu->read(event); + return local64_read(&event->count); +} + +/****************************************** + * Helpers for cpu counters + *****************************************/ +static inline u64 read_cpu_counter(int cpu, int index) +{ + struct perf_event *event = perf_event_of_cpu(cpu, index); + + if (!event || !event->pmu) + return 0; + + return perf_event_local_pmu_read(event); +} + +static struct perf_event_attr *alloc_attr(int event_id) +{ + struct perf_event_attr *attr; + + attr = kzalloc(sizeof(struct perf_event_attr), GFP_KERNEL); + if (!attr) + return ERR_PTR(-ENOMEM); + + attr->type = PERF_TYPE_RAW; + attr->config = event_id; + attr->size = sizeof(struct perf_event_attr); + attr->pinned = 1; + attr->disabled = 1; + //attr->exclude_hv; + //attr->exclude_idle; + //attr->exclude_kernel; + + return attr; +} + +static int create_cpu_counter(int cpu, int event_id, int index) +{ + struct perf_event_attr *attr = NULL; + struct perf_event **events = perf_events_of_cpu(cpu); + struct perf_event *event = NULL; + + return 0; + attr = alloc_attr(event_id); + if (IS_ERR(attr)) + return PTR_ERR(attr); + + event = perf_event_create_kernel_counter(attr, cpu, NULL, NULL, NULL); + if (IS_ERR(event)) { + pr_err("unable to create perf event (cpu:%i-type:%d-pinned:%d-config:0x%llx) : %ld", + cpu, attr->type, attr->pinned, attr->config, PTR_ERR(event)); + kfree(attr); + return PTR_ERR(event); + } else { + events[index] = event; + perf_event_enable(events[index]); + if (event->hw.idx == -1) { + pr_err("pinned event unable to get onto hardware, perf event (cpu:%i-type:%d-config:0x%llx)", + cpu, attr->type, attr->config); + kfree(attr); + return -EINVAL; + } + pr_info("create perf_event (cpu:%i-idx:%d-type:%d-pinned:%d-exclude_hv:%d" + "-exclude_idle:%d-exclude_kernel:%d-config:0x%llx-addr:%px)", + event->cpu, event->hw.idx, + event->attr.type, event->attr.pinned, event->attr.exclude_hv, + event->attr.exclude_idle, event->attr.exclude_kernel, + event->attr.config, event); + } + + kfree(attr); + return 0; +} + +static int release_cpu_counter(int cpu, int event_id, int index) +{ + struct perf_event **events = perf_events_of_cpu(cpu); + struct perf_event *event = NULL; + + return 0; + event = events[index]; + + if (!event) + return 0; + + pr_info("release perf_event (cpu:%i-idx:%d-type:%d-pinned:%d-exclude_hv:%d" + "-exclude_idle:%d-exclude_kernel:%d-config:0x%llx)", + event->cpu, event->hw.idx, + event->attr.type, event->attr.pinned, event->attr.exclude_hv, + event->attr.exclude_idle, event->attr.exclude_kernel, + event->attr.config); + + perf_event_release_kernel(event); + events[index] = NULL; + + return 0; +} + +enum { + CYCLES_INDEX = 0, + INST_RETIRED_INDEX, + PHASE_EVENT_FINAL_TERMINATOR +}; + +#define CYCLES 0x0011 +#define INST_RETIRED 0x0008 + +static int pevents[PHASE_PEVENT_NUM] = { + CYCLES, + INST_RETIRED, + PHASE_EVENT_FINAL_TERMINATOR, +}; + +#define for_each_phase_pevents(index, events) \ + for (index = 0; events != NULL && index < PHASE_PEVENT_NUM && \ + events[index] != PHASE_EVENT_FINAL_TERMINATOR; index++) + + +/****************************************** + * Helpers for phase perf + *****************************************/ +static int do_pevents(int (*fn)(int, int, int), int cpu) +{ + int index; + int err; + + for_each_phase_pevents(index, phase_perf_pevents) { + err = fn(cpu, phase_perf_pevents[index], index); + if (err) + return err; + } + + return 0; +} + +static int __phase_perf_create(void *args) +{ + int err; + int cpu = raw_smp_processor_id(); + + /* create pinned events */ + pr_info("create pinned events\n"); + err = do_pevents(create_cpu_counter, cpu); + if (err) { + pr_err("create pinned events failed\n"); + do_pevents(release_cpu_counter, cpu); + return err; + } + + pr_info("[%d] phase class event create success\n", cpu); + return 0; +} + +static int do_phase_perf_create(int *pevents, const struct cpumask *cpus) +{ + phase_perf_pevents = pevents; + return stop_machine(__phase_perf_create, NULL, cpus); +} + +static int __do_phase_perf_release(void *args) +{ + int cpu = raw_smp_processor_id(); + + /* release pinned events */ + pr_info("release pinned events\n"); + do_pevents(release_cpu_counter, cpu); + + pr_info("[%d] phase class event release success\n", cpu); + return 0; +} + +static void do_phase_perf_release(const struct cpumask *cpus) +{ + stop_machine(__do_phase_perf_release, NULL, cpus); + phase_perf_pevents = NULL; +} + +int phase_perf_create(void) +{ + return do_phase_perf_create(pevents, cpu_possible_mask); +} + +void phase_perf_release(void) +{ + do_phase_perf_release(cpu_possible_mask); +} + +DECLARE_STATIC_KEY_FALSE(sched_phase); +DECLARE_STATIC_KEY_FALSE(sched_phase_printk); + +#define PHASE_EVENT_OVERFLOW (~0ULL) + +static inline u64 phase_event_count_sub(u64 curr, u64 prev) +{ + if (curr < prev) { /* ovewrflow */ + u64 tmp = PHASE_EVENT_OVERFLOW - prev; + return curr + tmp; + } else { + return curr - prev; + } +} + +static inline void phase_calc_delta(struct task_struct *p, + struct phase_event_count *prev, + struct phase_event_count *curr, + struct phase_event_count *delta) +{ + int *pevents = phase_perf_pevents; + int index; + + for_each_phase_pevents(index, pevents) { + delta->pcount.data[index] = phase_event_count_sub(curr->pcount.data[index], prev->pcount.data[index]); + } +} + +static inline u64 phase_data_of_pevent(struct phase_event_pcount *counter, int event_id) +{ + int index; + int *events = phase_perf_pevents; + + for_each_phase_pevents(index, events) { + if (event_id == events[index]) + return counter->data[index]; + } + + return 0; +} + +static int cal_ring_history_average(int *history, int nr, int s_pos, int c_nr) +{ + int average = 0; + int start = ((s_pos - c_nr) + nr) % nr; + + if (start < 0) + return 0; + + for (;start != s_pos;) { + if (history[start] == 0) { + c_nr--; + if (c_nr == 0) + return 0; + continue; + } + average += history[start]; + start = (start + 1) % nr; + } + + return start / c_nr; +} + +static void __phase_cal_ipcx10(struct task_struct *p, struct phase_event_count *delta) +{ + u64 ins; + u64 cycles; + //invalid zero + int ipcx10 = 0; + + ins = phase_data_of_pevent(&delta->pcount, INST_RETIRED_INDEX); + cycles = phase_data_of_pevent(&delta->pcount, CYCLES_INDEX); + + if (cycles) + ipcx10 = (ins * 10) / cycles; + + //if (static_branch_unlikely(&sched_phase_printk)) { + // trace_printk("ins:%lld cycles:%lld\n", ins, cycles); + //} + + p->sched_memqos.ipcx10_history[p->sched_memqos.ipc_ringpos] = ipcx10; + p->sched_memqos.ipc_ringpos = (p->sched_memqos.ipc_ringpos + 1) % 10; + cal_ring_history_average(p->sched_memqos.ipcx10_history, 10, p->sched_memqos.ipc_ringpos, 5); +} + +static void __phase_cal_memband_div_10(struct task_struct *p) +{ + int pos; + int result[4]; + + pos = p->sched_memqos.memband_ringpos; + + phase_get_memband(p->sched_memqos.mpam_profile.profile, result, 4); + + //if (static_branch_unlikely(&sched_phase_printk)) { + // trace_printk("memband:%d %d %d %d profile:%llx\n", result[0], result[1], result[2], result[3], p->sched_memqos.mpam_profile.profile); + //} + + p->sched_memqos.memband_div_10_total[0] = p->sched_memqos.memband_div_10_total[0] - p->sched_memqos.memband_div_10_history[0][pos]; + p->sched_memqos.memband_div_10_total[0] = p->sched_memqos.memband_div_10_total[0] + result[0] / 10; + p->sched_memqos.memband_div_10_history[0][p->sched_memqos.memband_ringpos] = result[0] / 10; + + p->sched_memqos.memband_div_10_total[1] = p->sched_memqos.memband_div_10_total[1] - p->sched_memqos.memband_div_10_history[1][pos]; + p->sched_memqos.memband_div_10_total[1] = p->sched_memqos.memband_div_10_total[1] + result[1] / 10; + p->sched_memqos.memband_div_10_history[1][p->sched_memqos.memband_ringpos] = result[1] / 10; + + p->sched_memqos.memband_div_10_total[2] = p->sched_memqos.memband_div_10_total[2] - p->sched_memqos.memband_div_10_history[2][pos]; + p->sched_memqos.memband_div_10_total[2] = p->sched_memqos.memband_div_10_total[2] + result[2] / 10; + p->sched_memqos.memband_div_10_history[2][p->sched_memqos.memband_ringpos] = result[2] / 10; + + p->sched_memqos.memband_div_10_total[3] = p->sched_memqos.memband_div_10_total[3] - p->sched_memqos.memband_div_10_history[3][pos]; + p->sched_memqos.memband_div_10_total[3] = p->sched_memqos.memband_div_10_total[3] + result[3] / 10; + p->sched_memqos.memband_div_10_history[3][p->sched_memqos.memband_ringpos] = result[3] / 10; + + p->sched_memqos.memband_ringpos = (pos + 1) % 10; + + cal_ring_history_average(p->sched_memqos.memband_div_10_history[0], 10, pos, 5); + cal_ring_history_average(p->sched_memqos.memband_div_10_history[1], 10, pos, 5); + cal_ring_history_average(p->sched_memqos.memband_div_10_history[2], 10, pos, 5); + cal_ring_history_average(p->sched_memqos.memband_div_10_history[3], 10, pos, 5); +} + +static DEFINE_PER_CPU(struct phase_event_count, prev_phase_event_count); +static DEFINE_PER_CPU(struct phase_event_count, curr_phase_event_count); + +static void phase_perf_read_events(int cpu, u64 *pdata) +{ + int index; + + for_each_phase_pevents(index, phase_perf_pevents) { + pdata[index] = read_cpu_counter(cpu, index); + } +} + +static inline struct phase_event_count *phase_read_prev(unsigned int cpu) +{ + return &per_cpu(prev_phase_event_count, cpu); +} + +static inline struct phase_event_count *phase_read_curr(unsigned int cpu) +{ + struct phase_event_count *curr = &per_cpu(curr_phase_event_count, cpu); + + phase_perf_read_events(cpu, curr->pcount.data); + + return curr; +} + +void phase_account_task(struct task_struct *p, int cpu) +{ + struct phase_event_count delta; + struct phase_event_count *prev, *curr; + + if (!static_branch_likely(&sched_phase)) + return; + + //if (!sched_core_enabled(cpu_rq(cpu))) + // return; + + /* update phase_event_count */ + prev = phase_read_prev(cpu); + curr = phase_read_curr(cpu); + phase_calc_delta(p, prev, curr, &delta); + *prev = *curr; + + /* calculate phase */ + __phase_cal_ipcx10(p, &delta); + __phase_cal_memband_div_10(p); + p->sched_memqos.sample_times++; + if ((p->sched_memqos.sample_times % 3) == 0) + p->sched_memqos.account_ready = 1; +} + + +void phase_trace_printk(struct task_struct *p) +{ + if (!static_branch_unlikely(&sched_phase_printk)) + return; + + trace_printk("p->comm:%s(%d) ipcpos:%d ipcx10:%d membandpos:%d memband_div_10:%d numa_score[0]:%d numa_score[1]:%d numa_score[2]:%d numa_score[3]:%d turbo:%d prefered_nid:%d classid:%d partid:%d\n", + p->comm, p->pid, p->sched_memqos.ipc_ringpos,\ + p->sched_memqos.ipcx10, \ + p->sched_memqos.memband_ringpos,\ + p->sched_memqos.memband_div_10, \ + p->sched_memqos.numa_score[0], \ + p->sched_memqos.numa_score[1], \ + p->sched_memqos.numa_score[2], \ + p->sched_memqos.numa_score[3], \ + p->sched_memqos.turbo, \ + p->sched_memqos.preferred_nid, \ + p->sched_memqos.class_id, \ + p->closid); +} diff --git a/kernel/sched/memqos/phase_sim_knn.c b/kernel/sched/memqos/phase_sim_knn.c new file mode 100644 index 0000000000000..b80bb6b9ae0a3 --- /dev/null +++ b/kernel/sched/memqos/phase_sim_knn.c @@ -0,0 +1,92 @@ +#include <linux/types.h> + +#define DATA_ROW 20 +void QuickSort(u64 arr[DATA_ROW][2], int L, int R) { + int i = L; + int j = R; + int kk = (L + R) / 2; + u64 pivot = arr[kk][0]; + + while (i <= j) { + while (pivot > arr[i][0]) { + i++; + } + while (pivot < arr[j][0]) { + j--; + } + if (i <= j) { + u64 temp = arr[i][0]; + + arr[i][0] = arr[j][0]; + arr[j][0] = temp; + i++; j--; + } + } + if (L < j) { + QuickSort(arr, L, j); + } + if (i < R) { + QuickSort(arr, i, R); + } +} + +u64 euclidean_distance(u64 *row1, u64 *row2, int col) { + u64 distance = 0; + int i; + + for (i = 0; i < col - 1; i++) { + distance += ((row1[i] - row2[i]) * (row1[i] - row2[i])); + } + return distance; +} + +#define num_neighbors 6 +#define MAX_TAG 8 + +int get_neighbors_tag(u64 train_data[DATA_ROW][3], int train_row, int col, u64 *test_row) { + int i; + u64 neighbors[MAX_TAG] = {0}; + int max_tag = 0; + u64 distances[DATA_ROW][2]; + + for (i = 0; i < train_row; i++) { + distances[i][0] = euclidean_distance(train_data[i], test_row, col); + distances[i][1] = train_data[i][col - 1]; + } + QuickSort(distances, 0, train_row - 1); + for (i = 0; i < num_neighbors; i++) { + neighbors[distances[i][1]]++; + if (neighbors[distances[i][1]] > neighbors[max_tag]) + max_tag = distances[i][1]; + } + return max_tag; +} + +static u64 train_data[DATA_ROW][3] = { + {0, 1, 0}, + {0, 9, 0}, + {0, 20, 1}, + {0, 30, 1}, + {0, 40, 2}, + {0, 50, 3}, + {0, 60, 3}, + {0, 70, 3}, + {0, 80, 4}, + {0, 90, 4}, + {0, 100, 4}, + {0, 110, 5}, + {0, 120, 5}, + {0, 130, 6}, + {0, 140, 6}, + {0, 150, 7}, +}; + +int knn_get_tag(int ipcx10, int memband_div_10) +{ + u64 test_data[2]; + + test_data[0] = ipcx10; + test_data[1] = memband_div_10; + + return get_neighbors_tag(train_data, DATA_ROW, 3, test_data); +} diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 685f9881b8e23..0d2764c4449ce 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -465,6 +465,13 @@ static struct ctl_table kern_table[] = { .extra2 = &one, }, #endif /* CONFIG_NUMA_BALANCING */ +#ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY + { + .procname = "phase", + .mode = 0555, + .child = phase_table, + }, +#endif #endif /* CONFIG_SCHED_DEBUG */ { .procname = "sched_rt_period_us", diff --git a/mm/mempolicy.c b/mm/mempolicy.c index 4cac46d56f387..d748c291e7047 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -2164,12 +2164,15 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma, { struct mempolicy *pol; struct page *page; - int preferred_nid; + int preferred_nid = -1; nodemask_t *nmask; + if (current->sched_memqos.preferred_nid) + preferred_nid = current->sched_memqos.preferred_nid - 1; + pol = get_vma_policy(vma, addr); - if (pol->mode == MPOL_INTERLEAVE) { + if (pol->mode == MPOL_INTERLEAVE && preferred_nid != -1) { unsigned nid; nid = interleave_nid(pol, vma, addr, PAGE_SHIFT + order); @@ -2233,7 +2236,8 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma, } nmask = policy_nodemask(gfp, pol); - preferred_nid = policy_node(gfp, pol, node); + if (preferred_nid == -1) + preferred_nid = policy_node(gfp, pol, node); page = __alloc_pages_nodemask(gfp, order, preferred_nid, nmask); mark_vma_cdm(nmask, page, vma); mpol_cond_put(pol); -- 2.25.1

1 0