From 7df248c3f03d95decd61865b82bc76ef81354dc0 Mon Sep 17 00:00:00 2001 From: Yaoyao Tu Date: Mon, 15 Dec 2025 21:06:30 +0800 Subject: [PATCH 1/2] net: unic: Fix the calltrace caused by modifying queue parameters in the MUE scenario drivers inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID7LHB CVE: NA ---------------------------------------------------------------- This issue occurs in the multi-network-port MUE streaming media scenario when queue parameters are modified simultaneously. In this scenario, the unicast completion event is interrupted when queue resources such as channels are destroyed. When obtaining queue resources like rq and sq, the call trace will be suspended in this situation. Fixes: d8164d3745d4 ("net: unic: add io basic Rx/Tx functionality for unic") Signed-off-by: Yaoyao Tu --- drivers/net/ub/unic/unic_event.c | 12 +++++++++--- drivers/net/ub/unic/unic_reset.c | 8 ++------ 2 files changed, 11 insertions(+), 9 deletions(-) diff --git a/drivers/net/ub/unic/unic_event.c b/drivers/net/ub/unic/unic_event.c index 796966703751..9c4c8d9b80d3 100644 --- a/drivers/net/ub/unic/unic_event.c +++ b/drivers/net/ub/unic/unic_event.c @@ -153,6 +153,11 @@ static void unic_activate_handler(struct auxiliary_device *adev, bool activate) static void unic_ub_port_reset(struct unic_dev *unic_dev, bool link_up) { + struct net_device *netdev = unic_dev->comdev.netdev; + + if (!netif_running(netdev)) + return; + if (link_up) unic_dev->hw.mac.link_status = UNIC_LINK_STATUS_UP; else @@ -163,11 +168,15 @@ static void unic_eth_port_reset(struct net_device *netdev, bool link_up) { rtnl_lock(); + if (!netif_running(netdev)) + goto unlock; + if (link_up) unic_net_open(netdev); else unic_net_stop(netdev); +unlock: rtnl_unlock(); } @@ -176,9 +185,6 @@ static void unic_port_handler(struct auxiliary_device *adev, bool link_up) struct unic_dev *unic_dev = dev_get_drvdata(&adev->dev); struct net_device *netdev = unic_dev->comdev.netdev; - if (!netif_running(netdev)) - return; - if (unic_dev_ubl_supported(unic_dev)) unic_ub_port_reset(unic_dev, link_up); else diff --git a/drivers/net/ub/unic/unic_reset.c b/drivers/net/ub/unic/unic_reset.c index 6946e8976da0..a0a8bf625993 100644 --- a/drivers/net/ub/unic/unic_reset.c +++ b/drivers/net/ub/unic/unic_reset.c @@ -23,7 +23,6 @@ static void unic_reset_down(struct auxiliary_device *adev) { struct unic_dev *priv = (struct unic_dev *)dev_get_drvdata(&adev->dev); struct net_device *netdev = priv->comdev.netdev; - bool if_running; int ret; if (!test_bit(UNIC_STATE_INITED, &priv->state) || @@ -33,7 +32,6 @@ static void unic_reset_down(struct auxiliary_device *adev) } set_bit(UNIC_STATE_RESETTING, &priv->state); - if_running = netif_running(netdev); unic_info(priv, "unic reset start.\n"); @@ -53,7 +51,7 @@ static void unic_reset_down(struct auxiliary_device *adev) set_bit(UNIC_VPORT_STATE_PROMISC_CHANGE, &priv->vport.state); rtnl_lock(); - ret = if_running ? unic_net_stop(netdev) : 0; + ret = netif_running(netdev) ? unic_net_stop(netdev) : 0; rtnl_unlock(); if (ret) unic_err(priv, "failed to stop unic net, ret = %d.\n", ret); @@ -84,7 +82,6 @@ static void unic_reset_init(struct auxiliary_device *adev) { struct unic_dev *priv = (struct unic_dev *)dev_get_drvdata(&adev->dev); struct net_device *netdev = priv->comdev.netdev; - bool if_running; int ret; if (!test_bit(UNIC_STATE_RESETTING, &priv->state)) @@ -97,11 +94,10 @@ static void unic_reset_init(struct auxiliary_device *adev) unic_query_ip_addr(adev); unic_start_period_task(netdev); - if_running = netif_running(netdev); clear_bit(UNIC_STATE_RESETTING, &priv->state); clear_bit(UNIC_STATE_DISABLED, &priv->state); rtnl_lock(); - ret = if_running ? unic_net_open(netdev) : 0; + ret = netif_running(netdev) ? unic_net_open(netdev) : 0; rtnl_unlock(); if (ret) unic_err(priv, "failed to up net, ret = %d.\n", ret); -- Gitee From f9f7e0c614630b5b2fa86e18fd7a52cd1e2a99f9 Mon Sep 17 00:00:00 2001 From: Guangwei Zhang Date: Fri, 12 Dec 2025 17:41:40 +0800 Subject: [PATCH 2/2] ub: ubase: CtrlQ retry message uses the same seq drivers inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID7LHB CVE: NA --------------------------------------------------------------- This patch changes the sequence number for retransmission upon ctrlq timeout to be the same as the original sequence number. Fixes: d7ce08663cc5 ("ub: ubase: Supports for ctrl queue management.") Signed-off-by: Guangwei Zhang --- drivers/ub/ubase/ubase_cmd.h | 2 +- drivers/ub/ubase/ubase_ctrlq.c | 124 ++++++++++++++++-------------- drivers/ub/ubase/ubase_ctrlq.h | 2 + include/ub/ubase/ubase_comm_dev.h | 34 ++++---- 4 files changed, 85 insertions(+), 77 deletions(-) diff --git a/drivers/ub/ubase/ubase_cmd.h b/drivers/ub/ubase/ubase_cmd.h index ae34dccfdd01..d6f2def22117 100644 --- a/drivers/ub/ubase/ubase_cmd.h +++ b/drivers/ub/ubase/ubase_cmd.h @@ -14,7 +14,7 @@ #define UBASE_CMDQ_DESC_NUM_S 3 #define UBASE_CMDQ_DESC_NUM 1024 #define UBASE_CMDQ_TX_TIMEOUT 300000 -#define UBASE_CMDQ_MBX_TX_TIMEOUT 50 +#define UBASE_CMDQ_MBX_TX_TIMEOUT 500 #define UBASE_CMDQ_CLEAR_WAIT_TIME 200 #define UBASE_CMDQ_WAIT_TIME 10 diff --git a/drivers/ub/ubase/ubase_ctrlq.c b/drivers/ub/ubase/ubase_ctrlq.c index 5f6b6cf2559e..34a36843a5f6 100644 --- a/drivers/ub/ubase/ubase_ctrlq.c +++ b/drivers/ub/ubase/ubase_ctrlq.c @@ -554,11 +554,31 @@ static void ubase_ctrlq_send_to_csq(struct ubase_dev *udev, ubase_ctrlq_csq_report_irq(udev); } +static int ubase_ctrlq_check_csq_enough(struct ubase_dev *udev, u16 num) +{ + struct ubase_ctrlq_ring *csq = &udev->ctrlq.csq; + + csq->ci = (u16)ubase_read_dev(&udev->hw, UBASE_CTRLQ_CSQ_HEAD_REG); + if (num > ubase_ctrlq_remain_space(udev)) { + ubase_warn(udev, + "no enough space in ctrlq, ci = %u, num = %u.\n", + csq->ci, num); + return -EBUSY; + } + + return 0; +} + static int ubase_ctrlq_send_msg_to_sq(struct ubase_dev *udev, struct ubase_ctrlq_base_block *head, struct ubase_ctrlq_msg *msg, u8 num) { + int ret; + if (ubase_dev_ctrlq_supported(udev)) { + ret = ubase_ctrlq_check_csq_enough(udev, num); + if (ret) + return ret; ubase_ctrlq_send_to_csq(udev, head, msg, num); return 0; } @@ -710,19 +730,19 @@ static int ubase_ctrlq_msg_check(struct ubase_dev *udev, return -EINVAL; } -static int ubase_ctrlq_check_csq_enough(struct ubase_dev *udev, u16 num) +static int ubase_ctrlq_check_send_state(struct ubase_dev *udev, + struct ubase_ctrlq_msg *msg) { - struct ubase_ctrlq_ring *csq = &udev->ctrlq.csq; - - if (!ubase_dev_ctrlq_supported(udev)) - return 0; + if (udev->reset_stage == UBASE_RESET_STAGE_UNINIT && + !(msg->opcode == UBASE_CTRLQ_OPC_CTRLQ_CTRL && + msg->service_type == UBASE_CTRLQ_SER_TYPE_DEV_REGISTER)) { + ubase_dbg(udev, "ctrlq send is disabled.\n"); + return -EAGAIN; + } - csq->ci = (u16)ubase_read_dev(&udev->hw, UBASE_CTRLQ_CSQ_HEAD_REG); - if (num > ubase_ctrlq_remain_space(udev)) { - ubase_warn(udev, - "no enough space in ctrlq, ci = %u, num = %u.\n", - csq->ci, num); - return -EBUSY; + if (!test_bit(UBASE_CTRLQ_STATE_ENABLE, &udev->ctrlq.state)) { + ubase_warn(udev, "ctrlq is disabled in csq.\n"); + return -EAGAIN; } return 0; @@ -730,26 +750,22 @@ static int ubase_ctrlq_check_csq_enough(struct ubase_dev *udev, u16 num) static int ubase_ctrlq_send_real(struct ubase_dev *udev, struct ubase_ctrlq_msg *msg, + u16 num, struct ubase_ctrlq_ue_info *ue_info) { struct ubase_ctrlq_ring *csq = &udev->ctrlq.csq; struct ubase_ctrlq_base_block head = {0}; - u16 seq, num; + u16 seq, retry = 0; int ret; - num = ubase_ctrlq_calc_bb_num(msg->in_size); - spin_lock_bh(&csq->lock); - ret = ubase_ctrlq_check_csq_enough(udev, num); - if (ret) - goto unlock; - if (!ubase_ctrlq_msg_is_resp(msg)) { ret = ubase_ctrlq_alloc_seq(udev, msg, &seq); if (ret) { ubase_warn(udev, "no enough seq in ctrlq.\n"); - goto unlock; + spin_unlock_bh(&csq->lock); + return ret; } } else { seq = msg->resp_seq; @@ -757,21 +773,32 @@ static int ubase_ctrlq_send_real(struct ubase_dev *udev, ubase_ctrlq_addto_msg_queue(udev, seq, msg, ue_info); + spin_unlock_bh(&csq->lock); + head.bb_num = num; head.seq = cpu_to_le16(seq); ubase_ctrlq_fill_first_bb(udev, &head, msg, ue_info); - ret = ubase_ctrlq_send_msg_to_sq(udev, &head, msg, num); - if (ret) { - spin_unlock_bh(&csq->lock); - if (!ubase_ctrlq_msg_is_resp(msg)) - ubase_ctrlq_free_seq(udev, seq); - return ret; - } - spin_unlock_bh(&csq->lock); + do { + if (retry) { + msleep(UBASE_CTRLQ_RETRY_INTERVAL); + ubase_info(udev, "Ctrlq send msg retry = %u.\n", retry); + } - if (ubase_ctrlq_msg_is_sync_req(msg)) - ret = ubase_ctrlq_wait_completed(udev, seq, msg); + ret = ubase_ctrlq_check_send_state(udev, msg); + if (ret) + goto free_seq; + spin_lock_bh(&csq->lock); + ret = ubase_ctrlq_send_msg_to_sq(udev, &head, msg, num); + spin_unlock_bh(&csq->lock); + if (ret == -ETIMEDOUT) + continue; + else if (ret) + goto free_seq; + + if (ubase_ctrlq_msg_is_sync_req(msg)) + ret = ubase_ctrlq_wait_completed(udev, seq, msg); + } while (ret == -ETIMEDOUT && retry++ < UBASE_CTRLQ_RETRY_TIMES); if (ubase_ctrlq_msg_is_sync_req(msg) || ubase_ctrlq_msg_is_notify_req(msg)) @@ -779,48 +806,27 @@ static int ubase_ctrlq_send_real(struct ubase_dev *udev, return ret; -unlock: - spin_unlock_bh(&csq->lock); +free_seq: + if (!ubase_ctrlq_msg_is_resp(msg)) + ubase_ctrlq_free_seq(udev, seq); return ret; } int __ubase_ctrlq_send(struct ubase_dev *udev, struct ubase_ctrlq_msg *msg, struct ubase_ctrlq_ue_info *ue_info) { -#define UBASE_CTRLQ_RETRY_TIMES 3 -#define UBASE_RETRY_INTERVAL 100 - - int ret, retry_cnt = 0; + int ret; + u16 num; ret = ubase_ctrlq_msg_check(udev, msg); if (ret) return ret; - while (retry_cnt++ <= UBASE_CTRLQ_RETRY_TIMES) { - if (udev->reset_stage == UBASE_RESET_STAGE_UNINIT && - !(msg->opcode == UBASE_CTRLQ_OPC_CTRLQ_CTRL && - msg->service_type == UBASE_CTRLQ_SER_TYPE_DEV_REGISTER)) { - ubase_dbg(udev, "ctrlq send is disabled.\n"); - return -EAGAIN; - } - - if (!test_bit(UBASE_CTRLQ_STATE_ENABLE, &udev->ctrlq.state)) { - ubase_warn(udev, "ctrlq is disabled in csq.\n"); - return -EAGAIN; - } + num = ubase_ctrlq_calc_bb_num(msg->in_size); - atomic_inc(&udev->ctrlq.req_cnt); - ret = ubase_ctrlq_send_real(udev, msg, ue_info); - atomic_dec(&udev->ctrlq.req_cnt); - if (ret == -ETIMEDOUT && retry_cnt <= UBASE_CTRLQ_RETRY_TIMES) { - ubase_info(udev, - "Ctrlq send msg retry, retry cnt = %d.\n", - retry_cnt); - msleep(UBASE_RETRY_INTERVAL); - } else { - break; - } - } + atomic_inc(&udev->ctrlq.req_cnt); + ret = ubase_ctrlq_send_real(udev, msg, num, ue_info); + atomic_dec(&udev->ctrlq.req_cnt); return ret; } diff --git a/drivers/ub/ubase/ubase_ctrlq.h b/drivers/ub/ubase/ubase_ctrlq.h index e56728e4baae..93960c181e3b 100644 --- a/drivers/ub/ubase/ubase_ctrlq.h +++ b/drivers/ub/ubase/ubase_ctrlq.h @@ -21,6 +21,8 @@ #define UBASE_CTRLQ_DEAD_TIME 40000 #define UBASE_CTRLQ_CHAN_DISABLE_OPC 0x1 #define UBASE_CTRL_PLANE_INIT_RES BIT(0) +#define UBASE_CTRLQ_RETRY_TIMES 3 +#define UBASE_CTRLQ_RETRY_INTERVAL 100 enum ubase_ctrlq_state { UBASE_CTRLQ_STATE_ENABLE, diff --git a/include/ub/ubase/ubase_comm_dev.h b/include/ub/ubase/ubase_comm_dev.h index fbec3624c87b..6006019d4b8c 100644 --- a/include/ub/ubase/ubase_comm_dev.h +++ b/include/ub/ubase/ubase_comm_dev.h @@ -245,26 +245,26 @@ struct ubase_resource_space { /** * struct ubase_adev_qos - ubase auxiliary device qos information - * @rdma_tp_vl_num: rdma tp vl number - * @rdma_ctp_vl_num: rdma ctp vl number - * @rdma_tp_resp_vl_offset: rdma tp response vl offset, - * rdma_tp_resp_vl = rdma_ctp_resp_vl + rdma_tp_resp_vl_offset - * @rdma_ctp_resp_vl_offset: rdma ctp response vl offset, - * rdma_ctp_resp_vl = rdma_ctp_resp_vl + rdma_ctp_resp_vl_offset - * @max_vl: max vl number - * @resv: reserved bits - * @rdma_tp_sl_num: rdma tp sl number - * @rdma_ctp_sl_num: rdma ctp sl number + * @tp_sl_num: tp sl number + * @tp_sl: tp sl + * @ctp_sl_num: ctp sl number + * @ctp_sl: ctp sl + * @tp_vl_num: tp vl number + * + * @tp_resp_vl_offset: tp response vl offset, + * tp_resp_vl = tp_resp_vl + tp_resp_vl_offset + * @tp_req_vl: tp request number + * @ctp_vl_num: ctp vl number + * @ctp_resp_vl_offset: ctp response vl offset, + * ctp_resp_vl = ctp_resp_vl + ctp_resp_vl_offset + * @ctp_req_vl: ctp request vl + * @dscp_vl: dscp to vl mapping * @nic_sl_num: nic sl number - * @nic_vl_num: nic vl number - * @rdma_tp_req_vl: rdma tp request vl - * @rdma_ctp_req_vl: rdma ctp request vl - * @rdma_tp_sl: rdma tp sl - * @rdma_ctp_sl: rdma ctp sl * @nic_sl: nic sl + * @nic_vl_num: nic vl number * @nic_vl: nic vl - * @sl_vl: sl to vl mapping - * @rdma_dscp_vl: rdma dscp to vl mapping + * @ue_max_vl_id: ue max vl index + * @ue_sl_vl: ue sl to vl mapping */ struct ubase_adev_qos { /* udma/cdma resource */ -- Gitee