- Kernel - mailweb.openeuler.org

[PATCH v2 OLK-5.10 0/3] Backport 5.10.1 LTS
by Chen Jun 17 Dec '20

17 Dec '20

v1->v2 modifty the commit message: linux-5.10.1 -> stable-5.10.1 *** BLURB HERE *** Greg Kroah-Hartman (3): Revert "md: change mddev 'chunk_sectors' from int to unsigned" Revert "dm raid: fix discard limits for raid1 and raid10" Linux 5.10.1 Makefile | 2 +- drivers/md/dm-raid.c | 12 +++++------- drivers/md/md.h | 4 ++-- 3 files changed, 8 insertions(+), 10 deletions(-) -- 2.25.0

2 6

[OLK-5.10 0/3] Backport 5.10.1 LTS
by Chen Jun 16 Dec '20

16 Dec '20

*** BLURB HERE *** Greg Kroah-Hartman (3): Revert "md: change mddev 'chunk_sectors' from int to unsigned" Revert "dm raid: fix discard limits for raid1 and raid10" Linux 5.10.1 Makefile | 2 +- drivers/md/dm-raid.c | 12 +++++------- drivers/md/md.h | 4 ++-- 3 files changed, 8 insertions(+), 10 deletions(-) -- 2.25.0

2 6

为什么你一定要参加 openEuler Summit 的 TC、Maintainer、SIG 组工作会议
by public openEuler 16 Dec '20

16 Dec '20

嗨，各位 openEuler 社区的开发者：很高兴能够向你们汇报 openEuler Summit 的会议进度。对于各位来说，本周最重要的事情是 TC、Maintainer和SIG 组开放工作会议的议程已经上线了。 *为什么你一定要参与 TC、Maintainer、SIG组开放工作会议？* 1. 你可以清楚的了解 openEuler 社区的运作模式 2. 你可以和 TC、Maintainer、SIG 的成员共同探讨openEuler 社区的下一个版本的计划和技术路线 3. 可以跟社区里的技术大佬进行面对面交流。 4. 更好的规划自己在社区中的成长路线 *会议时间和房间号：* TC 开放工作会议 Maintainer 开放工作会议 SIG 组开放工作会议时间 12/24 13:00-14:30 12/24 15:00-17:00 12/25 13:00-15:30 房间号悦府6和悦府7 悦府6和悦府7 大宴会厅B *TC **开放工作会议议程：* 1. 讨论 openEuler 支持 App Stream 机制 2. 申请成立智能运维 SIG 3. 讨论从 Gitee issue 整体切换到bugzilla 4. 讨论2021年 TC 合作的开展方式 5. …… *Maintainer **开放工作会议议程* 1. 开场 & 颁发 Maintainer 纪念徽章 2. openEuler 社区运作分析 3. 我在 openEuler 社区担任 Maintainer 的那些事儿 4. 自由问答 5. 总结 *参与本次 SIG 组开放工作会议的 SIG 组：* 1. sig-DDE 2. sig-UKUI 3. sig-Ha 4. sig-arrch32 5. A-Tune 6. iSulad & Container 7. sig-ai-bitdata 8. sig-security-facility 9. sig-confidential-computing 10. Compiler 11. Doc 12. Infrastructure 13. security-committee 14. sig-Compatibility-Infra 15. sig-QA 16. sig-release-management 17. Kernel 18. Virt *openEuler Summit **专属伴手礼：* [image: image.png] *openEuler **卫衣* [image: image.png] *openEuler Maintainer **纪念徽章* *欢迎通过openEuler 社区开发者专属的报名渠道报名：* https://etherpad.openeuler.org/p/openEuler-Summit-2020 openEuler Summit 官网： https://openeuler.org/zh/interaction/summit-list/

1 0

[PATCH 1/2] arm64: arch_timer: only do cntvct workaround on VDSO path on D05
by Yang Yingliang 16 Dec '20

16 Dec '20

hulk inclusion category: bugfix bugzilla: NA CVE: NA -------------------------------- On other board do do cntvct workaround on VDSO path may cause unexpected error, so we do this only on D05. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/clocksource/arm_arch_timer.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c index 443079810300..50030326d27b 100644 --- a/drivers/clocksource/arm_arch_timer.c +++ b/drivers/clocksource/arm_arch_timer.c @@ -551,9 +551,14 @@ void arch_timer_enable_workaround(const struct arch_timer_erratum_workaround *wa * change both the default value and the vdso itself. */ if (wa->read_cntvct_el0) { - clocksource_counter.archdata.vdso_direct = true; - vdso_default = true; - vdso_fix = true; + if (wa->read_cntvct_el0 == hisi_161010101_read_cntvct_el0) { + clocksource_counter.archdata.vdso_direct = true; + vdso_default = true; + vdso_fix = true; + } else { + clocksource_counter.archdata.vdso_direct = false; + vdso_default = false; + } } } -- 2.25.1

1 1

[PATCH] scsi: libiscsi: Fix cmds hung when sd_shutdown
by Yang Yingliang 15 Dec '20

15 Dec '20

From: Wu Bo <wubo40(a)huawei.com> hulk inclusion category: bugfix bugzilla: NA CVE: NA https://gitee.com/src-openeuler/kernel/issues/I28N9J --------------------------- For some reason, during reboot the system, iscsi.service failed to logout all sessions. kernel will hang forever on its sd_sync_cache() logic, after issuing the SYNCHRONIZE_CACHE cmd to all still existent paths. [ 1044.098991] reboot: Mddev shutdown finished. [ 1044.099311] reboot: Usermodehelper disable finished. [ 1050.611244] connection2:0: ping timeout of 5 secs expired, recv timeout 5, last rx 4295152378, last ping 4295153633, now 4295154944 [ 1348.599676] Call trace: [ 1348.599887] __switch_to+0xe8/0x150 [ 1348.600113] __schedule+0x33c/0xa08 [ 1348.600372] schedule+0x2c/0x88 [ 1348.600567] schedule_timeout+0x184/0x3a8 [ 1348.600820] io_schedule_timeout+0x28/0x48 [ 1348.601089] wait_for_common_io.constprop.2+0x168/0x258 [ 1348.601425] wait_for_completion_io_timeout+0x28/0x38 [ 1348.601762] blk_execute_rq+0x98/0xd8 [ 1348.602006] __scsi_execute+0xe0/0x1e8 [ 1348.602262] sd_sync_cache+0xd0/0x220 [sd_mod] [ 1348.602551] sd_shutdown+0x6c/0xf8 [sd_mod] [ 1348.602826] device_shutdown+0x13c/0x250 [ 1348.603078] kernel_restart_prepare+0x5c/0x68 [ 1348.603400] kernel_restart+0x20/0x98 [ 1348.603683] __se_sys_reboot+0x214/0x260 [ 1348.603987] __arm64_sys_reboot+0x24/0x30 [ 1348.604300] el0_svc_common+0x80/0x1b8 [ 1348.604590] el0_svc_handler+0x78/0xe0 [ 1348.604877] el0_svc+0x10/0x260 d754941225 (scsi: libiscsi: Allow sd_shutdown on bad transport) Once solved this problem. The iscsi_eh_cmd_timed_out() function add system_state judgment, and will return BLK_EH_DONE and mark the result as DID_NO_CONNECT when system_state is not SYSTEM_RUNNING, To tell upper layers that the command was handled during the transport layer error handler helper. The scsi Mid Layer timeout handler function(scsi_times_out) will be abort the cmd if the scsi LLD timeout handler return BLK_EH_DONE. if abort cmd failed, will enter scsi EH logic. Scsi EH will do reset target logic, if reset target failed, Will call iscsi_eh_session_reset() function to drop the session. The iscsi_eh_session_reset function will wait for a relogin, session termination from userspace, or a recovery/replacement timeout. But at this time, the app iscsid has exited, and the session was marked as ISCSI_STATE_FAILED, So the SCSI EH process will never be scheduled back again. PID: 9123 TASK: ffff80020c1b4d80 CPU: 3 COMMAND: "scsi_eh_2" #0 [ffff00008632bb70] __switch_to at ffff000080088738 #1 [ffff00008632bb90] __schedule at ffff000080a00480 #2 [ffff00008632bc20] schedule at ffff000080a00b58 #3 [ffff00008632bc30] iscsi_eh_session_reset at ffff000000d1ab9c [libiscsi] #4 [ffff00008632bcb0] iscsi_eh_recover_target at ffff000000d1d1fc [libiscsi] #5 [ffff00008632bd00] scsi_try_target_reset at ffff0000806f0bac #6 [ffff00008632bd30] scsi_eh_ready_devs at ffff0000806f2724 #7 [ffff00008632bde0] scsi_error_handler at ffff0000806f41d4 #8 [ffff00008632be70] kthread at ffff000080119ae0 Reported-by: Tianxiong Lu <lutianxiong(a)huawei.com> Signed-off-by: Wu Bo <wubo40(a)huawei.com> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/scsi/libiscsi.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c index ec356e035c5f..35d603db33bb 100644 --- a/drivers/scsi/libiscsi.c +++ b/drivers/scsi/libiscsi.c @@ -2441,7 +2441,17 @@ int iscsi_eh_session_reset(struct scsi_cmnd *sc) mutex_lock(&session->eh_mutex); spin_lock_bh(&session->frwd_lock); - if (session->state == ISCSI_STATE_TERMINATE) { + + /* + * During shutdown, if session is prematurely disconnected, recovery + * won't happen and there will be hung cmds. To solve this case, all + * cmds would be enter scsi EH, but the EH path will wait for + * wait_event_interruptible() to complete until the state of the + * session is ISCSI_STATE_TERMINATE, ISCSI_STATE_LOGGED_IN or + * ISCSI_STATE_RECOVERY_FAILED. + */ + if (session->state == ISCSI_STATE_TERMINATE || + unlikely(system_state != SYSTEM_RUNNING)) { failed: ISCSI_DBG_EH(session, "failing session reset: Could not log back into " -- 2.25.1

1 0

[PATCH] scsi: iscsi: Perform connection failure entirely in kernel space
by Yang Yingliang 15 Dec '20

15 Dec '20

From: Bharath Ravi <rbharath(a)google.com> mainline inclusion from mainline-v5.7-rc1 commit 0ab710458da113a71c461c4df27e7f1353d9f864 category: bugfix bugzilla: NA CVE: NA https://gitee.com/src-openeuler/kernel/issues/I28N9J -------------------------------- Connection failure processing depends on a daemon being present to (at least) stop the connection and start recovery. This is a problem on a multipath scenario, where if the daemon failed for whatever reason, the SCSI path is never marked as down, multipath won't perform the failover and IO to the device will be forever waiting for that connection to come back. This patch performs the connection failure entirely inside the kernel. This way, the failover can happen and pending IO can continue even if the daemon is dead. Once the daemon comes alive again, it can execute recovery procedures if applicable. Cc: Mike Christie <mchristi(a)redhat.com> Cc: Lee Duncan <LDuncan(a)suse.com> Cc: Bart Van Assche <bvanassche(a)acm.org> Link: https://lore.kernel.org/r/20200125061925.191601-1-krisman@collabora.com Co-developed-by: Dave Clausen <dclausen(a)google.com> Co-developed-by: Nick Black <nlb(a)google.com> Co-developed-by: Vaibhav Nagarnaik <vnagarnaik(a)google.com> Co-developed-by: Anatol Pomazau <anatol(a)google.com> Co-developed-by: Tahsin Erdogan <tahsin(a)google.com> Co-developed-by: Frank Mayhar <fmayhar(a)google.com> Co-developed-by: Junho Ryu <jayr(a)google.com> Co-developed-by: Khazhismel Kumykov <khazhy(a)google.com> Reviewed-by: Reviewed-by: Khazhismel Kumykov <khazhy(a)google.com> Co-developed-by: Gabriel Krisman Bertazi <krisman(a)collabora.com> Reviewed-by: Lee Duncan <lduncan(a)suse.com> Signed-off-by: Bharath Ravi <rbharath(a)google.com> Signed-off-by: Dave Clausen <dclausen(a)google.com> Signed-off-by: Nick Black <nlb(a)google.com> Signed-off-by: Vaibhav Nagarnaik <vnagarnaik(a)google.com> Signed-off-by: Anatol Pomazau <anatol(a)google.com> Signed-off-by: Tahsin Erdogan <tahsin(a)google.com> Signed-off-by: Frank Mayhar <fmayhar(a)google.com> Signed-off-by: Junho Ryu <jayr(a)google.com> Signed-off-by: Khazhismel Kumykov <khazhy(a)google.com> Signed-off-by: Gabriel Krisman Bertazi <krisman(a)collabora.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/scsi/scsi_transport_iscsi.c | 68 +++++++++++++++++++++++++++++ include/scsi/scsi_transport_iscsi.h | 1 + 2 files changed, 69 insertions(+) diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c index 698347301198..e1ac96b8940b 100644 --- a/drivers/scsi/scsi_transport_iscsi.c +++ b/drivers/scsi/scsi_transport_iscsi.c @@ -81,6 +81,12 @@ struct iscsi_internal { struct transport_container session_cont; }; +/* Worker to perform connection failure on unresponsive connections + * completely in kernel space. + */ +static void stop_conn_work_fn(struct work_struct *work); +static DECLARE_WORK(stop_conn_work, stop_conn_work_fn); + static atomic_t iscsi_session_nr; /* sysfs session id for next new session */ static struct workqueue_struct *iscsi_eh_timer_workq; @@ -1609,6 +1615,7 @@ static DEFINE_MUTEX(rx_queue_mutex); static LIST_HEAD(sesslist); static DEFINE_SPINLOCK(sesslock); static LIST_HEAD(connlist); +static LIST_HEAD(connlist_err); static DEFINE_SPINLOCK(connlock); static uint32_t iscsi_conn_get_sid(struct iscsi_cls_conn *conn) @@ -2247,6 +2254,7 @@ iscsi_create_conn(struct iscsi_cls_session *session, int dd_size, uint32_t cid) mutex_init(&conn->ep_mutex); INIT_LIST_HEAD(&conn->conn_list); + INIT_LIST_HEAD(&conn->conn_list_err); conn->transport = transport; conn->cid = cid; @@ -2293,6 +2301,7 @@ int iscsi_destroy_conn(struct iscsi_cls_conn *conn) spin_lock_irqsave(&connlock, flags); list_del(&conn->conn_list); + list_del(&conn->conn_list_err); spin_unlock_irqrestore(&connlock, flags); transport_unregister_device(&conn->dev); @@ -2407,6 +2416,51 @@ int iscsi_offload_mesg(struct Scsi_Host *shost, } EXPORT_SYMBOL_GPL(iscsi_offload_mesg); +static void stop_conn_work_fn(struct work_struct *work) +{ + struct iscsi_cls_conn *conn, *tmp; + unsigned long flags; + LIST_HEAD(recovery_list); + + spin_lock_irqsave(&connlock, flags); + if (list_empty(&connlist_err)) { + spin_unlock_irqrestore(&connlock, flags); + return; + } + list_splice_init(&connlist_err, &recovery_list); + spin_unlock_irqrestore(&connlock, flags); + + list_for_each_entry_safe(conn, tmp, &recovery_list, conn_list_err) { + uint32_t sid = iscsi_conn_get_sid(conn); + struct iscsi_cls_session *session; + + mutex_lock(&rx_queue_mutex); + + session = iscsi_session_lookup(sid); + if (session) { + if (system_state != SYSTEM_RUNNING) { + session->recovery_tmo = 0; + conn->transport->stop_conn(conn, + STOP_CONN_TERM); + } else { + conn->transport->stop_conn(conn, + STOP_CONN_RECOVER); + } + } + + list_del_init(&conn->conn_list_err); + + mutex_unlock(&rx_queue_mutex); + + /* we don't want to hold rx_queue_mutex for too long, + * for instance if many conns failed at the same time, + * since this stall other iscsi maintenance operations. + * Give other users a chance to proceed. + */ + cond_resched(); + } +} + void iscsi_conn_error_event(struct iscsi_cls_conn *conn, enum iscsi_err error) { struct nlmsghdr *nlh; @@ -2414,6 +2468,12 @@ void iscsi_conn_error_event(struct iscsi_cls_conn *conn, enum iscsi_err error) struct iscsi_uevent *ev; struct iscsi_internal *priv; int len = nlmsg_total_size(sizeof(*ev)); + unsigned long flags; + + spin_lock_irqsave(&connlock, flags); + list_add(&conn->conn_list_err, &connlist_err); + spin_unlock_irqrestore(&connlock, flags); + queue_work(system_unbound_wq, &stop_conn_work); priv = iscsi_if_transport_lookup(conn->transport); if (!priv) @@ -2743,11 +2803,19 @@ static int iscsi_if_destroy_conn(struct iscsi_transport *transport, struct iscsi_uevent *ev) { struct iscsi_cls_conn *conn; + unsigned long flags; conn = iscsi_conn_lookup(ev->u.d_conn.sid, ev->u.d_conn.cid); if (!conn) return -EINVAL; + spin_lock_irqsave(&connlock, flags); + if (!list_empty(&conn->conn_list_err)) { + spin_unlock_irqrestore(&connlock, flags); + return -EAGAIN; + } + spin_unlock_irqrestore(&connlock, flags); + ISCSI_DBG_TRANS_CONN(conn, "Destroying transport conn\n"); if (transport->destroy_conn) transport->destroy_conn(conn); diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h index b266d2a3bcb1..7de0bf6a9b60 100644 --- a/include/scsi/scsi_transport_iscsi.h +++ b/include/scsi/scsi_transport_iscsi.h @@ -203,6 +203,7 @@ extern void iscsi_ping_comp_event(uint32_t host_no, struct iscsi_cls_conn { struct list_head conn_list; /* item in connlist */ + struct list_head conn_list_err; /* item in connlist_err */ void *dd_data; /* LLD private data */ struct iscsi_transport *transport; uint32_t cid; /* connection id */ -- 2.25.1

1 0

[PATCH 00/38] backport stable-4.19.163
by Yang Yingliang 14 Dec '20

14 Dec '20

Bjørn Mork (1): USB: serial: option: fix Quectel BG96 matching Bob Peterson (1): gfs2: check for empty rgrp tree in gfs2_ri_update Christian Eggers (3): i2c: imx: Don't generate STOP condition if arbitration has been lost i2c: imx: Fix reset of I2SR_IAL flag i2c: imx: Check for I2SR_IAL after every byte Florian Westphal (1): netfilter: nf_tables: avoid false-postive lockdep splat Giacinto Cifelli (1): USB: serial: option: add support for Thales Cinterion EXS82 Greg Kroah-Hartman (1): Linux 4.19.163 Hans de Goede (2): pinctrl: baytrail: Replace WARN with dev_info_once when setting direct-irq pin to output pinctrl: baytrail: Fix pin being driven low for a while on gpiod_get(..., GPIOD_OUT_HIGH) Jakub Kicinski (1): Revert "geneve: pull IP header before ECN decapsulation" Jan-Niklas Burfeind (1): USB: serial: ch341: add new Product ID for CH341A Jian-Hong Pan (1): ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 Johan Hovold (2): USB: serial: kl5kusb105: fix memleak on open USB: serial: ch341: sort device-id entries Kailang Yang (1): ALSA: hda/realtek - Add new codec supported for ALC897 Lukas Wunner (3): spi: Introduce device-managed SPI controller allocation spi: bcm-qspi: Fix use-after-free on unbind spi: bcm2835: Fix use-after-free on unbind Luo Meng (1): Input: i8042 - fix error return code in i8042_setup_aux() Masami Hiramatsu (2): x86/uprobes: Do not use prefixes.nbytes when looping over prefixes.bytes x86/insn-eval: Use new for_each_insn_prefix() macro to loop over prefixes bytes Mike Snitzer (2): dm: remove invalid sparse __acquires and __releases annotations dm writecache: remove BUG() and fail gracefully instead Mikulas Patocka (1): dm writecache: fix the maximum number of arguments Naveen N. Rao (1): ftrace: Fix updating FTRACE_FL_TRAMP Paulo Alcantara (1): cifs: fix potential use-after-free in cifs_echo_request() Peter Ujfalusi (1): spi: bcm2835: Release the DMA channel if probe fails after dma_init Qian Cai (1): mm/swapfile: do not sleep with a spin lock held Steven Rostedt (VMware) (1): tracing: Fix userstacktrace option for instances Suganath Prabu S (1): scsi: mpt3sas: Fix ioctl timeout Suravee Suthikulpanit (1): iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs Takashi Iwai (2): ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model ALSA: hda/generic: Add option to enforce preferred_dacs pairs Vamsi Krishna Samavedam (1): usb: gadget: f_fs: Use local copy of descriptors for userspace copy Vincent Palatin (1): USB: serial: option: add Fibocom NL668 variants Yang Shi (1): mm: list_lru: set shrinker map bit when child nr_items is not zero Zhihao Cheng (1): i2c: qup: Fix error return code in qup_i2c_bam_schedule_desc() Makefile | 2 +- arch/x86/include/asm/insn.h | 15 +++++ arch/x86/kernel/uprobes.c | 10 ++-- arch/x86/lib/insn-eval.c | 5 +- drivers/i2c/busses/i2c-imx.c | 42 +++++++++++--- drivers/i2c/busses/i2c-qup.c | 3 +- drivers/input/serio/i8042.c | 3 +- drivers/iommu/amd_iommu_types.h | 2 +- drivers/md/dm-writecache.c | 4 +- drivers/md/dm.c | 2 - drivers/net/geneve.c | 20 ++----- drivers/pinctrl/intel/pinctrl-baytrail.c | 67 ++++++++++++++++++----- drivers/scsi/mpt3sas/mpt3sas_ctl.c | 2 +- drivers/spi/spi-bcm-qspi.c | 34 ++++-------- drivers/spi/spi-bcm2835.c | 22 +++----- drivers/spi/spi.c | 58 +++++++++++++++++++- drivers/usb/gadget/function/f_fs.c | 6 +- drivers/usb/serial/ch341.c | 5 +- drivers/usb/serial/kl5kusb105.c | 10 ++-- drivers/usb/serial/option.c | 10 ++-- fs/cifs/connect.c | 2 + fs/gfs2/rgrp.c | 4 ++ include/linux/spi/spi.h | 19 +++++++ kernel/trace/ftrace.c | 22 +++++++- kernel/trace/trace.c | 7 ++- kernel/trace/trace.h | 6 +- mm/list_lru.c | 10 ++-- mm/swapfile.c | 4 +- net/netfilter/nf_tables_api.c | 3 +- sound/pci/hda/hda_generic.c | 12 ++-- sound/pci/hda/hda_generic.h | 1 + sound/pci/hda/patch_realtek.c | 6 ++ tools/objtool/arch/x86/include/asm/insn.h | 15 +++++ tools/perf/util/intel-pt-decoder/insn.h | 15 +++++ 34 files changed, 329 insertions(+), 119 deletions(-) -- 2.25.1

1 38

[PATCH 1/5] scsi: hisi_sas: Delete down() when handle Block-IO
by Yang Yingliang 14 Dec '20

14 Dec '20

From: Yang Xingui <yangxingui(a)huawei.com> driver inclusion category: bugfix bugzilla: NA CVE: NA Call down() at RCU Read-Side Critical Secrion sometimes may caugh a RCU preempt Calltrace. [ 3506.800288] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 3506.806357] rcu: Tasks blocked on level-1 rcu_node (CPUs 0-15): P22895/1:b..l [ 3506.813556] (detected by 108, t=162805 jiffies, g=124209, q=59192378) [ 3506.820056] kworker/0:1H D 0 22895 2 0x00000228 [ 3506.825524] Workqueue: kblockd blk_mq_run_work_fn [ 3506.830207] Call trace: [ 3506.832644] __switch_to+0xf0/0x140 [ 3506.836118] __schedule+0x890/0xdc8 [ 3506.839590] schedule+0x80/0x120 [ 3506.842804] schedule_timeout+0x22c/0x328 [ 3506.846796] __down+0x74/0xc8 [ 3506.849751] down+0x54/0x70 [ 3506.852539] hisi_sas_task_exec.isra.25+0x840/0xf28 [hisi_sas_main] [ 3506.858780] hisi_sas_queue_command+0x40/0x84 [hisi_sas_main] [ 3506.864502] sas_queuecommand+0x144/0x1c8 [libsas] [ 3506.869271] scsi_queue_rq+0x72c/0xa20 [ 3506.873005] blk_mq_dispatch_rq_list+0x110/0x680 [ 3506.877601] blk_mq_do_dispatch_sched+0x108/0x148 [ 3506.882285] __blk_mq_sched_dispatch_requests+0x120/0x1b8 [ 3506.887659] blk_mq_sched_dispatch_requests+0x40/0x78 [ 3506.892688] __blk_mq_run_hw_queue+0xb8/0x138 [ 3506.897026] blk_mq_run_work_fn+0x28/0x38 Actually it's no need for keeping IO stopping here to wait for controller reset complete. We can directly return error code. Signed-off-by: Yang Xingui <yangxingui(a)huawei.com> Reviewed-by: Zhu Xiongxiong <zhuxiongxiong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/scsi/hisi_sas/hisi_sas_main.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c index 124aa26fa4b8..0128c547e4c8 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_main.c +++ b/drivers/scsi/hisi_sas/hisi_sas_main.c @@ -611,19 +611,9 @@ static int hisi_sas_task_exec(struct sas_task *task, gfp_t gfp_flags, hisi_hba = dev_to_hisi_hba(device); dev = hisi_hba->dev; - if (unlikely(test_bit(HISI_SAS_REJECT_CMD_BIT, &hisi_hba->flags))) { - /* - * For IOs from upper layer, it may already disable preempt - * in the IO path, if disable preempt again in down(), - * function schedule() will report schedule_bug(), so check - * preemptible() before goto down(). - */ - if (!preemptible()) - return -EINVAL; + if (unlikely(test_bit(HISI_SAS_REJECT_CMD_BIT, &hisi_hba->flags))) + return -EINVAL; - down(&hisi_hba->sem); - up(&hisi_hba->sem); - } /* protect task_prep and start_delivery sequence */ rc = hisi_sas_task_prep(task, is_tmf, tmf, &pass, &dq); -- 2.25.1

1 4

[PATCH v2] arm64/mpam: Avoid compilation error of enable_acpi redefinition
by Wang ShaoBo 11 Dec '20

11 Dec '20

hulk inclusion category: bugfix bugzilla: 46772 CVE: NA Reference: https://gitee.com/openeuler/kernel/issues/I28HIY ------------------------------------------------- enable_acpi is declaration as a enumerated type in mpam, where it's also defined as a static inline function in acpi.h, this following compilation error will be triggered if we use their two like this. In file included from ./include/acpi/acpi_io.h:7:0, from ./include/linux/acpi.h:47, from ./arch/arm64/include/asm/machine_t.h:26, from arch/arm64/kernel/process.c:64: ./arch/arm64/include/asm/acpi.h:82:20: error: ‘enable_acpi’ redeclared as different kind of symbol static inline void enable_acpi(void) ^~~~~~~~~~~ In file included from arch/arm64/kernel/process.c:61:0: ./arch/arm64/include/asm/mpam_sched.h:46:2: note: previous definition of ‘enable_acpi’ was here enable_acpi, We should rename enable_acpi properly for mpam. Reported-by: Zhengyuan Liu <liuzhengyuan(a)tj.kylinos.cn> Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> --- arch/arm64/include/asm/mpam_sched.h | 6 +++--- arch/arm64/kernel/mpam.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/arch/arm64/include/asm/mpam_sched.h b/arch/arm64/include/asm/mpam_sched.h index 350296157087a..ddc7ce3e1a9e1 100644 --- a/arch/arm64/include/asm/mpam_sched.h +++ b/arch/arm64/include/asm/mpam_sched.h @@ -41,9 +41,9 @@ static inline void mpam_sched_in(void) } enum mpam_enable_type { - enable_denied = 0, - enable_default, - enable_acpi, + MPAM_ENABLE_DENIED = 0, + MPAM_ENABLE_DEFAULT, + MPAM_ENABLE_ACPI, }; extern enum mpam_enable_type __read_mostly mpam_enabled; diff --git a/arch/arm64/kernel/mpam.c b/arch/arm64/kernel/mpam.c index 3f89cec8e2fb1..96f4d013a9034 100644 --- a/arch/arm64/kernel/mpam.c +++ b/arch/arm64/kernel/mpam.c @@ -252,7 +252,7 @@ int __init mpam_force_init(void) { int ret; - if (mpam_enabled != enable_default) + if (mpam_enabled != MPAM_ENABLE_DEFAULT) return 0; ret = mpam_nodes_discovery_start(); @@ -1380,9 +1380,9 @@ enum mpam_enable_type __read_mostly mpam_enabled; static int __init mpam_setup(char *str) { if (!strcmp(str, "=acpi")) - mpam_enabled = enable_acpi; + mpam_enabled = MPAM_ENABLE_ACPI; else - mpam_enabled = enable_default; + mpam_enabled = MPAM_ENABLE_DEFAULT; return 1; } __setup("mpam", mpam_setup); -- 2.17.1

1 0

【会议纪要】 Re: openEuler kernel sig meeting
by Xie XiuQi 11 Dec '20

11 Dec '20

会议纪要：与会人：Zheng Zhenpeng, xiexiuqi， dukaitian, myeuler, jiaoff, Liu Yuan, Wenlong.Ding, 潘晨博 1. 网迅万兆网卡驱动合入 openEuler 内核讨论 - 郑振鹏、刘源 > > 网迅万兆网卡是国内具有完全知识产权的万兆网络控制器，相关资料请访问官方网站： > 网卡成品及资料 > https://www.net-swift.com/a/383.html > 网卡芯片 > https://www.net-swift.com/a/275.html > > 之前我们已向EulerOS发布版本提供万兆网卡驱动rpm包，此次希望能加深合作， > 将驱动源码推入openeuler内核。 > 根据开源规则（遵从GPLV2），我厂已在官网上提供源码下载 1）openEuler 欢迎网讯网卡驱动合入社区，使 openEuler 支持更丰富的设备。 2）kernel sig 同意网讯万兆网卡驱动合入 openEuler，后续驱动可以按照开源社区的规范，准备补丁； - 建议合入openEuler 20.03 LTS SP2 （kernel-4.19)，如果时间赶不上的话，与 Release sig 讨论是否可以合入后续 update 版本； - 该驱动代码量约 5w+ 行，首次合入时，不要求把所有开发历史作为补丁发出来，可以按照模块或者功能做适当的补丁拆分； 3）建议加入到兼容性sig 组，兼容性 sig 与网讯网卡确认的认证过程 4）与 Release sig 对齐 Release 节奏 5）另有针对网讯网卡针对 dpdk 的适配，也欢迎参与 openEuler，贡献社区。 On 2020/12/10 9:32, zhenpengzheng(a)net-swift.com wrote: > 收到，我会按时参加。 > > ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ > > **************************************************************** > > 郑振鹏(zheng zhenpeng) > > 北京网迅科技有限公司杭州分公司软件工程师 > > 浙江省杭州市西湖区文三路478号华星时代广场A座507室 310013 > > Beijing WangXun Technology Co., Ltd. Software Engineer. > > Room A507, HuaXing Times Square, No.478 West Wensan Road. > > West Lake District, Hangzhou City, 310013 ZHEJIANG, P.R.CHINA. > > > > Office: +86(0571)89807901-8014 > > Mobile: +86-13656681762 > > E-Mail: z <mailto:jianwang@trustnetic.com>henpengzheng(a)net-swift.com > > **************************************************************** > > > *发件人：* Xie XiuQi <mailto:xiexiuqi@huawei.com> > *发送时间：* 2020-12-09 20:09 > *收件人：* kernel(a)openeuler.org <mailto:kernel@openeuler.org> > *抄送：* tc(a)openeuler.org <mailto:tc@openeuler.org>; dev(a)openeuler.org <mailto:dev@openeuler.org>; release(a)openeuler.org <mailto:release@openeuler.org>; 郑振鹏 <mailto:zhenpengzheng@net-swift.com>; Liuyuan (Compatibility, Cloud Infrastructure Service Product Dept.) <mailto:liuyuan36@huawei.com> > *主题：* Re: [Release] Re: 【议题申报】 openEuler kernel sig meeting > 议题： > > 1）网迅万兆网卡驱动合入 openEuler 内核讨论 - 郑振鹏、刘源 > > 网迅万兆网卡是国内具有完全知识产权的万兆网络控制器，相关资料请访问官方网站： > 网卡成品及资料 > https://www.net-swift.com/a/383.html > 网卡芯片 > https://www.net-swift.com/a/275.html > > 之前我们已向EulerOS发布版本提供万兆网卡驱动rpm包，此次希望能加深合作，将驱动源码推入openeuler内核。 > 根据开源规则（遵从GPLV2），我厂已在官网上提供源码下载 > > > 欢迎继续申报议题 > > On 2020/12/2 19:52, Xie XiuQi wrote: > > > > > > On 2020/12/2 19:26, openEuler conference wrote: > >> 您好！ > >> > >> openEuler Kernel SIG 邀请您参加 2020-12-11 10:00 召开的ZOOM会议 > >> > >> 会议主题：openEuler kernel sig meeting > >> > >> 会议链接：https://zoom.us/j/95008051399?pwd=RVRzNk0zSVUxdmVaaWZjT1d4UEhVQT09 > >> > >> 更多资讯尽在：https://openeuler.org/zh/ > >> > >> > >> > >> Hello! > >> > >> openEuler Kernel SIG invites you to attend the ZOOM conference will be held at 2020-12-11 10:00, > >> > >> The subject of the conference is openEuler kernel sig meeting, > >> > >> You can join the meeting at https://zoom.us/j/95008051399?pwd=RVRzNk0zSVUxdmVaaWZjT1d4UEhVQT09. > >> > >> More information <https://openeuler.org/zh/> > >> > >> > >> _______________________________________________ > >> Release mailing list -- release(a)openeuler.org > >> To unsubscribe send an email to release-leave(a)openeuler.org > >> > > _______________________________________________ > > Release mailing list -- release(a)openeuler.org > > To unsubscribe send an email to release-leave(a)openeuler.org > > > >

1 0

[PATCH] arm64/mpam: Avoid compilation error of enable_acpi redefinition
by Wang ShaoBo 10 Dec '20

10 Dec '20

hulk inclusion category: bugfix bugzilla: 46772 CVE: NA Reference: https://gitee.com/openeuler/kernel/issues/I28HIY ------------------------------------------------- enable_acpi is declaration as a enumerated type in mpam, where it's also defined as a static inline function in acpi.h, this following compilation error will be triggered if we use their two like this. In file included from ./include/acpi/acpi_io.h:7:0, from ./include/linux/acpi.h:47, from ./arch/arm64/include/asm/machine_t.h:26, from arch/arm64/kernel/process.c:64: ./arch/arm64/include/asm/acpi.h:82:20: error: ‘enable_acpi’ redeclared as different kind of symbol static inline void enable_acpi(void) ^~~~~~~~~~~ In file included from arch/arm64/kernel/process.c:61:0: ./arch/arm64/include/asm/mpam_sched.h:46:2: note: previous definition of ‘enable_acpi’ was here enable_acpi, We should rename enable_acpi properly for mpam. Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> --- arch/arm64/include/asm/mpam_sched.h | 6 +++--- arch/arm64/kernel/mpam.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/arch/arm64/include/asm/mpam_sched.h b/arch/arm64/include/asm/mpam_sched.h index 350296157087a..ddc7ce3e1a9e1 100644 --- a/arch/arm64/include/asm/mpam_sched.h +++ b/arch/arm64/include/asm/mpam_sched.h @@ -41,9 +41,9 @@ static inline void mpam_sched_in(void) } enum mpam_enable_type { - enable_denied = 0, - enable_default, - enable_acpi, + MPAM_ENABLE_DENIED = 0, + MPAM_ENABLE_DEFAULT, + MPAM_ENABLE_ACPI, }; extern enum mpam_enable_type __read_mostly mpam_enabled; diff --git a/arch/arm64/kernel/mpam.c b/arch/arm64/kernel/mpam.c index 3f89cec8e2fb1..96f4d013a9034 100644 --- a/arch/arm64/kernel/mpam.c +++ b/arch/arm64/kernel/mpam.c @@ -252,7 +252,7 @@ int __init mpam_force_init(void) { int ret; - if (mpam_enabled != enable_default) + if (mpam_enabled != MPAM_ENABLE_DEFAULT) return 0; ret = mpam_nodes_discovery_start(); @@ -1380,9 +1380,9 @@ enum mpam_enable_type __read_mostly mpam_enabled; static int __init mpam_setup(char *str) { if (!strcmp(str, "=acpi")) - mpam_enabled = enable_acpi; + mpam_enabled = MPAM_ENABLE_ACPI; else - mpam_enabled = enable_default; + mpam_enabled = MPAM_ENABLE_DEFAULT; return 1; } __setup("mpam", mpam_setup); -- 2.17.1

2 1

[PATCH 00/32] backport stable-4.19.162
by Yang Yingliang 10 Dec '20

10 Dec '20

Alexander Duyck (1): tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control Anmol Karn (1): rose: Fix Null pointer dereference in rose_send_frame() Antoine Tenart (2): netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal net: ip6_gre: set dev->hard_header_len when using header_ops Dan Carpenter (2): net/x25: prevent a couple of overflows chelsio/chtls: fix a double free in chtls_setkey() Eran Ben Elisha (1): net/mlx5: Fix wrong address reclaim when command interface is down Eric Dumazet (1): geneve: pull IP header before ECN decapsulation Greg Kroah-Hartman (1): Linux 4.19.162 Guillaume Nault (1): ipv4: Fix tos mask in inet_rtm_getroute() Hector Martin (1): ALSA: usb-audio: US16x08: fix value count for level meters Jamie Iles (1): bonding: wait for sysfs kobject destruction before freeing struct slave Jens Axboe (1): tun: honor IOCB_NOWAIT flag Julian Wiedmann (1): net/af_iucv: set correct sk_protocol for child sockets Krzysztof Kozlowski (1): dt-bindings: net: correct interrupt flags in examples Lijun Pan (1): ibmvnic: fix call_netdevice_notifiers in do_reset Maxim Mikityanskiy (1): net/tls: Protect from calling tls_dev_del for TLS RX twice Po-Hsu Lin (1): Input: i8042 - add ByteSpeed touchpad to noloop table Sanjay Govind (1): Input: xpad - support Ardwiino Controllers Shiraz Saleem (1): RDMA/i40iw: Address an mmap handler exploit in i40iw Sylwester Dziedziuch (1): i40e: Fix removing driver while bare-metal VFs pass traffic Thomas Falcon (2): ibmvnic: Ensure that SCRQ entry reads are correctly ordered ibmvnic: Fix TX completion error handling Vadim Fedorenko (1): net/tls: missing received data after fast remote close Vasily Averin (1): tracing: Remove WARN_ON in start_thread() Vinay Kumar Yadav (1): chelsio/chtls: fix panic during unload reload chtls Wang Hai (2): ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init net: mvpp2: Fix error return code in mvpp2_open() Willem de Bruijn (1): sock: set sk_err to ee_errno on dequeue from errq Yves-Alexis Perez (1): usbnet: ipheth: fix connectivity with iOS 14 Zhang Changzhong (2): cxgb3: fix error return code in t3_sge_alloc_qset() net: pasemi: fix error return code in pasemi_mac_open() .../devicetree/bindings/net/nfc/nxp-nci.txt | 2 +- .../devicetree/bindings/net/nfc/pn544.txt | 2 +- Makefile | 2 +- drivers/crypto/chelsio/chtls/chtls_cm.c | 1 + drivers/crypto/chelsio/chtls/chtls_hw.c | 1 + drivers/infiniband/hw/i40iw/i40iw_main.c | 5 -- drivers/infiniband/hw/i40iw/i40iw_verbs.c | 36 +++-------- drivers/input/joystick/xpad.c | 2 + drivers/input/serio/i8042-x86ia64io.h | 4 ++ drivers/net/bonding/bond_main.c | 61 +++++++++++++------ drivers/net/bonding/bond_sysfs_slave.c | 18 +----- drivers/net/ethernet/chelsio/cxgb3/sge.c | 1 + drivers/net/ethernet/ibm/ibmvnic.c | 26 ++++++-- drivers/net/ethernet/intel/i40e/i40e.h | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 22 ++++--- .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 26 ++++---- .../net/ethernet/marvell/mvpp2/mvpp2_main.c | 1 + .../ethernet/mellanox/mlx5/core/pagealloc.c | 21 ++++++- drivers/net/ethernet/pasemi/pasemi_mac.c | 8 ++- drivers/net/geneve.c | 20 ++++-- drivers/net/tun.c | 14 ++++- drivers/net/usb/ipheth.c | 2 +- include/net/bonding.h | 8 +++ include/net/tls.h | 6 ++ kernel/trace/trace_hwlat.c | 2 +- net/bridge/br_netfilter_hooks.c | 7 ++- net/core/skbuff.c | 2 +- net/ipv4/route.c | 7 ++- net/ipv4/tcp_cong.c | 5 ++ net/ipv6/addrlabel.c | 26 +++++--- net/ipv6/ip6_gre.c | 16 ++++- net/iucv/af_iucv.c | 4 +- net/rose/rose_loopback.c | 17 ++++-- net/tls/tls_device.c | 5 +- net/tls/tls_sw.c | 6 ++ net/x25/af_x25.c | 6 +- sound/usb/mixer_us16x08.c | 2 +- 37 files changed, 260 insertions(+), 135 deletions(-) -- 2.25.1

1 32

[PATCH] fanotify: fix merging marks masks with FAN_ONDIR
by Yang Yingliang 10 Dec '20

10 Dec '20

From: Amir Goldstein <amir73il(a)gmail.com> mainline inclusion from mainline-5.7-rc1 commit 55bf882c7f13dda8bbe624040c6d5b4fbb812d16 category: bugfix bugzilla: 46764 CVE: NA https://gitee.com/openeuler/kernel/issues/I27PTB?from=project-issue --------------------------- Change the logic of FAN_ONDIR in two ways that are similar to the logic of FAN_EVENT_ON_CHILD, that was fixed in commit 54a307ba8d3c ("fanotify: fix logic of events on child"): 1. The flag is meaningless in ignore mask 2. The flag refers only to events in the mask of the mark where it is set This is what the fanotify_mark.2 man page says about FAN_ONDIR: "Without this flag, only events for files are created." It doesn't say anything about setting this flag in ignore mask to stop getting events on directories nor can I think of any setup where this capability would be useful. Currently, when marks masks are merged, the FAN_ONDIR flag set in one mark affects the events that are set in another mark's mask and this behavior causes unexpected results. For example, a user adds a mark on a directory with mask FAN_ATTRIB | FAN_ONDIR and a mount mark with mask FAN_OPEN (without FAN_ONDIR). An opendir() of that directory (which is inside that mount) generates a FAN_OPEN event even though neither of the marks requested to get open events on directories. Link: https://lore.kernel.org/r/20200319151022.31456-10-amir73il@gmail.com Signed-off-by: Amir Goldstein <amir73il(a)gmail.com> Signed-off-by: Jan Kara <jack(a)suse.cz> Conflicts: fs/notify/fanotify/fanotify.c Signed-off-by: yangerkun <yangerkun(a)huawei.com> Reviewed-by: zhangyi (F) <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/notify/fanotify/fanotify.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c index ca3405f73264..cdf0dc9ddbbb 100644 --- a/fs/notify/fanotify/fanotify.c +++ b/fs/notify/fanotify/fanotify.c @@ -117,6 +117,12 @@ static bool fanotify_should_send_event(struct fsnotify_iter_info *iter_info, /* Apply ignore mask regardless of ISDIR and ON_CHILD flags */ marks_ignored_mask |= mark->ignored_mask; + /* + * If the event is on dir and this mark doesn't care about + * events on dir, don't send it! + */ + if (d_is_dir(path->dentry) && !(mark->mask & FS_ISDIR)) + continue; /* * If the event is for a child and this mark doesn't care about @@ -130,10 +136,6 @@ static bool fanotify_should_send_event(struct fsnotify_iter_info *iter_info, marks_mask |= mark->mask; } - if (d_is_dir(path->dentry) && - !(marks_mask & FS_ISDIR & ~marks_ignored_mask)) - return false; - if (event_mask & FAN_ALL_OUTGOING_EVENTS & marks_mask & ~marks_ignored_mask) return true; -- 2.25.1

1 0

openEuler kernel sig meeting
by openEuler conference 09 Dec '20

09 Dec '20

3 3

[PATCH 01/17] share_pool: Fix series of bugs
by Yang Yingliang 08 Dec '20

08 Dec '20

From: Tang Yizhou <tangyizhou(a)huawei.com> ascend inclusion category: bugfix bugzilla: NA CVE: NA ------------------------------------------------- 1. Error handling of sp_free(). 2. When sp_alloc(..., SP_HUGEPAGE, ...) rollbacks to normal page, we need to call vfs_fallocate() otherwise memory leaks until sp group is dead. 3. When sp_alloc(..., SP_HUGEPAGE, ...) rollbacks to normal page, we need to clear SP_HUGEPAGE bit in sp_flags then spa_stat interface will show the spa as a normal page spa correctly. 4. Add the reference count of a spg in find_or_alloc_sp_group() due to closer relationship. Signed-off-by: Tang Yizhou <tangyizhou(a)huawei.com> Reviewed-by: Ding Tianhong <dingtianhong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/share_pool.c | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/mm/share_pool.c b/mm/share_pool.c index d39c2c3d728c..a71f6fb214ce 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -358,7 +358,7 @@ static struct sp_group *find_or_alloc_sp_group(int spg_id) spg->hugepage_failures = 0; spg->dvpp_multi_spaces = false; spg->owner = current->group_leader; - atomic_set(&spg->use_count, 0); + atomic_set(&spg->use_count, 1); INIT_LIST_HEAD(&spg->procs); INIT_LIST_HEAD(&spg->spa_list); @@ -391,6 +391,10 @@ static struct sp_group *find_or_alloc_sp_group(int spg_id) ret = PTR_ERR(spg->file_hugetlb); goto out_fput; } + } else { + if (!spg_valid(spg)) + return ERR_PTR(-ENODEV); + atomic_inc(&spg->use_count); } return spg; @@ -540,12 +544,6 @@ int sp_group_add_task(int pid, int spg_id) goto out_put_task; } - if (!spg_valid(spg)) { - ret = -ENODEV; - goto out_put_task; - } - atomic_inc(&spg->use_count); - /* access control permission check */ if (sysctl_ac_mode == AC_SINGLE_OWNER) { if (spg->owner != current->group_leader) { @@ -1102,6 +1100,7 @@ int sp_free(unsigned long addr) if (printk_ratelimit()) pr_err("share pool: sp free failed, addr %pK is not from sp_alloc\n", (void *)addr); + goto drop_spa; } if (!spg_valid(spa->spg)) @@ -1312,31 +1311,32 @@ void *sp_alloc(unsigned long size, unsigned long sp_flags, int spg_id) __sp_free(spg, sp_addr, size_aligned, list_next_entry(mm, sp_node)); + if (printk_ratelimit()) + pr_warn("share pool: allocation failed due to mm populate failed" + "(potential no enough memory when -12): %d\n", ret); + p = ERR_PTR(ret); + + mode = FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE; + offset = sp_addr - MMAP_SHARE_POOL_START; + + ret = vfs_fallocate(spa_file(spa), mode, offset, spa_size(spa)); + if (ret) + pr_err("share pool: sp alloc normal page fallocate failed %d\n", ret); + if (file == spg->file_hugetlb) { spg->hugepage_failures++; /* fallback to small pages */ if (!(sp_flags & SP_HUGEPAGE_ONLY)) { file = spg->file; - spa->is_hugepage = false; size_aligned = ALIGN(size, PAGE_SIZE); + sp_flags &= ~SP_HUGEPAGE; __sp_area_drop(spa); mmput(mm); goto try_again; } } - if (printk_ratelimit()) - pr_warn("share pool: allocation failed due to mm populate failed" - "(potential no enough memory when -12): %d\n", ret); - p = ERR_PTR(ret); - - mode = FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE; - offset = sp_addr - MMAP_SHARE_POOL_START; - ret = vfs_fallocate(spa_file(spa), mode, offset, spa_size(spa)); - if (ret) - pr_err("share pool: fallocate failed %d\n", ret); - mmput(mm); break; } -- 2.25.1

1 16

[PATCH 1/7] ascend: share_pool: Use sharepool_no_page to alloc hugepage
by Yang Yingliang 08 Dec '20

08 Dec '20

From: Weilong Chen <chenweilong(a)huawei.com> ascend inclusion category: feature bugzilla: NA CVE: NA ------------------------------------------------- Sharepool applies for a dedicated interface for large pages, which optimizes the efficiency of memory application Reviewed-by: Ding Tianhong <dingtianhong(a)huawei.com> Signed-off-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/hugetlb.h | 4 ++ include/linux/share_pool.h | 5 +++ mm/hugetlb.c | 22 +++++++--- mm/share_pool.c | 90 ++++++++++++++++++++++++++++++++++++++ 4 files changed, 115 insertions(+), 6 deletions(-) diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index bd658f44e133..be649e5ba322 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -645,4 +645,8 @@ static inline spinlock_t *huge_pte_lock(struct hstate *h, return ptl; } +#ifdef CONFIG_ASCEND_SHARE_POOL +pte_t make_huge_pte(struct vm_area_struct *vma, struct page *page, int writable); +#endif + #endif /* _LINUX_HUGETLB_H */ diff --git a/include/linux/share_pool.h b/include/linux/share_pool.h index 2557ef138122..47d8579c23ec 100644 --- a/include/linux/share_pool.h +++ b/include/linux/share_pool.h @@ -220,6 +220,11 @@ static inline void sp_dump_stack(void) dump_stack(); } +vm_fault_t sharepool_no_page(struct mm_struct *mm, + struct vm_area_struct *vma, + struct address_space *mapping, pgoff_t idx, + unsigned long address, pte_t *ptep, unsigned int flags); + #else static inline int sp_group_add_task(int pid, int spg_id) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 9d2035632aed..a68e7e1afd82 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -3352,8 +3352,13 @@ const struct vm_operations_struct hugetlb_vm_ops = { .pagesize = hugetlb_vm_op_pagesize, }; +#ifdef CONFIG_ASCEND_SHARE_POOL +pte_t make_huge_pte(struct vm_area_struct *vma, struct page *page, + int writable) +#else static pte_t make_huge_pte(struct vm_area_struct *vma, struct page *page, int writable) +#endif { pte_t entry; @@ -3370,6 +3375,9 @@ static pte_t make_huge_pte(struct vm_area_struct *vma, struct page *page, return entry; } +#ifdef CONFIG_ASCEND_SHARE_POOL +EXPORT_SYMBOL(make_huge_pte); +#endif static void set_huge_ptep_writable(struct vm_area_struct *vma, unsigned long address, pte_t *ptep) @@ -3962,12 +3970,6 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, } page = alloc_huge_page(vma, haddr, 0); - if (IS_ERR(page) && sp_check_vm_share_pool(vma->vm_flags)) { - page = alloc_huge_page_node(hstate_file(vma->vm_file), - numa_mem_id()); - if (!page) - page = ERR_PTR(-ENOMEM); - } if (IS_ERR(page)) { /* * Returning error will result in faulting task being @@ -4155,7 +4157,15 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, entry = huge_ptep_get(ptep); if (huge_pte_none(entry)) { +#ifdef CONFIG_ASCEND_SHARE_POOL + if (sp_check_vm_share_pool(vma->vm_flags)) { + ret = sharepool_no_page(mm, vma, mapping, idx, address, ptep, flags); + } else { + ret = hugetlb_no_page(mm, vma, mapping, idx, address, ptep, flags); + } +#else ret = hugetlb_no_page(mm, vma, mapping, idx, address, ptep, flags); +#endif goto out_mutex; } diff --git a/mm/share_pool.c b/mm/share_pool.c index 23195a76c2c6..286e74f99360 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -41,6 +41,8 @@ #include <linux/idr.h> #include <linux/proc_fs.h> #include <linux/seq_file.h> +#include <linux/rmap.h> +#include <linux/hugetlb.h> /* access control mode macros */ #define AC_NONE 0 @@ -2399,6 +2401,94 @@ static int spa_stat_show(struct seq_file *seq, void *offset) return 0; } +vm_fault_t sharepool_no_page(struct mm_struct *mm, + struct vm_area_struct *vma, + struct address_space *mapping, pgoff_t idx, + unsigned long address, pte_t *ptep, unsigned int flags) +{ + struct hstate *h = hstate_vma(vma); + vm_fault_t ret = VM_FAULT_SIGBUS; + unsigned long size; + struct page *page; + pte_t new_pte; + spinlock_t *ptl; + unsigned long haddr = address & huge_page_mask(h); + bool new_page = false; + int err; + +retry: + page = find_lock_page(mapping, idx); + if (!page) { + size = i_size_read(mapping->host) >> huge_page_shift(h); + if (idx >= size) + goto out; + + page = alloc_huge_page(vma, haddr, 0); + if (IS_ERR(page)) { + page = alloc_huge_page_node(hstate_file(vma->vm_file), + numa_mem_id()); + if (!page) + page = ERR_PTR(-ENOMEM); + } + if (IS_ERR(page)) { + ptl = huge_pte_lock(h, mm, ptep); + if (!huge_pte_none(huge_ptep_get(ptep))) { + ret = 0; + spin_unlock(ptl); + goto out; + } + spin_unlock(ptl); + ret = vmf_error(PTR_ERR(page)); + goto out; + } + __SetPageUptodate(page); + new_page = true; + + /* sharepool pages are all shared */ + err = huge_add_to_page_cache(page, mapping, idx); + if (err) { + put_page(page); + if (err == -EEXIST) + goto retry; + goto out; + } + } + + + ptl = huge_pte_lock(h, mm, ptep); + size = i_size_read(mapping->host) >> huge_page_shift(h); + if (idx >= size) + goto backout; + + ret = 0; + if (!huge_pte_none(huge_ptep_get(ptep))) + goto backout; + + page_dup_rmap(page, true); + new_pte = make_huge_pte(vma, page, ((vma->vm_flags & VM_WRITE) + && (vma->vm_flags & VM_SHARED))); + set_huge_pte_at(mm, haddr, ptep, new_pte); + + hugetlb_count_add(pages_per_huge_page(h), mm); + + spin_unlock(ptl); + + if (new_page) { + SetPagePrivate(&page[1]); + } + + unlock_page(page); +out: + return ret; + +backout: + spin_unlock(ptl); + unlock_page(page); + put_page(page); + goto out; +} +EXPORT_SYMBOL(sharepool_no_page); + /* * Called by proc_root_init() to initialize the /proc/sharepool subtree */ -- 2.25.1

1 6

Compilation error on openeuler 2003 LTS
by Zhengyuan Liu 08 Dec '20

08 Dec '20

Building the latest 2003 LTS can trigger following compilation error: In file included from ./include/acpi/acpi_io.h:7:0, from ./include/linux/acpi.h:47, from ./arch/arm64/include/asm/machine_t.h:26, from arch/arm64/kernel/process.c:64: ./arch/arm64/include/asm/acpi.h:82:20: error: ‘enable_acpi’ redeclared as different kind of symbol static inline void enable_acpi(void) ^~~~~~~~~~~ In file included from arch/arm64/kernel/process.c:61:0: ./arch/arm64/include/asm/mpam_sched.h:46:2: note: previous definition of ‘enable_acpi’ was here enable_acpi, The redefinition was introduced by commit 7e66740ad725 ("MPAM / ACPI: Refactoring MPAM init process and set MPAM ACPI as entrance")

2 2

openEuler Summit 报名渠道开启，我们为社区内的开发者准备了很多专属环节
by public openEuler 07 Dec '20

07 Dec '20

各位社区内的开发者： openEuler Summit 所有议程 <https://openeuler.org/zh/interaction/summit-list/> 本周已经全部上线。本次峰会设置了 Linux 操作系统、云与云原生、虚拟化、基础软件、开源基础设施、安全与可信六大专场。一些通过 Call for Speaker 提交的议题已经入选。欢迎大家快来围观有没有你感兴趣的议题。 [image: image.png] 针对社区的开发者，我们准备了很多专属环节： 1. 大会为社区开发者准备了专属报名通道，在现场有专属的签到通道和定制的伴手礼。 2. 大会为Maintainer 准备了一份十分具有荣誉感和纪念意义的徽章。大会现场还准备了惊喜环节：大会主题演讲时会通过报名时你填写的 Gitee ID 和Gitee 后台的数据演示一个非常炫酷的Live Demo。我们诚挚地邀请社区开发者到现场参会。社区开发者专属报名通道：https://etherpad.openeuler.org/p/openEuler-Summit-2020 P.S：通过该链接报名的人员可以参加 Day1和 Day2 两天会议。 openEuler 也将迎来自己的一周岁生日，社区准备了一个“我为 openEuler 代言”的百人视频合集，诚挚地邀请所有热爱openEuler 的人来拍摄一段视频，来纪念openEuler这朝气蓬勃的第一年。 “我为 openEuler 代言”的视频拍摄需求：自拍形式，对着镜头回答以下问题： 1. 我想要的操作系统是****的， 2. 我在**时候参与/认识/加入/知道的openEuler（社区） 3. 我在openEuler贡献了**** 4. 我是***，我为openEuler代言使用场景：您拍摄的视频素材将用于 openEuler Summit 2020 前期的会议宣传和开场视频中。拍摄指导： 1. 背景任您喜欢 2. 人物面对镜头，位于画面中央，取半身构图，横向拍摄16:9 的画面比例 3. 最好选择白炽灯，白色光源 4. 尽量由另一个人辅助，用手机后置摄像头拍摄，不要用前置，拍摄前擦拭摄像头 5. 读口播时，声音越大越好 6. 尽量保证每一句话都是完整通顺的，中间重来的部分可以忽略 7. 视频输出，用电脑将手机视频导出，打压缩包传输即可（不要用微信上传，会压缩画质） 8. 拍摄完毕后请将视频上传到百度网盘，将分享链接期限设置为永久，然后发给 public(a)openeuler.io 9. 视频收集截止日期：2020年12月11日23:59分

1 0

[PATCH 00/58] backport stable-4.19.161
by Yang Yingliang 03 Dec '20

03 Dec '20

Alan Stern (2): USB: core: Change %pK for __user pointers to %px USB: core: Fix regression in Hercules audio card Anand K Mistry (1): x86/speculation: Fix prctl() when spectre_v2_user={seccomp,prctl},ibpb Ard Biesheuvel (1): efivarfs: revert "fix memory leak in efivarfs_create()" Benjamin Berg (1): platform/x86: thinkpad_acpi: Send tablet mode switch at wakeup time Brian Masney (1): x86/xen: don't unbind uninitialized lock_kicker_irq Chris Ye (1): HID: add HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE for Gamevice devices Cong Wang (1): netfilter: clear skb->next in NF_HOOK_LIST() Dexuan Cui (1): video: hyperv_fb: Fix the cache type when mapping the VRAM Filipe Manana (1): btrfs: fix lockdep splat when reading qgroup config on mount Frank Yang (1): HID: cypress: Support Varmilo Keyboards' media hotkeys Greg Kroah-Hartman (1): Linux 4.19.161 Hans de Goede (2): Input: i8042 - allow insmod to succeed on devices without an i8042 controller HID: Add Logitech Dinovo Edge battery quirk Hauke Mehrtens (1): wireless: Use linux/stddef.h instead of stddef.h Igor Lubashev (1): perf event: Check ref_reloc_sym before using it Jens Axboe (1): proc: don't allow async path resolution of /proc/self components Jiri Kosina (1): HID: add support for Sega Saturn Johannes Thumshirn (1): btrfs: don't access possibly stale fs_info data for printing duplicate device Julian Wiedmann (1): s390/qeth: fix tear down of async TX buffers Kai Vehmanen (1): ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close Kaixu Xia (1): platform/x86: toshiba_acpi: Fix the wrong variable assignment Krzysztof Kozlowski (1): nfc: s3fwrn5: use signed integer for parsing GPIO numbers Laurent Pinchart (1): xtensa: uaccess: Add missing __user to strncpy_from_user() prototype Lee Duncan (1): scsi: libiscsi: Fix NOP race condition Lijun Pan (2): ibmvnic: fix NULL pointer dereference in reset_sub_crq_queues ibmvnic: fix NULL pointer dereference in ibmvic_reset_crq Lyude Paul (1): drm/atomic_helper: Stop modesets on unregistered connectors harder Marc Ferland (1): dmaengine: xilinx_dma: use readl_poll_timeout_atomic variant Marc Kleine-Budde (3): ARM: dts: dra76x: m_can: fix order of clocks can: gs_usb: fix endianess problem with candleLight firmware can: m_can: fix nominal bitiming tseg2 min for version >= 3.1 Marc Zyngier (1): phy: tegra: xusb: Fix dangling pointer on probe failure Masami Hiramatsu (1): perf probe: Fix to die_entrypc() returns error correctly Michael Chan (1): bnxt_en: Release PCI regions when DMA mask setup fails during probe. Mike Christie (1): scsi: target: iscsi: Fix cmd abort fabric stop race Minwoo Im (1): nvme: free sq/cq dbbuf pointers when dbbuf set fails Pablo Ceballos (1): HID: hid-sensor-hub: Fix issue with devices with no report ID Paolo Bonzini (2): KVM: x86: handle !lapic_in_kernel case in kvm_cpu_*_extint KVM: x86: Fix split-irqchip vs interrupt injection window request Raju Rangoju (1): cxgb4: fix the panic caused by non smac rewrite Rui Miguel Silva (1): optee: add writeback to valid memory type Sami Tolvanen (1): perf/x86: fix sysfs type mismatches Shay Agroskin (1): net: ena: set initial DMA width to avoid intel iommu issue Stanley Chu (1): scsi: ufs: Fix race between shutdown and runtime resume flow Sugar Zhang (1): dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size Taehee Yoo (1): batman-adv: set .owner to THIS_MODULE Will Deacon (2): arm64: pgtable: Fix pte_accessible() arm64: pgtable: Ensure dirty bit is preserved across pte_wrprotect() Xiaochen Shen (2): x86/resctrl: Remove superfluous kernfs_get() calls to prevent refcount leak x86/resctrl: Add necessary kernfs_put() calls to prevent refcount leak Xiongfeng Wang (1): IB/mthca: fix return value of error branch in mthca_init_cq() Zenghui Yu (1): KVM: arm64: vgic-v3: Drop the reporting of GICR_TYPER.Last for userspace Zhang Changzhong (2): bnxt_en: fix error return code in bnxt_init_one() bnxt_en: fix error return code in bnxt_init_board() Zhang Qilong (2): usb: gadget: f_midi: Fix memleak in f_midi_alloc usb: gadget: Fix memleak in gadgetfs_fill_super penghao (1): USB: quirks: Add USB_QUIRK_DISCONNECT_SUSPEND quirk for Lenovo A630Z TIO built-in usb-audio card Makefile | 2 +- arch/arm/boot/dts/dra76x.dtsi | 4 +- arch/arm64/include/asm/pgtable.h | 34 ++--- arch/x86/events/intel/cstate.c | 6 +- arch/x86/events/intel/rapl.c | 14 +- arch/x86/events/intel/uncore.c | 4 +- arch/x86/events/intel/uncore.h | 12 +- arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kernel/cpu/bugs.c | 4 +- arch/x86/kernel/cpu/intel_rdt_rdtgroup.c | 65 ++++----- arch/x86/kvm/irq.c | 85 +++++------- arch/x86/kvm/lapic.c | 2 +- arch/x86/kvm/x86.c | 18 +-- arch/x86/xen/spinlock.c | 12 +- arch/xtensa/include/asm/uaccess.h | 2 +- drivers/dma/pl330.c | 2 +- drivers/dma/xilinx/xilinx_dma.c | 4 +- drivers/gpu/drm/drm_atomic.c | 21 --- drivers/gpu/drm/drm_atomic_helper.c | 21 ++- drivers/gpu/drm/drm_connector.c | 11 +- drivers/gpu/drm/i915/intel_dp_mst.c | 8 +- drivers/hid/hid-cypress.c | 44 +++++- drivers/hid/hid-ids.h | 8 ++ drivers/hid/hid-input.c | 3 + drivers/hid/hid-quirks.c | 5 + drivers/hid/hid-sensor-hub.c | 3 +- drivers/infiniband/hw/mthca/mthca_cq.c | 10 +- drivers/input/serio/i8042.c | 12 +- drivers/net/can/m_can/m_can.c | 2 +- drivers/net/can/usb/gs_usb.c | 131 ++++++++++-------- drivers/net/ethernet/amazon/ena/ena_netdev.c | 17 ++- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +- .../net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 3 +- drivers/net/ethernet/ibm/ibmvnic.c | 6 + drivers/nfc/s3fwrn5/i2c.c | 4 +- drivers/nvme/host/pci.c | 15 ++ drivers/phy/tegra/xusb.c | 1 + drivers/platform/x86/thinkpad_acpi.c | 1 + drivers/platform/x86/toshiba_acpi.c | 3 +- drivers/s390/net/qeth_core_main.c | 6 - drivers/scsi/libiscsi.c | 23 +-- drivers/scsi/ufs/ufshcd.c | 6 +- drivers/target/iscsi/iscsi_target.c | 17 ++- drivers/tee/optee/call.c | 3 +- drivers/usb/core/devio.c | 14 +- drivers/usb/core/quirks.c | 10 ++ drivers/usb/gadget/function/f_midi.c | 10 +- drivers/usb/gadget/legacy/inode.c | 3 + drivers/video/fbdev/hyperv_fb.c | 7 +- fs/btrfs/qgroup.c | 2 +- fs/btrfs/volumes.c | 8 +- fs/efivarfs/inode.c | 2 + fs/efivarfs/super.c | 1 - fs/proc/self.c | 7 + include/drm/drm_connector.h | 71 +++++++++- include/linux/netfilter.h | 2 +- include/scsi/libiscsi.h | 3 + include/uapi/linux/wireless.h | 6 +- net/batman-adv/log.c | 1 + sound/pci/hda/patch_hdmi.c | 20 +-- tools/perf/util/dwarf-aux.c | 8 ++ tools/perf/util/event.c | 7 +- virt/kvm/arm/vgic/vgic-mmio-v3.c | 22 ++- 63 files changed, 540 insertions(+), 323 deletions(-) -- 2.25.1

1 49

[PATCH 00/87] backport patches from linux-4.19.y for openEuler-1.0-LTS
by Yang Yingliang 02 Dec '20

02 Dec '20

Al Viro (1): don't dump the threads that had been already exiting when zapped. Aleksandr Nogikh (1): netem: fix zero division in tabledist Andy Shevchenko (2): device property: Keep secondary firmware node secondary by type device property: Don't clear secondary pointer for shared primary firmware node Arjun Roy (1): tcp: Prevent low rmem stalls with SO_RCVLOWAT. Arnaldo Carvalho de Melo (1): perf scripting python: Avoid declaring function pointers with a visibility attribute Boris Protopopov (1): Convert trailing spaces and periods in path components Brian Foster (1): xfs: flush new eof page on truncate to avoid post-eof corruption Chen Zhou (1): selinux: Fix error return code in sel_ib_pkey_sid_slow() Christoph Hellwig (2): nbd: fix a block_device refcount leak in nbd_release xfs: fix a missing unlock on error in xfs_fs_map_blocks Chunyan Zhang (1): tick/common: Touch watchdog in tick_unfreeze() on all CPUs Dan Carpenter (1): futex: Don't enable IRQs unconditionally in put_pi_state() Darrick J. Wong (12): xfs: fix realtime bitmap/summary file truncation when growing rt volume xfs: don't free rt blocks when we're doing a REMAP bunmapi call xfs: set xefi_discard when creating a deferred agfl free log intent item xfs: fix scrub flagging rtinherit even if there is no rt device xfs: fix flags argument to rmap lookup when converting shared file rmaps xfs: set the unwritten bit in rmap lookup flags in xchk_bmap_get_rmapextents xfs: fix rmap key and record comparison functions xfs: fix brainos in the refcount scrubber's rmap fragment processor vfs: remove lockdep bogosity in __sb_start_write xfs: fix the minrecs logic when dealing with inode root child blocks xfs: strengthen rmap record flags checking xfs: revert "xfs: fix rmap key and record comparison functions" Dinghao Liu (1): ext4: fix error handling code in add_new_gdb Dongli Zhang (1): page_frag: Recover from memory pressure Douglas Gilbert (1): sgl_alloc_order: fix memory leak Eddy Wu (1): fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent Eric Biggers (1): ext4: fix leaking sysfs kobject after failed mount Gabriel Krisman Bertazi (2): blk-cgroup: Fix memleak on error path blk-cgroup: Pre-allocate tree node on blkg_conf_prep George Spelvin (1): random32: make prandom_u32() output unpredictable Gerald Schaefer (1): mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault() Heiner Kallweit (1): net: bridge: add missing counters to ndo_get_stats64 callback Jan Kara (2): ext4: Detect already used quota file early ext4: fix bogus warning in ext4_update_dx_flag() Jason A. Donenfeld (1): netfilter: use actual socket sk rather than skb sk when routing harder Jiri Olsa (2): perf python scripting: Fix printable strings in python3 scripts perf tools: Add missing swap for ino_generation Jonathan Cameron (1): ACPI: Add out of bounds and numa_off protections to pxm_to_node() Joseph Qi (1): ext4: unlock xattr_sem properly in ext4_inline_data_truncate() Kaixu Xia (1): ext4: correctly report "not supported" for {usr, grp}jquota when !CONFIG_QUOTA Lang Dai (1): uio: free uio id after uio file node is freed Lee Jones (1): Fonts: Replace discarded const qualifier Leo Yan (1): perf lock: Don't free "lock_seq_stat" if read_count isn't zero Luo Meng (2): ext4: fix invalid inode checksum fail_function: Remove a redundant mutex unlock Mao Wenan (1): net: Update window_clamp if SOCK_RCVBUF is set Marc Zyngier (1): arm64: Run ARCH_WORKAROUND_1 enabling code on all CPUs Mateusz Nosek (1): futex: Fix incorrect should_fail_futex() handling Matteo Croce (2): Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint" reboot: fix overflow parsing reboot cpu number Michael Schaller (1): efivarfs: Replace invalid slashes with exclamation marks in dentries. Mike Galbraith (1): futex: Handle transient "ownerless" rtmutex state correctly Miklos Szeredi (1): fuse: fix page dereference after free Ming Lei (1): scsi: core: Don't start concurrent async scan on same host Nicholas Piggin (1): mm: fix exec activate_mm vs TLB shootdown and lazy tlb switching race Oleg Nesterov (1): ptrace: fix task_join_group_stop() for the case when current is traced Oliver Herms (1): IPv6: Set SIT tunnel hard_header_len to zero Peter Zijlstra (2): serial: pl011: Fix lockdep splat when handling magic-sysrq interrupt perf: Fix get_recursion_context() Qiujun Huang (2): ring-buffer: Return 0 on success from ring_buffer_resize() tracing: Fix out of bounds write in get_trace_buf Ronnie Sahlberg (1): cifs: handle -EINTR in cifs_setattr Ryan Sharpelletti (1): tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate Shijie Luo (1): mm: mempolicy: fix potential pte_unmap_unlock pte error Shin'ichiro Kawasaki (1): uio: Fix use-after-free in uio_unregister_device() Stefano Brivio (1): netfilter: ipset: Update byte and packet counters regardless of whether they match Steven Rostedt (VMware) (3): ring-buffer: Fix recursion protection transitions between interrupt context ftrace: Fix recursion check for NMI test ftrace: Handle tracing when switching between context Tyler Hicks (1): tpm: efi: Don't create binary_bios_measurements file for an empty log Valentin Schneider (1): arm64: topology: Stop using MPIDR for topology information Vamshi K Sthambamkadi (1): efivarfs: fix memory leak in efivarfs_create() Wang Hai (2): devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill() inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() Wengang Wang (1): ocfs2: initialize ip_next_orphan Will Deacon (1): arm64: psci: Avoid printing in cpu_psci_cpu_die() Xiubo Li (1): nbd: make the config put is called before the notifying the waiter Yi-Hung Wei (1): ip_tunnels: Set tunnel option flag when tunnel metadata is present Yicong Yang (1): libfs: fix error cast of negative value in simple_attr_write() Yunsheng Lin (1): net: sch_generic: fix the missing new qdisc assignment bug Zeng Tao (1): time: Prevent undefined behaviour in timespec64_to_ns() Zhengyuan Liu (1): arm64/mm: return cpu_all_mask when node is NUMA_NO_NODE Zqiang (1): kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled zhuoliang zhang (1): net: xfrm: fix a race condition during allocing spi arch/Kconfig | 7 + arch/arm64/include/asm/numa.h | 3 + arch/arm64/kernel/cpu_errata.c | 8 + arch/arm64/kernel/psci.c | 5 +- arch/arm64/kernel/topology.c | 43 +- arch/arm64/mm/numa.c | 6 +- block/blk-cgroup.c | 15 +- drivers/acpi/numa.c | 2 +- drivers/base/core.c | 4 +- drivers/block/nbd.c | 3 +- drivers/char/random.c | 1 - drivers/char/tpm/eventlog/efi.c | 5 + drivers/net/geneve.c | 3 +- drivers/scsi/scsi_scan.c | 7 +- drivers/tty/serial/amba-pl011.c | 11 +- drivers/uio/uio.c | 12 +- fs/cifs/cifs_unicode.c | 8 +- fs/cifs/inode.c | 13 +- fs/efivarfs/super.c | 4 + fs/exec.c | 15 +- fs/ext4/ext4.h | 3 +- fs/ext4/inline.c | 1 + fs/ext4/inode.c | 11 +- fs/ext4/resize.c | 4 +- fs/ext4/super.c | 10 +- fs/fuse/dev.c | 28 +- fs/libfs.c | 6 +- fs/ocfs2/super.c | 1 + fs/super.c | 33 +- fs/xfs/libxfs/xfs_alloc.c | 1 + fs/xfs/libxfs/xfs_bmap.c | 19 +- fs/xfs/libxfs/xfs_bmap.h | 2 +- fs/xfs/libxfs/xfs_rmap.c | 2 +- fs/xfs/scrub/bmap.c | 10 +- fs/xfs/scrub/btree.c | 45 +- fs/xfs/scrub/inode.c | 3 +- fs/xfs/scrub/refcount.c | 8 +- fs/xfs/xfs_iops.c | 10 + fs/xfs/xfs_pnfs.c | 2 +- fs/xfs/xfs_rtalloc.c | 10 +- include/linux/netfilter_ipv4.h | 2 +- include/linux/netfilter_ipv6.h | 2 +- include/linux/prandom.h | 36 +- include/linux/time64.h | 4 + include/net/ip_tunnels.h | 7 +- kernel/events/internal.h | 2 +- kernel/exit.c | 5 +- kernel/fail_function.c | 5 +- kernel/fork.c | 10 +- kernel/futex.c | 25 +- kernel/kthread.c | 3 +- kernel/reboot.c | 28 +- kernel/signal.c | 19 +- kernel/time/itimer.c | 4 - kernel/time/tick-common.c | 2 + kernel/time/timer.c | 7 - kernel/trace/ring_buffer.c | 66 ++- kernel/trace/trace.c | 2 +- kernel/trace/trace.h | 26 +- kernel/trace/trace_selftest.c | 9 +- lib/fonts/font_10x18.c | 2 +- lib/fonts/font_6x10.c | 2 +- lib/fonts/font_6x11.c | 2 +- lib/fonts/font_7x14.c | 2 +- lib/fonts/font_8x16.c | 2 +- lib/fonts/font_8x8.c | 2 +- lib/fonts/font_acorn_8x8.c | 2 +- lib/fonts/font_mini_4x6.c | 2 +- lib/fonts/font_pearl_8x8.c | 2 +- lib/fonts/font_sun12x22.c | 2 +- lib/fonts/font_sun8x16.c | 2 +- lib/random32.c | 462 +++++++++++------- lib/scatterlist.c | 2 +- mm/huge_memory.c | 9 +- mm/mempolicy.c | 6 +- mm/page_alloc.c | 5 + net/bridge/br_device.c | 1 + net/core/devlink.c | 6 +- net/ipv4/inet_diag.c | 4 +- net/ipv4/netfilter.c | 12 +- net/ipv4/netfilter/ipt_SYNPROXY.c | 2 +- net/ipv4/netfilter/iptable_mangle.c | 2 +- net/ipv4/netfilter/nf_nat_l3proto_ipv4.c | 2 +- net/ipv4/netfilter/nf_reject_ipv4.c | 2 +- net/ipv4/netfilter/nft_chain_route_ipv4.c | 2 +- net/ipv4/syncookies.c | 9 +- net/ipv4/tcp.c | 2 + net/ipv4/tcp_bbr.c | 2 +- net/ipv4/tcp_input.c | 3 +- net/ipv6/netfilter.c | 6 +- net/ipv6/netfilter/ip6table_mangle.c | 2 +- net/ipv6/netfilter/nf_nat_l3proto_ipv6.c | 2 +- net/ipv6/netfilter/nft_chain_route_ipv6.c | 2 +- net/ipv6/sit.c | 2 - net/ipv6/syncookies.c | 10 +- net/netfilter/ipset/ip_set_core.c | 3 +- net/netfilter/ipvs/ip_vs_core.c | 4 +- net/sched/sch_generic.c | 3 + net/sched/sch_netem.c | 9 +- net/xfrm/xfrm_state.c | 8 +- security/selinux/ibpkey.c | 4 +- tools/perf/builtin-lock.c | 2 +- tools/perf/util/print_binary.c | 2 +- .../scripting-engines/trace-event-python.c | 7 +- tools/perf/util/session.c | 1 + 105 files changed, 809 insertions(+), 461 deletions(-) -- 2.25.1

1 87

Re: openeuler patch tag咨询
by Xie XiuQi 02 Dec '20

02 Dec '20

Hi, On 2020/12/2 11:12, Zhengyuan Liu wrote: > > > On 2020/12/2 上午10:59, Yang Yingliang wrote: >> >> On 2020/12/2 10:47, Zhengyuan Liu wrote: >>> Hi, Xiuqi >>> >>> 最近在　backport OpenEuler内核补丁时对于补丁来源有个疑问，每个Patch　来源类别都在 >>> commit log　里面标注了，如 mainline inclusion, stable inclusion, 这两个比较好理解．但是像： >>> hulk >>> ascend >>> driver >>> euleros >>> 这几个我查阅openeuler开发文档也没找到说明，　所以想请问下你们这几个是怎么做区分的． >>> 这个开发者在向openeuler社区提补丁时也用得到，方便的话麻烦你们更新到文档里去．　这个确实是存在一些问题，这个 tag 的划分，既没有覆盖全，划分的标准也不完全一致。当前是给的比较主观的一些 tag，既有按领域的，也有按来源的,也有按子系统的。总之目的是为了方便识别和统计。下面表格是我准备发到社区讨论的，也请大家帮忙看看。 | 补丁 tag | 说明 | | ------------------- | ----------------------------------- | | mainline inclusion | 主线 backport | | stable inclusion | 上游 stable 分支的补丁 | | maillist inclusion | 发到社区，但是还没进主线的补丁 | | hulk inclusion | openEuler kernel 团队开发的补丁 | | virt inclusion | 虚拟化相关的补丁 | | ascend inclusion | 昇腾相关的补丁或特性 | | kunpeng inclusion | 鲲鹏相关的补丁或特性 | | dist inclusion | 从其他发行版移植的补丁 | | openEuler inclusion | 其他发送到openEuler社区的非上游补丁 | >> >> 非主线的补丁会用到上面的分类，只要补丁是来自主线的统一用mainline >> >> ascend是支持昇腾芯片的一些特有补丁 >> >> driver是驱动补丁 >> >> euleros和hulk是一类，主要是一些未进主线的或者待进主线的通用补丁 > > 感谢回复． > > driver相当于从hulk一类单独挑出来的是吧．从现有的分类来看，好像也没有严格的区分． > > >> >> >>> >>> 谢谢． >>> _______________________________________________ >>> Kernel mailing list -- kernel(a)openeuler.org >>> To unsubscribe send an email to kernel-leave(a)openeuler.org >> > >

1 0

openeuler patch tag咨询
by Zhengyuan Liu 02 Dec '20

02 Dec '20

Hi, Xiuqi 最近在　backport OpenEuler内核补丁时对于补丁来源有个疑问，每个Patch　来源类别都在 commit log　里面标注了，如 mainline inclusion, stable inclusion, 这两个比较好理解．但是像： hulk ascend driver euleros 这几个我查阅openeuler开发文档也没找到说明，　所以想请问下你们这几个是怎么做区分的．这个开发者在向openeuler社区提补丁时也用得到，方便的话麻烦你们更新到文档里去．　谢谢．

3 3

bonding: add an option to specify a delay between peer notifications
by liaichun 02 Dec '20

02 Dec '20

From: Vincent Bernat <vincent(a)bernat.ch> mainline inclusion from mainline-5.5-rc5 commit 07a4ddec3ce9b0a533b5f90f582f1057390d5e63 category: bugfix issue: I27SUX bugzilla: NA ------------------------------ Currently, gratuitous ARP/ND packets are sent every `miimon' milliseconds. This commit allows a user to specify a custom delay through a new option, `peer_notif_delay'. Like for `updelay' and `downdelay', this delay should be a multiple of `miimon' to avoid managing an additional work queue. The configuration logic is copied from `updelay' and `downdelay'. However, the default value cannot be set using a module parameter: Netlink or sysfs should be used to configure this feature. When setting `miimon' to 100 and `peer_notif_delay' to 500, we can observe the 500 ms delay is respected: 20:30:19.354693 ARP, Request who-has 203.0.113.10 tell 203.0.113.10, length 28 20:30:19.874892 ARP, Request who-has 203.0.113.10 tell 203.0.113.10, length 28 20:30:20.394919 ARP, Request who-has 203.0.113.10 tell 203.0.113.10, length 28 20:30:20.914963 ARP, Request who-has 203.0.113.10 tell 203.0.113.10, length 28 In bond_mii_monitor(), I have tried to keep the lock logic readable. The change is due to the fact we cannot rely on a notification to lower the value of `bond->send_peer_notif' as `NETDEV_NOTIFY_PEERS' is only triggered once every N times, while we need to decrement the counter each time. iproute2 also needs to be updated to be able to specify this new attribute through `ip link'. Signed-off-by: Vincent Bernat <vincent(a)bernat.ch> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: wangli <wangli221(a)huawei.com> Signed-off-by: Aichun Li <liaichun(a)huawei.com> --- drivers/net/bonding/bond_main.c | 31 +-- drivers/net/bonding/bond_netlink.c | 14 ++ drivers/net/bonding/bond_options.c | 75 +++++--- drivers/net/bonding/bond_procfs.c | 3 +- drivers/net/bonding/bond_sysfs.c | 13 ++ include/net/bond_options.h | 1 + include/net/bonding.h | 3 +- include/uapi/linux/if_link.h | 1 + tools/include/uapi/linux/if_link.h | 1 + 9 files changed, 102 insertions(+), 40 deletions(-) diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index a59333b..b1f3520 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -786,6 +786,8 @@ static bool bond_should_notify_peers(struct bonding *bond) slave ? slave->dev->name : "NULL"); if (!slave || !bond->send_peer_notif || + (bond->send_peer_notif % + max(1, bond->params.peer_notif_delay) != 0) || !netif_carrier_ok(bond->dev) || test_bit(__LINK_STATE_LINKWATCH_PENDING, &slave->dev->state)) return false; @@ -878,15 +880,18 @@ void bond_change_active_slave(struct bonding *bond, struct slave *new_active) if (netif_running(bond->dev)) { bond->send_peer_notif = - bond->params.num_peer_notif; + bond->params.num_peer_notif * + max(1, bond->params.peer_notif_delay); should_notify_peers = bond_should_notify_peers(bond); } call_netdevice_notifiers(NETDEV_BONDING_FAILOVER, bond->dev); - if (should_notify_peers) + if (should_notify_peers) { + bond->send_peer_notif--; call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, bond->dev); + } } } @@ -2290,6 +2295,7 @@ static void bond_mii_monitor(struct work_struct *work) struct bonding *bond = container_of(work, struct bonding, mii_work.work); bool should_notify_peers = false; + bool commit; unsigned long delay; struct slave *slave; struct list_head *iter; @@ -2302,10 +2308,18 @@ static void bond_mii_monitor(struct work_struct *work) rcu_read_lock(); should_notify_peers = bond_should_notify_peers(bond); - - if (bond_miimon_inspect(bond)) { + commit = !!bond_miimon_inspect(bond); + if (bond->send_peer_notif) { + rcu_read_unlock(); + if (rtnl_trylock()) { + bond->send_peer_notif--; + rtnl_unlock(); + } + } else { rcu_read_unlock(); + } + if (commit) { /* Race avoidance with bond_close cancel of workqueue */ if (!rtnl_trylock()) { delay = 1; @@ -2319,9 +2333,7 @@ static void bond_mii_monitor(struct work_struct *work) bond_miimon_commit(bond); rtnl_unlock(); /* might sleep, hold no other locks */ - } else - rcu_read_unlock(); - + } re_arm: if (bond->params.miimon) queue_delayed_work(bond->wq, &bond->mii_work, delay); @@ -3093,10 +3105,6 @@ static int bond_master_netdev_event(unsigned long event, case NETDEV_REGISTER: bond_create_proc_entry(event_bond); break; - case NETDEV_NOTIFY_PEERS: - if (event_bond->send_peer_notif) - event_bond->send_peer_notif--; - break; default: break; } @@ -4743,6 +4751,7 @@ static int bond_check_params(struct bond_params *params) params->arp_all_targets = arp_all_targets_value; params->updelay = updelay; params->downdelay = downdelay; + params->peer_notif_delay = 0; params->use_carrier = use_carrier; params->lacp_fast = lacp_fast; params->primary[0] = 0; diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c index fbcd8a7..ae8e4e4 100644 --- a/drivers/net/bonding/bond_netlink.c +++ b/drivers/net/bonding/bond_netlink.c @@ -112,6 +112,7 @@ static int bond_fill_slave_info(struct sk_buff *skb, [IFLA_BOND_AD_ACTOR_SYSTEM] = { .type = NLA_BINARY, .len = ETH_ALEN }, [IFLA_BOND_TLB_DYNAMIC_LB] = { .type = NLA_U8 }, + [IFLA_BOND_PEER_NOTIF_DELAY] = { .type = NLA_U32 }, }; static const struct nla_policy bond_slave_policy[IFLA_BOND_SLAVE_MAX + 1] = { @@ -219,6 +220,14 @@ static int bond_changelink(struct net_device *bond_dev, struct nlattr *tb[], if (err) return err; } + if (data[IFLA_BOND_PEER_NOTIF_DELAY]) { + int delay = nla_get_u32(data[IFLA_BOND_PEER_NOTIF_DELAY]); + + bond_opt_initval(&newval, delay); + err = __bond_opt_set(bond, BOND_OPT_PEER_NOTIF_DELAY, &newval); + if (err) + return err; + } if (data[IFLA_BOND_USE_CARRIER]) { int use_carrier = nla_get_u8(data[IFLA_BOND_USE_CARRIER]); @@ -497,6 +506,7 @@ static size_t bond_get_size(const struct net_device *bond_dev) nla_total_size(sizeof(u16)) + /* IFLA_BOND_AD_USER_PORT_KEY */ nla_total_size(ETH_ALEN) + /* IFLA_BOND_AD_ACTOR_SYSTEM */ nla_total_size(sizeof(u8)) + /* IFLA_BOND_TLB_DYNAMIC_LB */ + nla_total_size(sizeof(u32)) + /* IFLA_BOND_PEER_NOTIF_DELAY */ 0; } @@ -539,6 +549,10 @@ static int bond_fill_info(struct sk_buff *skb, bond->params.downdelay * bond->params.miimon)) goto nla_put_failure; + if (nla_put_u32(skb, IFLA_BOND_PEER_NOTIF_DELAY, + bond->params.peer_notif_delay * bond->params.miimon)) + goto nla_put_failure; + if (nla_put_u8(skb, IFLA_BOND_USE_CARRIER, bond->params.use_carrier)) goto nla_put_failure; diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c index 80867bd..ceae69c 100644 --- a/drivers/net/bonding/bond_options.c +++ b/drivers/net/bonding/bond_options.c @@ -28,6 +28,8 @@ static int bond_option_updelay_set(struct bonding *bond, const struct bond_opt_value *newval); static int bond_option_downdelay_set(struct bonding *bond, const struct bond_opt_value *newval); +static int bond_option_peer_notif_delay_set(struct bonding *bond, + const struct bond_opt_value *newval); static int bond_option_use_carrier_set(struct bonding *bond, const struct bond_opt_value *newval); static int bond_option_arp_interval_set(struct bonding *bond, @@ -78,7 +80,10 @@ static int bond_option_ad_actor_system_set(struct bonding *bond, const struct bond_opt_value *newval); static int bond_option_ad_user_port_key_set(struct bonding *bond, const struct bond_opt_value *newval); - +static int _bond_option_delay_set(struct bonding *bond, + const struct bond_opt_value *newval, + const char *name, + int *target); static const struct bond_opt_value bond_mode_tbl[] = { { "balance-rr", BOND_MODE_ROUNDROBIN, BOND_VALFLAG_DEFAULT}, @@ -428,6 +433,13 @@ static int bond_option_ad_user_port_key_set(struct bonding *bond, .desc = "Number of peer notifications to send on failover event", .values = bond_num_peer_notif_tbl, .set = bond_option_num_peer_notif_set + }, + [BOND_OPT_PEER_NOTIF_DELAY] = { + .id = BOND_OPT_PEER_NOTIF_DELAY, + .name = "peer_notif_delay", + .desc = "Delay between each peer notification on failover event, in milliseconds", + .values = bond_intmax_tbl, + .set = bond_option_peer_notif_delay_set } }; @@ -850,6 +862,9 @@ static int bond_option_miimon_set(struct bonding *bond, if (bond->params.downdelay) netdev_dbg(bond->dev, "Note: Updating downdelay (to %d) since it is a multiple of the miimon value\n", bond->params.downdelay * bond->params.miimon); + if (bond->params.peer_notif_delay) + netdev_dbg(bond->dev, "Note: Updating peer_notif_delay (to %d) since it is a multiple of the miimon value\n", + bond->params.peer_notif_delay * bond->params.miimon); if (newval->value && bond->params.arp_interval) { netdev_dbg(bond->dev, "MII monitoring cannot be used with ARP monitoring - disabling ARP monitoring...\n"); bond->params.arp_interval = 0; @@ -873,52 +888,58 @@ static int bond_option_miimon_set(struct bonding *bond, return 0; } -/* Set up and down delays. These must be multiples of the - * MII monitoring value, and are stored internally as the multiplier. - * Thus, we must translate to MS for the real world. +/* Set up, down and peer notification delays. These must be multiples + * of the MII monitoring value, and are stored internally as the + * multiplier.Thus, we must translate to MS for the real world. */ -static int bond_option_updelay_set(struct bonding *bond, - const struct bond_opt_value *newval) +static int _bond_option_delay_set(struct bonding *bond, + const struct bond_opt_value *newval, + const char *name, + int *target) { int value = newval->value; if (!bond->params.miimon) { - netdev_err(bond->dev, "Unable to set up delay as MII monitoring is disabled\n"); + netdev_err(bond->dev, "Unable to set %s as MII monitoring is disabled\n", + name); return -EPERM; } if ((value % bond->params.miimon) != 0) { - netdev_warn(bond->dev, "up delay (%d) is not a multiple of miimon (%d), updelay rounded to %d ms\n", + netdev_warn(bond->dev, + "%s (%d) is not a multiple of miimon (%d), value rounded to %d ms\n", + name, value, bond->params.miimon, (value / bond->params.miimon) * bond->params.miimon); } - bond->params.updelay = value / bond->params.miimon; - netdev_dbg(bond->dev, "Setting up delay to %d\n", - bond->params.updelay * bond->params.miimon); + *target = value / bond->params.miimon; + netdev_dbg(bond->dev, "Setting %s to %d\n", + name, + *target * bond->params.miimon); return 0; } +static int bond_option_updelay_set(struct bonding *bond, + const struct bond_opt_value *newval) +{ + return _bond_option_delay_set(bond, newval, "up delay", + &bond->params.updelay); +} + static int bond_option_downdelay_set(struct bonding *bond, const struct bond_opt_value *newval) { - int value = newval->value; - - if (!bond->params.miimon) { - netdev_err(bond->dev, "Unable to set down delay as MII monitoring is disabled\n"); - return -EPERM; - } - if ((value % bond->params.miimon) != 0) { - netdev_warn(bond->dev, "down delay (%d) is not a multiple of miimon (%d), delay rounded to %d ms\n", - value, bond->params.miimon, - (value / bond->params.miimon) * - bond->params.miimon); - } - bond->params.downdelay = value / bond->params.miimon; - netdev_dbg(bond->dev, "Setting down delay to %d\n", - bond->params.downdelay * bond->params.miimon); + return _bond_option_delay_set(bond, newval, "down delay", + &bond->params.downdelay); +} - return 0; +static int bond_option_peer_notif_delay_set(struct bonding *bond, + const struct bond_opt_value *newval) +{ + return _bond_option_delay_set(bond, newval, + "peer notification delay", + &bond->params.peer_notif_delay); } static int bond_option_use_carrier_set(struct bonding *bond, diff --git a/drivers/net/bonding/bond_procfs.c b/drivers/net/bonding/bond_procfs.c index 9f7d83e..850dde4 100644 --- a/drivers/net/bonding/bond_procfs.c +++ b/drivers/net/bonding/bond_procfs.c @@ -104,7 +104,8 @@ static void bond_info_show_master(struct seq_file *seq) bond->params.updelay * bond->params.miimon); seq_printf(seq, "Down Delay (ms): %d\n", bond->params.downdelay * bond->params.miimon); - + seq_printf(seq, "Peer Notification Delay (ms): %d\n", + bond->params.peer_notif_delay * bond->params.miimon); /* ARP information */ if (bond->params.arp_interval > 0) { diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c index 3584725..0ecafe1 100644 --- a/drivers/net/bonding/bond_sysfs.c +++ b/drivers/net/bonding/bond_sysfs.c @@ -343,6 +343,18 @@ static ssize_t bonding_show_updelay(struct device *d, static DEVICE_ATTR(updelay, 0644, bonding_show_updelay, bonding_sysfs_store_option); +static ssize_t bonding_show_peer_notif_delay(struct device *d, + struct device_attribute *attr, + char *buf) +{ + struct bonding *bond = to_bond(d); + + return sprintf(buf, "%d\n", + bond->params.peer_notif_delay * bond->params.miimon); +} +static DEVICE_ATTR(peer_notif_delay, 0644, + bonding_show_peer_notif_delay, bonding_sysfs_store_option); + /* Show the LACP interval. */ static ssize_t bonding_show_lacp(struct device *d, struct device_attribute *attr, @@ -734,6 +746,7 @@ static DEVICE_ATTR(ad_user_port_key, 0644, &dev_attr_arp_ip_target.attr, &dev_attr_downdelay.attr, &dev_attr_updelay.attr, + &dev_attr_peer_notif_delay.attr, &dev_attr_lacp_rate.attr, &dev_attr_ad_select.attr, &dev_attr_xmit_hash_policy.attr, diff --git a/include/net/bond_options.h b/include/net/bond_options.h index d79d28f..6889a04 100644 --- a/include/net/bond_options.h +++ b/include/net/bond_options.h @@ -67,6 +67,7 @@ enum { BOND_OPT_AD_ACTOR_SYSTEM, BOND_OPT_AD_USER_PORT_KEY, BOND_OPT_NUM_PEER_NOTIF_ALIAS, + BOND_OPT_PEER_NOTIF_DELAY, BOND_OPT_LAST }; diff --git a/include/net/bonding.h b/include/net/bonding.h index 81166488..c241010 100644 --- a/include/net/bonding.h +++ b/include/net/bonding.h @@ -114,6 +114,7 @@ struct bond_params { int fail_over_mac; int updelay; int downdelay; + int peer_notif_delay; int lacp_fast; unsigned int min_links; int ad_select; @@ -205,7 +206,7 @@ struct bonding { */ spinlock_t mode_lock; spinlock_t stats_lock; - u8 send_peer_notif; + u64 send_peer_notif; u8 igmp_retrans; #ifdef CONFIG_PROC_FS struct proc_dir_entry *proc_entry; diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h index 9d8eac5..f9a0359 100644 --- a/include/uapi/linux/if_link.h +++ b/include/uapi/linux/if_link.h @@ -615,6 +615,7 @@ enum { IFLA_BOND_AD_USER_PORT_KEY, IFLA_BOND_AD_ACTOR_SYSTEM, IFLA_BOND_TLB_DYNAMIC_LB, + IFLA_BOND_PEER_NOTIF_DELAY, __IFLA_BOND_MAX, }; diff --git a/tools/include/uapi/linux/if_link.h b/tools/include/uapi/linux/if_link.h index 43391e2..f57af58 100644 --- a/tools/include/uapi/linux/if_link.h +++ b/tools/include/uapi/linux/if_link.h @@ -614,6 +614,7 @@ enum { IFLA_BOND_AD_USER_PORT_KEY, IFLA_BOND_AD_ACTOR_SYSTEM, IFLA_BOND_TLB_DYNAMIC_LB, + IFLA_BOND_PEER_NOTIF_DELAY, __IFLA_BOND_MAX, }; -- 1.8.3.1

1 0

[PATCH 1/6] share_pool: Add sp_area cache
by Yang Yingliang 02 Dec '20

02 Dec '20

From: Tang Yizhou <tangyizhou(a)huawei.com> ascend inclusion category: feature bugzilla: NA CVE: NA ------------------------------------------------- Provide a free area cache for the share pool VA allocator, based on the algorithm used by linux mainline commit 89699605fe7c. This reduces the number of rbtree operations and linear traversals over the share pool extents in order to find a free area, by starting off at the last point that a free area was found. The free area cache is reset if areas are freed behind it, or if we are searching for an another area (such as DVPP 16G area) than last time. So allocation patterns are not changed. After this patch, the search will start from where it left off, giving closer to an amortized O(1). Test environment: Huawei 1951 DC (8 CPU cores) with 21G memory, no load. Test method: A single thread process first call sp_alloc() to allocate a specified number of 2M hugepages, then we calculate the allocation time when sp_alloc() another 2M hugepage. The results are in microsecond. test 1, first sp_alloc() 256 2M-hugepage, total 512M test 2, first sp_alloc() 512 2M-hugepage, total 1G test 3, first sp_alloc() 1024 2M-hugepage, total 2G test 4, first sp_alloc() 1536 2M-hugepage, total 3G test 5, first sp_alloc() 2048 2M-hugepage, total 4G test 6, first sp_alloc() 4096 2M-hugepage, total 8G test 7, first sp_alloc() 6072 2M-hugepage, total 12G test 8, first sp_alloc() 8192 2M-hugepage, total 16G test1 test2 test3 test4 231 238 240 252 279 253 315 268 242 238 247 253 282 255 326 265 233 234 250 243 272 251 314 258 239 224 245 246 273 261 324 262 234 233 252 257 277 262 326 265 225 231 243 243 279 249 325 264 236 261 246 248 265 262 323 266 233 238 247 246 281 259 331 265 239 222 243 241 270 248 325 263 241 231 239 241 335 246 321 268 avg: 235.3 235 245.2 247 281.3 254.6 323 264.4 res: - - 9.49% 18.14% test5 test6 test7 test8 371 280 720 458 1001 629 1547 909 369 283 691 465 1005 718 1533 903 374 279 954 470 1003 680 1371 908 363 279 697 457 1004 923 1375 930 369 286 711 464 1016 683 1395 1083 382 280 967 491 1029 695 1413 1096 378 284 688 823 1008 689 1419 905 376 360 921 469 1285 696 1554 1085 374 287 896 485 1030 682 1381 902 380 276 706 545 1286 717 1606 1097 avg: 373.6 289.4 791.5 512.7 1066.7 717.5 1459.4 981.8 res: 22.54% 35.52% 32.74% 32.73% Suggested-by: Zefan Li <lizefan(a)huawei.com> Signed-off-by: Tang Yizhou <tangyizhou(a)huawei.com> Reviewed-by: Ding Tianhong <dingtianhong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/share_pool.c | 104 ++++++++++++++++++++++++++++++++++-------------- 1 file changed, 75 insertions(+), 29 deletions(-) diff --git a/mm/share_pool.c b/mm/share_pool.c index 24c5dd680451..b9d30d36b7c2 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -730,6 +730,11 @@ static void __insert_sp_area(struct sp_area *spa) rb_insert_color(&spa->rb_node, &sp_area_root); } +/* The sp_area cache globals are protected by sp_area_lock */ +static struct rb_node *free_sp_area_cache; +static unsigned long cached_hole_size; +static unsigned long cached_vstart; /* affected by SP_DVPP and sp_config_dvpp_range() */ + /* * Allocate a region of VA from the share pool. * @size - the size of VA to allocate @@ -741,7 +746,7 @@ static void __insert_sp_area(struct sp_area *spa) static struct sp_area *sp_alloc_area(unsigned long size, unsigned long flags, struct sp_group *spg, enum spa_type type) { - struct sp_area *spa, *err; + struct sp_area *spa, *first, *err; struct rb_node *n; unsigned long vstart = MMAP_SHARE_POOL_START; unsigned long vend = MMAP_SHARE_POOL_16G_START; @@ -763,8 +768,6 @@ static struct sp_area *sp_alloc_area(unsigned long size, unsigned long flags, } } - addr = vstart; - spa = kmalloc(sizeof(struct sp_area), GFP_KERNEL); if (unlikely(!spa)) { if (printk_ratelimit()) @@ -774,45 +777,75 @@ static struct sp_area *sp_alloc_area(unsigned long size, unsigned long flags, spin_lock(&sp_area_lock); - n = sp_area_root.rb_node; - if (n) { - struct sp_area *first = NULL; + /* + * Invalidate cache if we have more permissive parameters. + * cached_hole_size notes the largest hole noticed _below_ + * the sp_area cached in free_sp_area_cache: if size fits + * into that hole, we want to scan from vstart to reuse + * the hole instead of allocating above free_sp_area_cache. + * Note that sp_free_area may update free_sp_area_cache + * without updating cached_hole_size. + */ + if (!free_sp_area_cache || size_align < cached_hole_size || + vstart != cached_vstart) { + cached_hole_size = 0; + free_sp_area_cache = NULL; + } + + /* record if we encounter less permissive parameters */ + cached_vstart = vstart; + + /* find starting point for our search */ + if (free_sp_area_cache) { + first = rb_entry(free_sp_area_cache, struct sp_area, rb_node); + addr = first->va_end; + if (addr + size_align < addr) { + err = ERR_PTR(-EOVERFLOW); + goto error; + } + } else { + addr = vstart; + if (addr + size_align < addr) { + err = ERR_PTR(-EOVERFLOW); + goto error; + } + + n = sp_area_root.rb_node; + first = NULL; - do { + while (n) { struct sp_area *tmp; tmp = rb_entry(n, struct sp_area, rb_node); if (tmp->va_end >= addr) { - if (!first && tmp->va_start < addr + size_align) - first = tmp; - n = n->rb_left; - } else { first = tmp; + if (tmp->va_start <= addr) + break; + n = n->rb_left; + } else n = n->rb_right; - } - } while (n); + } if (!first) goto found; + } - if (first->va_end < addr) { - n = rb_next(&first->rb_node); - if (n) - first = rb_entry(n, struct sp_area, rb_node); - else - goto found; + /* from the starting point, traverse areas until a suitable hole is found */ + while (addr + size_align > first->va_start && addr + size_align <= vend) { + if (addr + cached_hole_size < first->va_start) + cached_hole_size = first->va_start - addr; + addr = first->va_end; + if (addr + size_align < addr) { + err = ERR_PTR(-EOVERFLOW); + goto error; } - while (addr + size_align >= first->va_start && - addr + size_align <= vend) { - addr = first->va_end; - - n = rb_next(&first->rb_node); - if (n) - first = rb_entry(n, struct sp_area, rb_node); - else - goto found; - } + n = rb_next(&first->rb_node); + if (n) + first = rb_entry(n, struct sp_area, rb_node); + else + goto found; } + found: if (addr + size_align > vend) { err = ERR_PTR(-EOVERFLOW); @@ -833,6 +866,7 @@ static struct sp_area *sp_alloc_area(unsigned long size, unsigned long flags, } __insert_sp_area(spa); + free_sp_area_cache = &spa->rb_node; if (spa->spg) { atomic_inc(&spg->spa_num); atomic64_add(size, &spg->size); @@ -889,6 +923,18 @@ static void sp_free_area(struct sp_area *spa) { lockdep_assert_held(&sp_area_lock); + if (free_sp_area_cache) { + struct sp_area *cache; + cache = rb_entry(free_sp_area_cache, struct sp_area, rb_node); + if (spa->va_start <= cache->va_start) { + free_sp_area_cache = rb_prev(&spa->rb_node); + /* + * We don't try to update cached_hole_size, + * but it won't go very wrong. + */ + } + } + spa_dec_usage(spa->type, spa->real_size); /* won't fail */ if (spa->spg) { atomic_dec(&spa->spg->spa_num); -- 2.25.1

1 5

[PATCH 1/2] nvme: fix nvme_stop_queues cost long time error
by Yang Yingliang 02 Dec '20

02 Dec '20

From: Di Wang <wangdi44(a)huawei.com> driver inclusion category: bugfix bugzilla: NA Link: https://gitee.com/openeuler/kernel/issues/I1WGZE -------------------------------- It will cost a lot of time when synchronize_rcu() is called for every namspace in nvme_stop_queues(). Reviewed-by: Chao Leng <lengchao(a)huawei.com> Reviewed-by: Jike Cheng <chengjike.cheng(a)huawei.com> Signed-off-by: Di Wang <wangdi44(a)huawei.com> Signed-off-by: Lijie <lijie34(a)huawei.com> Acked-by: Hanjun Guo <guohanjun(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-mq.c | 18 ++++++++++++++++++ drivers/nvme/host/core.c | 6 +++++- include/linux/blk-mq.h | 1 + 3 files changed, 24 insertions(+), 1 deletion(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index 7096f23b18da..41e92dbff821 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -242,6 +242,24 @@ void blk_mq_quiesce_queue(struct request_queue *q) } EXPORT_SYMBOL_GPL(blk_mq_quiesce_queue); +bool blk_mq_quiesce_queue_without_rcu(struct request_queue *q) +{ + struct blk_mq_hw_ctx *hctx; + unsigned int i; + bool rcu = false; + + blk_mq_quiesce_queue_nowait(q); + + queue_for_each_hw_ctx(q, hctx, i) { + if (hctx->flags & BLK_MQ_F_BLOCKING) + synchronize_srcu(hctx->srcu); + else + rcu = true; + } + return rcu; +} +EXPORT_SYMBOL_GPL(blk_mq_quiesce_queue_without_rcu); + /* * blk_mq_unquiesce_queue() - counterpart of blk_mq_quiesce_queue() * @q: request queue. diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index 8443c6c5c5af..c9faa824de26 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -3904,11 +3904,15 @@ EXPORT_SYMBOL_GPL(nvme_start_freeze); void nvme_stop_queues(struct nvme_ctrl *ctrl) { struct nvme_ns *ns; + bool rcu = false; down_read(&ctrl->namespaces_rwsem); list_for_each_entry(ns, &ctrl->namespaces, list) - blk_mq_quiesce_queue(ns->queue); + rcu = (blk_mq_quiesce_queue_without_rcu(ns->queue) || rcu); up_read(&ctrl->namespaces_rwsem); + + if (rcu) + synchronize_rcu(); } EXPORT_SYMBOL_GPL(nvme_stop_queues); diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h index d26edab21d5c..730de600075b 100644 --- a/include/linux/blk-mq.h +++ b/include/linux/blk-mq.h @@ -309,6 +309,7 @@ void blk_mq_start_hw_queues(struct request_queue *q); void blk_mq_start_stopped_hw_queue(struct blk_mq_hw_ctx *hctx, bool async); void blk_mq_start_stopped_hw_queues(struct request_queue *q, bool async); void blk_mq_quiesce_queue(struct request_queue *q); +bool blk_mq_quiesce_queue_without_rcu(struct request_queue *q); void blk_mq_unquiesce_queue(struct request_queue *q); void blk_mq_delay_run_hw_queue(struct blk_mq_hw_ctx *hctx, unsigned long msecs); bool blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async); -- 2.25.1

1 1

Re: [Release] openEuler 20.03 LTS SP1 内核版本咨询
by Xie XiuQi 02 Dec '20

02 Dec '20

Hi 亚芬， On 2020/12/1 16:47, 方亚芬 wrote: > 内核组的老师们，大家好。我是 openEuler 社区树莓派 SIG 组的 maintainer 方亚芬。 > > > 针对即将发布的 openEuler 20.03 LTS SP1，有个问题想咨询一下。 > > 当前 openEuler 4.19 内核源码最新版本为 4.19.90-2011.6.0（https://gitee.com/openeuler/kernel/tree/4.19.90-2011.6.0/）… src-openeuler/kernel（https://gitee.com/src-openeuler/kernel）下三个分支更新版本不同，分别为： > 1. openEuler 20.03 LTS Next：4.19.90-2010.2.0 > 2. openEuler 20.03 LTS SP1：4.19.90-2011.4.0 > 3. openEuler 20.03 LTS：4.19.90-2011.6.0 > > > 针对该情况有以下两个问题： > 1. 之前树莓派镜像的内核版本一直根据 src-openeuler/kernel 下内核版本做更新，即将发布的 openEuler 20.03 LTS SP1 > 树莓派镜像采用内核版本要与 src-openeuler/kernel 的 openEuler 20.03 LTS SP1 分支内核版本一致？还是需要采用 openEuler 4.19 内核源码的最新版本（https://gitee.com/openeuler/kernel/tree/openEuler-1.0-LTS/，当前为 4.19.90-2011.6.0）？ 20.03 LTS SP1 和 20.03 LTS 的kernel同源，使用相同的内核分支，4.19.90-2011.4.0 和 4.19.90-2011.6.0 只是合入节奏的问题，实际上是同一个分支。对应的源码分支都是 openEuler-1.0-LTS. > > 2. openEuler 20.03 LTS SP1 正式发布前，内核会一直不定期更新，还是会有个具体的截止时间停止更新呢？ > SP1 包括之前的 20.03 LTS 都会陆续有少量的 cve 或 bugfix 补丁，SP1 正式发布之后，也会有陆续的更新，会持续到 SP1、SP0 生命周期结束。我理解你的诉求，你关心树莓派的内核 rebase 到openEuler具体哪个版本。我觉得这个影响应该不大，近期到 SP1 release，合入的补丁应该会很少。这个 SP1 的 release 计划， https://gitee.com/openeuler/release-management/blob/master/openEuler-20.03-… > ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ > 祝工作顺利，生活愉快。 > > ------------------------------------------ > 方亚芬 > 中国科学院软件研究所智能软件研究中心 > 邮箱：yafen(a)iscas.ac.cn <mailto:jiran@iscas.ac.cn> > 地址：北京市海淀区中关村南四街4号5楼 > > _______________________________________________ > Release mailing list -- release(a)openeuler.org > To unsubscribe send an email to release-leave(a)openeuler.org >

2 1

openEuler Summit 社区内报名通道开启，欢迎报名，诚挚的欢迎您为 openEuler 代言
by public＠openeuler.io 30 Nov '20

30 Nov '20

亲爱的 openEuler 社区开发者： openEuler Summit 是由 openEuler 社区举办的开发者交流会，首届线下 openEuler Summit 2020 将于 12 月 24-25 日在北京・望京凯悦酒店举办。openEuler 是一个面向未来的开源操作系统，依托于最具活力的 openEuler 社区，它的未来将不止于操作系统！ openEuler Summit 2020 将聚焦于软硬件协同、云边端协同的技术趋势，万物互联的多算力场景，挖掘技术创新与社区生态的价值。开发者、用户、社区贡献者、软件爱好者在 openEuler Summit 上汇聚成海，连接行业上下游，让全产业链共享操作系统创新价值。目前各大 Session 议题已经评审完毕，今日将会上线部分议程，大会报名通道开启，TC、Maintainer、SIG 工作组会议也在有条不紊地推进中。我们也将持续向大家同步会议进程，以便于社区成员了解 openEuler Summit 最新进展。 openEuler Summit 社区内开发者报名专属通道：https://etherpad.openeuler.org/p/openEuler-Summit-2020 在 openEuler 一周年之际，大会准备了一个 100个社区开发者为openEuler 代言的视频，诚挚地邀请您按照下方的要求拍摄一段视频，将 openEuler 操作系统推荐给更多的人。拍摄需求：自拍形式，对着镜头回答以下问题： 1. 我想要的操作系统是****的， 2. 我在**时候参与/认识/加入/知道的openEuler（社区） 3. 我在openEuler贡献了**** 4. 我是***，我为openEuler代言使用场景：您拍摄的视频素材将用于 openEuler Summit 2020 前期的会议宣传和开场视频中。拍摄指导： 1. 背景任您喜欢 2. 人物面对镜头，取半身构图，横向拍摄16:9 的画面比例 3. 最好选择白炽灯，白色光源 4. 尽量由另一个人辅助，用手机后置摄像头拍摄，不要用前置，拍摄前擦拭摄像头 5. 读口播时，声音越大越好 6. 尽量保证每一句话都是完整通顺的，中间重来的部分可以忽略 7. 视频输出，用电脑将手机视频导出，打压缩包传输即可（不要用微信上传，会压缩画质） 8. 拍摄完毕后请将视频上传到百度网盘，将分享链接期限设置为永久，然后发给 public(a)openeuler.io 9. 样片在附件，请您参考

1 0

[PATCH 1/3] Revert "refcount_t: Add ACQUIRE ordering on success for dec(sub)_and_test() variants"
by Yang Yingliang 28 Nov '20

28 Nov '20

hulk inclusion category: bugfix bugzilla: NA CVE: NA ---------------------------------------- This reverts commit 99294378e022ec2785f88247a7373767fd090e3a. 288e4521f0f6 ("x86/asm: 'Simplify' GEN_*_RMWcc() macros") need be apply before this commit to avoid compile error. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- Documentation/core-api/refcount-vs-atomic.rst | 24 +++---------------- arch/x86/include/asm/refcount.h | 18 ++------------ lib/refcount.c | 18 ++++---------- 3 files changed, 10 insertions(+), 50 deletions(-) diff --git a/Documentation/core-api/refcount-vs-atomic.rst b/Documentation/core-api/refcount-vs-atomic.rst index 976e85adffe8..322851bada16 100644 --- a/Documentation/core-api/refcount-vs-atomic.rst +++ b/Documentation/core-api/refcount-vs-atomic.rst @@ -54,13 +54,6 @@ must propagate to all other CPUs before the release operation (A-cumulative property). This is implemented using :c:func:`smp_store_release`. -An ACQUIRE memory ordering guarantees that all post loads and -stores (all po-later instructions) on the same CPU are -completed after the acquire operation. It also guarantees that all -po-later stores on the same CPU must propagate to all other CPUs -after the acquire operation executes. This is implemented using -:c:func:`smp_acquire__after_ctrl_dep`. - A control dependency (on success) for refcounters guarantees that if a reference for an object was successfully obtained (reference counter increment or addition happened, function returned true), @@ -126,24 +119,13 @@ Memory ordering guarantees changes: result of obtaining pointer to the object! -case 5) - generic dec/sub decrement-based RMW ops that return a value ---------------------------------------------------------------------- +case 5) - decrement-based RMW ops that return a value +----------------------------------------------------- Function changes: * :c:func:`atomic_dec_and_test` --> :c:func:`refcount_dec_and_test` * :c:func:`atomic_sub_and_test` --> :c:func:`refcount_sub_and_test` - -Memory ordering guarantees changes: - - * fully ordered --> RELEASE ordering + ACQUIRE ordering on success - - -case 6) other decrement-based RMW ops that return a value ---------------------------------------------------------- - -Function changes: - * no atomic counterpart --> :c:func:`refcount_dec_if_one` * ``atomic_add_unless(&var, -1, 1)`` --> ``refcount_dec_not_one(&var)`` @@ -154,7 +136,7 @@ Memory ordering guarantees changes: .. note:: :c:func:`atomic_add_unless` only provides full order on success. -case 7) - lock-based RMW +case 6) - lock-based RMW ------------------------ Function changes: diff --git a/arch/x86/include/asm/refcount.h b/arch/x86/include/asm/refcount.h index 88061df7add6..19b90521954c 100644 --- a/arch/x86/include/asm/refcount.h +++ b/arch/x86/include/asm/refcount.h @@ -67,28 +67,14 @@ static __always_inline void refcount_dec(refcount_t *r) static __always_inline __must_check bool refcount_sub_and_test(unsigned int i, refcount_t *r) { - bool ret = GEN_BINARY_SUFFIXED_RMWcc(LOCK_PREFIX "subl", REFCOUNT_CHECK_LT_ZERO, + GEN_BINARY_SUFFIXED_RMWcc(LOCK_PREFIX "subl", REFCOUNT_CHECK_LT_ZERO, r->refs.counter, "er", i, "%0", e, "cx"); - - if (ret) { - smp_acquire__after_ctrl_dep(); - return true; - } - - return false; } static __always_inline __must_check bool refcount_dec_and_test(refcount_t *r) { - bool ret = GEN_UNARY_SUFFIXED_RMWcc(LOCK_PREFIX "decl", REFCOUNT_CHECK_LT_ZERO, + GEN_UNARY_SUFFIXED_RMWcc(LOCK_PREFIX "decl", REFCOUNT_CHECK_LT_ZERO, r->refs.counter, "%0", e, "cx"); - - if (ret) { - smp_acquire__after_ctrl_dep(); - return true; - } - - return false; } static __always_inline __must_check diff --git a/lib/refcount.c b/lib/refcount.c index 6e904af0fb3e..ebcf8cd49e05 100644 --- a/lib/refcount.c +++ b/lib/refcount.c @@ -33,9 +33,6 @@ * Note that the allocator is responsible for ordering things between free() * and alloc(). * - * The decrements dec_and_test() and sub_and_test() also provide acquire - * ordering on success. - * */ #include <linux/mutex.h> @@ -167,8 +164,8 @@ EXPORT_SYMBOL(refcount_inc_checked); * at UINT_MAX. * * Provides release memory ordering, such that prior loads and stores are done - * before, and provides an acquire ordering on success such that free() - * must come after. + * before, and provides a control dependency such that free() must come after. + * See the comment on top. * * Use of this function is not recommended for the normal reference counting * use case in which references are taken and released one at a time. In these @@ -193,12 +190,7 @@ bool refcount_sub_and_test_checked(unsigned int i, refcount_t *r) } while (!atomic_try_cmpxchg_release(&r->refs, &val, new)); - if (!new) { - smp_acquire__after_ctrl_dep(); - return true; - } - return false; - + return !new; } EXPORT_SYMBOL(refcount_sub_and_test_checked); @@ -210,8 +202,8 @@ EXPORT_SYMBOL(refcount_sub_and_test_checked); * decrement when saturated at UINT_MAX. * * Provides release memory ordering, such that prior loads and stores are done - * before, and provides an acquire ordering on success such that free() - * must come after. + * before, and provides a control dependency such that free() must come after. + * See the comment on top. * * Return: true if the resulting refcount is 0, false otherwise */ -- 2.25.1

1 2

[PATCH 01/11] mm: move nr_deactivate accounting to shrink_active_list()
by Yang Yingliang 28 Nov '20

28 Nov '20

From: Kirill Tkhai <ktkhai(a)virtuozzo.com> mainline inclusion from mainline-v5.2-rc1 commit 9851ac13592df77958ae7bac6ba39e71420c38ec category: bugfix bugzilla: 36232 CVE: NA ------------------------------------------------- We know which LRU is not active. [chris(a)chrisdown.name: fix build on !CONFIG_MEMCG] Link: http://lkml.kernel.org/r/20190322150513.GA22021@chrisdown.name Link: http://lkml.kernel.org/r/155290128498.31489.18250485448913338607.stgit@loca… Signed-off-by: Kirill Tkhai <ktkhai(a)virtuozzo.com> Signed-off-by: Chris Down <chris(a)chrisdown.name> Reviewed-by: Daniel Jordan <daniel.m.jordan(a)oracle.com> Cc: Michal Hocko <mhocko(a)kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/memcontrol.h | 6 ++++++ mm/vmscan.c | 10 ++++------ 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h index f6f51b14a332..029b4848ab6f 100644 --- a/include/linux/memcontrol.h +++ b/include/linux/memcontrol.h @@ -1109,6 +1109,12 @@ static inline void count_memcg_events(struct mem_cgroup *memcg, { } +static inline void __count_memcg_events(struct mem_cgroup *memcg, + enum vm_event_item idx, + unsigned long count) +{ +} + static inline void count_memcg_page_event(struct page *page, int idx) { diff --git a/mm/vmscan.c b/mm/vmscan.c index 38fcda38bf7b..92f2489efda8 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -2077,12 +2077,6 @@ static unsigned move_active_pages_to_lru(struct lruvec *lruvec, } } - if (!is_active_lru(lru)) { - __count_vm_events(PGDEACTIVATE, nr_moved); - count_memcg_events(lruvec_memcg(lruvec), PGDEACTIVATE, - nr_moved); - } - return nr_moved; } @@ -2178,6 +2172,10 @@ static void shrink_active_list(unsigned long nr_to_scan, nr_activate = move_active_pages_to_lru(lruvec, &l_active, &l_hold, lru); nr_deactivate = move_active_pages_to_lru(lruvec, &l_inactive, &l_hold, lru - LRU_ACTIVE); + + __count_vm_events(PGDEACTIVATE, nr_deactivate); + __count_memcg_events(lruvec_memcg(lruvec), PGDEACTIVATE, nr_deactivate); + __mod_node_page_state(pgdat, NR_ISOLATED_ANON + file, -nr_taken); spin_unlock_irq(&pgdat->lru_lock); -- 2.25.1

1 10

[PATCH 01/13] bpf: remove duplicated include from syscall.c
by Yang Yingliang 28 Nov '20

28 Nov '20

From: YueHaibing <yuehaibing(a)huawei.com> mainline inclusion from mainline-v4.20-rc1 commit efbaec89c642cd1d4977fc6df9923697e1598d4e category: other bugzilla: 43460 CVE: NA --------------------------------------- Remove duplicated include. Signed-off-by: YueHaibing <yuehaibing(a)huawei.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Signed-off-by: liuxin <liuxin264(a)huawei.com> Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/bpf/syscall.c | 1 - 1 file changed, 1 deletion(-) diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index cb473159a55c..3e9ff9897c7c 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -30,7 +30,6 @@ #include <linux/cred.h> #include <linux/timekeeping.h> #include <linux/ctype.h> -#include <linux/btf.h> #include <linux/nospec.h> #define IS_FD_ARRAY(map) ((map)->map_type == BPF_MAP_TYPE_PROG_ARRAY || \ -- 2.25.1

1 12

[PATCH 00/91] backport stable-4.19.160
by Yang Yingliang 28 Nov '20

28 Nov '20

Aaron Lewis (1): selftests: kvm: Fix the segment descriptor layout to match the actual layout Alejandro Concepcion Rodriguez (1): can: dev: can_restart(): post buffer from the right context Anant Thazhemadam (2): can: af_can: prevent potential access of uninitialized member in can_rcv() can: af_can: prevent potential access of uninitialized member in canfd_rcv() Arvind Sankar (1): efi/x86: Free efi_pgd with free_pages() Aya Levin (1): net/mlx4_core: Fix init_hca fields offset Brian O'Keefe (1): staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids Can Guo (1): scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by ufshcd_hold() Chen Yu (1): x86/microcode/intel: Check patch signature before saving microcode for early loading Chen-Yu Tsai (4): Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to active high" ARM: dts: sun8i: h3: orangepi-plus2e: Enable RGMII RX/TX delay on Ethernet PHY ARM: dts: sun8i: a83t: Enable both RGMII RX/TX delay on Ethernet PHY arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on PHY Colin Ian King (1): can: peak_usb: fix potential integer overflow on shift of a int Dan Carpenter (2): Input: adxl34x - clean up a data type in adxl34x_probe() ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() Darrick J. Wong (4): vfs: remove lockdep bogosity in __sb_start_write xfs: fix the minrecs logic when dealing with inode root child blocks xfs: strengthen rmap record flags checking xfs: revert "xfs: fix rmap key and record comparison functions" Dongli Zhang (1): page_frag: Recover from memory pressure Edwin Peer (1): bnxt_en: read EEPROM A2h address using page 0 Fabio Estevam (1): ARM: dts: imx50-evk: Fix the chip select 1 IOMUX Felix Fietkau (2): mac80211: minstrel: remove deferred sampling code mac80211: minstrel: fix tx status processing corner case Filip Moc (1): net: usb: qmi_wwan: Set DTR quirk for MR400 Florian Fainelli (1): net: Have netpoll bring-up DSA management interface Fugang Duan (1): tty: serial: imx: keep console clocks always on Gerald Schaefer (1): mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault() Greg Kroah-Hartman (1): Linux 4.19.160 Hans de Goede (3): ACPI: button: Add DMI quirk for Medion Akoya E2228T iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode Heiner Kallweit (1): net: bridge: add missing counters to ndo_get_stats64 callback Ido Schimmel (1): mlxsw: core: Use variable timeout for EMAD retries Jan Kara (1): ext4: fix bogus warning in ext4_update_dx_flag() Jernej Skrabec (3): arm64: dts: allwinner: a64: Pine64 Plus: Fix ethernet node arm64: dts: allwinner: h5: OrangePi PC2: Fix ethernet node ARM: dts: sun8i: r40: bananapi-m2-ultra: Fix ethernet node Jianqun Xu (1): pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq Jimmy Assarsson (1): can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits Joakim Tjernlund (1): ALSA: usb-audio: Add delay quirk for all Logitech USB devices Joel Stanley (2): net/ncsi: Fix netlink registration net: ftgmac100: Fix crash when removing driver Johannes Berg (1): mac80211: free sta in sta_info_insert_finish() on errors Leo Yan (1): perf lock: Don't free "lock_seq_stat" if read_count isn't zero Luo Meng (1): fail_function: Remove a redundant mutex unlock Marc Kleine-Budde (1): can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb() Max Filippov (1): xtensa: disable preemption around cache alias management calls Michał Mirosław (3): regulator: fix memory leak with repeated set_machine_constraints() regulator: avoid resolve_supply() infinite recursion regulator: workaround self-referent regulators Mickaël Salaün (2): ptrace: Set PF_SUPERPRIV when checking capability seccomp: Set PF_SUPERPRIV when checking capability Necip Fazil Yildiran (1): Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER Nenad Peric (1): arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node Nishanth Menon (1): regulator: ti-abb: Fix array out of bound read access on the first transition Paul Moore (2): netlabel: fix our progress tracking in netlbl_unlabel_staticlist() netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist() PeiSen Hou (1): ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) Randy Dunlap (1): MIPS: export has_transparent_hugepage() for modules Ryan Sharpelletti (1): tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate Sean Nyekjaer (1): regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200} Sebastian Andrzej Siewior (1): atm: nicstar: Unmap DMA on send error Sergey Matyukevich (1): arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy Srinivasa Rao Mandadapu (1): ASoC: qcom: lpass-platform: Fix memory leak Stefan Haberland (1): s390/dasd: fix null pointer dereference for ERP requests Subash Abhinov Kasiviswanathan (1): net: qualcomm: rmnet: Fix incorrect receive packet handling during cleanup Sven Van Asbroeck (2): lan743x: fix issue causing intermittent kernel log warnings lan743x: prevent entire kernel HANG on open, for some platforms Takashi Iwai (1): ALSA: mixart: Fix mutex deadlock Takashi Sakamoto (1): ALSA: ctl: fix error path at adding user-defined element set Thomas Richter (1): s390/cpum_sf.c: fix file permission for cpum_sfb_size Tobias Waldekranz (1): net: dsa: mv88e6xxx: Avoid VTU corruption on 6097 Vamshi K Sthambamkadi (1): efivarfs: fix memory leak in efivarfs_create() Vladyslav Tarasiuk (1): net/mlx5: Disable QoS when min_rates on all VFs are zero Wang Hai (2): devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill() inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() Will Deacon (1): arm64: psci: Avoid printing in cpu_psci_cpu_die() Wu Bo (1): can: m_can: m_can_handle_state_change(): fix state change Xie He (1): net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request Xin Long (1): sctp: change to hold/put transport for proto_unreach_timer Xiongfeng Wang (1): drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind() Yi-Hung Wei (1): ip_tunnels: Set tunnel option flag when tunnel metadata is present Yicong Yang (1): libfs: fix error cast of negative value in simple_attr_write() Zhang Changzhong (4): ah6: fix error return code in ah6_input() net: b44: fix error return code in b44_init_one() qed: fix error return code in qed_iwarp_ll2_start() qlcnic: fix error return code in qlcnic_83xx_restart_hw() Zhang Qilong (2): can: ti_hecc: Fix memleak in ti_hecc_probe MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu Makefile | 2 +- arch/arm/boot/dts/imx50-evk.dts | 2 +- arch/arm/boot/dts/imx6qdl-udoo.dtsi | 2 +- arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts | 2 +- .../boot/dts/sun8i-a83t-cubietruck-plus.dts | 2 +- .../boot/dts/sun8i-h3-orangepi-pc-plus.dts | 5 -- .../arm/boot/dts/sun8i-h3-orangepi-plus2e.dts | 2 +- .../boot/dts/sun8i-r40-bananapi-m2-ultra.dts | 2 +- .../dts/allwinner/sun50i-a64-bananapi-m64.dts | 2 +- .../dts/allwinner/sun50i-a64-pine64-plus.dts | 2 +- .../dts/allwinner/sun50i-h5-orangepi-pc2.dts | 2 +- .../allwinner/sun50i-h5-orangepi-prime.dts | 2 +- arch/arm64/kernel/psci.c | 5 +- arch/mips/alchemy/common/clock.c | 9 ++- arch/mips/mm/tlb-r4k.c | 1 + arch/s390/kernel/perf_cpum_sf.c | 2 +- arch/x86/kernel/cpu/microcode/intel.c | 63 +++---------------- arch/x86/platform/efi/efi_64.c | 24 +++---- arch/xtensa/mm/cache.c | 14 +++++ drivers/acpi/button.c | 13 +++- drivers/atm/nicstar.c | 2 + drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 1 + drivers/iio/accel/kxcjk-1013.c | 51 +++++++++++++-- drivers/input/misc/adxl34x.c | 2 +- drivers/input/touchscreen/Kconfig | 1 + drivers/net/can/dev.c | 2 +- drivers/net/can/m_can/m_can.c | 4 +- drivers/net/can/ti_hecc.c | 13 ++-- .../net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 2 +- drivers/net/can/usb/mcba_usb.c | 4 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 4 +- drivers/net/dsa/mv88e6xxx/global1_vtu.c | 59 ++++++++++++++--- drivers/net/ethernet/broadcom/b44.c | 3 +- .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- drivers/net/ethernet/faraday/ftgmac100.c | 4 ++ drivers/net/ethernet/mellanox/mlx4/fw.c | 6 +- drivers/net/ethernet/mellanox/mlx4/fw.h | 4 +- .../net/ethernet/mellanox/mlx5/core/eswitch.c | 15 ++--- drivers/net/ethernet/mellanox/mlxsw/core.c | 3 +- drivers/net/ethernet/microchip/lan743x_main.c | 13 ++-- drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 12 +++- .../ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 3 +- .../ethernet/qualcomm/rmnet/rmnet_handlers.c | 5 ++ drivers/net/geneve.c | 3 +- drivers/net/usb/qmi_wwan.c | 2 +- drivers/pinctrl/pinctrl-rockchip.c | 2 + drivers/regulator/core.c | 38 ++++++----- drivers/regulator/pfuze100-regulator.c | 13 ++-- drivers/regulator/ti-abb-regulator.c | 12 +++- drivers/s390/block/dasd.c | 6 ++ drivers/scsi/ufs/ufshcd.c | 6 +- drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 1 + drivers/tty/serial/imx.c | 20 +----- fs/efivarfs/super.c | 1 + fs/ext4/ext4.h | 3 +- fs/libfs.c | 6 +- fs/super.c | 33 ++-------- fs/xfs/libxfs/xfs_rmap_btree.c | 16 ++--- fs/xfs/scrub/bmap.c | 8 +-- fs/xfs/scrub/btree.c | 45 +++++++------ include/net/ip_tunnels.h | 7 ++- kernel/fail_function.c | 5 +- kernel/ptrace.c | 16 ++--- kernel/seccomp.c | 5 +- mm/huge_memory.c | 9 ++- mm/page_alloc.c | 5 ++ net/bridge/br_device.c | 1 + net/can/af_can.c | 38 ++++++++--- net/core/devlink.c | 6 +- net/core/netpoll.c | 22 +++++-- net/ipv4/inet_diag.c | 4 +- net/ipv4/tcp_bbr.c | 2 +- net/ipv6/ah6.c | 3 +- net/mac80211/rc80211_minstrel.c | 27 ++------ net/mac80211/rc80211_minstrel.h | 1 - net/mac80211/sta_info.c | 14 ++--- net/ncsi/ncsi-manage.c | 5 -- net/ncsi/ncsi-netlink.c | 22 +------ net/ncsi/ncsi-netlink.h | 3 - net/netlabel/netlabel_unlabeled.c | 17 +++-- net/sctp/input.c | 4 +- net/sctp/sm_sideeffect.c | 4 +- net/sctp/transport.c | 2 +- net/x25/af_x25.c | 1 + sound/core/control.c | 2 +- .../fireworks/fireworks_transaction.c | 4 +- sound/pci/hda/patch_realtek.c | 50 ++++++++++++++- sound/pci/mixart/mixart_core.c | 5 +- sound/soc/qcom/lpass-platform.c | 5 +- sound/usb/quirks.c | 10 +-- tools/perf/builtin-lock.c | 2 +- tools/testing/selftests/kvm/include/x86.h | 2 +- tools/testing/selftests/kvm/lib/x86.c | 3 +- 93 files changed, 517 insertions(+), 377 deletions(-) -- 2.25.1

1 91

[PATCH 01/14] blk-cgroup: prevent rcu_sched detected stalls warnings in blkg_destroy_all()
by Yang Yingliang 28 Nov '20

28 Nov '20

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 46357 CVE: NA --------------------------- test procedures: a. create 20000 cgroups, and echo "8:0 10000" to blkio.throttle.write_bps_device b. echo 1 > /sys/blocd/sda/device/delete test result: rcu: INFO: rcu_sched detected stalls on CPUs/tasks: [5/1143] rcu: 0-...0: (0 ticks this GP) idle=0f2/1/0x4000000000000000 softirq=15507/15507 fq rcu: (detected by 6, t=60012 jiffies, g=119977, q=27153) NMI backtrace for cpu 0 CPU: 0 PID: 443 Comm: bash Not tainted 4.19.95-00061-g0bcc83b30eec #63 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-p4 RIP: 0010:blk_throtl_update_limit_valid.isra.0+0x116/0x2a0 Code: 01 00 00 e8 7c dd 74 ff 48 83 bb 78 01 00 00 00 0f 85 54 01 00 00 48 8d bb 88 01 1 RSP: 0018:ffff8881030bf9f0 EFLAGS: 00000046 RAX: 0000000000000000 RBX: ffff8880b4f37080 RCX: ffffffff95da0afe RDX: dffffc0000000000 RSI: ffff888100373980 RDI: ffff8880b4f37208 RBP: ffff888100deca00 R08: ffffffff9528f951 R09: 0000000000000001 R10: ffffed10159dbf56 R11: ffff8880acedfab3 R12: ffff8880b9fda498 R13: ffff8880b9fda4f4 R14: 0000000000000050 R15: ffffffff98b622c0 FS: 00007feb51c51700(0000) GS:ffff888106200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561619547080 CR3: 0000000102bc9000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: throtl_pd_offline+0x98/0x100 blkg_destroy+0x133/0x630 ? blkcg_deactivate_policy+0x2c0/0x2c0 ? lock_timer_base+0x65/0x110 blkg_destroy_all+0x7f/0x100 blkcg_exit_queue+0x3f/0xa5 blk_exit_queue+0x69/0xa0 blk_cleanup_queue+0x226/0x360 __scsi_remove_device+0xb4/0x3c0 scsi_remove_device+0x38/0x60 sdev_store_delete+0x74/0x100 ? dev_driver_string+0xb0/0xb0 dev_attr_store+0x41/0x70 sysfs_kf_write+0x89/0xc0 kernfs_fop_write+0x1b6/0x2e0 ? sysfs_kf_bin_read+0x130/0x130 __vfs_write+0xca/0x420 ? kernel_read+0xc0/0xc0 ? __alloc_fd+0x16f/0x2d0 ? __fd_install+0x95/0x1a0 ? handle_mm_fault+0x3e0/0x560 vfs_write+0x11a/0x2f0 ksys_write+0xb9/0x1e0 ? __x64_sys_read+0x60/0x60 ? kasan_check_write+0x20/0x30 ? filp_close+0xb5/0xf0 __x64_sys_write+0x46/0x60 do_syscall_64+0xd9/0x1f0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The usage of so many blkg is very rare, however, such problem do exist in theory. In order to avoid such warnings, release 'q->queue_lock' for a while when a batch of blkg were destroyed. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Tao Hou <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-cgroup.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index e592167449aa..c64f0afa27dc 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -364,16 +364,31 @@ static void blkg_destroy(struct blkcg_gq *blkg) */ static void blkg_destroy_all(struct request_queue *q) { +#define BLKG_DESTROY_BATCH 4096 struct blkcg_gq *blkg, *n; + int count; lockdep_assert_held(q->queue_lock); +again: + count = BLKG_DESTROY_BATCH; list_for_each_entry_safe(blkg, n, &q->blkg_list, q_node) { struct blkcg *blkcg = blkg->blkcg; spin_lock(&blkcg->lock); blkg_destroy(blkg); spin_unlock(&blkcg->lock); + /* + * If the list is too long, the loop can took a long time, + * thus relese the lock for a while when a batch of blkg + * were destroyed. + */ + if (!--count) { + spin_unlock_irq(q->queue_lock); + cond_resched(); + spin_lock_irq(q->queue_lock); + goto again; + } } q->root_blkg = NULL; -- 2.25.1

1 13

kernel sig meeting
by openEuler conference 26 Nov '20

26 Nov '20

2 1

[PATCH 00/26] KVM RISC-V Support
by MingWang Li 25 Nov '20

25 Nov '20

From: Mingwang Li <limingwang(a)huawei.com> euleros inclusion category: feature bugzilla: NA CVE: NA This series adds initial KVM RISC-V support. Currently, we are able to boot Linux on RV64/RV32 Guest with multiple VCPUs. This series can be found in riscv_kvm_v15 branch at: https//github.com/avpatel/linux.git Link: https://gitee.com/openeuler/kernel/issues/I26X9V Alistair Francis (1): Revert "riscv: Use latest system call ABI" Anup Patel (20): RISC-V: Add fragmented config for debug options RISC-V: Enable CPU Hotplug in defconfigs RISC-V: Add Microchip PolarFire kconfig option RISC-V: Initial DTS for Microchip ICICLE board RISC-V: Enable drivers for Microchip PolarFire ICICLE board RISC-V: Add missing jump label initialization RISC-V: Add hypervisor extension related CSR defines RISC-V: Add initial skeletal KVM support RISC-V: KVM: Implement VCPU create, init and destroy functions RISC-V: KVM: Implement VCPU interrupts and requests handling RISC-V: KVM: Implement KVM_GET_ONE_REG/KVM_SET_ONE_REG ioctls RISC-V: KVM: Implement VCPU world-switch RISC-V: KVM: Handle MMIO exits for VCPU RISC-V: KVM: Handle WFI exits for VCPU RISC-V: KVM: Implement VMID allocator RISC-V: KVM: Implement stage2 page table programming RISC-V: KVM: Implement MMU notifiers RISC-V: KVM: Document RISC-V specific parts of KVM API RISC-V: KVM: Add MAINTAINERS entry RISC-V: Enable KVM for RV64 and RV32 Atish Patra (4): RISC-V: KVM: Add timer functionality RISC-V: KVM: FP lazy save/restore RISC-V: KVM: Implement ONE REG interface for FP registers RISC-V: KVM: Add SBI v0.1 support m34782 (1): Microchip Polarfire SoC Clock Driver Documentation/virt/kvm/api.rst | 193 +++- MAINTAINERS | 11 + arch/riscv/Kconfig | 2 + arch/riscv/Kconfig.socs | 7 + arch/riscv/Makefile | 2 + arch/riscv/boot/dts/Makefile | 1 + arch/riscv/boot/dts/microchip/Makefile | 2 + .../boot/dts/microchip/icicle-kit-es.dts | 307 +++++ arch/riscv/configs/defconfig | 30 +- arch/riscv/configs/extra_debug.config | 21 + arch/riscv/configs/rv32_defconfig | 26 +- arch/riscv/include/asm/csr.h | 89 ++ arch/riscv/include/asm/kvm_host.h | 279 +++++ arch/riscv/include/asm/kvm_types.h | 7 + arch/riscv/include/asm/kvm_vcpu_timer.h | 44 + arch/riscv/include/asm/pgtable-bits.h | 1 + arch/riscv/include/uapi/asm/kvm.h | 128 +++ arch/riscv/include/uapi/asm/unistd.h | 5 +- arch/riscv/kernel/asm-offsets.c | 156 +++ arch/riscv/kernel/setup.c | 1 + arch/riscv/kvm/Kconfig | 36 + arch/riscv/kvm/Makefile | 15 + arch/riscv/kvm/main.c | 118 ++ arch/riscv/kvm/mmu.c | 860 ++++++++++++++ arch/riscv/kvm/tlb.S | 74 ++ arch/riscv/kvm/vcpu.c | 1012 +++++++++++++++++ arch/riscv/kvm/vcpu_exit.c | 701 ++++++++++++ arch/riscv/kvm/vcpu_sbi.c | 173 +++ arch/riscv/kvm/vcpu_switch.S | 400 +++++++ arch/riscv/kvm/vcpu_timer.c | 225 ++++ arch/riscv/kvm/vm.c | 81 ++ arch/riscv/kvm/vmid.c | 120 ++ drivers/clk/Kconfig | 5 + drivers/clk/Makefile | 1 + drivers/clk/microchip/Makefile | 2 + drivers/clk/microchip/clk-pfsoc.c | 508 +++++++++ drivers/clocksource/timer-riscv.c | 8 + include/clocksource/timer-riscv.h | 16 + include/uapi/linux/kvm.h | 8 + 39 files changed, 5621 insertions(+), 54 deletions(-) create mode 100644 arch/riscv/boot/dts/microchip/Makefile create mode 100644 arch/riscv/boot/dts/microchip/icicle-kit-es.dts create mode 100644 arch/riscv/configs/extra_debug.config create mode 100644 arch/riscv/include/asm/kvm_host.h create mode 100644 arch/riscv/include/asm/kvm_types.h create mode 100644 arch/riscv/include/asm/kvm_vcpu_timer.h create mode 100644 arch/riscv/include/uapi/asm/kvm.h create mode 100644 arch/riscv/kvm/Kconfig create mode 100644 arch/riscv/kvm/Makefile create mode 100644 arch/riscv/kvm/main.c create mode 100644 arch/riscv/kvm/mmu.c create mode 100644 arch/riscv/kvm/tlb.S create mode 100644 arch/riscv/kvm/vcpu.c create mode 100644 arch/riscv/kvm/vcpu_exit.c create mode 100644 arch/riscv/kvm/vcpu_sbi.c create mode 100644 arch/riscv/kvm/vcpu_switch.S create mode 100644 arch/riscv/kvm/vcpu_timer.c create mode 100644 arch/riscv/kvm/vm.c create mode 100644 arch/riscv/kvm/vmid.c create mode 100644 drivers/clk/microchip/clk-pfsoc.c create mode 100644 include/clocksource/timer-riscv.h -- 2.19.1

1 26

[PATCH 0/7] fixes CVE-2020-4788
by Yang Yingliang 24 Nov '20

24 Nov '20

Andrew Donnellan (1): powerpc: Fix __clear_user() with KUAP enabled Christophe Leroy (2): powerpc: Add a framework for user access tracking powerpc: Implement user_access_begin and friends Daniel Axtens (1): powerpc/64s: move some exception handlers out of line Nicholas Piggin (3): powerpc/64s: flush L1D on kernel entry powerpc/uaccess: Evaluate macro arguments once, before user access is allowed powerpc/64s: flush L1D after user accesses .../admin-guide/kernel-parameters.txt | 7 + .../powerpc/include/asm/book3s/64/kup-radix.h | 22 +++ arch/powerpc/include/asm/exception-64s.h | 9 +- arch/powerpc/include/asm/feature-fixups.h | 19 +++ arch/powerpc/include/asm/futex.h | 4 + arch/powerpc/include/asm/kup.h | 40 +++++ arch/powerpc/include/asm/security_features.h | 7 + arch/powerpc/include/asm/setup.h | 4 + arch/powerpc/include/asm/uaccess.h | 147 ++++++++++++++---- arch/powerpc/kernel/exceptions-64s.S | 96 +++++++----- arch/powerpc/kernel/setup_64.c | 122 ++++++++++++++- arch/powerpc/kernel/vmlinux.lds.S | 14 ++ arch/powerpc/lib/checksum_wrappers.c | 4 + arch/powerpc/lib/feature-fixups.c | 104 +++++++++++++ arch/powerpc/lib/string_32.S | 4 +- arch/powerpc/lib/string_64.S | 6 +- arch/powerpc/platforms/powernv/setup.c | 17 ++ arch/powerpc/platforms/pseries/setup.c | 8 + 18 files changed, 553 insertions(+), 81 deletions(-) create mode 100644 arch/powerpc/include/asm/book3s/64/kup-radix.h create mode 100644 arch/powerpc/include/asm/kup.h -- 2.25.1

1 7

[PATCH 00/14] backport stable-4.19.159
by Yang Yingliang 23 Nov '20

23 Nov '20

Andrew Donnellan (1): powerpc: Fix __clear_user() with KUAP enabled Christophe Leroy (3): powerpc: Add a framework for user access tracking powerpc: Implement user_access_begin and friends powerpc/8xx: Always fault when _PAGE_ACCESSED is not set Daniel Axtens (1): powerpc/64s: move some exception handlers out of line David Edmondson (1): KVM: x86: clflushopt should be treated as a no-op by emulation Greg Kroah-Hartman (1): Linux 4.19.159 Johannes Berg (1): mac80211: always wind down STA state Nicholas Piggin (3): powerpc/64s: flush L1D on kernel entry powerpc/uaccess: Evaluate macro arguments once, before user access is allowed powerpc/64s: flush L1D after user accesses Nick Desaulniers (1): ACPI: GED: fix -Wformat Salvatore Bonaccorso (1): Revert "perf cs-etm: Move definition of 'traceid_list' global variable from header file" Zhang Changzhong (1): can: proc: can_remove_proc(): silence remove_proc_entry warning .../admin-guide/kernel-parameters.txt | 7 + Makefile | 2 +- .../powerpc/include/asm/book3s/64/kup-radix.h | 22 +++ arch/powerpc/include/asm/exception-64s.h | 9 +- arch/powerpc/include/asm/feature-fixups.h | 19 +++ arch/powerpc/include/asm/futex.h | 4 + arch/powerpc/include/asm/kup.h | 40 +++++ arch/powerpc/include/asm/security_features.h | 7 + arch/powerpc/include/asm/setup.h | 4 + arch/powerpc/include/asm/uaccess.h | 147 ++++++++++++++---- arch/powerpc/kernel/exceptions-64s.S | 96 +++++++----- arch/powerpc/kernel/head_8xx.S | 8 +- arch/powerpc/kernel/setup_64.c | 122 ++++++++++++++- arch/powerpc/kernel/vmlinux.lds.S | 14 ++ arch/powerpc/lib/checksum_wrappers.c | 4 + arch/powerpc/lib/feature-fixups.c | 104 +++++++++++++ arch/powerpc/lib/string_32.S | 4 +- arch/powerpc/lib/string_64.S | 6 +- arch/powerpc/platforms/powernv/setup.c | 17 ++ arch/powerpc/platforms/pseries/setup.c | 8 + arch/x86/kvm/emulate.c | 8 +- drivers/acpi/evged.c | 2 +- net/can/proc.c | 6 +- net/mac80211/sta_info.c | 18 +++ tools/perf/util/cs-etm.c | 3 - tools/perf/util/cs-etm.h | 3 + 26 files changed, 589 insertions(+), 95 deletions(-) create mode 100644 arch/powerpc/include/asm/book3s/64/kup-radix.h create mode 100644 arch/powerpc/include/asm/kup.h -- 2.25.1

1 14

[PATCH] vt: Disable KD_FONT_OP_COPY
by Yang Yingliang 23 Nov '20

23 Nov '20

From: Daniel Vetter <daniel.vetter(a)ffwll.ch> stable inclusion from linux-4.19.156 commit 6612b754ac0c85ca8b1181b5d3ea4461a8c1bbcb CVE: CVE-2020-28974 -------------------------------- commit 3c4e0dff2095c579b142d5a0693257f1c58b4804 upstream. It's buggy: On Fri, Nov 06, 2020 at 10:30:08PM +0800, Minh Yuan wrote: > We recently discovered a slab-out-of-bounds read in fbcon in the latest > kernel ( v5.10-rc2 for now ). The root cause of this vulnerability is that > "fbcon_do_set_font" did not handle "vc->vc_font.data" and > "vc->vc_font.height" correctly, and the patch > <https://lkml.org/lkml/2020/9/27/223> for VT_RESIZEX can't handle this > issue. > > Specifically, we use KD_FONT_OP_SET to set a small font.data for tty6, and > use KD_FONT_OP_SET again to set a large font.height for tty1. After that, > we use KD_FONT_OP_COPY to assign tty6's vc_font.data to tty1's vc_font.data > in "fbcon_do_set_font", while tty1 retains the original larger > height. Obviously, this will cause an out-of-bounds read, because we can > access a smaller vc_font.data with a larger vc_font.height. Further there was only one user ever. - Android's loadfont, busybox and console-tools only ever use OP_GET and OP_SET - fbset documentation only mentions the kernel cmdline font: option, not anything else. - systemd used OP_COPY before release 232 published in Nov 2016 Now unfortunately the crucial report seems to have gone down with gmane, and the commit message doesn't say much. But the pull request hints at OP_COPY being broken https://github.com/systemd/systemd/pull/3651 So in other words, this never worked, and the only project which foolishly every tried to use it, realized that rather quickly too. Instead of trying to fix security issues here on dead code by adding missing checks, fix the entire thing by removing the functionality. Note that systemd code using the OP_COPY function ignored the return value, so it doesn't matter what we're doing here really - just in case a lone server somewhere happens to be extremely unlucky and running an affected old version of systemd. The relevant code from font_copy_to_all_vcs() in systemd was: /* copy font from active VT, where the font was uploaded to */ cfo.op = KD_FONT_OP_COPY; cfo.height = vcs.v_active-1; /* tty1 == index 0 */ (void) ioctl(vcfd, KDFONTOP, &cfo); Note this just disables the ioctl, garbage collecting the now unused callbacks is left for -next. v2: Tetsuo found the old mail, which allowed me to find it on another archive. Add the link too. Acked-by: Peilin Ye <yepeilin.cs(a)gmail.com> Reported-by: Minh Yuan <yuanmingbuaa(a)gmail.com> References: https://lists.freedesktop.org/archives/systemd-devel/2016-June/036935.html References: https://github.com/systemd/systemd/pull/3651 Cc: Greg KH <greg(a)kroah.com> Cc: Peilin Ye <yepeilin.cs(a)gmail.com> Cc: Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp> Signed-off-by: Daniel Vetter <daniel.vetter(a)intel.com> Link: https://lore.kernel.org/r/20201108153806.3140315-1-daniel.vetter@ffwll.ch Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/tty/vt/vt.c | 24 ++---------------------- 1 file changed, 2 insertions(+), 22 deletions(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 758f522f331e..13ea0579f104 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -4574,27 +4574,6 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op) return rc; } -static int con_font_copy(struct vc_data *vc, struct console_font_op *op) -{ - int con = op->height; - int rc; - - - console_lock(); - if (vc->vc_mode != KD_TEXT) - rc = -EINVAL; - else if (!vc->vc_sw->con_font_copy) - rc = -ENOSYS; - else if (con < 0 || !vc_cons_allocated(con)) - rc = -ENOTTY; - else if (con == vc->vc_num) /* nothing to do */ - rc = 0; - else - rc = vc->vc_sw->con_font_copy(vc, con); - console_unlock(); - return rc; -} - int con_font_op(struct vc_data *vc, struct console_font_op *op) { switch (op->op) { @@ -4605,7 +4584,8 @@ int con_font_op(struct vc_data *vc, struct console_font_op *op) case KD_FONT_OP_SET_DEFAULT: return con_font_default(vc, op); case KD_FONT_OP_COPY: - return con_font_copy(vc, op); + /* was buggy and never really used */ + return -EINVAL; } return -ENOSYS; } -- 2.25.1

1 0

[PATCH 1/3] fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h
by Yang Yingliang 23 Nov '20

23 Nov '20

From: Peilin Ye <yepeilin.cs(a)gmail.com> stable inclusion from linux-4.19.151 commit 7b9eaa7241ea2cfa580b854d461be72107a4b35c CVE: CVE-2020-28915 It's prepare for fixing CVE-2020-28915. -------------------------------- commit bb0890b4cd7f8203e3aa99c6d0f062d6acdaad27 upstream. drivers/video/console/newport_con.c is borrowing FONT_EXTRA_WORDS macros from drivers/video/fbdev/core/fbcon.h. To keep things simple, move all definitions into <linux/font.h>. Since newport_con now uses four extra words, initialize the fourth word in newport_set_font() properly. Cc: stable(a)vger.kernel.org Signed-off-by: Peilin Ye <yepeilin.cs(a)gmail.com> Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Daniel Vetter <daniel.vetter(a)ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/7fb8bc9b0abc676ada6b7ac0e0bd4… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/video/console/newport_con.c | 7 +------ drivers/video/fbdev/core/fbcon.h | 7 ------- drivers/video/fbdev/core/fbcon_rotate.c | 1 + drivers/video/fbdev/core/tileblit.c | 1 + include/linux/font.h | 8 ++++++++ 5 files changed, 11 insertions(+), 13 deletions(-) diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c index 7f2526b43b33..46a6e6568994 100644 --- a/drivers/video/console/newport_con.c +++ b/drivers/video/console/newport_con.c @@ -33,12 +33,6 @@ #define FONT_DATA ((unsigned char *)font_vga_8x16.data) -/* borrowed from fbcon.c */ -#define REFCOUNT(fd) (((int *)(fd))[-1]) -#define FNTSIZE(fd) (((int *)(fd))[-2]) -#define FNTCHARCNT(fd) (((int *)(fd))[-3]) -#define FONT_EXTRA_WORDS 3 - static unsigned char *font_data[MAX_NR_CONSOLES]; static struct newport_regs *npregs; @@ -519,6 +513,7 @@ static int newport_set_font(int unit, struct console_font *op) FNTSIZE(new_data) = size; FNTCHARCNT(new_data) = op->charcount; REFCOUNT(new_data) = 0; /* usage counter */ + FNTSUM(new_data) = 0; p = new_data; for (i = 0; i < op->charcount; i++) { diff --git a/drivers/video/fbdev/core/fbcon.h b/drivers/video/fbdev/core/fbcon.h index ac11200fd2d5..609280281a47 100644 --- a/drivers/video/fbdev/core/fbcon.h +++ b/drivers/video/fbdev/core/fbcon.h @@ -152,13 +152,6 @@ static inline int attr_col_ec(int shift, struct vc_data *vc, #define attr_bgcol_ec(bgshift, vc, info) attr_col_ec(bgshift, vc, info, 0) #define attr_fgcol_ec(fgshift, vc, info) attr_col_ec(fgshift, vc, info, 1) -/* Font */ -#define REFCOUNT(fd) (((int *)(fd))[-1]) -#define FNTSIZE(fd) (((int *)(fd))[-2]) -#define FNTCHARCNT(fd) (((int *)(fd))[-3]) -#define FNTSUM(fd) (((int *)(fd))[-4]) -#define FONT_EXTRA_WORDS 4 - /* * Scroll Method */ diff --git a/drivers/video/fbdev/core/fbcon_rotate.c b/drivers/video/fbdev/core/fbcon_rotate.c index c0d445294aa7..ac72d4f85f7d 100644 --- a/drivers/video/fbdev/core/fbcon_rotate.c +++ b/drivers/video/fbdev/core/fbcon_rotate.c @@ -14,6 +14,7 @@ #include <linux/fb.h> #include <linux/vt_kern.h> #include <linux/console.h> +#include <linux/font.h> #include <asm/types.h> #include "fbcon.h" #include "fbcon_rotate.h" diff --git a/drivers/video/fbdev/core/tileblit.c b/drivers/video/fbdev/core/tileblit.c index eb664dbf96f6..adff8d6ffe6f 100644 --- a/drivers/video/fbdev/core/tileblit.c +++ b/drivers/video/fbdev/core/tileblit.c @@ -13,6 +13,7 @@ #include <linux/fb.h> #include <linux/vt_kern.h> #include <linux/console.h> +#include <linux/font.h> #include <asm/types.h> #include "fbcon.h" diff --git a/include/linux/font.h b/include/linux/font.h index d6821769dd1e..0a3639a00b3a 100644 --- a/include/linux/font.h +++ b/include/linux/font.h @@ -57,4 +57,12 @@ extern const struct font_desc *get_default_font(int xres, int yres, /* Max. length for the name of a predefined font */ #define MAX_FONT_NAME 32 +/* Extra word getters */ +#define REFCOUNT(fd) (((int *)(fd))[-1]) +#define FNTSIZE(fd) (((int *)(fd))[-2]) +#define FNTCHARCNT(fd) (((int *)(fd))[-3]) +#define FNTSUM(fd) (((int *)(fd))[-4]) + +#define FONT_EXTRA_WORDS 4 + #endif /* _VIDEO_FONT_H */ -- 2.25.1

1 2

[PATCH] speakup: Do not let the line discipline be used several times
by Yang Yingliang 23 Nov '20

23 Nov '20

From: Samuel Thibault <samuel.thibault(a)ens-lyon.org> mainline inclusion from mainline-v5.10 commit d4122754442799187d5d537a9c039a49a67e57f1 category: bugfix bugzilla: NA CVE: CVE-2020-28941 -------------------------------- Speakup has only one speakup_tty variable to store the tty it is managing. This makes sense since its codebase currently assumes that there is only one user who controls the screen reading. That however means that we have to forbid using the line discipline several times, otherwise the second closure would try to free a NULL ldisc_data, leading to general protection fault: 0000 [#1] SMP KASAN PTI RIP: 0010:spk_ttyio_ldisc_close+0x2c/0x60 Call Trace: tty_ldisc_release+0xa2/0x340 tty_release_struct+0x17/0xd0 tty_release+0x9d9/0xcc0 __fput+0x231/0x740 task_work_run+0x12c/0x1a0 do_exit+0x9b5/0x2230 ? release_task+0x1240/0x1240 ? __do_page_fault+0x562/0xa30 do_group_exit+0xd5/0x2a0 __x64_sys_exit_group+0x35/0x40 do_syscall_64+0x89/0x2b0 ? page_fault+0x8/0x30 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Cc: stable(a)vger.kernel.org Reported-by: 秦世松 <qinshisong1205(a)gmail.com> Signed-off-by: Samuel Thibault <samuel.thibault(a)ens-lyon.org> Tested-by: Shisong Qin <qinshisong1205(a)gmail.com> Link: https://lore.kernel.org/r/20201110183541.fzgnlwhjpgqzjeth@function Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/accessibility/speakup/spk_ttyio.c [yyl: spk_ttyio.c is in drivers/staging/ in kernel-4.19] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/staging/speakup/spk_ttyio.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/staging/speakup/spk_ttyio.c b/drivers/staging/speakup/spk_ttyio.c index 93742dbdee77..6c754ddf1257 100644 --- a/drivers/staging/speakup/spk_ttyio.c +++ b/drivers/staging/speakup/spk_ttyio.c @@ -49,15 +49,25 @@ static int spk_ttyio_ldisc_open(struct tty_struct *tty) if (tty->ops->write == NULL) return -EOPNOTSUPP; + + mutex_lock(&speakup_tty_mutex); + if (speakup_tty) { + mutex_unlock(&speakup_tty_mutex); + return -EBUSY; + } speakup_tty = tty; ldisc_data = kmalloc(sizeof(struct spk_ldisc_data), GFP_KERNEL); - if (!ldisc_data) + if (!ldisc_data) { + speakup_tty = NULL; + mutex_unlock(&speakup_tty_mutex); return -ENOMEM; + } sema_init(&ldisc_data->sem, 0); ldisc_data->buf_free = true; speakup_tty->disc_data = ldisc_data; + mutex_unlock(&speakup_tty_mutex); return 0; } -- 2.25.1

1 0

[PATCH 00/98] backport stable-4.19.158
by Yang Yingliang 23 Nov '20

23 Nov '20

Al Viro (1): don't dump the threads that had been already exiting when zapped. Alexander Usyskin (1): mei: protect mei_cl_mtu from null dereference Anand Jain (1): btrfs: dev-replace: fail mount if we don't have replace item with target device Anand K Mistry (1): x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP Andrew Jeffery (1): ARM: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe template Andy Shevchenko (1): pinctrl: intel: Set default bias in case no particular value given Ard Biesheuvel (1): crypto: arm64/aes-modes - get rid of literal load of addend vector Arnaldo Carvalho de Melo (1): perf scripting python: Avoid declaring function pointers with a visibility attribute Arnaud de Turckheim (3): gpio: pcie-idio-24: Fix irq mask when masking gpio: pcie-idio-24: Fix IRQ Enable Register value gpio: pcie-idio-24: Enable PEX8311 interrupts Baolin Wang (1): mfd: sprd: Add wakeup capability for PMIC IRQ Billy Tsai (1): pinctrl: aspeed: Fix GPI only function problem. Bob Peterson (3): gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free gfs2: Add missing truncate_inode_pages_final for sd_aspace gfs2: check for live vs. read-only file system in gfs2_fitrim Boris Protopopov (1): Convert trailing spaces and periods in path components Brian Foster (1): xfs: flush new eof page on truncate to avoid post-eof corruption Chen Zhou (1): selinux: Fix error return code in sel_ib_pkey_sid_slow() Chris Brandt (1): usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode Christoph Hellwig (2): nbd: fix a block_device refcount leak in nbd_release xfs: fix a missing unlock on error in xfs_fs_map_blocks Chunyan Zhang (1): tick/common: Touch watchdog in tick_unfreeze() on all CPUs Coiby Xu (2): pinctrl: amd: use higher precision for 512 RtcClk pinctrl: amd: fix incorrect way to disable debounce filter Dan Carpenter (3): ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() can: peak_usb: add range checking in decode operations futex: Don't enable IRQs unconditionally in put_pi_state() Darrick J. Wong (6): xfs: set xefi_discard when creating a deferred agfl free log intent item xfs: fix scrub flagging rtinherit even if there is no rt device xfs: fix flags argument to rmap lookup when converting shared file rmaps xfs: set the unwritten bit in rmap lookup flags in xchk_bmap_get_rmapextents xfs: fix rmap key and record comparison functions xfs: fix brainos in the refcount scrubber's rmap fragment processor Dinghao Liu (1): btrfs: ref-verify: fix memory leak in btrfs_ref_tree_mod Evan Nimmo (1): of/address: Fix of_node memory leak in of_dma_is_coherent Evan Quan (3): drm/amdgpu: perform srbm soft reset always on SDMA resume drm/amd/pm: perform SMC reset on suspend/hibernation drm/amd/pm: do not use ixFEATURE_STATUS for checking smc running Evgeny Novikov (1): usb: gadget: goku_udc: fix potential crashes in probe Filipe Manana (1): Btrfs: fix missing error return if writeback for extent buffer never started Gao Xiang (1): erofs: derive atime instead of leaving it empty George Spelvin (1): random32: make prandom_u32() output unpredictable Greg Kroah-Hartman (1): Linux 4.19.158 Hannes Reinecke (1): scsi: scsi_dh_alua: Avoid crash during alua_bus_detach() Heiner Kallweit (1): r8169: fix potential skb double free in an error path Jason A. Donenfeld (1): netfilter: use actual socket sk rather than skb sk when routing harder Jerry Snitselaar (1): tpm_tis: Disable interrupts on ThinkPad T490s Jing Xiangfeng (1): thunderbolt: Add the missed ida_simple_remove() in ring_request_msix() Jiri Olsa (1): perf tools: Add missing swap for ino_generation Joakim Zhang (1): can: flexcan: remove FLEXCAN_QUIRK_DISABLE_MECR quirk for LS1021A Johannes Berg (1): mac80211: fix use of skb payload instead of header Johannes Thumshirn (1): btrfs: reschedule when cloning lots of extents Josef Bacik (1): btrfs: sysfs: init devices outside of the chunk_mutex Joseph Qi (1): ext4: unlock xattr_sem properly in ext4_inline_data_truncate() Kaixu Xia (1): ext4: correctly report "not supported" for {usr,grp}jquota when !CONFIG_QUOTA Keita Suzuki (1): scsi: hpsa: Fix memory leak in hpsa_init_one() Mao Wenan (1): net: Update window_clamp if SOCK_RCVBUF is set Marc Kleine-Budde (1): can: rx-offload: don't call kfree_skb() from IRQ context Marc Zyngier (1): genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY Martin Schiller (1): net/x25: Fix null-ptr-deref in x25_connect Martin Willi (1): vrf: Fix fast path output packet handling with async Netfilter rules Masashi Honma (1): ath9k_htc: Use appropriate rs_datalen type Matteo Croce (2): Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint" reboot: fix overflow parsing reboot cpu number Matthew Wilcox (Oracle) (1): btrfs: fix potential overflow in cluster_pages_for_defrag on 32bit arch Michał Mirosław (1): regulator: defer probe when trying to get voltage from unresolved supply Mika Westerberg (1): thunderbolt: Fix memory leak if ida_simple_get() fails in enumerate_services() Olaf Hering (1): hv_balloon: disable warning when floor reached Oleksij Rempel (1): can: can_create_echo_skb(): fix echo skb generation: always use skb_clone() Oliver Hartkopp (1): can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames Oliver Herms (1): IPv6: Set SIT tunnel hard_header_len to zero Peter Zijlstra (1): perf: Fix get_recursion_context() Qian Cai (1): s390/smp: move rcu_cpu_starting() earlier Shin'ichiro Kawasaki (1): uio: Fix use-after-free in uio_unregister_device() Stefano Brivio (1): netfilter: ipset: Update byte and packet counters regardless of whether they match Stefano Stabellini (1): swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb" Stephane Grosjean (2): can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on Suravee Suthikulpanit (1): iommu/amd: Increase interrupt remapping table limit to 512 entries Sven Van Asbroeck (1): lan743x: fix "BUG: invalid wait context" when setting rx mode Thinh Nguyen (2): usb: dwc3: gadget: Continue to process pending requests usb: dwc3: gadget: Reclaim extra TRBs after request completion Thomas Zimmermann (1): drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[] Tommi Rantala (1): selftests: proc: fix warning: _GNU_SOURCE redefined Tyler Hicks (1): tpm: efi: Don't create binary_bios_measurements file for an empty log Ursula Braun (1): net/af_iucv: fix null pointer dereference on shutdown Vincent Mailhol (1): can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context Wang Hai (2): cosa: Add missing kfree in error path of cosa_write tipc: fix memory leak in tipc_topsrv_start() Wengang Wang (1): ocfs2: initialize ip_next_orphan Ye Bin (1): cfg80211: regulatory: Fix inconsistent format argument Yoshihiro Shimoda (1): mmc: renesas_sdhi_core: Add missing tmio_mmc_host_free() at remove Yunsheng Lin (1): net: sch_generic: fix the missing new qdisc assignment bug Zeng Tao (1): time: Prevent undefined behaviour in timespec64_to_ns() Zhang Qilong (2): vfio: platform: fix reference leak in vfio_platform_open xhci: hisilicon: fix refercence leak in xhci_histb_probe zhuoliang zhang (1): net: xfrm: fix a race condition during allocing spi Makefile | 2 +- arch/arm/include/asm/kprobes.h | 22 +- arch/arm/probes/kprobes/opt-arm.c | 18 +- arch/arm64/crypto/aes-modes.S | 16 +- arch/s390/kernel/smp.c | 3 +- arch/x86/kernel/cpu/bugs.c | 52 +- drivers/block/nbd.c | 1 + drivers/char/random.c | 1 - drivers/char/tpm/eventlog/efi.c | 5 + drivers/char/tpm/tpm_tis.c | 29 +- drivers/gpio/gpio-pcie-idio-24.c | 62 ++- drivers/gpu/drm/amd/amdgpu/cik_sdma.c | 27 +- .../gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 4 + drivers/gpu/drm/amd/powerplay/inc/hwmgr.h | 1 + drivers/gpu/drm/amd/powerplay/inc/smumgr.h | 2 + .../gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 29 +- drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c | 8 + drivers/gpu/drm/gma500/psb_irq.c | 34 +- drivers/hv/hv_balloon.c | 2 +- drivers/iommu/amd_iommu_types.h | 6 +- drivers/mfd/sprd-sc27xx-spi.c | 28 +- drivers/misc/mei/client.h | 4 +- drivers/mmc/host/renesas_sdhi_core.c | 1 + drivers/net/can/dev.c | 14 +- drivers/net/can/flexcan.c | 3 +- drivers/net/can/peak_canfd/peak_canfd.c | 11 +- drivers/net/can/rx-offload.c | 4 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 51 +- drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 48 +- drivers/net/ethernet/microchip/lan743x_main.c | 12 +- drivers/net/ethernet/microchip/lan743x_main.h | 3 - drivers/net/ethernet/realtek/r8169.c | 3 +- drivers/net/vrf.c | 92 +++- drivers/net/wan/cosa.c | 1 + drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 2 +- drivers/of/address.c | 4 +- drivers/pinctrl/aspeed/pinctrl-aspeed.c | 7 +- drivers/pinctrl/intel/pinctrl-intel.c | 8 + drivers/pinctrl/pinctrl-amd.c | 6 +- drivers/regulator/core.c | 2 + drivers/scsi/device_handler/scsi_dh_alua.c | 9 +- drivers/scsi/hpsa.c | 4 +- drivers/staging/erofs/inode.c | 21 +- drivers/thunderbolt/nhi.c | 19 +- drivers/thunderbolt/xdomain.c | 1 + drivers/uio/uio.c | 10 +- drivers/usb/class/cdc-acm.c | 9 + drivers/usb/dwc3/gadget.c | 32 +- drivers/usb/gadget/udc/goku_udc.c | 2 +- drivers/usb/host/xhci-histb.c | 2 +- drivers/vfio/platform/vfio_platform_common.c | 3 +- fs/btrfs/dev-replace.c | 26 +- fs/btrfs/extent_io.c | 4 + fs/btrfs/ioctl.c | 12 +- fs/btrfs/ref-verify.c | 1 + fs/btrfs/volumes.c | 33 +- fs/cifs/cifs_unicode.c | 8 +- fs/ext4/inline.c | 1 + fs/ext4/super.c | 4 +- fs/gfs2/rgrp.c | 5 +- fs/gfs2/super.c | 1 + fs/ocfs2/super.c | 1 + fs/xfs/libxfs/xfs_alloc.c | 1 + fs/xfs/libxfs/xfs_bmap.h | 2 +- fs/xfs/libxfs/xfs_rmap.c | 2 +- fs/xfs/libxfs/xfs_rmap_btree.c | 16 +- fs/xfs/scrub/bmap.c | 2 + fs/xfs/scrub/inode.c | 3 +- fs/xfs/scrub/refcount.c | 8 +- fs/xfs/xfs_iops.c | 10 + fs/xfs/xfs_pnfs.c | 2 +- include/linux/can/skb.h | 20 +- include/linux/netfilter_ipv4.h | 2 +- include/linux/netfilter_ipv6.h | 2 +- include/linux/prandom.h | 36 +- include/linux/time64.h | 4 + kernel/dma/swiotlb.c | 6 +- kernel/events/internal.h | 2 +- kernel/exit.c | 5 +- kernel/futex.c | 5 +- kernel/irq/Kconfig | 1 + kernel/reboot.c | 28 +- kernel/time/itimer.c | 4 - kernel/time/tick-common.c | 2 + kernel/time/timer.c | 7 - lib/random32.c | 462 +++++++++++------- net/ipv4/netfilter.c | 12 +- net/ipv4/netfilter/ipt_SYNPROXY.c | 2 +- net/ipv4/netfilter/iptable_mangle.c | 2 +- net/ipv4/netfilter/nf_nat_l3proto_ipv4.c | 2 +- net/ipv4/netfilter/nf_reject_ipv4.c | 2 +- net/ipv4/netfilter/nft_chain_route_ipv4.c | 2 +- net/ipv4/syncookies.c | 9 +- net/ipv6/netfilter.c | 6 +- net/ipv6/netfilter/ip6table_mangle.c | 2 +- net/ipv6/netfilter/nf_nat_l3proto_ipv6.c | 2 +- net/ipv6/netfilter/nft_chain_route_ipv6.c | 2 +- net/ipv6/sit.c | 2 - net/ipv6/syncookies.c | 10 +- net/iucv/af_iucv.c | 3 +- net/mac80211/tx.c | 37 +- net/netfilter/ipset/ip_set_core.c | 3 +- net/netfilter/ipvs/ip_vs_core.c | 4 +- net/sched/sch_generic.c | 3 + net/tipc/topsrv.c | 10 +- net/wireless/reg.c | 2 +- net/x25/af_x25.c | 2 +- net/xfrm/xfrm_state.c | 8 +- security/selinux/ibpkey.c | 4 +- sound/hda/ext/hdac_ext_controller.c | 2 + .../scripting-engines/trace-event-python.c | 7 +- tools/perf/util/session.c | 1 + .../testing/selftests/proc/proc-loadavg-001.c | 1 - .../selftests/proc/proc-self-syscall.c | 1 - .../testing/selftests/proc/proc-uptime-002.c | 1 - 115 files changed, 1073 insertions(+), 539 deletions(-) -- 2.25.1

1 98

[PATCH 1/2] ascend: share_pool: support debug mode and refactor some functions
by Yang Yingliang 23 Nov '20

23 Nov '20

From: Ding Tianhong <dingtianhong(a)huawei.com> ascend inclusion category: feature bugzilla: NA CVE: NA ------------------------------------------------- The share pool is used widely for several accelerator, and it is difficult to debug the user problem, so add debug mode to analyse the problem, this mode is enabled by the sysctl_sp_debug_mode flag. Some functions have been refactored to protect the critical area correctly, and output message more clearly. Signed-off-by: Tang Yizhou <tangyizhou(a)huawei.com> Signed-off-by: Zhou Guanghui <zhouguanghui1(a)huawei.com> Signed-off-by: Wu Peng <wupeng58(a)huawei.com> Signed-off-by: Ding Tianhong <dingtianhong(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/share_pool.h | 15 +- kernel/sysctl.c | 9 + mm/share_pool.c | 537 +++++++++++++++++++++---------------- 3 files changed, 326 insertions(+), 235 deletions(-) diff --git a/include/linux/share_pool.h b/include/linux/share_pool.h index 09afbae33d41..2557ef138122 100644 --- a/include/linux/share_pool.h +++ b/include/linux/share_pool.h @@ -5,6 +5,7 @@ #include <linux/mm_types.h> #include <linux/notifier.h> #include <linux/vmalloc.h> +#include <linux/printk.h> #define SP_HUGEPAGE (1 << 0) #define SP_HUGEPAGE_ONLY (1 << 1) @@ -35,6 +36,8 @@ extern int sysctl_share_pool_hugepage_enable; extern int sysctl_ac_mode; +extern int sysctl_sp_debug_mode; + extern int enable_ascend_share_pool; /* Processes in the same sp_group can share memory. @@ -70,7 +73,7 @@ struct sp_group { /* number of sp_area */ atomic_t spa_num; /* total size of all sp_area from sp_alloc and k2u(spg) */ - atomic_t size; + atomic64_t size; /* record the number of hugepage allocation failures */ int hugepage_failures; /* is_alive == false means it's being destroyed */ @@ -211,6 +214,12 @@ static inline bool sp_mmap_check(unsigned long flags) return false; } +static inline void sp_dump_stack(void) +{ + if (sysctl_sp_debug_mode) + dump_stack(); +} + #else static inline int sp_group_add_task(int pid, int spg_id) @@ -349,6 +358,10 @@ static inline bool sp_mmap_check(unsigned long flags) { return false; } + +static inline void sp_dump_stack(void) +{ +} #endif #endif /* LINUX_SHARE_POOL_H */ diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 61e62f1ccee4..26c215fb37dc 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -1737,6 +1737,15 @@ static struct ctl_table vm_table[] = { .extra1 = &zero, .extra2 = &one, }, + { + .procname = "sharepool_debug_mode", + .data = &sysctl_sp_debug_mode, + .maxlen = sizeof(sysctl_sp_debug_mode), + .mode = 0600, + .proc_handler = proc_dointvec_minmax, + .extra1 = &zero, + .extra2 = &one, + }, #endif { } }; diff --git a/mm/share_pool.c b/mm/share_pool.c index fcbc831f7f8c..24c5dd680451 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -57,6 +57,8 @@ static const int mdc_default_group_id = 1; /* access control mode */ int sysctl_ac_mode = AC_NONE; +/* debug mode */ +int sysctl_sp_debug_mode; /* idr of all sp_groups */ static DEFINE_IDR(sp_group_idr); @@ -85,9 +87,11 @@ struct sp_proc_stat { /* for kthread buff_module_guard_work */ static struct sp_proc_stat kthread_stat = {0}; -/* The caller must hold sp_mutex. */ -static struct sp_proc_stat *sp_init_proc_stat(struct task_struct *tsk) -{ +/* + * The caller must hold sp_mutex and ensure no concurrency problem + * for task_struct and mm_struct. + */ +static struct sp_proc_stat *sp_init_proc_stat(struct task_struct *tsk) { struct sp_proc_stat *stat; int id = tsk->mm->sp_stat_id; int tgid = tsk->tgid; @@ -138,7 +142,7 @@ static struct sp_spa_stat spa_stat = {0}; /* statistics of all sp group born from sp_alloc and k2u(spg) */ struct sp_spg_stat { atomic_t spa_total_num; - atomic_t spa_total_size; + atomic64_t spa_total_size; }; static struct sp_spg_stat spg_stat = {0}; @@ -166,10 +170,11 @@ struct sp_area { struct list_head link; /* link to the spg->head */ struct sp_group *spg; enum spa_type type; /* where spa born from */ + struct mm_struct *mm; /* owner of k2u(task) */ }; static DEFINE_SPINLOCK(sp_area_lock); static struct rb_root sp_area_root = RB_ROOT; -bool host_svm_sp_enable = false; +static bool host_svm_sp_enable = false; int sysctl_share_pool_hugepage_enable = 1; @@ -241,7 +246,7 @@ static int spa_dec_usage(enum spa_type type, unsigned long size) return 0; } -static void *sp_mmap(struct mm_struct *mm, struct file *file, +static unsigned long sp_mmap(struct mm_struct *mm, struct file *file, struct sp_area *spa, unsigned long *populate); static void free_sp_group(struct sp_group *spg) @@ -274,7 +279,18 @@ static struct sp_group *__sp_find_spg(int pid, int spg_id) if (ret) return NULL; - spg = tsk->mm->sp_group; + /* + * Once we encounter a concurrency problem here. + * To fix it, we believe get_task_mm() and mmput() is too + * heavy because we just get the pointer of sp_group. + */ + task_lock(tsk); + if (tsk->mm == NULL) + spg = NULL; + else + spg = tsk->mm->sp_group; + task_unlock(tsk); + put_task_struct(tsk); } else { spg = idr_find(&sp_group_idr, spg_id); @@ -318,7 +334,7 @@ static struct sp_group *find_or_alloc_sp_group(int spg_id) } spg->id = spg_id; atomic_set(&spg->spa_num, 0); - atomic_set(&spg->size, 0); + atomic64_set(&spg->size, 0); spg->is_alive = true; spg->hugepage_failures = 0; spg->dvpp_multi_spaces = false; @@ -377,9 +393,6 @@ static void sp_munmap_task_areas(struct mm_struct *mm, struct list_head *stop) struct sp_area *spa, *prev = NULL; int err; - if (!mmget_not_zero(mm)) - return; - down_write(&mm->mmap_sem); spin_lock(&sp_area_lock); list_for_each_entry(spa, &mm->sp_group->spa_list, link) { @@ -406,8 +419,17 @@ static void sp_munmap_task_areas(struct mm_struct *mm, struct list_head *stop) __sp_area_drop_locked(prev); spin_unlock(&sp_area_lock); - up_write(&mm->mmap_sem); - mmput(mm); +} + +/* The caller must hold sp_mutex. */ +static void __sp_group_drop_locked(struct sp_group *spg) +{ + bool is_alive = spg->is_alive; + + if (atomic_dec_and_test(&spg->use_count)) { + BUG_ON(is_alive); + free_sp_group(spg); + } } /** @@ -446,8 +468,9 @@ int sp_group_add_task(int pid, int spg_id) spg = idr_find(&sp_group_idr, spg_id); if (!spg_valid(spg)) { mutex_unlock(&sp_mutex); - pr_err("share pool: task add group failed because group id %d hasn't been create or dead\n", - spg_id); + if (printk_ratelimit()) + pr_err("share pool: task add group failed because group id %d " + "hasn't been create or dead\n", spg_id); return -EINVAL; } mutex_unlock(&sp_mutex); @@ -457,7 +480,9 @@ int sp_group_add_task(int pid, int spg_id) spg_id = ida_alloc_range(&sp_group_id_ida, SPG_ID_AUTO_MIN, SPG_ID_AUTO_MAX, GFP_ATOMIC); if (spg_id < 0) { - pr_err("share pool: task add group failed when automatically generate group id failed\n"); + if (printk_ratelimit()) + pr_err("share pool: task add group failed when automatically " + "generate group id failed\n"); return spg_id; } } @@ -467,8 +492,9 @@ int sp_group_add_task(int pid, int spg_id) SPG_ID_DVPP_PASS_THROUGH_MIN, SPG_ID_DVPP_PASS_THROUGH_MAX, GFP_ATOMIC); if (spg_id < 0) { - pr_err("share pool: task add group failed when automatically generate group id failed" - "in DVPP pass through\n"); + if (printk_ratelimit()) + pr_err("share pool: task add group failed when automatically " + "generate group id failed in DVPP pass through\n"); return spg_id; } } @@ -494,25 +520,31 @@ int sp_group_add_task(int pid, int spg_id) ret = PTR_ERR(spg); goto out_put_task; } + atomic_inc(&spg->use_count); + /* access control permission check */ if (sysctl_ac_mode == AC_SINGLE_OWNER) { if (spg->owner != current->group_leader) { ret = -EPERM; - goto out_put_task; + goto out_drop_group; } } + mm = get_task_mm(tsk); + if (!mm) { + ret = -ESRCH; + goto out_drop_group; + } + /* per process statistics initialization */ stat = sp_init_proc_stat(tsk); if (IS_ERR(stat)) { ret = PTR_ERR(stat); pr_err("share pool: init proc stat failed, ret %lx\n", PTR_ERR(stat)); - goto out_put_task; + goto out_put_mm; } - mm = tsk->mm; mm->sp_group = spg; - atomic_inc(&spg->use_count); list_add_tail(&tsk->mm->sp_node, &spg->procs); /* * create mappings of existing shared memory segments into this @@ -523,7 +555,7 @@ int sp_group_add_task(int pid, int spg_id) list_for_each_entry(spa, &spg->spa_list, link) { unsigned long populate = 0; struct file *file = spa_file(spa); - void *p; + unsigned long addr; if (prev) __sp_area_drop_locked(prev); @@ -532,28 +564,24 @@ int sp_group_add_task(int pid, int spg_id) atomic_inc(&spa->use_count); spin_unlock(&sp_area_lock); - p = sp_mmap(mm, file, spa, &populate); - if (IS_ERR(p) && (PTR_ERR(p) != -ESPGMMEXIT)) { + down_write(&mm->mmap_sem); + addr = sp_mmap(mm, file, spa, &populate); + if (IS_ERR_VALUE(addr)) { sp_munmap_task_areas(mm, &spa->link); - ret = PTR_ERR(p); + up_write(&mm->mmap_sem); + ret = addr; pr_err("share pool: task add group sp mmap failed, ret %d\n", ret); spin_lock(&sp_area_lock); break; } - - if (PTR_ERR(p) == -ESPGMMEXIT) { - pr_err("share pool: task add group sp mmap failed, ret -ESPGMEXIT\n"); - spin_lock(&sp_area_lock); - ret = -ESPGMMEXIT; - break; - } + up_write(&mm->mmap_sem); if (populate) { ret = do_mm_populate(mm, spa->va_start, populate, 0); if (ret) { if (printk_ratelimit()) - pr_err("share pool: task add group failed when mm populate failed: %d\n", - ret); + pr_warn("share pool: task add group failed when mm populate " + "failed (potential no enough memory): %d\n", ret); sp_munmap_task_areas(mm, spa->link.next); } } @@ -567,8 +595,16 @@ int sp_group_add_task(int pid, int spg_id) if (unlikely(ret)) { idr_remove(&sp_stat_idr, mm->sp_stat_id); kfree(stat); + mm->sp_stat_id = 0; + list_del(&mm->sp_node); + mm->sp_group = NULL; } +out_put_mm: + mmput(mm); +out_drop_group: + if (unlikely(ret)) + __sp_group_drop_locked(spg); out_put_task: put_task_struct(tsk); out_unlock: @@ -609,9 +645,6 @@ void sp_group_exit(struct mm_struct *mm) bool is_alive = true; bool unlock; - if (!enable_ascend_share_pool) - return; - /* * Nothing to do if this thread group doesn't belong to any sp_group. * No need to protect this check with lock because we can add a task @@ -638,18 +671,13 @@ void sp_group_exit(struct mm_struct *mm) void sp_group_post_exit(struct mm_struct *mm) { - bool is_alive; struct sp_proc_stat *stat; bool unlock; - if (!enable_ascend_share_pool) - return; - if (!mm->sp_group) return; spg_exit_lock(&unlock); - is_alive = mm->sp_group->is_alive; /* pointer stat must be valid, we don't need to check sanity */ stat = idr_find(&sp_stat_idr, mm->sp_stat_id); @@ -673,10 +701,7 @@ void sp_group_post_exit(struct mm_struct *mm) idr_remove(&sp_stat_idr, mm->sp_stat_id); - if (atomic_dec_and_test(&mm->sp_group->use_count)) { - BUG_ON(is_alive); - free_sp_group(mm->sp_group); - } + __sp_group_drop_locked(mm->sp_group); spg_exit_unlock(unlock); kfree(stat); @@ -716,7 +741,7 @@ static void __insert_sp_area(struct sp_area *spa) static struct sp_area *sp_alloc_area(unsigned long size, unsigned long flags, struct sp_group *spg, enum spa_type type) { - struct sp_area *spa; + struct sp_area *spa, *err; struct rb_node *n; unsigned long vstart = MMAP_SHARE_POOL_START; unsigned long vend = MMAP_SHARE_POOL_16G_START; @@ -728,6 +753,11 @@ static struct sp_area *sp_alloc_area(unsigned long size, unsigned long flags, vstart = MMAP_SHARE_POOL_16G_START; vend = MMAP_SHARE_POOL_16G_START + MMAP_SHARE_POOL_16G_SIZE; } else { + if (!spg) { + if (printk_ratelimit()) + pr_err("share pool: don't allow k2u(task) in host svm multiprocess scene\n"); + return ERR_PTR(-EINVAL); + } vstart = spg->dvpp_va_start; vend = spg->dvpp_va_start + spg->dvpp_size; } @@ -735,14 +765,11 @@ static struct sp_area *sp_alloc_area(unsigned long size, unsigned long flags, addr = vstart; - if (!sysctl_share_pool_hugepage_enable) - flags &= ~(SP_HUGEPAGE_ONLY | SP_HUGEPAGE); - spa = kmalloc(sizeof(struct sp_area), GFP_KERNEL); if (unlikely(!spa)) { if (printk_ratelimit()) pr_err("share pool: alloc spa failed due to lack of memory\n"); - return NULL; + return ERR_PTR(-ENOMEM); } spin_lock(&sp_area_lock); @@ -788,6 +815,7 @@ static struct sp_area *sp_alloc_area(unsigned long size, unsigned long flags, } found: if (addr + size_align > vend) { + err = ERR_PTR(-EOVERFLOW); goto error; } @@ -799,15 +827,17 @@ static struct sp_area *sp_alloc_area(unsigned long size, unsigned long flags, atomic_set(&spa->use_count, 1); spa->type = type; - if (spa_inc_usage(type, size)) + if (spa_inc_usage(type, size)) { + err = ERR_PTR(-EINVAL); goto error; + } __insert_sp_area(spa); if (spa->spg) { atomic_inc(&spg->spa_num); - atomic_add(size, &spg->size); + atomic64_add(size, &spg->size); atomic_inc(&spg_stat.spa_total_num); - atomic_add(size, &spg_stat.spa_total_size); + atomic64_add(size, &spg_stat.spa_total_size); list_add_tail(&spa->link, &spg->spa_list); } spin_unlock(&sp_area_lock); @@ -817,7 +847,7 @@ static struct sp_area *sp_alloc_area(unsigned long size, unsigned long flags, error: spin_unlock(&sp_area_lock); kfree(spa); - return NULL; + return err; } /* the caller should hold sp_area_lock */ @@ -862,9 +892,9 @@ static void sp_free_area(struct sp_area *spa) spa_dec_usage(spa->type, spa->real_size); /* won't fail */ if (spa->spg) { atomic_dec(&spa->spg->spa_num); - atomic_sub(spa->real_size, &spa->spg->size); + atomic64_sub(spa->real_size, &spa->spg->size); atomic_dec(&spg_stat.spa_total_num); - atomic_sub(spa->real_size, &spg_stat.spa_total_size); + atomic64_sub(spa->real_size, &spg_stat.spa_total_size); list_del(&spa->link); } rb_erase(&spa->rb_node, &sp_area_root); @@ -898,7 +928,7 @@ void sp_area_drop(struct vm_area_struct *vma) { struct sp_area *spa; - if (!sp_check_vm_share_pool(vma->vm_flags)) + if (!(vma->vm_flags & VM_SHARE_POOL)) return; /* @@ -979,13 +1009,25 @@ int sp_free(unsigned long addr) } else { /* spa == NULL */ ret = -EINVAL; if (printk_ratelimit()) - pr_err("share pool: sp_free invalid input addr %pK\n", (void *)addr); + pr_err("share pool: sp free invalid input addr %pK\n", (void *)addr); goto out; } + if (spa->type != SPA_TYPE_ALLOC) { + if (printk_ratelimit()) + pr_err("share pool: sp free failed, addr %pK is not from sp_alloc\n", + (void *)addr); + } + if (!spg_valid(spa->spg)) goto drop_spa; + pr_notice("share pool: [sp free] caller %s(%d/%d); " + "group id %d addr 0x%pK, size %ld\n", + current->comm, current->tgid, current->pid, spa->spg->id, + (void *)spa->va_start, spa->real_size); + sp_dump_stack(); + __sp_free(spa->spg, spa->va_start, spa_size(spa), NULL); /* Free the memory of the backing shmem or hugetlbfs */ @@ -993,7 +1035,7 @@ int sp_free(unsigned long addr) offset = addr - MMAP_SHARE_POOL_START; ret = vfs_fallocate(spa_file(spa), mode, offset, spa_size(spa)); if (ret) - pr_err("share pool: fallocate failed: %d\n", ret); + pr_err("share pool: sp free fallocate failed: %d\n", ret); /* pointer stat may be invalid because of kthread buff_module_guard_work */ if (current->mm == NULL) { @@ -1016,7 +1058,7 @@ int sp_free(unsigned long addr) EXPORT_SYMBOL_GPL(sp_free); /* wrapper of __do_mmap() and the caller must hold down_write(&mm->mmap_sem). */ -static unsigned long __sp_mmap(struct mm_struct *mm, struct file *file, +static unsigned long sp_mmap(struct mm_struct *mm, struct file *file, struct sp_area *spa, unsigned long *populate) { unsigned long addr = spa->va_start; @@ -1033,30 +1075,13 @@ static unsigned long __sp_mmap(struct mm_struct *mm, struct file *file, if (IS_ERR_VALUE(addr)) { atomic_dec(&spa->use_count); pr_err("share pool: do_mmap fails %ld\n", addr); + } else { + BUG_ON(addr != spa->va_start); } return addr; } -static void *sp_mmap(struct mm_struct *mm, struct file *file, - struct sp_area *spa, unsigned long *populate) -{ - unsigned long addr; - - if (!mmget_not_zero(mm)) - return ERR_PTR(-ESPGMMEXIT); - down_write(&mm->mmap_sem); - addr = __sp_mmap(mm, file, spa, populate); - up_write(&mm->mmap_sem); - mmput(mm); - - if (IS_ERR_VALUE(addr)) - return ERR_PTR(addr); - - BUG_ON(addr != spa->va_start); - return (void *)addr; -} - /** * Allocate shared memory for all the processes in the same sp_group * size - the size of memory to allocate @@ -1071,12 +1096,14 @@ void *sp_alloc(unsigned long size, unsigned long sp_flags, int spg_id) struct sp_area *spa = NULL; struct sp_proc_stat *stat; unsigned long sp_addr; - void *p_mmap, *p = ERR_PTR(-ENODEV); + unsigned long mmap_addr; + void *p = ERR_PTR(-ENODEV); struct mm_struct *mm; struct file *file; unsigned long size_aligned; int ret = 0; struct mm_struct *tmp; + unsigned long mode, offset; /* mdc scene hack */ if (enable_mdc_default_group) @@ -1133,9 +1160,6 @@ void *sp_alloc(unsigned long size, unsigned long sp_flags, int spg_id) goto out; } - if (!sysctl_share_pool_hugepage_enable) - sp_flags &= ~(SP_HUGEPAGE_ONLY | SP_HUGEPAGE); - if (sp_flags & SP_HUGEPAGE) { file = spg->file_hugetlb; size_aligned = ALIGN(size, PMD_SIZE); @@ -1145,10 +1169,12 @@ void *sp_alloc(unsigned long size, unsigned long sp_flags, int spg_id) } try_again: spa = sp_alloc_area(size_aligned, sp_flags, spg, SPA_TYPE_ALLOC); - if (!spa) { + if (IS_ERR(spa)) { if (printk_ratelimit()) - pr_err("share pool: allocation failed due to alloc spa failure\n"); - p = ERR_PTR(-ENOMEM); + pr_err("share pool: allocation failed due to alloc spa failure " + "(potential no enough virtual memory when -75): %ld\n", + PTR_ERR(spa)); + p = spa; goto out; } sp_addr = spa->va_start; @@ -1158,33 +1184,34 @@ void *sp_alloc(unsigned long size, unsigned long sp_flags, int spg_id) unsigned long populate = 0; struct vm_area_struct *vma; - p_mmap = sp_mmap(mm, file, spa, &populate); - if (IS_ERR(p_mmap) && (PTR_ERR(p_mmap) != -ESPGMMEXIT)) { - p = p_mmap; + if (!mmget_not_zero(mm)) + continue; + + down_write(&mm->mmap_sem); + mmap_addr = sp_mmap(mm, file, spa, &populate); + if (IS_ERR_VALUE(mmap_addr)) { + up_write(&mm->mmap_sem); + p = (void *)mmap_addr; __sp_free(spg, sp_addr, size_aligned, mm); - pr_err("share pool: allocation sp mmap failed, ret %ld\n", PTR_ERR(p_mmap)); - break; + mmput(mm); + pr_err("share pool: allocation sp mmap failed, ret %ld\n", mmap_addr); + goto out; } - if (PTR_ERR(p_mmap) == -ESPGMMEXIT) { - pr_info("share pool: allocation sp mmap failed, ret -ESPGMMEXIT\n"); + p =(void *)mmap_addr; /* success */ + if (populate == 0) { + up_write(&mm->mmap_sem); + mmput(mm); continue; } - p = p_mmap; /* success */ - if (populate == 0) - continue; - - if (!mmget_not_zero(mm)) - continue; - down_write(&mm->mmap_sem); vma = find_vma(mm, sp_addr); if (unlikely(!vma)) { + up_write(&mm->mmap_sem); + mmput(mm); pr_err("share pool: allocation failed due to find %pK vma failure\n", (void *)sp_addr); p = ERR_PTR(-EINVAL); - up_write(&mm->mmap_sem); - mmput(mm); goto out; } /* clean PTE_RDONLY flags or trigger SMMU event */ @@ -1216,9 +1243,17 @@ void *sp_alloc(unsigned long size, unsigned long sp_flags, int spg_id) } if (printk_ratelimit()) - pr_err("share pool: allocation failed due to mm populate failed: %d\n", - ret); + pr_warn("share pool: allocation failed due to mm populate failed" + "(potential no enough memory when -12): %d\n", ret); p = ERR_PTR(ret); + __sp_area_drop(spa); + + mode = FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE; + offset = sp_addr - MMAP_SHARE_POOL_START; + ret = vfs_fallocate(spa_file(spa), mode, offset, spa_size(spa)); + if (ret) + pr_err("share pool: fallocate failed %d\n", ret); + mmput(mm); break; } @@ -1235,24 +1270,20 @@ void *sp_alloc(unsigned long size, unsigned long sp_flags, int spg_id) mutex_unlock(&sp_mutex); /* this will free spa if mmap failed */ - if (spa) + if (spa && !IS_ERR(spa)) __sp_area_drop(spa); + if (!IS_ERR(p)) { + pr_notice("share pool: [sp alloc] caller %s(%d/%d); group id %d; " + "return addr 0x%pK, size %ld\n", + current->comm, current->tgid, current->pid, spa->spg->id, + (void *)spa->va_start, spa->real_size); + sp_dump_stack(); + } return p; } EXPORT_SYMBOL_GPL(sp_alloc); -static unsigned long __sp_remap_get_pfn(unsigned long kva) -{ - unsigned long pfn; - if (is_vmalloc_addr((void *)kva)) - pfn = vmalloc_to_pfn((void *)kva); - else - pfn = virt_to_pfn(kva); - - return pfn; -} - /* * return value: >0 means this is a hugepage addr * =0 means a normal addr. <0 means an errno. @@ -1286,7 +1317,6 @@ static unsigned long sp_remap_kva_to_vma(unsigned long kva, struct sp_area *spa, struct vm_area_struct *vma; unsigned long ret_addr; unsigned long populate = 0; - unsigned long addr, buf, offset; struct file *file = NULL; int ret = 0; struct user_struct *user = NULL; @@ -1307,7 +1337,7 @@ static unsigned long sp_remap_kva_to_vma(unsigned long kva, struct sp_area *spa, } down_write(&mm->mmap_sem); - ret_addr = __sp_mmap(mm, file, spa, &populate); + ret_addr = sp_mmap(mm, file, spa, &populate); if (IS_ERR_VALUE(ret_addr)) { pr_err("share pool: k2u mmap failed %lx\n", ret_addr); goto out; @@ -1326,20 +1356,12 @@ static unsigned long sp_remap_kva_to_vma(unsigned long kva, struct sp_area *spa, goto out; } } else { - buf = ret_addr; - addr = kva; - offset = 0; - do { - ret = remap_pfn_range(vma, buf, __sp_remap_get_pfn(addr), PAGE_SIZE, - __pgprot(vma->vm_page_prot.pgprot)); - if (ret) { - ret_addr = ret; - goto out; - } - offset += PAGE_SIZE; - buf += PAGE_SIZE; - addr += PAGE_SIZE; - } while (offset < spa_size(spa)); + ret = remap_vmalloc_range(vma, (void *)kva, 0); + if (ret) { + pr_err("share pool: remap vmalloc failed, ret %d\n", ret); + ret_addr = ret; + goto out; + } } out: @@ -1380,6 +1402,13 @@ static void *sp_make_share_kva_to_task(unsigned long kva, struct sp_area *spa, } p = (void *)ret_addr; + + task_lock(tsk); + if (tsk->mm == NULL) + p = ERR_PTR(-ESRCH); + else + spa->mm = tsk->mm; + task_unlock(tsk); out: put_task_struct(tsk); return p; @@ -1438,6 +1467,7 @@ void *sp_make_share_k2u(unsigned long kva, unsigned long size, unsigned long kva_aligned; unsigned long size_aligned; unsigned int page_size = PAGE_SIZE; + enum spa_type type; int ret; if (sp_flags & ~SP_DVPP) { @@ -1453,6 +1483,7 @@ void *sp_make_share_k2u(unsigned long kva, unsigned long size, } else if (ret == 0) { /* do nothing */ } else { + pr_err("it is not vmalloc address\n"); return ERR_PTR(ret); } /* aligned down kva is convenient for caller to start with any valid kva */ @@ -1460,24 +1491,42 @@ void *sp_make_share_k2u(unsigned long kva, unsigned long size, size_aligned = ALIGN(kva + size, page_size) - kva_aligned; mutex_lock(&sp_mutex); - spg = __sp_find_spg(pid, spg_id); + spg = __sp_find_spg(pid, SPG_ID_DEFAULT); if (spg == NULL) { - spa = sp_alloc_area(size_aligned, sp_flags, NULL, SPA_TYPE_K2TASK); - if (!spa) { + type = SPA_TYPE_K2TASK; + if (spg_id != SPG_ID_NONE && spg_id != SPG_ID_DEFAULT) { mutex_unlock(&sp_mutex); if (printk_ratelimit()) - pr_err("share pool: k2u failed due to alloc spa failure\n"); - return ERR_PTR(-ENOMEM); + pr_err("share pool: k2task invalid spg id %d\n", spg_id); + return ERR_PTR(-EINVAL); + } + spa = sp_alloc_area(size_aligned, sp_flags, NULL, type); + if (IS_ERR(spa)) { + mutex_unlock(&sp_mutex); + if (printk_ratelimit()) + pr_err("share pool: k2u(task) failed due to alloc spa failure " + "(potential no enough virtual memory when -75): %ld\n", + PTR_ERR(spa)); + return spa; } uva = sp_make_share_kva_to_task(kva_aligned, spa, pid); mutex_unlock(&sp_mutex); } else if (spg_valid(spg)) { - spa = sp_alloc_area(size_aligned, sp_flags, spg, SPA_TYPE_K2SPG); - if (!spa) { + type = SPA_TYPE_K2SPG; + if (spg_id != SPG_ID_DEFAULT && spg_id != spg->id) { mutex_unlock(&sp_mutex); if (printk_ratelimit()) - pr_err("share pool: k2u failed due to alloc spa failure\n"); - return ERR_PTR(-ENOMEM); + pr_err("share pool: k2spg invalid spg id %d\n", spg_id); + return ERR_PTR(-EINVAL); + } + spa = sp_alloc_area(size_aligned, sp_flags, spg, type); + if (IS_ERR(spa)) { + mutex_unlock(&sp_mutex); + if (printk_ratelimit()) + pr_err("share pool: k2u(spg) failed due to alloc spa failure " + "(potential no enough virtual memory when -75): %ld\n", + PTR_ERR(spa)); + return spa; } uva = sp_make_share_kva_to_spg(kva_aligned, spa, spg); @@ -1492,6 +1541,17 @@ void *sp_make_share_k2u(unsigned long kva, unsigned long size, uva = uva + (kva - kva_aligned); __sp_area_drop(spa); + + if (!IS_ERR(uva)) { + if (spg_valid(spa->spg)) + spg_id = spa->spg->id; + pr_notice("share pool: [sp k2u type %d] caller %s(%d/%d); group id %d; " + "return addr 0x%pK size %ld\n", + type, current->comm, current->tgid, current->pid, spg_id, + (void *)spa->va_start, spa->real_size); + sp_dump_stack(); + } + return uva; } EXPORT_SYMBOL_GPL(sp_make_share_k2u); @@ -1531,7 +1591,8 @@ static int sp_pte_hole(unsigned long start, unsigned long end, struct mm_walk *walk) { if (printk_ratelimit()) - pr_err("share pool: hole [%pK, %pK) appeared unexpectedly\n", (void *)start, (void *)end); + pr_err("share pool: hole [%pK, %pK) appeared unexpectedly\n", + (void *)start, (void *)end); return -EFAULT; } @@ -1545,7 +1606,8 @@ static int sp_hugetlb_entry(pte_t *ptep, unsigned long hmask, if (unlikely(!pte_present(pte))) { if (printk_ratelimit()) - pr_err("share pool: the page of addr %pK unexpectedly not in RAM\n", (void *)addr); + pr_err("share pool: the page of addr %pK unexpectedly " + "not in RAM\n", (void *)addr); return -EFAULT; } @@ -1758,6 +1820,11 @@ static int sp_unshare_uva(unsigned long uva, unsigned long size, int pid, int sp } } + if (spa->type != SPA_TYPE_K2TASK && spa->type != SPA_TYPE_K2SPG) { + pr_err("share pool: this spa should not be unshare here\n"); + ret = -EINVAL; + goto out_drop_area; + } /* * 1. overflow actually won't happen due to an spa must be valid. * 2. we must unshare [spa->va_start, spa->va_start + spa->real_size) completely @@ -1771,32 +1838,57 @@ static int sp_unshare_uva(unsigned long uva, unsigned long size, int pid, int sp if (size_aligned < ALIGN(size, page_size)) { ret = -EINVAL; if (printk_ratelimit()) - pr_err("share pool: unshare uva failed due to invalid parameter size %lu\n", size); + pr_err("share pool: unshare uva failed due to invalid parameter size %lu\n", + size); goto out_drop_area; } - if (spg_id == SPG_ID_NONE) { - if (spa->spg) { - ret = -EINVAL; + if (spa->type == SPA_TYPE_K2TASK) { + if (spg_id != SPG_ID_NONE && spg_id != SPG_ID_DEFAULT) { if (printk_ratelimit()) - pr_err("share pool: unshare uva failed, SPG_ID_NONE is invalid\n"); + pr_err("share pool: unshare uva(to task) failed, " + "invalid spg id %d\n", spg_id); + ret = -EINVAL; goto out_drop_area; } rcu_read_lock(); tsk = find_task_by_vpid(pid); - if (!tsk || (tsk->flags & PF_EXITING)) - ret = -ESRCH; - else - get_task_struct(tsk); - + if (!tsk || !tsk->mm || (tsk->flags & PF_EXITING)) { + if (printk_ratelimit()) + pr_info("share pool: no need to unshare uva(to task), " + "target process not found or do_exit\n"); + ret = -EINVAL; + rcu_read_unlock(); + sp_dump_stack(); + goto out_drop_area; + } + get_task_struct(tsk); rcu_read_unlock(); - if (ret) + + if (!spa->mm || + (current->mm && (current->mm != tsk->mm || tsk->mm != spa->mm))) { + if (printk_ratelimit()) + pr_err("share pool: unshare uva(to task) failed, " + "wrong pid or invalid spa\n"); + ret = -EINVAL; goto out_drop_area; + } + + if (spa->mm != tsk->mm) { + if (printk_ratelimit()) + pr_err("share pool: unshare uva(to task) failed, " + "spa not belong to the task\n"); + ret = -EINVAL; + goto out_drop_area; + } if (!mmget_not_zero(tsk->mm)) { put_task_struct(tsk); - pr_info("share pool: no need to unshare uva, target process is exiting\n"); + if (printk_ratelimit()) + pr_info("share pool: no need to unshare uva(to task), " + "target process mm is not existing\n"); + sp_dump_stack(); goto out_drop_area; } down_write(&tsk->mm->mmap_sem); @@ -1809,32 +1901,51 @@ static int sp_unshare_uva(unsigned long uva, unsigned long size, int pid, int sp (void *)uva_aligned); } put_task_struct(tsk); - } else { - /* - * k2u to task, then unshare_uva(..., spg_id) is invalid due to potential - * spa memory leak. - */ - if (!spa->spg) { + } else if (spa->type == SPA_TYPE_K2SPG) { + if (!spa->spg || spg_id == SPG_ID_NONE) { + if (printk_ratelimit()) + pr_err("share pool: unshare uva(to group) failed, " + "invalid spg id %d\n", spg_id); ret = -EINVAL; + goto out_drop_area; + } + + spg = __sp_find_spg(pid, SPG_ID_DEFAULT); + if (!spg_valid(spg)) { if (printk_ratelimit()) - pr_err("share pool: unshare uva failed, sp group id %d is invalid\n", spg_id); + pr_err("share pool: unshare uva(to group) invalid pid, " + "process not in sp group or group is dead\n"); + ret = -EINVAL; goto out_drop_area; } - spg = __sp_find_spg(pid, spg_id); - if (spg_valid(spg)) { - __sp_free(spg, uva_aligned, size_aligned, NULL); - } else { - if (!spg) { - if (printk_ratelimit()) - pr_err("share pool: unshare uva failed, doesn't belong to group %d\n", - spg_id); - ret = -EINVAL; - goto out_drop_area; - } else { - pr_info("share pool: no need to unshare uva, target process is exiting\n"); - } + if (spa->spg != spg) { + if (printk_ratelimit()) + pr_err("share pool: unshare uva(to group) failed, " + "spa not belong to the group\n"); + ret = -EINVAL; + goto out_drop_area; } + + if (current->mm && current->mm->sp_group != spg) { + if (printk_ratelimit()) + pr_err("share pool: unshare uva(to group) failed, " + "caller process doesn't belong to target group\n"); + ret = -EINVAL; + goto out_drop_area; + } + + __sp_free(spg, uva_aligned, size_aligned, NULL); + } + + if (!ret) { + if (spg_valid(spa->spg)) + spg_id = spa->spg->id; + pr_notice("share pool: [sp unshare uva type %d] caller %s(%d/%d); " + "group id %d addr 0x%pK size %ld\n", + spa->type, current->comm, current->tgid, current->pid, + spg_id, (void *)spa->va_start, spa->real_size); + sp_dump_stack(); } out_drop_area: @@ -1864,7 +1975,8 @@ static int sp_unshare_kva(unsigned long kva, unsigned long size) step = PAGE_SIZE; is_hugepage = false; } else { - pr_err("share pool: check vmap hugepage failed, ret %d\n", ret); + if (printk_ratelimit()) + pr_err("share pool: check vmap hugepage failed, ret %d\n", ret); return -EINVAL; } @@ -1882,7 +1994,8 @@ static int sp_unshare_kva(unsigned long kva, unsigned long size) if (page) put_page(page); else - pr_err("share pool: vmalloc to hugepage failed\n"); + pr_err("share pool: vmalloc %pK to page/hugepage failed\n", + (void *)addr); } vunmap((void *)kva_aligned); @@ -1944,7 +2057,7 @@ int sp_walk_page_range(unsigned long uva, unsigned long size, get_task_struct(tsk); if (!mmget_not_zero(tsk->mm)) { put_task_struct(tsk); - return -EINVAL; + return -ESRCH; } down_write(&tsk->mm->mmap_sem); ret = __sp_walk_page_range(uva, size, tsk, sp_walk_data); @@ -1973,46 +2086,6 @@ void sp_walk_page_free(struct sp_walk_data *sp_walk_data) } EXPORT_SYMBOL_GPL(sp_walk_page_free); -/** - * Walk the mm_struct of processes in the specified sp_group - * and call CALLBACK once for each mm_struct. - * @spg_id: the ID of the specified sp_group - * @data: the param for callback function - * @func: caller specific callback function - * - * Return -errno if fail. - */ -int sp_group_walk(int spg_id, void *data, int (*func)(struct mm_struct *mm, void *)) -{ - struct sp_group *spg; - int ret = -ESRCH; - - if (!func) { - if (printk_ratelimit()) - pr_err("share pool: null func pointer\n"); - return -EINVAL; - } - - mutex_lock(&sp_mutex); - spg = idr_find(&sp_group_idr, spg_id); - if (spg_valid(spg)) { - struct mm_struct *mm; - struct mm_struct *tmp; - list_for_each_entry_safe(mm, tmp, &spg->procs, sp_node) { - if (func) { - ret = func(mm, data); - if (ret) - goto out_unlock; - } - } - } -out_unlock: - mutex_unlock(&sp_mutex); - - return ret; -} -EXPORT_SYMBOL_GPL(sp_group_walk); - int sp_register_notifier(struct notifier_block *nb) { return blocking_notifier_chain_register(&sp_notifier_chain, nb); @@ -2039,7 +2112,7 @@ bool sp_config_dvpp_range(size_t start, size_t size, int device_id, int pid) struct sp_group *spg; if (device_id < 0 || device_id >= MAX_DEVID || pid < 0 || size <= 0 || - size > MMAP_SHARE_POOL_16G_SIZE) + size> MMAP_SHARE_POOL_16G_SIZE) return false; mutex_lock(&sp_mutex); @@ -2061,11 +2134,9 @@ EXPORT_SYMBOL_GPL(sp_config_dvpp_range); /* Check whether the address belongs to the share pool. */ bool is_sharepool_addr(unsigned long addr) { - if (host_svm_sp_enable == false) - return (addr >= MMAP_SHARE_POOL_START) && - addr < (MMAP_SHARE_POOL_16G_START + MMAP_SHARE_POOL_16G_SIZE); - - return addr >= MMAP_SHARE_POOL_START && addr < MMAP_SHARE_POOL_END; + if (host_svm_sp_enable == false) + return addr >= MMAP_SHARE_POOL_START && addr < (MMAP_SHARE_POOL_16G_START + MMAP_SHARE_POOL_16G_SIZE); + return addr >= MMAP_SHARE_POOL_START && addr < MMAP_SHARE_POOL_END; } EXPORT_SYMBOL_GPL(is_sharepool_addr); @@ -2109,7 +2180,7 @@ static int idr_proc_stat_cb(int id, void *p, void *data) mutex_lock(&sp_mutex); spg = __sp_find_spg(id, SPG_ID_DEFAULT); - if (spg) { + if (spg_valid(spg)) { seq_printf(seq, "%-12d %-10d %-18ld\n", id, spg->id, byte2kb(stat->amount)); } @@ -2130,8 +2201,7 @@ static int proc_stat_show(struct seq_file *seq, void *offset) return 0; } -static void rb_spa_stat_show(struct seq_file *seq) -{ +static void rb_spa_stat_show(struct seq_file *seq) { struct rb_node *node; struct sp_area *spa; @@ -2215,8 +2285,8 @@ static int idr_spg_stat_cb(int id, void *p, void *data) struct sp_group *spg = p; struct seq_file *seq = data; - seq_printf(seq, "Group %-10d size: %13d KB, spa num: %d.\n", - id, byte2kb(atomic_read(&spg->size)), + seq_printf(seq, "Group %-10d size: %13ld KB, spa num: %d.\n", + id, byte2kb(atomic64_read(&spg->size)), atomic_read(&spg->spa_num)); return 0; @@ -2227,8 +2297,8 @@ static void spg_overview_show(struct seq_file *seq) mutex_lock(&sp_mutex); idr_for_each(&sp_group_idr, idr_spg_stat_cb, seq); mutex_unlock(&sp_mutex); - seq_printf(seq, "Share pool total size: %13d KB, spa total num: %d.\n\n", - byte2kb(atomic_read(&spg_stat.spa_total_size)), + seq_printf(seq, "Share pool total size: %13ld KB, spa total num: %d.\n\n", + byte2kb(atomic64_read(&spg_stat.spa_total_size)), atomic_read(&spg_stat.spa_total_num)); } @@ -2255,7 +2325,6 @@ void __init proc_sharepool_init(void) proc_create_single_data("sharepool/spa_stat", 0, NULL, spa_stat_show, NULL); } - struct page *sp_alloc_pages(struct vm_struct *area, gfp_t mask, unsigned int page_order, int node) { -- 2.25.1

1 1

[PATCH] powercap: restrict energy meter to root access
by Yang Yingliang 20 Nov '20

20 Nov '20

From: Len Brown <len.brown(a)intel.com> stable inclusion from linux-4.19.157 commit 900281e167f45e0c0e5df6e59fa00334b5e38133 CVE: CVE-2020-8694 -------------------------------- commit 949dd0104c496fa7c14991a23c03c62e44637e71 upstream. Remove non-privileged user access to power data contained in /sys/class/powercap/intel-rapl*/*/energy_uj Non-privileged users currently have read access to power data and can use this data to form a security attack. Some privileged drivers/applications need read access to this data, but don't expose it to non-privileged users. For example, thermald uses this data to ensure that power management works correctly. Thus removing non-privileged access is preferred over completely disabling this power reporting capability with CONFIG_INTEL_RAPL=n. Fixes: 95677a9a3847 ("PowerCap: Fix mode for energy counter") Signed-off-by: Len Brown <len.brown(a)intel.com> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/powercap/powercap_sys.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c index 9e2f274bd44f..60c8375c3c81 100644 --- a/drivers/powercap/powercap_sys.c +++ b/drivers/powercap/powercap_sys.c @@ -379,9 +379,9 @@ static void create_power_zone_common_attributes( &dev_attr_max_energy_range_uj.attr; if (power_zone->ops->get_energy_uj) { if (power_zone->ops->reset_energy_uj) - dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUGO; + dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUSR; else - dev_attr_energy_uj.attr.mode = S_IRUGO; + dev_attr_energy_uj.attr.mode = S_IRUSR; power_zone->zone_dev_attrs[count++] = &dev_attr_energy_uj.attr; } -- 2.25.1

1 0

[summit]Last Call: 不要错过在首届线下openEuler Summit 登台演讲的机会
by Liyongle (Fred) 20 Nov '20

20 Nov '20

openEuler Summit 已经得到了大家的很多支持演讲议题、支持单位、SIG、Demo 还在增加但是，申报议题和Demo今天就是 Deadline 了 11月20日23：59截至，不要错过你发展最迅速、最具活力的首届openEuler Summit 展示自己的技术实力赶快点击下方的链接报名申请链接 Call for Speaker<https://shimo.im/forms/XtCTP9jcrXKgjytD/fill> Call for Sponsor<https://shimo.im/forms/VWWtgLsVHzovmbeH/fill> Call for SIG<https://shimo.im/forms/KSMKHGPHIAsjoNHP/fill> Call for Demo<https://shimo.im/forms/lMTsArbYcy4hd2dY/fill> [cid:image001.png@01D6BF24.25DA26F0]<https://openeuler.org/zh/interaction/summit-list/> 在 openEuler Summit 人人都是主办方人人都是参与者这和开源精神的内核是一致的大会议程日益丰满并且干货满满、富有趣味 Hello openEuler 开发者体验区非常的酷因为我们想到了一个从树莓派到数据中心的全场景展示还有其他一些 “别有用心” 的 Demo 绝对的好玩 TC、SIG、Maintainer 已经准备好了 “网友见面” 现场召开 TC 工作会议现场召开 SIG 组工作会议现场接受新 SIG 申请现场的 Maintainer 共同分享学习不断增加的支持单位、友好基金会和社区媒体 [cid:image001.jpg@01D6BF21.1ADA52F0]

1 0

[PATCH] Input: sunkbd - avoid use-after-free in teardown paths
by Yang Yingliang 19 Nov '20

19 Nov '20

From: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> mainline inclusion from mainline-v5.10-rc5 commit 77e70d351db7de07a46ac49b87a6c3c7a60fca7e category: bugfix bugzilla: NA CVE: CVE-2020-25669 -------------------------------- We need to make sure we cancel the reinit work before we tear down the driver structures. Reported-by: Bodong Zhao <nopitydays(a)gmail.com> Tested-by: Bodong Zhao <nopitydays(a)gmail.com> Cc: stable(a)vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/input/keyboard/sunkbd.c | 41 ++++++++++++++++++++++++++------- 1 file changed, 33 insertions(+), 8 deletions(-) diff --git a/drivers/input/keyboard/sunkbd.c b/drivers/input/keyboard/sunkbd.c index ad5d7f94f95a..1c7aa86c92ab 100644 --- a/drivers/input/keyboard/sunkbd.c +++ b/drivers/input/keyboard/sunkbd.c @@ -111,7 +111,8 @@ static irqreturn_t sunkbd_interrupt(struct serio *serio, switch (data) { case SUNKBD_RET_RESET: - schedule_work(&sunkbd->tq); + if (sunkbd->enabled) + schedule_work(&sunkbd->tq); sunkbd->reset = -1; break; @@ -212,16 +213,12 @@ static int sunkbd_initialize(struct sunkbd *sunkbd) } /* - * sunkbd_reinit() sets leds and beeps to a state the computer remembers they - * were in. + * sunkbd_set_leds_beeps() sets leds and beeps to a state the computer remembers + * they were in. */ -static void sunkbd_reinit(struct work_struct *work) +static void sunkbd_set_leds_beeps(struct sunkbd *sunkbd) { - struct sunkbd *sunkbd = container_of(work, struct sunkbd, tq); - - wait_event_interruptible_timeout(sunkbd->wait, sunkbd->reset >= 0, HZ); - serio_write(sunkbd->serio, SUNKBD_CMD_SETLED); serio_write(sunkbd->serio, (!!test_bit(LED_CAPSL, sunkbd->dev->led) << 3) | @@ -234,11 +231,39 @@ static void sunkbd_reinit(struct work_struct *work) SUNKBD_CMD_BELLOFF - !!test_bit(SND_BELL, sunkbd->dev->snd)); } + +/* + * sunkbd_reinit() wait for the keyboard reset to complete and restores state + * of leds and beeps. + */ + +static void sunkbd_reinit(struct work_struct *work) +{ + struct sunkbd *sunkbd = container_of(work, struct sunkbd, tq); + + /* + * It is OK that we check sunkbd->enabled without pausing serio, + * as we only want to catch true->false transition that will + * happen once and we will be woken up for it. + */ + wait_event_interruptible_timeout(sunkbd->wait, + sunkbd->reset >= 0 || !sunkbd->enabled, + HZ); + + if (sunkbd->reset >= 0 && sunkbd->enabled) + sunkbd_set_leds_beeps(sunkbd); +} + static void sunkbd_enable(struct sunkbd *sunkbd, bool enable) { serio_pause_rx(sunkbd->serio); sunkbd->enabled = enable; serio_continue_rx(sunkbd->serio); + + if (!enable) { + wake_up_interruptible(&sunkbd->wait); + cancel_work_sync(&sunkbd->tq); + } } /* -- 2.25.1

1 0

[PATCH v3 kernel-4.19] nbd: don't update block size after device is started
by lining 19 Nov '20

19 Nov '20

From: Ming Lei <ming.lei(a)redhat.com> mainline inclusion from mainline-v5.10-rc2 commit b40813ddcd6b category: bugfix bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1891363 CVE: NA backport: openEuler-20.09 Here is the testcase: 1. rbd create --size 2G rbdpool/foo 2. rbd-nbd map rbdpool/foo 3. mkfs.ext4 /dev/nbd0 4. mount /dev/nbd0 /mnt 5. rbd resize --size 4G rbdpool/foo 6. ls /mnt ls will stuck here forever. -------------------------------- [ Upstream commit b40813ddcd6bf9f01d020804e4cb8febc480b9e4 ] Mounted NBD device can be resized, one use case is rbd-nbd. Fix the issue by setting up default block size, then not touch it in nbd_size_update() any more. This kind of usage is aligned with loop which has same use case too. Cc: stable(a)vger.kernel.org Fixes: c8a83a6b54d0 ("nbd: Use set_blocksize() to set device blocksize") Reported-by: lining <lining2020x(a)163.com> Signed-off-by: Ming Lei <ming.lei(a)redhat.com> Cc: Josef Bacik <josef(a)toxicpanda.com> Cc: Jan Kara <jack(a)suse.cz> Tested-by: lining <lining2020x(a)163.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: lining <lining_yewu(a)cmss.chinamobile.com> --- drivers/block/nbd.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index cdf62fb94fb15..9a0fb2d52a76c 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -268,7 +268,7 @@ static void nbd_size_clear(struct nbd_device *nbd) } } -static void nbd_size_update(struct nbd_device *nbd) +static void nbd_size_update(struct nbd_device *nbd, bool start) { struct nbd_config *config = nbd->config; struct block_device *bdev = bdget_disk(nbd->disk, 0); @@ -279,7 +279,8 @@ static void nbd_size_update(struct nbd_device *nbd) if (bdev) { if (bdev->bd_disk) { bd_set_size(bdev, config->bytesize); - set_blocksize(bdev, config->blksize); + if (start) + set_blocksize(bdev, config->blksize); } else bdev->bd_invalidated = 1; bdput(bdev); @@ -294,7 +295,7 @@ static void nbd_size_set(struct nbd_device *nbd, loff_t blocksize, config->blksize = blocksize; config->bytesize = blocksize * nr_blocks; if (nbd->task_recv != NULL) - nbd_size_update(nbd); + nbd_size_update(nbd, false); } static void nbd_complete_rq(struct request *req) @@ -1231,7 +1232,7 @@ static int nbd_start_device(struct nbd_device *nbd) args->index = i; queue_work(nbd->recv_workq, &args->work); } - nbd_size_update(nbd); + nbd_size_update(nbd, true); return error; } -- 2.27.0

3 2

[PATCH 0/2] backport stable-4.19.157
by Yang Yingliang 19 Nov '20

19 Nov '20

*** BLURB HERE *** Greg Kroah-Hartman (1): Linux 4.19.157 Len Brown (1): powercap: restrict energy meter to root access Makefile | 2 +- drivers/powercap/powercap_sys.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) -- 2.25.1

1 2

[PATCH 00/66] backport stable-4.19.156
by Yang Yingliang 19 Nov '20

19 Nov '20

Alan Stern (1): USB: Add NO_LPM quirk for Kingston flash drive Alexander Aring (1): gfs2: Wake up when sd_glock_disposal becomes zero Artem Lapkin (1): ALSA: usb-audio: add usb vendor id as DSD-capable for Khadas devices Ben Hutchings (1): Revert "btrfs: flush write bio if we loop in extent_write_cache_pages" Chris Wilson (1): drm/i915: Break up error capture compression loops with cond_resched() Claire Chang (1): serial: 8250_mtk: Fix uart_get_baud_rate warning Claudiu Manoil (2): gianfar: Replace skb_realloc_headroom with skb_cow_head for PTP gianfar: Account for Tx PTP timestamp in the skb headroom Clément Péron (1): ARM: dts: sun4i-a10: fix cpu_alert temperature Daniel Vetter (1): vt: Disable KD_FONT_OP_COPY Daniele Palmas (3): net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231 USB: serial: option: add Telit FN980 composition 0x1055 Eddy Wu (1): fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent Filipe Manana (1): Btrfs: fix unwritten extent buffers and hangs on future writeback attempts Gabriel Krisman Bertazi (2): blk-cgroup: Fix memleak on error path blk-cgroup: Pre-allocate tree node on blkg_conf_prep Geoffrey D. Bennett (2): ALSA: usb-audio: Add implicit feedback quirk for Qu-16 ALSA: usb-audio: Add implicit feedback quirk for MODX Greg Kroah-Hartman (1): Linux 4.19.156 Guenter Roeck (1): tools: perf: Fix build error in v4.19.y Hoang Huu Le (1): tipc: fix use-after-free in tipc_bcast_get_mode Hoegeun Kwon (1): drm/vc4: drv: Add error handding for bind Jason Gunthorpe (1): mm: always have io_remap_pfn_range() set pgprot_decrypted() Jeff Vander Stoep (1): vsock: use ns_capable_noaudit() on socket create Johan Hovold (1): USB: serial: cyberjack: fix write-URB completion race Josef Bacik (1): btrfs: flush write bio if we loop in extent_write_cache_pages Kairui Song (1): x86/kexec: Use up-to-dated screen_info copy to fill boot params Keith Winstein (1): ALSA: usb-audio: Add implicit feedback quirk for Zoom UAC-2 Lee Jones (1): Fonts: Replace discarded const qualifier Macpaul Lin (1): usb: mtu3: fix panic in mtu3_gadget_stop() Mark Deneen (1): cadence: force nonlinear buffers to be cloned Mike Galbraith (1): futex: Handle transient "ownerless" rtmutex state correctly Ming Lei (1): scsi: core: Don't start concurrent async scan on same host Oleg Nesterov (1): ptrace: fix task_join_group_stop() for the case when current is traced Pali Rohár (1): arm64: dts: marvell: espressobin: Add ethernet switch aliases Petr Malat (1): sctp: Fix COMM_LOST/CANT_STR_ASSOC err reporting on big-endian platforms Qinglang Miao (1): serial: txx9: add missing platform_driver_unregister() on error in serial_txx9_init Qiujun Huang (1): tracing: Fix out of bounds write in get_trace_buf Qu Wenruo (11): btrfs: extent_io: Kill the forward declaration of flush_write_bio btrfs: extent_io: Move the BUG_ON() in flush_write_bio() one level up btrfs: extent_io: Handle errors better in btree_write_cache_pages() btrfs: extent_io: add proper error handling to lock_extent_buffer_for_io() btrfs: Move btrfs_check_chunk_valid() to tree-check.[ch] and export it btrfs: tree-checker: Make chunk item checker messages more readable btrfs: tree-checker: Make btrfs_check_chunk_valid() return EUCLEAN instead of EIO btrfs: tree-checker: Check chunk item at tree block read time btrfs: tree-checker: Verify dev item btrfs: tree-checker: Fix wrong check on max devid btrfs: tree-checker: fix the error message for transid error Rafael J. Wysocki (1): PM: runtime: Resume the device earlier in __device_release_driver() Shijie Luo (1): mm: mempolicy: fix potential pte_unmap_unlock pte error Steven Rostedt (VMware) (3): ring-buffer: Fix recursion protection transitions between interrupt context ftrace: Fix recursion check for NMI test ftrace: Handle tracing when switching between context Vasily Gorbik (1): lib/crc32test: remove extra local_irq_disable/enable Vinay Kumar Yadav (2): chelsio/chtls: fix memory leaks caused by a race chelsio/chtls: fix always leaking ctrl_skb Vincent Whitchurch (1): of: Fix reserved-memory overlap detection Vineet Gupta (2): ARC: stack unwinding: avoid indefinite looping Revert "ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE" Xiaofei Shen (1): net: dsa: read mac address from DT for slave device YueHaibing (1): sfp: Fix error handing in sfp_probe() Zhang Qilong (1): ACPI: NFIT: Fix comparison to '-ENXIO' Ziyi Cao (1): USB: serial: option: add Quectel EC200T module support Zqiang (1): kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled Makefile | 2 +- arch/arc/kernel/entry.S | 16 +- arch/arc/kernel/stacktrace.c | 7 +- arch/arm/boot/dts/sun4i-a10.dtsi | 2 +- .../dts/marvell/armada-3720-espressobin.dts | 12 +- arch/x86/kernel/kexec-bzimage64.c | 3 +- block/blk-cgroup.c | 15 +- drivers/acpi/nfit/core.c | 2 +- drivers/base/dd.c | 7 +- drivers/crypto/chelsio/chtls/chtls_cm.c | 2 +- drivers/crypto/chelsio/chtls/chtls_hw.c | 3 + drivers/gpu/drm/i915/i915_gpu_error.c | 3 + drivers/gpu/drm/vc4/vc4_drv.c | 1 + drivers/net/ethernet/cadence/macb_main.c | 3 +- drivers/net/ethernet/freescale/gianfar.c | 14 +- drivers/net/phy/sfp.c | 3 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/of/of_reserved_mem.c | 13 +- drivers/scsi/scsi_scan.c | 7 +- drivers/tty/serial/8250/8250_mtk.c | 2 +- drivers/tty/serial/serial_txx9.c | 3 + drivers/tty/vt/vt.c | 24 +- drivers/usb/core/quirks.c | 3 + drivers/usb/mtu3/mtu3_gadget.c | 1 + drivers/usb/serial/cyberjack.c | 7 +- drivers/usb/serial/option.c | 10 + fs/btrfs/extent_io.c | 171 +++++++++---- fs/btrfs/tree-checker.c | 236 +++++++++++++++++- fs/btrfs/tree-checker.h | 4 + fs/btrfs/volumes.c | 123 +-------- fs/btrfs/volumes.h | 9 + fs/gfs2/glock.c | 3 +- include/asm-generic/pgtable.h | 4 - include/linux/mm.h | 9 + include/net/dsa.h | 1 + kernel/fork.c | 10 +- kernel/futex.c | 16 +- kernel/kthread.c | 3 +- kernel/signal.c | 19 +- kernel/trace/ring_buffer.c | 58 ++++- kernel/trace/trace.c | 2 +- kernel/trace/trace.h | 26 +- kernel/trace/trace_selftest.c | 9 +- lib/crc32test.c | 4 - lib/fonts/font_10x18.c | 2 +- lib/fonts/font_6x10.c | 2 +- lib/fonts/font_6x11.c | 2 +- lib/fonts/font_7x14.c | 2 +- lib/fonts/font_8x16.c | 2 +- lib/fonts/font_8x8.c | 2 +- lib/fonts/font_acorn_8x8.c | 2 +- lib/fonts/font_mini_4x6.c | 2 +- lib/fonts/font_pearl_8x8.c | 2 +- lib/fonts/font_sun12x22.c | 2 +- lib/fonts/font_sun8x16.c | 2 +- mm/mempolicy.c | 6 +- net/dsa/dsa2.c | 1 + net/dsa/slave.c | 5 +- net/sctp/sm_sideeffect.c | 4 +- net/tipc/core.c | 5 + net/vmw_vsock/af_vsock.c | 2 +- sound/usb/pcm.c | 6 + sound/usb/quirks.c | 1 + tools/perf/util/util.h | 2 +- 64 files changed, 634 insertions(+), 293 deletions(-) -- 2.25.1

1 66

[PATCH] tools: perf: Fix build error in v4.19.y
by Yang Yingliang 18 Nov '20

18 Nov '20

From: Guenter Roeck <linux(a)roeck-us.net> perf may fail to build in v4.19.y with the following error. util/evsel.c: In function ‘perf_evsel__exit’: util/util.h:25:28: error: passing argument 1 of ‘free’ discards ‘const’ qualifier from pointer target type This is observed (at least) with gcc v6.5.0. The underlying problem is the following statement. zfree(&evsel->pmu_name); evsel->pmu_name is decared 'const *'. zfree in turn is defined as #define zfree(ptr) ({ free(*ptr); *ptr = NULL; }) and thus passes the const * to free(). The problem is not seen in the upstream kernel since zfree() has been rewritten there. The problem has been introduced into v4.19.y with the backport of upstream commit d4953f7ef1a2 (perf parse-events: Fix 3 use after frees found with clang ASAN). One possible fix of this problem would be to not declare pmu_name as const. This patch chooses to typecast the parameter of zfree() to void *, following the guidance from the upstream kernel which does the same since commit 7f7c536f23e6a ("tools lib: Adopt zalloc()/zfree() from tools/perf") Fixes: a0100a363098 ("perf parse-events: Fix 3 use after frees found with clang ASAN") Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- tools/perf/util/util.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/perf/util/util.h b/tools/perf/util/util.h index dc58254a2b69..8c01b2cfdb1a 100644 --- a/tools/perf/util/util.h +++ b/tools/perf/util/util.h @@ -22,7 +22,7 @@ static inline void *zalloc(size_t size) return calloc(1, size); } -#define zfree(ptr) ({ free(*ptr); *ptr = NULL; }) +#define zfree(ptr) ({ free((void *)*ptr); *ptr = NULL; }) struct dirent; struct nsinfo; -- 2.25.1

1 0

[PATCH 01/19] nvme: Fix ctrl use-after-free during sysfs deletion
by Yang Yingliang 18 Nov '20

18 Nov '20

From: Israel Rukshin <israelr(a)mellanox.com> mainline inclusion from mainline-v5.7-rc1 commit b780d7415aacec855e2f2370cbf98f918b224903 category: bugfix bugzilla: NA CVE: NA Link: https://gitee.com/openeuler/kernel/issues/I1WGZE -------------------------------- In case nvme_sysfs_delete() is called by the user before taking the ctrl reference count, the ctrl may be freed during the creation and cause the bug. Take the reference as soon as the controller is externally visible, which is done by cdev_device_add() in nvme_init_ctrl(). Also take the reference count at the core layer instead of taking it on each transport separately. Signed-off-by: Israel Rukshin <israelr(a)mellanox.com> Reviewed-by: Max Gurtovoy <maxg(a)mellanox.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/tcp.c [No code about TCP in current version.] Reviewed-by: Chao Leng <lengchao(a)huawei.com> Reviewed-by: Jike Cheng <chengjike.cheng(a)huawei.com> Signed-off-by: Lijie <lijie34(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Acked-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/nvme/host/core.c | 2 ++ drivers/nvme/host/fc.c | 4 +--- drivers/nvme/host/pci.c | 1 - drivers/nvme/host/rdma.c | 3 +-- drivers/nvme/target/loop.c | 3 +-- 5 files changed, 5 insertions(+), 8 deletions(-) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index b8446637b3c2..b7a40ac4b637 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -3779,6 +3779,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev, if (ret) goto out_release_instance; + nvme_get_ctrl(ctrl); cdev_init(&ctrl->cdev, &nvme_dev_fops); ctrl->cdev.owner = ops->module; ret = cdev_device_add(&ctrl->cdev, ctrl->device); @@ -3795,6 +3796,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev, return 0; out_free_name: + nvme_put_ctrl(ctrl); kfree_const(ctrl->device->kobj.name); out_release_instance: ida_simple_remove(&nvme_instance_ida, ctrl->instance); diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c index ed88d5021772..d75ae1b201ad 100644 --- a/drivers/nvme/host/fc.c +++ b/drivers/nvme/host/fc.c @@ -3146,10 +3146,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts, goto fail_ctrl; } - nvme_get_ctrl(&ctrl->ctrl); - if (!queue_delayed_work(nvme_wq, &ctrl->connect_work, 0)) { - nvme_put_ctrl(&ctrl->ctrl); dev_err(ctrl->ctrl.device, "NVME-FC{%d}: failed to schedule initial connect\n", ctrl->cnum); @@ -3174,6 +3171,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts, /* initiate nvme ctrl ref counting teardown */ nvme_uninit_ctrl(&ctrl->ctrl); + nvme_put_ctrl(&ctrl->ctrl); /* Remove core ctrl ref. */ nvme_put_ctrl(&ctrl->ctrl); diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index f194bb7ccb04..1a0eec110614 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -2558,7 +2558,6 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id) dev_info(dev->ctrl.device, "pci function %s\n", dev_name(&pdev->dev)); nvme_reset_ctrl(&dev->ctrl); - nvme_get_ctrl(&dev->ctrl); async_schedule(nvme_async_probe, dev); return 0; diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c index d0cf19e593b2..0e998e85e962 100644 --- a/drivers/nvme/host/rdma.c +++ b/drivers/nvme/host/rdma.c @@ -2050,8 +2050,6 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev, dev_info(ctrl->ctrl.device, "new ctrl: NQN \"%s\", addr %pISpcs\n", ctrl->ctrl.opts->subsysnqn, &ctrl->addr); - nvme_get_ctrl(&ctrl->ctrl); - mutex_lock(&nvme_rdma_ctrl_mutex); list_add_tail(&ctrl->list, &nvme_rdma_ctrl_list); mutex_unlock(&nvme_rdma_ctrl_mutex); @@ -2061,6 +2059,7 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev, out_uninit_ctrl: nvme_uninit_ctrl(&ctrl->ctrl); nvme_put_ctrl(&ctrl->ctrl); + nvme_put_ctrl(&ctrl->ctrl); if (ret > 0) ret = -EIO; return ERR_PTR(ret); diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c index 137a27fa369c..e30080c629fd 100644 --- a/drivers/nvme/target/loop.c +++ b/drivers/nvme/target/loop.c @@ -639,8 +639,6 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev, dev_info(ctrl->ctrl.device, "new ctrl: \"%s\"\n", ctrl->ctrl.opts->subsysnqn); - nvme_get_ctrl(&ctrl->ctrl); - changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE); WARN_ON_ONCE(!changed); @@ -658,6 +656,7 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev, kfree(ctrl->queues); out_uninit_ctrl: nvme_uninit_ctrl(&ctrl->ctrl); + nvme_put_ctrl(&ctrl->ctrl); out_put_ctrl: nvme_put_ctrl(&ctrl->ctrl); if (ret > 0) -- 2.25.1

1 18

[PATCH v2 kernel-4.19] nbd: don't update block size after device is started
by lining 17 Nov '20

17 Nov '20

mainline inclusion from mainline-v5.10-rc2 commit b40813ddcd6b category: bugfix bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1891363 CVE: NA backport: openEuler-20.09 Here is the testcase: 1. rbd create --size 2G rbdpool/foo 2. rbd-nbd map rbdpool/foo 3. mkfs.ext4 /dev/nbd0 4. mount /dev/nbd0 /mnt 5. rbd resize --size 4G rbdpool/foo 6. ls /mnt ls will stuck here forever. -------------------------------- From: Ming Lei <ming.lei(a)redhat.com> [ Upstream commit b40813ddcd6bf9f01d020804e4cb8febc480b9e4 ] Mounted NBD device can be resized, one use case is rbd-nbd. Fix the issue by setting up default block size, then not touch it in nbd_size_update() any more. This kind of usage is aligned with loop which has same use case too. Cc: stable(a)vger.kernel.org Fixes: c8a83a6b54d0 ("nbd: Use set_blocksize() to set device blocksize") Reported-by: lining <lining2020x(a)163.com> Signed-off-by: Ming Lei <ming.lei(a)redhat.com> Cc: Josef Bacik <josef(a)toxicpanda.com> Cc: Jan Kara <jack(a)suse.cz> Tested-by: lining <lining2020x(a)163.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: lining <lining_yewu(a)cmss.chinamobile.com> --- drivers/block/nbd.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index cdf62fb94fb15..9a0fb2d52a76c 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -268,7 +268,7 @@ static void nbd_size_clear(struct nbd_device *nbd) } } -static void nbd_size_update(struct nbd_device *nbd) +static void nbd_size_update(struct nbd_device *nbd, bool start) { struct nbd_config *config = nbd->config; struct block_device *bdev = bdget_disk(nbd->disk, 0); @@ -279,7 +279,8 @@ static void nbd_size_update(struct nbd_device *nbd) if (bdev) { if (bdev->bd_disk) { bd_set_size(bdev, config->bytesize); - set_blocksize(bdev, config->blksize); + if (start) + set_blocksize(bdev, config->blksize); } else bdev->bd_invalidated = 1; bdput(bdev); @@ -294,7 +295,7 @@ static void nbd_size_set(struct nbd_device *nbd, loff_t blocksize, config->blksize = blocksize; config->bytesize = blocksize * nr_blocks; if (nbd->task_recv != NULL) - nbd_size_update(nbd); + nbd_size_update(nbd, false); } static void nbd_complete_rq(struct request *req) @@ -1231,7 +1232,7 @@ static int nbd_start_device(struct nbd_device *nbd) args->index = i; queue_work(nbd->recv_workq, &args->work); } - nbd_size_update(nbd); + nbd_size_update(nbd, true); return error; } -- 2.27.0

2 1