hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8MVBZ CVE: NA

-----------------------------------------------

On Hisilicon LINXICORE9100 cores, SMMU pagetable prefetch features may prefetch and use a invalid PTE even the PTE is valid at that time. This will cause the device trigger fake pagefaults. If the SMMU works in terminate mode, transactions which occur fake pagefaults will be aborted, and could result in unexpected errors.

To fix this problem, we need to add a SYNC command after smmu has map a iova, then smmu will always try to get the newest PTE.

Signed-off-by: Zhang Zekun zhangzekun11@huawei.com --- arch/arm64/Kconfig | 13 +++++++++++++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/kernel/cpu_errata.c | 14 ++++++++++++++ arch/arm64/tools/cpucaps | 1 + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 20 ++++++++++++++++++++ 5 files changed, 49 insertions(+)

diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 2aca373a7038..02f6dff029ed 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -1180,6 +1180,19 @@ config HISILICON_ERRATUM_1980005

If unsure, say N.

+config HISILICON_ERRATUM_162100602 + bool "Hisilicon erratum 162100602" + depends on ARM_SMMU_V3 + default y + help + On Hisilicon LINXICORE9100 cores, SMMU pagetable prefetch features may + prefetch and use a invalid PTE even the PTE is valid at that time. This + will cause the device trigger fake pagefaults. If the SMMU works in + terminate mode, transactions which occur fake pagefaults will be aborted, + and could result in unexpected errors. + + If unsure, say Y. + config QCOM_FALKOR_ERRATUM_1003 bool "Falkor E1003: Incorrect translation due to ASID change" default y diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 33ba39711884..98fa4d2f3b13 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -399,6 +399,7 @@ CONFIG_CAVIUM_TX2_ERRATUM_219=y CONFIG_FUJITSU_ERRATUM_010001=y CONFIG_HISILICON_ERRATUM_161600802=y CONFIG_HISILICON_ERRATUM_162100125=y +CONFIG_HISILICON_ERRATUM_162100602=y CONFIG_QCOM_FALKOR_ERRATUM_1003=y CONFIG_QCOM_FALKOR_ERRATUM_1009=y CONFIG_QCOM_QDF2400_ERRATUM_0065=y diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c index a686a96d966a..c569e6c0ac07 100644 --- a/arch/arm64/kernel/cpu_errata.c +++ b/arch/arm64/kernel/cpu_errata.c @@ -360,6 +360,13 @@ static const struct midr_range hisilicon_erratum_162100125_cpus[] = { }; #endif

+#ifdef CONFIG_HISILICON_ERRATUM_162100602 +static const struct midr_range hisilicon_erratum_162100602_cpus[] = { + MIDR_REV(MIDR_HISI_LINXICORE9100, 0, 0), + {}, +}; +#endif + #ifdef CONFIG_QCOM_FALKOR_ERRATUM_1003 static const struct arm64_cpu_capabilities qcom_erratum_1003_list[] = { { @@ -591,6 +598,13 @@ const struct arm64_cpu_capabilities arm64_errata[] = { ERRATA_MIDR_RANGE_LIST(hisilicon_erratum_162100125_cpus), }, #endif +#ifdef CONFIG_HISILICON_ERRATUM_162100602 + { + .desc = "Hisilicon erratum 162100602", + .capability = ARM64_WORKAROUND_HISILICON_ERRATUM_162100602, + ERRATA_MIDR_RANGE_LIST(hisilicon_erratum_162100602_cpus), + }, +#endif #ifdef CONFIG_HISILICON_ERRATUM_1980005 { .desc = "Hisilicon erratum 1980005 (IDC)", diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps index 0b62edb91876..569ecec76c16 100644 --- a/arch/arm64/tools/cpucaps +++ b/arch/arm64/tools/cpucaps @@ -103,3 +103,4 @@ WORKAROUND_SPECULATIVE_AT WORKAROUND_HISILICON_ERRATUM_162100125 WORKAROUND_HISI_HIP08_RU_PREFETCH WORKAROUND_HISILICON_1980005 +WORKAROUND_HISILICON_ERRATUM_162100602 diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index 5055a66644af..d0422bb13724 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -2528,6 +2528,23 @@ static void arm_smmu_iotlb_sync(struct iommu_domain *domain, gather->pgsize, true, smmu_domain); }

+#ifdef CONFIG_HISILICON_ERRATUM_162100602 +static void arm_smmu_iotlb_sync_map(struct iommu_domain *domain, + unsigned long iova, size_t size) +{ + struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain); + size_t granule_size; + + if (!cpus_have_const_cap(ARM64_WORKAROUND_HISILICON_ERRATUM_162100602)) + return; + + granule_size = 1 << __ffs(smmu_domain->domain.pgsize_bitmap); + + /* Add a SYNC command to sync io-pgtale to avoid errors in pgtable prefetch*/ + arm_smmu_tlb_inv_range_domain(iova, granule_size, granule_size, true, smmu_domain); +} +#endif + static phys_addr_t arm_smmu_iova_to_phys(struct iommu_domain *domain, dma_addr_t iova) { @@ -2883,6 +2900,9 @@ static struct iommu_ops arm_smmu_ops = { .unmap_pages = arm_smmu_unmap_pages, .flush_iotlb_all = arm_smmu_flush_iotlb_all, .iotlb_sync = arm_smmu_iotlb_sync, +#ifdef CONFIG_HISILICON_ERRATUM_162100602 + .iotlb_sync_map = arm_smmu_iotlb_sync_map, +#endif .iova_to_phys = arm_smmu_iova_to_phys, .enable_nesting = arm_smmu_enable_nesting, .free = arm_smmu_domain_free,

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8Q58S CVE: NA

---------------------------------

In some ascend sceneraios, we need to get the task regradless of whether it has signal handling functions.

Signed-off-by: Zhang Zekun zhangzekun11@huawei.com --- include/linux/mm.h | 4 ++++ mm/Kconfig | 9 +++++++++ mm/memory-failure.c | 5 +++++ 3 files changed, 18 insertions(+)

diff --git a/include/linux/mm.h b/include/linux/mm.h index 80bacc4da324..4e482ff01d38 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -395,6 +395,10 @@ extern unsigned int kobjsize(const void *objp); # define VM_SHARE_POOL VM_NONE #endif

+#if defined(CONFIG_ASCEND_RAS_FEATURES) +#define ASCEND_HWPOISON_MAGIC_NUM 0xABAB +#endif + #ifndef VM_GROWSUP # define VM_GROWSUP VM_NONE #endif diff --git a/mm/Kconfig b/mm/Kconfig index ff0c36f42ca8..65855eaf945e 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -1323,6 +1323,15 @@ config ASCEND_OOM 0: disable oom killer 1: enable oom killer (default,compatible with mainline)

+config ASCEND_RAS_FEATURES + bool "ACPI RAS features for ascend scenarios" + default n + depends on ACPI && ARM64 + help + ACPI RAS features developed to support some of special cases in ascend + scenarios. If you don't know the actual usage of these features don't + open this config. + source "mm/damon/Kconfig"

endmenu diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 4d6e43c88489..228700bb5cb4 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -582,6 +582,11 @@ struct task_struct *task_early_kill(struct task_struct *tsk, int force_early) { if (!tsk->mm) return NULL; + +#ifdef CONFIG_ASCEND_RAS_FEATURES + if (force_early == ASCEND_HWPOISON_MAGIC_NUM) + return tsk; +#endif /* * Comparing ->mm here because current task might represent * a subthread, while tsk always points to the main thread.

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8Q58S CVE: NA

------------------------------------

Provide a way to query whether a page is hwpoioned and isolated. The driver can use this function to query if a page has beed isolated.

Signed-off-by: Zhang Zekun zhangzekun11@huawei.com --- include/linux/mm.h | 1 + mm/memory-failure.c | 27 +++++++++++++++++++++++++++ 2 files changed, 28 insertions(+)

diff --git a/include/linux/mm.h b/include/linux/mm.h index 4e482ff01d38..7381d6b604e4 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -3866,6 +3866,7 @@ enum mf_flags { int mf_dax_kill_procs(struct address_space *mapping, pgoff_t index, unsigned long count, int mf_flags); extern int memory_failure(unsigned long pfn, int flags); +extern bool pfn_hwpoison_isolated(unsigned long pfn); extern void memory_failure_queue_kick(int cpu); extern int unpoison_memory(unsigned long pfn); extern void shake_page(struct page *p); diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 228700bb5cb4..3010a20fb930 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -2375,6 +2375,33 @@ int memory_failure(unsigned long pfn, int flags) } EXPORT_SYMBOL_GPL(memory_failure);

+#ifdef CONFIG_ASCEND_RAS_FEATURES +bool pfn_hwpoison_isolated(unsigned long pfn) +{ + struct page *p; + struct page *head; + + p = pfn_to_online_page(pfn); + if (!p) + return false; + + head = compound_head(p); + + if (PageHuge(p)) { + if (PageHWPoison(head) && (page_count(head) == 0 + || page_count(head) == 1)) + return true; + } else { + if (PageHWPoison(p) && (page_count(head) == 0 + || page_count(head) == 1)) + return true; + } + + return false; +} +EXPORT_SYMBOL_GPL(pfn_hwpoison_isolated); +#endif + #define MEMORY_FAILURE_FIFO_ORDER 4 #define MEMORY_FAILURE_FIFO_SIZE (1 << MEMORY_FAILURE_FIFO_ORDER)