From 82ba2bc6121dd1485447223291fd68cfbfaa1544 Mon Sep 17 00:00:00 2001 From: Wei Qin Date: Fri, 5 Dec 2025 15:06:48 +0800 Subject: [PATCH 1/2] ub: udma: bugfix for rx close. driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IDAYM3 CVE: NA ----------------------------------------------------------- This patch fix a bug about rx close. Fixes: 534649e2be8e ("ub: udma: Support get tp list.") Signed-off-by: Wei Qin --- drivers/ub/urma/hw/udma/udma_main.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/drivers/ub/urma/hw/udma/udma_main.c b/drivers/ub/urma/hw/udma/udma_main.c index 44a93fd000b0..99c9fa2fe219 100644 --- a/drivers/ub/urma/hw/udma/udma_main.c +++ b/drivers/ub/urma/hw/udma/udma_main.c @@ -1123,6 +1123,10 @@ int udma_probe(struct auxiliary_device *adev, void udma_remove(struct auxiliary_device *adev) { +#define MIN_SLEEP_TIME 100 +#define MAX_SLEEP_TIME 800 +#define TIME_SLEEP_RATE 2 + uint32_t wait_time = MIN_SLEEP_TIME; struct udma_dev *udma_dev; ubase_reset_unregister(adev); @@ -1135,12 +1139,14 @@ void udma_remove(struct auxiliary_device *adev) } ubcore_stop_requests(&udma_dev->ub_dev); - if (udma_close_ue_rx(udma_dev, false, false, false, 0)) { - mutex_unlock(&udma_reset_mutex); - dev_err(&adev->dev, "udma close ue rx failed in remove process.\n"); - return; + while (true) { + if (!udma_close_ue_rx(udma_dev, false, false, false, 0)) + break; + msleep(wait_time); + if (wait_time < MAX_SLEEP_TIME) + wait_time *= TIME_SLEEP_RATE; + dev_err_ratelimited(&adev->dev, "udma close ue rx failed in remove process.\n"); } - udma_dev->status = UDMA_SUSPEND; udma_report_reset_event(UBCORE_EVENT_ELR_ERR, udma_dev); @@ -1150,7 +1156,8 @@ void udma_remove(struct auxiliary_device *adev) udma_unregister_debugfs(udma_dev); udma_unregister_activate_workqueue(udma_dev); check_and_wait_flush_done(udma_dev); - (void)ubase_activate_dev(adev); + if (is_rmmod) + (void)ubase_activate_dev(adev); udma_destroy_dev(udma_dev); mutex_unlock(&udma_reset_mutex); dev_info(&adev->dev, "udma device remove success.\n"); -- Gitee From 430e4e841b46b8d9e07514cdbfe5ee3544e2ac02 Mon Sep 17 00:00:00 2001 From: Wei Qin Date: Fri, 5 Dec 2025 16:04:10 +0800 Subject: [PATCH 2/2] ub: udma: bugfix related to init xa flags. driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IDAYM3 CVE: NA ----------------------------------------------------------- This patch fix a bug about init xa flags. Fixes: d0c38b53548d ("ub: udma: Support query ub memory info.") Signed-off-by: Wei Qin --- drivers/ub/urma/hw/udma/udma_common.c | 15 +++++++++++---- drivers/ub/urma/hw/udma/udma_common.h | 4 ++-- drivers/ub/urma/hw/udma/udma_ctl.c | 2 ++ drivers/ub/urma/hw/udma/udma_ctrlq_tp.c | 12 +++++------- drivers/ub/urma/hw/udma/udma_ctx.c | 3 ++- drivers/ub/urma/hw/udma/udma_db.c | 1 + drivers/ub/urma/hw/udma/udma_jfr.c | 2 +- drivers/ub/urma/hw/udma/udma_jfs.c | 1 + drivers/ub/urma/hw/udma/udma_main.c | 12 ++++++------ 9 files changed, 31 insertions(+), 21 deletions(-) diff --git a/drivers/ub/urma/hw/udma/udma_common.c b/drivers/ub/urma/hw/udma/udma_common.c index 07d57a5ce96b..c4c3e2c746b6 100644 --- a/drivers/ub/urma/hw/udma/udma_common.c +++ b/drivers/ub/urma/hw/udma/udma_common.c @@ -418,15 +418,21 @@ static void udma_init_ida_table(struct udma_ida *ida_table, uint32_t max, uint32 ida_table->next = min; } -void udma_init_udma_table(struct udma_table *table, uint32_t max, uint32_t min) +void udma_init_udma_table(struct udma_table *table, uint32_t max, uint32_t min, bool irq_lock) { udma_init_ida_table(&table->ida_table, max, min); - xa_init(&table->xa); + if (irq_lock) + xa_init_flags(&table->xa, XA_FLAGS_LOCK_IRQ); + else + xa_init(&table->xa); } -void udma_init_udma_table_mutex(struct xarray *table, struct mutex *udma_mutex) +void udma_init_udma_table_mutex(struct xarray *table, struct mutex *udma_mutex, bool irq_lock) { - xa_init(table); + if (irq_lock) + xa_init_flags(table, XA_FLAGS_LOCK_IRQ); + else + xa_init(table); mutex_init(udma_mutex); } @@ -582,6 +588,7 @@ int udma_alloc_normal_buf(struct udma_dev *udma_dev, size_t memory_size, if (IS_ERR(buf->umem)) { ret = PTR_ERR(buf->umem); vfree(buf->aligned_va); + buf->aligned_va = NULL; dev_err(udma_dev->dev, "pin kernel buf failed, ret = %d.\n", ret); return ret; } diff --git a/drivers/ub/urma/hw/udma/udma_common.h b/drivers/ub/urma/hw/udma/udma_common.h index dee92a4186d3..22992e94e2e1 100644 --- a/drivers/ub/urma/hw/udma/udma_common.h +++ b/drivers/ub/urma/hw/udma/udma_common.h @@ -316,8 +316,8 @@ struct udma_tp_ctx { struct ubcore_umem *udma_umem_get(struct udma_umem_param *param); void udma_umem_release(struct ubcore_umem *umem, bool is_kernel); -void udma_init_udma_table(struct udma_table *table, uint32_t max, uint32_t min); -void udma_init_udma_table_mutex(struct xarray *table, struct mutex *udma_mutex); +void udma_init_udma_table(struct udma_table *table, uint32_t max, uint32_t min, bool irq_lock); +void udma_init_udma_table_mutex(struct xarray *table, struct mutex *udma_mutex, bool irq_lock); void udma_destroy_npu_cb_table(struct udma_dev *dev); void udma_destroy_udma_table(struct udma_dev *dev, struct udma_table *table, const char *table_name); diff --git a/drivers/ub/urma/hw/udma/udma_ctl.c b/drivers/ub/urma/hw/udma/udma_ctl.c index 0dafb84d352d..4609ff0ea80b 100644 --- a/drivers/ub/urma/hw/udma/udma_ctl.c +++ b/drivers/ub/urma/hw/udma/udma_ctl.c @@ -1008,6 +1008,7 @@ static int copy_out_cqe_data_from_user(struct udma_dev *udma_dev, sizeof(uint32_t), GFP_KERNEL); if (!aux_info_out->aux_info_value) { kfree(aux_info_out->aux_info_type); + aux_info_out->aux_info_type = NULL; return -ENOMEM; } } @@ -1206,6 +1207,7 @@ static int copy_out_ae_data_from_user(struct udma_dev *udma_dev, sizeof(uint32_t), GFP_KERNEL); if (!aux_info_out->aux_info_value) { kfree(aux_info_out->aux_info_type); + aux_info_out->aux_info_type = NULL; return -ENOMEM; } } diff --git a/drivers/ub/urma/hw/udma/udma_ctrlq_tp.c b/drivers/ub/urma/hw/udma/udma_ctrlq_tp.c index 86d68ace7000..b313c2683140 100644 --- a/drivers/ub/urma/hw/udma/udma_ctrlq_tp.c +++ b/drivers/ub/urma/hw/udma/udma_ctrlq_tp.c @@ -332,7 +332,8 @@ static int udma_ctrlq_store_one_tpid(struct udma_dev *udev, struct xarray *ctrlq int ret; if (debug_switch) - dev_info(udev->dev, "udma ctrlq store one tpid start. tpid %u\n", tpid->tpid); + dev_info_ratelimited(udev->dev, "udma ctrlq store one tpid start. tpid %u\n", + tpid->tpid); if (xa_load(ctrlq_tpid_table, tpid->tpid)) { dev_warn(udev->dev, @@ -419,7 +420,7 @@ static int udma_ctrlq_store_tpid_list(struct udma_dev *udev, int i; if (debug_switch) - dev_info(udev->dev, "udma ctrlq store tpid list tp_list_cnt = %u.\n", + dev_info_ratelimited(udev->dev, "udma ctrlq store tpid list tp_list_cnt = %u.\n", tpid_list_resp->tp_list_cnt); for (i = 0; i < (int)tpid_list_resp->tp_list_cnt; i++) { @@ -776,10 +777,6 @@ int udma_active_tp(struct ubcore_device *dev, struct ubcore_active_tp_cfg *activ struct udma_dev *udma_dev = to_udma_dev(dev); int ret; - if (debug_switch) - udma_dfx_ctx_print(udma_dev, "udma active tp ex", active_cfg->tp_handle.bs.tpid, - sizeof(struct ubcore_active_tp_cfg) / sizeof(uint32_t), - (uint32_t *)active_cfg); ret = udma_ctrlq_set_active_tp_ex(udma_dev, active_cfg); if (ret) dev_err(udma_dev->dev, "Failed to set active tp msg, ret %d.\n", ret); @@ -793,7 +790,8 @@ int udma_deactive_tp(struct ubcore_device *dev, union ubcore_tp_handle tp_handle struct udma_dev *udma_dev = to_udma_dev(dev); if (debug_switch) - dev_info(udma_dev->dev, "udma deactivate tp ex tp_id = %u\n", tp_handle.bs.tpid); + dev_info_ratelimited(udma_dev->dev, "udma deactivate tp ex tp_id = %u\n", + tp_handle.bs.tpid); return udma_k_ctrlq_deactive_tp(udma_dev, tp_handle, udata); } diff --git a/drivers/ub/urma/hw/udma/udma_ctx.c b/drivers/ub/urma/hw/udma/udma_ctx.c index ccc3b4905af9..4613923b6ee5 100644 --- a/drivers/ub/urma/hw/udma/udma_ctx.c +++ b/drivers/ub/urma/hw/udma/udma_ctx.c @@ -198,7 +198,8 @@ static int udma_mmap_hugepage(struct udma_dev *dev, struct ubcore_ucontext *uctx return -EINVAL; } - vm_flags_set(vma, VM_IO | VM_LOCKED | VM_DONTEXPAND | VM_DONTDUMP | VM_DONTCOPY); + vm_flags_set(vma, VM_IO | VM_LOCKED | VM_DONTEXPAND | VM_DONTDUMP | VM_DONTCOPY | + VM_WIPEONFORK); vma->vm_page_prot = __pgprot(((~PTE_ATTRINDX_MASK) & vma->vm_page_prot.pgprot) | PTE_ATTRINDX(MT_NORMAL)); if (udma_alloc_u_hugepage(to_udma_context(uctx), vma)) { diff --git a/drivers/ub/urma/hw/udma/udma_db.c b/drivers/ub/urma/hw/udma/udma_db.c index c66d6b23b2e8..ba8c3ffd265d 100644 --- a/drivers/ub/urma/hw/udma/udma_db.c +++ b/drivers/ub/urma/hw/udma/udma_db.c @@ -69,6 +69,7 @@ void udma_unpin_sw_db(struct udma_context *ctx, struct udma_sw_db *db) list_del(&db->page->list); udma_umem_release(db->page->umem, false); kfree(db->page); + db->page = NULL; } mutex_unlock(&ctx->pgdir_mutex); diff --git a/drivers/ub/urma/hw/udma/udma_jfr.c b/drivers/ub/urma/hw/udma/udma_jfr.c index 8e98319715e0..cdd0d50236a1 100644 --- a/drivers/ub/urma/hw/udma/udma_jfr.c +++ b/drivers/ub/urma/hw/udma/udma_jfr.c @@ -81,7 +81,7 @@ static int udma_get_k_jfr_buf(struct udma_dev *dev, struct udma_jfr *jfr) goto err_alloc_db; } - udma_init_udma_table(&jfr->idx_que.jfr_idx_table, jfr->idx_que.buf.entry_cnt - 1, 0); + udma_init_udma_table(&jfr->idx_que.jfr_idx_table, jfr->idx_que.buf.entry_cnt - 1, 0, false); jfr->rq.tid = dev->tid; diff --git a/drivers/ub/urma/hw/udma/udma_jfs.c b/drivers/ub/urma/hw/udma/udma_jfs.c index 5d520a0cea00..5875e7e0ff80 100644 --- a/drivers/ub/urma/hw/udma/udma_jfs.c +++ b/drivers/ub/urma/hw/udma/udma_jfs.c @@ -102,6 +102,7 @@ void udma_free_sq_buf(struct udma_dev *dev, struct udma_jetty_queue *sq) if (sq->buf.kva) { udma_k_free_buf(dev, &sq->buf); kfree(sq->wrid); + sq->wrid = NULL; return; } diff --git a/drivers/ub/urma/hw/udma/udma_main.c b/drivers/ub/urma/hw/udma/udma_main.c index 99c9fa2fe219..686e4a02026c 100644 --- a/drivers/ub/urma/hw/udma/udma_main.c +++ b/drivers/ub/urma/hw/udma/udma_main.c @@ -365,15 +365,15 @@ int udma_init_tables(struct udma_dev *udma_dev) } udma_init_udma_table(&udma_dev->jfr_table, udma_dev->caps.jfr.max_cnt + - udma_dev->caps.jfr.start_idx - 1, udma_dev->caps.jfr.start_idx); + udma_dev->caps.jfr.start_idx - 1, udma_dev->caps.jfr.start_idx, false); udma_init_udma_table(&udma_dev->jfc_table, udma_dev->caps.jfc.max_cnt + - udma_dev->caps.jfc.start_idx - 1, udma_dev->caps.jfc.start_idx); + udma_dev->caps.jfc.start_idx - 1, udma_dev->caps.jfc.start_idx, true); udma_init_udma_table(&udma_dev->jetty_grp_table, udma_dev->caps.jetty_grp.max_cnt + udma_dev->caps.jetty_grp.start_idx - 1, - udma_dev->caps.jetty_grp.start_idx); - udma_init_udma_table_mutex(&udma_dev->ksva_table, &udma_dev->ksva_mutex); - udma_init_udma_table_mutex(&udma_dev->npu_nb_table, &udma_dev->npu_nb_mutex); - xa_init(&udma_dev->tpn_ue_idx_table); + udma_dev->caps.jetty_grp.start_idx, true); + udma_init_udma_table_mutex(&udma_dev->ksva_table, &udma_dev->ksva_mutex, false); + udma_init_udma_table_mutex(&udma_dev->npu_nb_table, &udma_dev->npu_nb_mutex, true); + xa_init_flags(&udma_dev->tpn_ue_idx_table, XA_FLAGS_LOCK_IRQ); xa_init(&udma_dev->crq_nb_table); ida_init(&udma_dev->rsvd_jetty_ida_table.ida); mutex_init(&udma_dev->disable_ue_rx_mutex); -- Gitee