- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 0/6] Fix the problem that the number of tcp timeout retransmissions is lost
by jiazhenyuan 25 Oct '21

25 Oct '21

From: Jiazhenyuan <jiazhenyuan(a)uniontech.com> issue: https://gitee.com/openeuler/kernel/issues/I4AFRJ?from=project-issue jiazhenyuan (6): tcp: switch tcp and sch_fq to new earliest departure time net_sched: sch_fq: ensure maxrate fq parameter applies to EDT flows From 9efdda4e3abed13f0903b7b6e4d4c2102019440a Mon Sep 17 00:00:00 2001 From: Eric Dumazet <edumazet(a)google.com> Date: Sat, 24 Nov 2018 09:12:24 -0800 Subject: [PATCH] tcp: address problems caused by EDT misshaps From 7ae189759cc48cf8b54beebff566e9fd2d4e7d7c Mon Sep 17 00:00:00 2001 From: Yuchung Cheng <ycheng(a)google.com> Date: Wed, 16 Jan 2019 15:05:30 -0800 Subject: [PATCH] tcp: always set retrans_stamp on recovery From 01a523b071618abbc634d1958229fe3bd2dfa5fa Mon Sep 17 00:00:00 2001 From: Yuchung Cheng <ycheng(a)google.com> Date: Wed, 16 Jan 2019 15:05:32 -0800 Subject: [PATCH] tcp: create a helper to model exponential backoff From 3256a2d6ab1f71f9a1bd2d7f6f18eb8108c48d17 Mon Sep 17 00:00:00 2001 From: Eric Dumazet <edumazet(a)google.com> Date: Mon, 30 Sep 2019 15:44:44 -0700 Subject: [PATCH] tcp: adjust rto_base in retransmits_timed_out() net/ipv4/tcp_bbr.c | 7 +++-- net/ipv4/tcp_input.c | 17 +++++++----- net/ipv4/tcp_output.c | 29 ++++++++++++++------ net/ipv4/tcp_timer.c | 64 ++++++++++++++++++++----------------------- net/sched/sch_fq.c | 46 ++++++++++++++++++------------- 5 files changed, 92 insertions(+), 71 deletions(-) -- 2.27.0

2 7

[PATCH openEuler-1.0-LTS] nvme-rdma: destroy cm id before destroy qp to avoid use after free
by Yang Yingliang 25 Oct '21

25 Oct '21

From: Ruozhu Li <liruozhu(a)huawei.com> mainline inclusion from mainline-v5.15-rc2 commit 9817d763dbe15327b9b3ff4404fa6f27f927e744 category: bugfix bugzilla: NA CVE: NA Link: https://gitee.com/openeuler/kernel/issues/I1WGZE We got a panic when host received a rej cm event soon after a connect error cm event. When host get connect error cm event, it will destroy qp immediately. But cm_id is still valid then.Another cm event rise here, try to access the qp which was destroyed.Then we got a kernel panic blow: [87816.777089] [20473] ib_cm:cm_rep_handler:2343: cm_rep_handler: Stale connection. local_comm_id -154357094, remote_comm_id -1133609861 [87816.777223] [20473] ib_cm:cm_init_qp_rtr_attr:4162: cm_init_qp_rtr_attr: local_id -1150387077, cm_id_priv->id.state: 13 [87816.777225] [20473] rdma_cm:cma_rep_recv:1871: RDMA CM: CONNECT_ERROR: failed to handle reply. status -22 [87816.777395] [20473] ib_cm:ib_send_cm_rej:2781: ib_send_cm_rej: local_id -1150387077, cm_id->state: 13 [87816.777398] [20473] nvme_rdma:nvme_rdma_cm_handler:1718: nvme nvme278: connect error (6): status -22 id 00000000c3809aff [87816.801155] [20473] nvme_rdma:nvme_rdma_cm_handler:1742: nvme nvme278: CM error event 6 [87816.801160] [20473] rdma_cm:cma_ib_handler:1947: RDMA CM: REJECTED: consumer defined [87816.801163] nvme nvme278: rdma connection establishment failed (-104) [87816.801168] BUG: unable to handle kernel NULL pointer dereference at 0000000000000370 [87816.801201] RIP: 0010:_ib_modify_qp+0x6e/0x3a0 [ib_core] [87816.801215] Call Trace: [87816.801223] cma_modify_qp_err+0x52/0x80 [rdma_cm] [87816.801228] ? __dynamic_pr_debug+0x8a/0xb0 [87816.801232] cma_ib_handler+0x25a/0x2f0 [rdma_cm] [87816.801235] cm_process_work+0x60/0xe0 [ib_cm] [87816.801238] cm_work_handler+0x13b/0x1b97 [ib_cm] [87816.801243] ? __switch_to_asm+0x35/0x70 [87816.801244] ? __switch_to_asm+0x41/0x70 [87816.801246] ? __switch_to_asm+0x35/0x70 [87816.801248] ? __switch_to_asm+0x41/0x70 [87816.801252] ? __switch_to+0x8c/0x480 [87816.801254] ? __switch_to_asm+0x41/0x70 [87816.801256] ? __switch_to_asm+0x35/0x70 [87816.801259] process_one_work+0x1a7/0x3b0 [87816.801263] worker_thread+0x30/0x390 [87816.801266] ? create_worker+0x1a0/0x1a0 [87816.801268] kthread+0x112/0x130 [87816.801270] ? kthread_flush_work_fn+0x10/0x10 [87816.801272] ret_from_fork+0x35/0x40 ------------------------------------------------- We should always destroy cm_id before destroy qp to avoid to get cma event after qp was destroyed, which may lead to use after free. In RDMA connection establishment error flow, don't destroy qp in cm event handler.Just report cm_error to upper level, qp will be destroy in nvme_rdma_alloc_queue() after destroy cm id. Signed-off-by: Ruozhu Li <liruozhu(a)huawei.com> Reviewed-by: Max Gurtovoy <mgurtovoy(a)nvidia.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Conflicts: drivers/nvme/host/rdma.c [lrz: adjust context] Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/nvme/host/rdma.c | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-) diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c index b8e0d637ddcfc..049edb9ed1858 100644 --- a/drivers/nvme/host/rdma.c +++ b/drivers/nvme/host/rdma.c @@ -575,8 +575,8 @@ static void nvme_rdma_free_queue(struct nvme_rdma_queue *queue) if (!test_and_clear_bit(NVME_RDMA_Q_ALLOCATED, &queue->flags)) return; - nvme_rdma_destroy_queue_ib(queue); rdma_destroy_id(queue->cm_id); + nvme_rdma_destroy_queue_ib(queue); mutex_destroy(&queue->queue_lock); } @@ -1509,14 +1509,10 @@ static int nvme_rdma_conn_established(struct nvme_rdma_queue *queue) for (i = 0; i < queue->queue_size; i++) { ret = nvme_rdma_post_recv(queue, &queue->rsp_ring[i]); if (ret) - goto out_destroy_queue_ib; + return ret; } return 0; - -out_destroy_queue_ib: - nvme_rdma_destroy_queue_ib(queue); - return ret; } static int nvme_rdma_conn_rejected(struct nvme_rdma_queue *queue, @@ -1608,14 +1604,10 @@ static int nvme_rdma_route_resolved(struct nvme_rdma_queue *queue) if (ret) { dev_err(ctrl->ctrl.device, "rdma_connect failed (%d).\n", ret); - goto out_destroy_queue_ib; + return ret; } return 0; - -out_destroy_queue_ib: - nvme_rdma_destroy_queue_ib(queue); - return ret; } static int nvme_rdma_cm_handler(struct rdma_cm_id *cm_id, @@ -1646,8 +1638,6 @@ static int nvme_rdma_cm_handler(struct rdma_cm_id *cm_id, case RDMA_CM_EVENT_ROUTE_ERROR: case RDMA_CM_EVENT_CONNECT_ERROR: case RDMA_CM_EVENT_UNREACHABLE: - nvme_rdma_destroy_queue_ib(queue); - /* fall through */ case RDMA_CM_EVENT_ADDR_ERROR: dev_dbg(queue->ctrl->ctrl.device, "CM error event %d\n", ev->event); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] arm64: Errata: fix kabi changed by cpu_errata
by Yang Yingliang 25 Oct '21

25 Oct '21

From: Weilong Chen <chenweilong(a)huawei.com> ascend inclusion category: feature bugzilla: 46922 CVE: NA ------------------------------------- Patch "cache: Workaround HiSilicon Taishan DC CVAU" breaks the kabi symbols: cpu_hwcaps cpu_hwcap_keys Fix by using CONFIG_HISILICON_ERRATUM_1980005 to protect it. Signed-off-by: Weilong Chen <chenweilong(a)huawei.com> Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/include/asm/cpucaps.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/arm64/include/asm/cpucaps.h b/arch/arm64/include/asm/cpucaps.h index d6c863d2cf984..69515f9077e34 100644 --- a/arch/arm64/include/asm/cpucaps.h +++ b/arch/arm64/include/asm/cpucaps.h @@ -56,8 +56,12 @@ #define ARM64_WORKAROUND_1463225 35 #define ARM64_HAS_CRC32 36 #define ARM64_SSBS 37 +#ifdef CONFIG_HISILICON_ERRATUM_1980005 #define ARM64_WORKAROUND_HISILICON_1980005 38 #define ARM64_NCAPS 39 +#else +#define ARM64_NCAPS 38 +#endif #endif /* __ASM_CPUCAPS_H */ -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 01/45] af_unix: fix garbage collect vs MSG_PEEK
by Yang Yingliang 25 Oct '21

25 Oct '21

From: Miklos Szeredi <mszeredi(a)redhat.com> stable inclusion from linux-4.19.200 commit 1dabafa9f61118b1377fde424d9a94bf8dbf2813 -------------------------------- commit cbcf01128d0a92e131bd09f1688fe032480b65ca upstream. unix_gc() assumes that candidate sockets can never gain an external reference (i.e. be installed into an fd) while the unix_gc_lock is held. Except for MSG_PEEK this is guaranteed by modifying inflight count under the unix_gc_lock. MSG_PEEK does not touch any variable protected by unix_gc_lock (file count is not), yet it needs to be serialized with garbage collection. Do this by locking/unlocking unix_gc_lock: 1) increment file count 2) lock/unlock barrier to make sure incremented file count is visible to garbage collection 3) install file into fd This is a lock barrier (unlike smp_mb()) that ensures that garbage collection is run completely before or completely after the barrier. Cc: <stable(a)vger.kernel.org> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/unix/af_unix.c | 51 ++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 49 insertions(+), 2 deletions(-) diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index 337c4797ab167..98c253afa0db2 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -1517,6 +1517,53 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int peer) return err; } +static void unix_peek_fds(struct scm_cookie *scm, struct sk_buff *skb) +{ + scm->fp = scm_fp_dup(UNIXCB(skb).fp); + + /* + * Garbage collection of unix sockets starts by selecting a set of + * candidate sockets which have reference only from being in flight + * (total_refs == inflight_refs). This condition is checked once during + * the candidate collection phase, and candidates are marked as such, so + * that non-candidates can later be ignored. While inflight_refs is + * protected by unix_gc_lock, total_refs (file count) is not, hence this + * is an instantaneous decision. + * + * Once a candidate, however, the socket must not be reinstalled into a + * file descriptor while the garbage collection is in progress. + * + * If the above conditions are met, then the directed graph of + * candidates (*) does not change while unix_gc_lock is held. + * + * Any operations that changes the file count through file descriptors + * (dup, close, sendmsg) does not change the graph since candidates are + * not installed in fds. + * + * Dequeing a candidate via recvmsg would install it into an fd, but + * that takes unix_gc_lock to decrement the inflight count, so it's + * serialized with garbage collection. + * + * MSG_PEEK is special in that it does not change the inflight count, + * yet does install the socket into an fd. The following lock/unlock + * pair is to ensure serialization with garbage collection. It must be + * done between incrementing the file count and installing the file into + * an fd. + * + * If garbage collection starts after the barrier provided by the + * lock/unlock, then it will see the elevated refcount and not mark this + * as a candidate. If a garbage collection is already in progress + * before the file count was incremented, then the lock/unlock pair will + * ensure that garbage collection is finished before progressing to + * installing the fd. + * + * (*) A -> B where B is on the queue of A or B is on the queue of C + * which is on the queue of listening socket A. + */ + spin_lock(&unix_gc_lock); + spin_unlock(&unix_gc_lock); +} + static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds) { int err = 0; @@ -2142,7 +2189,7 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg, sk_peek_offset_fwd(sk, size); if (UNIXCB(skb).fp) - scm.fp = scm_fp_dup(UNIXCB(skb).fp); + unix_peek_fds(&scm, skb); } err = (flags & MSG_TRUNC) ? skb->len - skip : size; @@ -2383,7 +2430,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state, /* It is questionable, see note in unix_dgram_recvmsg. */ if (UNIXCB(skb).fp) - scm.fp = scm_fp_dup(UNIXCB(skb).fp); + unix_peek_fds(&scm, skb); sk_peek_offset_fwd(sk, chunk); -- 2.25.1

1 44

[PATCH kernel-4.19 1/9] iommu/arm-smmu-v3: Add support to configure mpam in STE/CD context
by Yang Yingliang 22 Oct '21

22 Oct '21

From: Xingang Wang <wangxingang5(a)huawei.com> ascend inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49RB2 CVE: NA ------------------------------------------------- To support limiting qos of device, the partid and pmg need to be set into the SMMU STE/CD context. This introduce support of SMMU mpam feature and add interface to set mpam configuration in STE/CD. Signed-off-by: Xingang Wang <wangxingang5(a)huawei.com> Signed-off-by: Rui Zhu <zhurui3(a)huawei.com> Reviewed-by: Yingtai Xie <xieyingtai(a)huawei.com> Reviewed-by: Zhen Lei <thunder.leizhen(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/iommu/arm-smmu-v3-context.c | 25 +++++ drivers/iommu/arm-smmu-v3.c | 151 ++++++++++++++++++++++++++++ include/linux/ascend_smmu.h | 9 ++ 3 files changed, 185 insertions(+) create mode 100644 include/linux/ascend_smmu.h diff --git a/drivers/iommu/arm-smmu-v3-context.c b/drivers/iommu/arm-smmu-v3-context.c index 2351de86d31f1..b30a93e076608 100644 --- a/drivers/iommu/arm-smmu-v3-context.c +++ b/drivers/iommu/arm-smmu-v3-context.c @@ -66,6 +66,9 @@ #define CTXDESC_CD_1_TTB0_MASK GENMASK_ULL(51, 4) +#define CTXDESC_CD_5_PARTID_MASK GENMASK_ULL(47, 32) +#define CTXDESC_CD_5_PMG_MASK GENMASK_ULL(55, 48) + /* Convert between AArch64 (CPU) TCR format and SMMU CD format */ #define ARM_SMMU_TCR2CD(tcr, fld) FIELD_PREP(CTXDESC_CD_0_TCR_##fld, \ FIELD_GET(ARM64_TCR_##fld, tcr)) @@ -563,6 +566,28 @@ static int arm_smmu_set_cd(struct iommu_pasid_table_ops *ops, int pasid, return arm_smmu_write_ctx_desc(tbl, pasid, cd); } +int arm_smmu_set_cd_mpam(struct iommu_pasid_table_ops *ops, + int ssid, int partid, int pmg) +{ + struct arm_smmu_cd_tables *tbl = pasid_ops_to_tables(ops); + u64 val; + __le64 *cdptr = arm_smmu_get_cd_ptr(tbl, ssid); + + if (!cdptr) + return -ENOMEM; + + val = le64_to_cpu(cdptr[5]); + val &= ~CTXDESC_CD_5_PARTID_MASK; + val |= FIELD_PREP(CTXDESC_CD_5_PARTID_MASK, partid); + val &= ~CTXDESC_CD_5_PMG_MASK; + val |= FIELD_PREP(CTXDESC_CD_5_PMG_MASK, pmg); + WRITE_ONCE(cdptr[5], cpu_to_le64(val)); + + iommu_pasid_flush(&tbl->pasid, ssid, true); + + return 0; +} + static void arm_smmu_clear_cd(struct iommu_pasid_table_ops *ops, int pasid, struct iommu_pasid_entry *entry) { diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c index 8b5083c3e0a16..6634d596f7efc 100644 --- a/drivers/iommu/arm-smmu-v3.c +++ b/drivers/iommu/arm-smmu-v3.c @@ -88,6 +88,10 @@ #define IDR1_SSIDSIZE GENMASK(10, 6) #define IDR1_SIDSIZE GENMASK(5, 0) +#define ARM_SMMU_IDR3 0xc +#define IDR3_MPAM (1 << 7) +#define ARM_SMMU_IDR3_CFG 0x140C + #define ARM_SMMU_IDR5 0x14 #define IDR5_STALL_MAX GENMASK(31, 16) #define IDR5_GRAN64K (1 << 6) @@ -186,6 +190,10 @@ #define ARM_SMMU_PRIQ_IRQ_CFG1 0xd8 #define ARM_SMMU_PRIQ_IRQ_CFG2 0xdc +#define ARM_SMMU_MPAMIDR 0x130 +#define MPAMIDR_PMG_MAX GENMASK(23, 16) +#define MPAMIDR_PARTID_MAX GENMASK(15, 0) + /* Common MSI config fields */ #define MSI_CFG0_ADDR_MASK GENMASK_ULL(51, 2) #define MSI_CFG2_SH GENMASK(5, 4) @@ -250,6 +258,7 @@ #define STRTAB_STE_1_S1COR GENMASK_ULL(5, 4) #define STRTAB_STE_1_S1CSH GENMASK_ULL(7, 6) +#define STRTAB_STE_1_S1MPAM (1UL << 26) #define STRTAB_STE_1_S1STALLD (1UL << 27) #define STRTAB_STE_1_EATS GENMASK_ULL(29, 28) @@ -273,6 +282,11 @@ #define STRTAB_STE_3_S2TTB_MASK GENMASK_ULL(51, 4) +#define STRTAB_STE_4_PARTID_MASK GENMASK_ULL(31, 16) + +#define STRTAB_STE_5_MPAM_NS (1UL << 8) +#define STRTAB_STE_5_PMG_MASK GENMASK_ULL(7, 0) + /* Command queue */ #define CMDQ_ENT_SZ_SHIFT 4 #define CMDQ_ENT_DWORDS ((1 << CMDQ_ENT_SZ_SHIFT) >> 3) @@ -634,6 +648,7 @@ struct arm_smmu_device { #define ARM_SMMU_FEAT_SVA (1 << 17) #define ARM_SMMU_FEAT_HA (1 << 18) #define ARM_SMMU_FEAT_HD (1 << 19) +#define ARM_SMMU_FEAT_MPAM (1 << 20) u32 features; #define ARM_SMMU_OPT_SKIP_PREFETCH (1 << 0) @@ -672,6 +687,9 @@ struct arm_smmu_device { struct mutex streams_mutex; struct iopf_queue *iopf_queue; + + unsigned int mpam_partid_max; + unsigned int mpam_pmg_max; }; struct arm_smmu_stream { @@ -3980,6 +3998,25 @@ static int arm_smmu_device_hw_probe(struct arm_smmu_device *smmu) if (smmu->sid_bits <= STRTAB_SPLIT) smmu->features &= ~ARM_SMMU_FEAT_2_LVL_STRTAB; + /* IDR3 */ + reg = readl_relaxed(smmu->base + ARM_SMMU_IDR3); + + if (!(reg & IDR3_MPAM)) { + reg |= FIELD_PREP(IDR3_MPAM, 1); + writel(reg, smmu->base + ARM_SMMU_IDR3_CFG); + reg = readl_relaxed(smmu->base + ARM_SMMU_IDR3); + if (!(reg & IDR3_MPAM)) + dev_warn(smmu->dev, "enable smmu mpam failed\n"); + } + + if (reg & IDR3_MPAM) { + reg = readl_relaxed(smmu->base + ARM_SMMU_MPAMIDR); + smmu->mpam_partid_max = FIELD_GET(MPAMIDR_PARTID_MAX, reg); + smmu->mpam_pmg_max = FIELD_GET(MPAMIDR_PMG_MAX, reg); + if (smmu->mpam_partid_max || smmu->mpam_pmg_max) + smmu->features |= ARM_SMMU_FEAT_MPAM; + } + /* IDR5 */ reg = readl_relaxed(smmu->base + ARM_SMMU_IDR5); @@ -4127,6 +4164,120 @@ static unsigned long arm_smmu_resource_size(struct arm_smmu_device *smmu) return SZ_128K; } +static int arm_smmu_set_ste_mpam(struct arm_smmu_device *smmu, + int sid, int partid, int pmg, int s1mpam) +{ + u64 val; + __le64 *ste; + + if (!arm_smmu_sid_in_range(smmu, sid)) + return -ERANGE; + + /* get ste ptr */ + ste = arm_smmu_get_step_for_sid(smmu, sid); + + /* write s1mpam to ste */ + val = le64_to_cpu(ste[1]); + val &= ~STRTAB_STE_1_S1MPAM; + val |= FIELD_PREP(STRTAB_STE_1_S1MPAM, s1mpam); + WRITE_ONCE(ste[1], cpu_to_le64(val)); + + val = le64_to_cpu(ste[4]); + val &= ~STRTAB_STE_4_PARTID_MASK; + val |= FIELD_PREP(STRTAB_STE_4_PARTID_MASK, partid); + WRITE_ONCE(ste[4], cpu_to_le64(val)); + + val = le64_to_cpu(ste[5]); + val &= ~STRTAB_STE_5_PMG_MASK; + val |= FIELD_PREP(STRTAB_STE_5_PMG_MASK, pmg); + WRITE_ONCE(ste[5], cpu_to_le64(val)); + + arm_smmu_sync_ste_for_sid(smmu, sid); + + return 0; +} + +int arm_smmu_set_cd_mpam(struct iommu_pasid_table_ops *ops, + int ssid, int partid, int pmg); + +static int arm_smmu_set_mpam(struct arm_smmu_device *smmu, + int sid, int ssid, int partid, int pmg, int s1mpam) +{ + struct arm_smmu_master_data *master = arm_smmu_find_master(smmu, sid); + struct arm_smmu_s1_cfg *cfg = master ? master->ste.s1_cfg : NULL; + struct arm_smmu_domain *domain = master ? master->domain : NULL; + int ret; + + struct arm_smmu_cmdq_ent prefetch_cmd = { + .opcode = CMDQ_OP_PREFETCH_CFG, + .prefetch = { + .sid = sid, + }, + }; + + if (!(smmu->features & ARM_SMMU_FEAT_MPAM)) + return -ENODEV; + + if (WARN_ON(!domain)) + return -EINVAL; + + if (WARN_ON(!cfg)) + return -EINVAL; + + if (WARN_ON(ssid >= (1 << master->ssid_bits))) + return -E2BIG; + + if (partid > smmu->mpam_partid_max || pmg > smmu->mpam_pmg_max) { + dev_err(smmu->dev, + "mpam rmid out of range: partid[0, %d] pmg[0, %d]\n", + smmu->mpam_partid_max, smmu->mpam_pmg_max); + return -ERANGE; + } + + ret = arm_smmu_set_ste_mpam(smmu, sid, partid, pmg, s1mpam); + if (ret < 0) { + dev_err(smmu->dev, "set ste mpam configuration error %d\n", + ret); + return ret; + } + + /* do not modify cd table which owned by guest */ + if (domain->stage == ARM_SMMU_DOMAIN_NESTED) { + dev_err(smmu->dev, + "mpam: smmu cd is owned by guest, not modified\n"); + return 0; + } + + ret = arm_smmu_set_cd_mpam(cfg->ops, ssid, partid, pmg); + if (s1mpam && ret < 0) { + dev_err(smmu->dev, "set cd mpam configuration error %d\n", + ret); + return ret; + } + + /* It's likely that we'll want to use the new STE soon */ + if (!(smmu->options & ARM_SMMU_OPT_SKIP_PREFETCH)) + arm_smmu_cmdq_issue_cmd(smmu, &prefetch_cmd); + + dev_info(smmu->dev, "partid %d, pmg %d\n", partid, pmg); + + return 0; +} + +/** + * arm_smmu_set_dev_mpam() - Set mpam configuration to SMMU STE/CD + */ +int arm_smmu_set_dev_mpam(struct device *dev, int ssid, int partid, int pmg, + int s1mpam) +{ + struct arm_smmu_master_data *master = dev->iommu_fwspec->iommu_priv; + struct arm_smmu_device *smmu = master->domain->smmu; + int sid = master->streams->id; + + return arm_smmu_set_mpam(smmu, sid, ssid, partid, pmg, s1mpam); +} +EXPORT_SYMBOL(arm_smmu_set_dev_mpam); + static int arm_smmu_device_probe(struct platform_device *pdev) { int irq, ret; diff --git a/include/linux/ascend_smmu.h b/include/linux/ascend_smmu.h new file mode 100644 index 0000000000000..bd0edd25057e1 --- /dev/null +++ b/include/linux/ascend_smmu.h @@ -0,0 +1,9 @@ +#ifndef __LINUX_ASCEND_SMMU_H +#define __LINUX_ASCEND_SMMU_H + +#include <linux/device.h> + +extern int arm_smmu_set_dev_mpam(struct device *dev, int ssid, int partid, + int pmg, int s1mpam); + +#endif /* __LINUX_ASCEND_SMMU_H */ -- 2.25.1

1 8

[PATCH kernel-4.19] efi: Change down_interruptible() in virt_efi_reset_system() to down_trylock()
by Yang Yingliang 22 Oct '21

22 Oct '21

From: Zhang Jianhua <chris.zjh(a)huawei.com> hulk inclusion category: bugfix bugzilla: 182892, https://gitee.com/openeuler/kernel/issues/I4F04R -------- While reboot the system by sysrq, the following bug will be occur. BUG: sleeping function called from invalid context at kernel/locking/semaphore.c:90 in_atomic(): 0, irqs_disabled(): 128, non_block: 0, pid: 10052, name: rc.shutdown CPU: 3 PID: 10052 Comm: rc.shutdown Tainted: G W O 5.10.0 #1 Call trace: dump_backtrace+0x0/0x1c8 show_stack+0x18/0x28 dump_stack+0xd0/0x110 ___might_sleep+0x14c/0x160 __might_sleep+0x74/0x88 down_interruptible+0x40/0x118 virt_efi_reset_system+0x3c/0xd0 efi_reboot+0xd4/0x11c machine_restart+0x60/0x9c emergency_restart+0x1c/0x2c sysrq_handle_reboot+0x1c/0x2c __handle_sysrq+0xd0/0x194 write_sysrq_trigger+0xbc/0xe4 proc_reg_write+0xd4/0xf0 vfs_write+0xa8/0x148 ksys_write+0x6c/0xd8 __arm64_sys_write+0x18/0x28 el0_svc_common.constprop.3+0xe4/0x16c do_el0_svc+0x1c/0x2c el0_svc+0x20/0x30 el0_sync_handler+0x80/0x17c el0_sync+0x158/0x180 The reason for this problem is that irq has been disabled in machine_restart() and then it calls down_interruptible() in virt_efi_reset_system(), which would occur sleep in irq context, it is dangerous! Commit 99409b935c9a("locking/semaphore: Add might_sleep() to down_*() family") add might_sleep() in down_interruptible(), so the bug info is here. down_trylock() can solve this problem, cause there is no might_sleep. Signed-off-by: Zhang Jianhua <chris.zjh(a)huawei.com> Reviewed-by: Chen Lifu <chenlifu(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Reviewed-by: Liao Chang <liaochang1(a)huawei.com> Reviewed-by: He Ying <heying24(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Reviewed-by: Yihang Xu <xuyihang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/firmware/efi/runtime-wrappers.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c index 04288719721fc..ecee810f7a6fa 100644 --- a/drivers/firmware/efi/runtime-wrappers.c +++ b/drivers/firmware/efi/runtime-wrappers.c @@ -408,7 +408,7 @@ static void virt_efi_reset_system(int reset_type, unsigned long data_size, efi_char16_t *data) { - if (down_interruptible(&efi_runtime_lock)) { + if (down_trylock(&efi_runtime_lock)) { pr_warn("failed to invoke the reset_system() runtime service:\n" "could not get exclusive access to the firmware\n"); return; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] svm: Use vma->vm_pgoff for the nid
by Yang Yingliang 22 Oct '21

22 Oct '21

From: Lijun Fang <fanglijun3(a)huawei.com> ascend inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4DZYE CVE: NA --------------------------- svm_mmap use the pgoff flag for the security requirement nid, which used as cdm node. Signed-off-by: Lijun Fang <fanglijun3(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/char/svm.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/char/svm.c b/drivers/char/svm.c index f312b7e02263c..62092fbaa0104 100644 --- a/drivers/char/svm.c +++ b/drivers/char/svm.c @@ -1820,9 +1820,17 @@ static int svm_mmap(struct file *file, struct vm_area_struct *vma) if ((vma->vm_end < vma->vm_start) || (vm_size > MMAP_PHY32_MAX)) return -EINVAL; - page = alloc_pages(GFP_KERNEL | GFP_DMA32, get_order(vm_size)); + /* vma->vm_pgoff transfer the nid */ + if (vma->vm_pgoff == 0) + page = alloc_pages(GFP_KERNEL | GFP_DMA32, + get_order(vm_size)); + else + page = alloc_pages_node((int)vma->vm_pgoff, + GFP_KERNEL | __GFP_THISNODE, + get_order(vm_size)); if (!page) { - dev_err(sdev->dev, "fail to alloc page\n"); + dev_err(sdev->dev, "fail to alloc page on node 0x%lx\n", + vma->vm_pgoff); return -ENOMEM; } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] Ascend/hugetlb:support alloc normal and buddy hugepage
by Yang Yingliang 22 Oct '21

22 Oct '21

From: Zhou Guanghui <zhouguanghui1(a)huawei.com> ascend inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4D63I CVE: NA ---------------------------------------------------- The current function hugetlb_alloc_hugepage implements the allocation from static hugepages first. When the static hugepage is used up, it attempts to apply for hugepages from buddy system. Two additional modes are supported: static hugepages only and buddy hugepages only. Signed-off-by: Zhou Guanghui <zhouguanghui1(a)huawei.com> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/hugetlb.h | 11 +++++++++-- mm/hugetlb.c | 35 +++++++++++++++++++++++++++++++++-- 2 files changed, 42 insertions(+), 4 deletions(-) diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index 830c41a5ca70e..de6cdfa51694c 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -374,8 +374,15 @@ int huge_add_to_page_cache(struct page *page, struct address_space *mapping, pgoff_t idx); #ifdef CONFIG_ASCEND_FEATURES +#define HUGETLB_ALLOC_NONE 0x00 +#define HUGETLB_ALLOC_NORMAL 0x01 /* normal hugepage */ +#define HUGETLB_ALLOC_BUDDY 0x02 /* buddy hugepage */ +#define HUGETLB_ALLOC_MASK (HUGETLB_ALLOC_NONE | \ + HUGETLB_ALLOC_NORMAL | \ + HUGETLB_ALLOC_BUDDY) + const struct hstate *hugetlb_get_hstate(void); -struct page *hugetlb_alloc_hugepage(int nid); +struct page *hugetlb_alloc_hugepage(int nid, int flag); int hugetlb_insert_hugepage_pte(struct mm_struct *mm, unsigned long addr, pgprot_t prot, struct page *hpage); #else @@ -384,7 +391,7 @@ static inline const struct hstate *hugetlb_get_hstate(void) return NULL; } -static inline struct page *hugetlb_alloc_hugepage(int nid) +static inline struct page *hugetlb_alloc_hugepage(int nid, int flag) { return NULL; } diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 3091c61bb63e3..907b1351b0f5f 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5233,17 +5233,48 @@ const struct hstate *hugetlb_get_hstate(void) } EXPORT_SYMBOL_GPL(hugetlb_get_hstate); +static struct page *hugetlb_alloc_hugepage_normal(struct hstate *h, + gfp_t gfp_mask, int nid) +{ + struct page *page = NULL; + + spin_lock(&hugetlb_lock); + if (h->free_huge_pages - h->resv_huge_pages > 0) + page = dequeue_huge_page_nodemask(h, gfp_mask, nid, NULL, NULL); + spin_unlock(&hugetlb_lock); + + return page; +} + /* * Allocate hugepage without reserve */ -struct page *hugetlb_alloc_hugepage(int nid) +struct page *hugetlb_alloc_hugepage(int nid, int flag) { + struct hstate *h = &default_hstate; + gfp_t gfp_mask = htlb_alloc_mask(h); + struct page *page = NULL; + VM_WARN_ON(nid < 0 || nid >= MAX_NUMNODES); + if (flag & ~HUGETLB_ALLOC_MASK) + return NULL; + if (nid == NUMA_NO_NODE) nid = numa_mem_id(); - return alloc_huge_page_node(&default_hstate, nid); + gfp_mask |= __GFP_THISNODE; + + if (flag & HUGETLB_ALLOC_NORMAL) + page = hugetlb_alloc_hugepage_normal(h, gfp_mask, nid); + else if (flag & HUGETLB_ALLOC_BUDDY) { + if (enable_charge_mighp) + gfp_mask |= __GFP_ACCOUNT; + page = alloc_migrate_huge_page(h, gfp_mask, nid, NULL); + } else + page = alloc_huge_page_node(h, nid); + + return page; } EXPORT_SYMBOL_GPL(hugetlb_alloc_hugepage); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] Ascend/memcg: Use CONFIG_ASCEND_FEATURES for customized interfaces
by Yang Yingliang 22 Oct '21

22 Oct '21

From: Zhou Guanghui <zhouguanghui1(a)huawei.com> ascend inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4D63I CVE: NA ------------------------------------------------------------- The following functions are used only in the ascend scenario: hugetlb_get_hstate, hugetlb_alloc_hugepage, hugetlb_insert_hugepage_pte, hugetlb_insert_hugepage_pte_by_pa Remove unused interface hugetlb_insert_hugepage Signed-off-by: Zhou Guanghui <zhouguanghui1(a)huawei.com> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/hugetlb.h | 33 ++++++++++++++++++++++++++------- mm/hugetlb.c | 2 +- 2 files changed, 27 insertions(+), 8 deletions(-) diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index 6831b24defd64..830c41a5ca70e 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -373,11 +373,27 @@ struct page *alloc_huge_page_vma(struct hstate *h, struct vm_area_struct *vma, int huge_add_to_page_cache(struct page *page, struct address_space *mapping, pgoff_t idx); -#ifdef CONFIG_ARM64 +#ifdef CONFIG_ASCEND_FEATURES const struct hstate *hugetlb_get_hstate(void); struct page *hugetlb_alloc_hugepage(int nid); int hugetlb_insert_hugepage_pte(struct mm_struct *mm, unsigned long addr, pgprot_t prot, struct page *hpage); +#else +static inline const struct hstate *hugetlb_get_hstate(void) +{ + return NULL; +} + +static inline struct page *hugetlb_alloc_hugepage(int nid) +{ + return NULL; +} + +static inline int hugetlb_insert_hugepage_pte(struct mm_struct *mm, + unsigned long addr, pgprot_t prot, struct page *hpage) +{ + return -EPERM; +} #endif /* arch callback */ @@ -614,12 +630,6 @@ static inline void set_huge_swap_pte_at(struct mm_struct *mm, unsigned long addr { } -static inline int hugetlb_insert_hugepage_pte_by_pa(struct mm_struct *mm, - unsigned long vir_addr, - pgprot_t prot, unsigned long phy_addr) -{ - return 0; -} #endif /* CONFIG_HUGETLB_PAGE */ static inline spinlock_t *huge_pte_lock(struct hstate *h, @@ -632,4 +642,13 @@ static inline spinlock_t *huge_pte_lock(struct hstate *h, return ptl; } +#ifndef CONFIG_ASCEND_FEATURES +static inline int hugetlb_insert__hugepage_pte_by_pa(struct mm_struct *mm, + unsigned long vir_addr, + pgprot_t prot, unsigned long phy_addr) +{ + return -EPERM; +} +#endif + #endif /* _LINUX_HUGETLB_H */ diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 5132fefb60c86..3091c61bb63e3 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5226,7 +5226,7 @@ void move_hugetlb_state(struct page *oldpage, struct page *newpage, int reason) } } -#ifdef CONFIG_ARM64 +#ifdef CONFIG_ASCEND_FEATURES const struct hstate *hugetlb_get_hstate(void) { return &default_hstate; -- 2.25.1

1 0

[PATCH kernel-4.19 1/2] fuse: truncate pagecache on atomic_o_trunc
by Yang Yingliang 22 Oct '21

22 Oct '21

From: Miklos Szeredi <mszeredi(a)redhat.com> mainline inclusion from mainline-5.14 commit 76224355db7570cbe6b6f75c8929a1558828dd55 category: bugfix bugzilla: 181107 CVE: NA --------------------------- fuse_finish_open() will be called with FUSE_NOWRITE in case of atomic O_TRUNC. This can deadlock with fuse_wait_on_page_writeback() in fuse_launder_page() triggered by invalidate_inode_pages2(). Fix by replacing invalidate_inode_pages2() in fuse_finish_open() with a truncate_pagecache() call. This makes sense regardless of FOPEN_KEEP_CACHE or fc->writeback cache, so do it unconditionally. Reported-by: Xie Yongji <xieyongji(a)bytedance.com> Reported-and-tested-by: syzbot+bea44a5189836d956894(a)syzkaller.appspotmail.com Fixes: e4648309b85a ("fuse: truncate pending writes on O_TRUNC") Cc: <stable(a)vger.kernel.org> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Conflict: fs/fuse/file.c Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/fuse/file.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/fuse/file.c b/fs/fuse/file.c index 41e2a7b567d7f..5ecabacabd477 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -178,8 +178,6 @@ void fuse_finish_open(struct inode *inode, struct file *file) if (ff->open_flags & FOPEN_DIRECT_IO) file->f_op = &fuse_direct_io_file_operations; - if (!(ff->open_flags & FOPEN_KEEP_CACHE)) - invalidate_inode_pages2(inode->i_mapping); if (ff->open_flags & FOPEN_STREAM) stream_open(inode, file); else if (ff->open_flags & FOPEN_NONSEEKABLE) @@ -191,10 +189,13 @@ void fuse_finish_open(struct inode *inode, struct file *file) fi->attr_version = ++fc->attr_version; i_size_write(inode, 0); spin_unlock(&fc->lock); + truncate_pagecache(inode, 0); fuse_invalidate_attr(inode); if (fc->writeback_cache) file_update_time(file); - } + } else if (!(ff->open_flags & FOPEN_KEEP_CACHE)) + invalidate_inode_pages2(inode->i_mapping); + if ((file->f_mode & FMODE_WRITE) && fc->writeback_cache) fuse_link_write_file(file); } -- 2.25.1

1 1