October 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
by Long Li 28 Oct '24

28 Oct '24

From: Li Zhijian <lizhijian(a)fujitsu.com> mainline inclusion from mainline-v6.10-rc2 commit 7f7b850689ac06a62befe26e1fd1806799e7f152 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAZ CVE: CVE-2024-49934 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- It's observed that a crash occurs during hot-remove a memory device, in which user is accessing the hugetlb. See calltrace as following: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 14045 at arch/x86/mm/fault.c:1278 do_user_addr_fault+0x2a0/0x790 Modules linked in: kmem device_dax cxl_mem cxl_pmem cxl_port cxl_pci dax_hmem dax_pmem nd_pmem cxl_acpi nd_btt cxl_core crc32c_intel nvme virtiofs fuse nvme_core nfit libnvdimm dm_multipath scsi_dh_rdac scsi_dh_emc s mirror dm_region_hash dm_log dm_mod CPU: 1 PID: 14045 Comm: daxctl Not tainted 6.10.0-rc2-lizhijian+ #492 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:do_user_addr_fault+0x2a0/0x790 Code: 48 8b 00 a8 04 0f 84 b5 fe ff ff e9 1c ff ff ff 4c 89 e9 4c 89 e2 be 01 00 00 00 bf 02 00 00 00 e8 b5 ef 24 00 e9 42 fe ff ff <0f> 0b 48 83 c4 08 4c 89 ea 48 89 ee 4c 89 e7 5b 5d 41 5c 41 5d 41 RSP: 0000:ffffc90000a575f0 EFLAGS: 00010046 RAX: ffff88800c303600 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000001000 RSI: ffffffff82504162 RDI: ffffffff824b2c36 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffc90000a57658 R13: 0000000000001000 R14: ffff88800bc2e040 R15: 0000000000000000 FS: 00007f51cb57d880(0000) GS:ffff88807fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000001000 CR3: 00000000072e2004 CR4: 00000000001706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __warn+0x8d/0x190 ? do_user_addr_fault+0x2a0/0x790 ? report_bug+0x1c3/0x1d0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? do_user_addr_fault+0x2a0/0x790 ? exc_page_fault+0x31/0x200 exc_page_fault+0x68/0x200 <...snip...> BUG: unable to handle page fault for address: 0000000000001000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 800000000ad92067 P4D 800000000ad92067 PUD 7677067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI ---[ end trace 0000000000000000 ]--- BUG: unable to handle page fault for address: 0000000000001000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 800000000ad92067 P4D 800000000ad92067 PUD 7677067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 14045 Comm: daxctl Kdump: loaded Tainted: G W 6.10.0-rc2-lizhijian+ #492 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:dentry_name+0x1f4/0x440 <...snip...> ? dentry_name+0x2fa/0x440 vsnprintf+0x1f3/0x4f0 vprintk_store+0x23a/0x540 vprintk_emit+0x6d/0x330 _printk+0x58/0x80 dump_mapping+0x10b/0x1a0 ? __pfx_free_object_rcu+0x10/0x10 __dump_page+0x26b/0x3e0 ? vprintk_emit+0xe0/0x330 ? _printk+0x58/0x80 ? dump_page+0x17/0x50 dump_page+0x17/0x50 do_migrate_range+0x2f7/0x7f0 ? do_migrate_range+0x42/0x7f0 ? offline_pages+0x2f4/0x8c0 offline_pages+0x60a/0x8c0 memory_subsys_offline+0x9f/0x1c0 ? lockdep_hardirqs_on+0x77/0x100 ? _raw_spin_unlock_irqrestore+0x38/0x60 device_offline+0xe3/0x110 state_store+0x6e/0xc0 kernfs_fop_write_iter+0x143/0x200 vfs_write+0x39f/0x560 ksys_write+0x65/0xf0 do_syscall_64+0x62/0x130 Previously, some sanity check have been done in dump_mapping() before the print facility parsing '%pd' though, it's still possible to run into an invalid dentry.d_name.name. Since dump_mapping() only needs to dump the filename only, retrieve it by itself in a safer way to prevent an unnecessary crash. Note that either retrieving the filename with '%pd' or strncpy_from_kernel_nofault(), the filename could be unreliable. Signed-off-by: Li Zhijian <lizhijian(a)fujitsu.com> Link: https://lore.kernel.org/r/20240826055503.1522320-1-lizhijian@fujitsu.com Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Conflicts: mm/debug.c [Conflicts due to not merged 3e9d80a891df ("mm,fs: split dump_mapping() out from dump_page()")] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- mm/debug.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/mm/debug.c b/mm/debug.c index 6ead410ec389..22abce837b71 100644 --- a/mm/debug.c +++ b/mm/debug.c @@ -120,6 +120,7 @@ void __dump_page(struct page *page, const char *reason) struct hlist_node *dentry_first; struct dentry *dentry_ptr; struct dentry dentry; + char fname[64] = {}; unsigned long ino; /* @@ -155,13 +156,14 @@ void __dump_page(struct page *page, const char *reason) pr_warn("aops:%ps ino:%lx with invalid dentry %px\n", a_ops, ino, dentry_ptr); } else { + if (strncpy_from_kernel_nofault(fname, dentry.d_name.name, 63) < 0) + strscpy(fname, "<invalid>", sizeof(fname)); /* - * if dentry is corrupted, the %pd handler may still - * crash, but it's unlikely that we reach here with a - * corrupted struct page + * Even if strncpy_from_kernel_nofault() succeeded, + * the fname could be unreliable */ - pr_warn("aops:%ps ino:%lx dentry name:\"%pd\"\n", - a_ops, ino, &dentry); + pr_warn("aops:%ps ino:%lx dentry name(?):\"%s\"\n", + a_ops, ino, fname); } } out_mapping: -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1
by Luo Gengkun 28 Oct '24

28 Oct '24

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v6.1-rc7 commit 05530ef7cf7c7d700f6753f058999b1b5099a026 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRDZ CVE: CVE-2022-48994 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. seq_copy_in_user() and seq_copy_in_kernel() did not have prototypes matching snd_seq_dump_func_t. Adjust this and remove the casts. There are not resulting binary output differences. This was found as a result of Clang's new -Wcast-function-type-strict flag, which is more sensitive than the simpler -Wcast-function-type, which only checks for type width mismatches. Reported-by: kernel test robot <lkp(a)intel.com> Link: https://lore.kernel.org/lkml/202211041527.HD8TLSE1-lkp@intel.com Cc: Jaroslav Kysela <perex(a)perex.cz> Cc: Takashi Iwai <tiwai(a)suse.com> Cc: "Gustavo A. R. Silva" <gustavoars(a)kernel.org> Cc: alsa-devel(a)alsa-project.org Signed-off-by: Kees Cook <keescook(a)chromium.org> Link: https://lore.kernel.org/r/20221118232346.never.380-kees@kernel.org Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Luo Gengkun <luogengkun(a)huaweicloud.com> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- sound/core/seq/seq_memory.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c index 65db1a7c77b7..bb76a2dd0a2f 100644 --- a/sound/core/seq/seq_memory.c +++ b/sound/core/seq/seq_memory.c @@ -112,15 +112,19 @@ EXPORT_SYMBOL(snd_seq_dump_var_event); * expand the variable length event to linear buffer space. */ -static int seq_copy_in_kernel(char **bufptr, const void *src, int size) +static int seq_copy_in_kernel(void *ptr, void *src, int size) { + char **bufptr = ptr; + memcpy(*bufptr, src, size); *bufptr += size; return 0; } -static int seq_copy_in_user(char __user **bufptr, const void *src, int size) +static int seq_copy_in_user(void *ptr, void *src, int size) { + char __user **bufptr = ptr; + if (copy_to_user(*bufptr, src, size)) return -EFAULT; *bufptr += size; @@ -149,8 +153,7 @@ int snd_seq_expand_var_event(const struct snd_seq_event *event, int count, char return newlen; } err = snd_seq_dump_var_event(event, - in_kernel ? (snd_seq_dump_func_t)seq_copy_in_kernel : - (snd_seq_dump_func_t)seq_copy_in_user, + in_kernel ? seq_copy_in_kernel : seq_copy_in_user, &buf); return err < 0 ? err : newlen; } -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
by Luo Gengkun 28 Oct '24

28 Oct '24

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v6.1-rc7 commit 05530ef7cf7c7d700f6753f058999b1b5099a026 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRDZ CVE: CVE-2022-48994 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. seq_copy_in_user() and seq_copy_in_kernel() did not have prototypes matching snd_seq_dump_func_t. Adjust this and remove the casts. There are not resulting binary output differences. This was found as a result of Clang's new -Wcast-function-type-strict flag, which is more sensitive than the simpler -Wcast-function-type, which only checks for type width mismatches. Reported-by: kernel test robot <lkp(a)intel.com> Link: https://lore.kernel.org/lkml/202211041527.HD8TLSE1-lkp@intel.com Cc: Jaroslav Kysela <perex(a)perex.cz> Cc: Takashi Iwai <tiwai(a)suse.com> Cc: "Gustavo A. R. Silva" <gustavoars(a)kernel.org> Cc: alsa-devel(a)alsa-project.org Signed-off-by: Kees Cook <keescook(a)chromium.org> Link: https://lore.kernel.org/r/20221118232346.never.380-kees@kernel.org Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Luo Gengkun <luogengkun(a)huaweicloud.com> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- sound/core/seq/seq_memory.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c index 5b0388202bac..ac854beb8347 100644 --- a/sound/core/seq/seq_memory.c +++ b/sound/core/seq/seq_memory.c @@ -126,15 +126,19 @@ EXPORT_SYMBOL(snd_seq_dump_var_event); * expand the variable length event to linear buffer space. */ -static int seq_copy_in_kernel(char **bufptr, const void *src, int size) +static int seq_copy_in_kernel(void *ptr, void *src, int size) { + char **bufptr = ptr; + memcpy(*bufptr, src, size); *bufptr += size; return 0; } -static int seq_copy_in_user(char __user **bufptr, const void *src, int size) +static int seq_copy_in_user(void *ptr, void *src, int size) { + char __user **bufptr = ptr; + if (copy_to_user(*bufptr, src, size)) return -EFAULT; *bufptr += size; @@ -163,8 +167,7 @@ int snd_seq_expand_var_event(const struct snd_seq_event *event, int count, char return newlen; } err = snd_seq_dump_var_event(event, - in_kernel ? (snd_seq_dump_func_t)seq_copy_in_kernel : - (snd_seq_dump_func_t)seq_copy_in_user, + in_kernel ? seq_copy_in_kernel : seq_copy_in_user, &buf); return err < 0 ? err : newlen; } -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 18194/23866] include/linux/uaccess.h:112:17: warning: 'spallocinfo' may be used uninitialized
by kernel test robot 28 Oct '24

28 Oct '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 22c50245e8025b0c6beee13d0df238987b98e6f8 commit: 9469d1759c2905dcef49df7e6240ad5c32b66296 [18194/23866] ascend: share_pool: enable svm to use share pool memory config: arm64-randconfig-004-20241027 (https://download.01.org/0day-ci/archive/20241028/202410281052.z4Ng6x4J-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241028/202410281052.z4Ng6x4J-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410281052.z4Ng6x4J-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): drivers/char/svm.c:249:21: warning: no previous prototype for 'svm_find_mem_reg_node' [-Wmissing-prototypes] 249 | struct device_node *svm_find_mem_reg_node(struct device *dev, const char *compat) | ^~~~~~~~~~~~~~~~~~~~~ drivers/char/svm.c:419:6: warning: no previous prototype for 'sysrq_sched_debug_show_export' [-Wmissing-prototypes] 419 | void sysrq_sched_debug_show_export(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/char/svm.c:1429:5: warning: no previous prototype for 'svm_get_pasid' [-Wmissing-prototypes] 1429 | int svm_get_pasid(pid_t vpid, int dev_id __maybe_unused) | ^~~~~~~~~~~~~ drivers/char/svm.c:1502:5: warning: no previous prototype for '__svm_get_mpam' [-Wmissing-prototypes] 1502 | int __svm_get_mpam(struct svm_mpam *mpam) | ^~~~~~~~~~~~~~ drivers/char/svm.c:2437:36: warning: 'svm_acpi_match' defined but not used [-Wunused-const-variable=] 2437 | static const struct acpi_device_id svm_acpi_match[] = { | ^~~~~~~~~~~~~~ In file included from drivers/char/svm.c:29: In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'svm_sp_alloc_mem' at drivers/char/svm.c:2144:8: >> include/linux/uaccess.h:112:17: warning: 'spallocinfo' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler.h:251, from arch/arm64/include/asm/memory.h:24, from arch/arm64/include/asm/esr.h:21, from drivers/char/svm.c:10: include/linux/kasan-checks.h: In function 'svm_sp_alloc_mem': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/char/svm.c:2135:24: note: 'spallocinfo' declared here 2135 | struct spalloc spallocinfo; | ^~~~~~~~~~~ In file included from arch/arm64/include/asm/atomic.h:34, from include/linux/atomic.h:7, from include/asm-generic/bitops/atomic.h:5, from arch/arm64/include/asm/bitops.h:37, from include/linux/bitops.h:19, from include/linux/kernel.h:11, from include/asm-generic/bug.h:18, from arch/arm64/include/asm/bug.h:37, from arch/arm64/include/asm/memory.h:27: In function '__cmpxchg_case_mb_4', inlined from '__cmpxchg_mb' at arch/arm64/include/asm/cmpxchg.h:143:1, inlined from 'svm_proc_load_flag' at drivers/char/svm.c:1967:12: arch/arm64/include/asm/atomic_lse.h:492:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'atomic_t[1]' [-Warray-bounds=] 492 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_lse.h:523:1: note: in expansion of macro '__CMPXCHG_CASE' 523 | __CMPXCHG_CASE(w, , mb_4, al, "memory") | ^~~~~~~~~~~~~~ drivers/char/svm.c: In function 'svm_proc_load_flag': drivers/char/svm.c:1958:25: note: object 'l2buf_load_flag' of size 4 1958 | static atomic_t l2buf_load_flag = ATOMIC_INIT(0); | ^~~~~~~~~~~~~~~ In function '__cmpxchg_case_mb_4', inlined from '__cmpxchg_mb' at arch/arm64/include/asm/cmpxchg.h:143:1, inlined from 'svm_proc_load_flag' at drivers/char/svm.c:1967:12: arch/arm64/include/asm/atomic_lse.h:492:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'atomic_t[1]' [-Warray-bounds=] 492 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_lse.h:523:1: note: in expansion of macro '__CMPXCHG_CASE' 523 | __CMPXCHG_CASE(w, , mb_4, al, "memory") | ^~~~~~~~~~~~~~ drivers/char/svm.c: In function 'svm_proc_load_flag': drivers/char/svm.c:1958:25: note: object 'l2buf_load_flag' of size 4 1958 | static atomic_t l2buf_load_flag = ATOMIC_INIT(0); | ^~~~~~~~~~~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'svm_get_phy_memory_info' at drivers/char/svm.c:1805:6: include/linux/uaccess.h:112:17: warning: 'para' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'svm_get_phy_memory_info': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/char/svm.c:1800:33: note: 'para' declared here 1800 | struct phymeminfo_ioctl para; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'svm_remap_proc' at drivers/char/svm.c:1863:8: include/linux/uaccess.h:112:17: warning: 'pmem' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'svm_remap_proc': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/char/svm.c:1849:29: note: 'pmem' declared here 1849 | struct svm_proc_mem pmem; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'svm_ioctl' at drivers/char/svm.c:2217:9: include/linux/uaccess.h:112:17: warning: 'params' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'svm_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/char/svm.c:2209:33: note: 'params' declared here 2209 | struct svm_bind_process params; | ^~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'svm_sp_free_mem' at drivers/char/svm.c:2179:8, inlined from 'svm_ioctl' at drivers/char/svm.c:2280:9: >> include/linux/uaccess.h:112:17: warning: 'spallocinfo' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'svm_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/char/svm.c:2172:24: note: 'spallocinfo' declared here 2172 | struct spalloc spallocinfo; | ^~~~~~~~~~~ vim +/spallocinfo +112 include/linux/uaccess.h d597580d373774 Al Viro 2017-03-20 104 d597580d373774 Al Viro 2017-03-20 105 #ifdef INLINE_COPY_FROM_USER d597580d373774 Al Viro 2017-03-20 106 static inline unsigned long d597580d373774 Al Viro 2017-03-20 107 _copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774 Al Viro 2017-03-20 108 { d597580d373774 Al Viro 2017-03-20 109 unsigned long res = n; 9c5f6908de03a4 Al Viro 2017-06-29 110 might_fault(); 4983cb67a383a7 Linus Torvalds 2019-02-14 111 if (likely(access_ok(from, n))) { 9c5f6908de03a4 Al Viro 2017-06-29 @112 kasan_check_write(to, n); d597580d373774 Al Viro 2017-03-20 113 res = raw_copy_from_user(to, from, n); 9c5f6908de03a4 Al Viro 2017-06-29 114 } d597580d373774 Al Viro 2017-03-20 115 if (unlikely(res)) d597580d373774 Al Viro 2017-03-20 116 memset(to + (n - res), 0, res); d597580d373774 Al Viro 2017-03-20 117 return res; d597580d373774 Al Viro 2017-03-20 118 } d597580d373774 Al Viro 2017-03-20 119 #else d597580d373774 Al Viro 2017-03-20 120 extern unsigned long d597580d373774 Al Viro 2017-03-20 121 _copy_from_user(void *, const void __user *, unsigned long); d597580d373774 Al Viro 2017-03-20 122 #endif d597580d373774 Al Viro 2017-03-20 123 :::::: The code at line 112 was first introduced by commit :::::: 9c5f6908de03a4f52ba7364b11fcd6116225480c copy_{from,to}_user(): move kasan checks and might_fault() out-of-line :::::: TO: Al Viro <viro(a)zeniv.linux.org.uk> :::::: CC: Al Viro <viro(a)zeniv.linux.org.uk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/3] Fix TX fifo corruption in patch [3].
by Zhao Yipeng 28 Oct '24

28 Oct '24

Patch [1-2] are pre patches. Patch [3] fix TX fifo corruption. Hugo Villeneuve (2): [Backport] serial: sc16is7xx: refactor FIFO access functions to increase commonality [Backport] serial: sc16is7xx: fix TX fifo corruption Jiri Slaby (SUSE) (1): [Backport] kfifo: add kfifo_out_linear{,_ptr}() drivers/tty/serial/sc16is7xx.c | 67 ++++++++++++++-------------------- include/linux/kfifo.h | 63 ++++++++++++++++++++++++++++++++ lib/kfifo.c | 26 +++++++++++++ 3 files changed, 117 insertions(+), 39 deletions(-) -- 2.34.1

2 4

[openeuler:OLK-5.10 28837/30000] drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c:1195:5: warning: no previous prototype for 'hclge_tm_vf_tc_dwrr_cfg'
by kernel test robot 28 Oct '24

28 Oct '24

Hi Hao, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 412556141b3c12f2f160acc3a09a40c937837ee3 commit: 518ea89ec98b78c749c27d6ba7792e1bdb5779ed [28837/30000] net: hns3: add support for vf multiple tcs config: arm64-defconfig (https://download.01.org/0day-ci/archive/20241028/202410280946.pPdl5dH4-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241028/202410280946.pPdl5dH4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410280946.pPdl5dH4-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c:1195:5: warning: no previous prototype for 'hclge_tm_vf_tc_dwrr_cfg' [-Wmissing-prototypes] 1195 | int hclge_tm_vf_tc_dwrr_cfg(struct hclge_vport *vport) | ^~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c:2323:5: warning: no previous prototype for 'hclge_mbx_set_vf_multi_tc' [-Wmissing-prototypes] 2323 | int hclge_mbx_set_vf_multi_tc(struct hclge_vport *vport, | ^~~~~~~~~~~~~~~~~~~~~~~~~ vim +/hclge_tm_vf_tc_dwrr_cfg +1195 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c 1194 > 1195 int hclge_tm_vf_tc_dwrr_cfg(struct hclge_vport *vport) 1196 { 1197 struct hnae3_knic_private_info *kinfo = &vport->nic.kinfo; 1198 struct hclge_dev *hdev = vport->back; 1199 struct hclge_pg_info *pg_info; 1200 u8 dwrr; 1201 int ret; 1202 u32 i; 1203 1204 for (i = 0; i < kinfo->tc_info.max_tc; i++) { 1205 pg_info = &hdev->tm_info.pg_info[hdev->tm_info.tc_info[i].pgid]; 1206 dwrr = i < kinfo->tc_info.num_tc ? pg_info->tc_dwrr[i] : 0; 1207 ret = hclge_tm_qs_weight_cfg(hdev, vport->qs_offset + i, dwrr); 1208 if (ret) 1209 return ret; 1210 } 1211 1212 return 0; 1213 } 1214 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 15692/23866] include/linux/uaccess.h:112:17: warning: 'ciov' may be used uninitialized
by kernel test robot 28 Oct '24

28 Oct '24

Hi Jens, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 22c50245e8025b0c6beee13d0df238987b98e6f8 commit: 6c08191286995b0594d2ecf12fe7fca3cea1a5ca [15692/23866] io_uring: add support for pre-mapped user IO buffers config: arm64-randconfig-004-20241027 (https://download.01.org/0day-ci/archive/20241028/202410280718.cUYy6LpU-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241028/202410280718.cUYy6LpU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410280718.cUYy6LpU-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In file included from include/linux/poll.h:12, from include/linux/ring_buffer.h:7, from include/linux/trace_events.h:6, from include/trace/syscall.h:7, from include/linux/syscalls.h:86, from fs/io_uring.c:32: In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'io_copy_iov.isra' at fs/io_uring.c:1457:7: >> include/linux/uaccess.h:112:17: warning: 'ciov' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler.h:251, from include/linux/kernel.h:10, from fs/io_uring.c:29: include/linux/kasan-checks.h: In function 'io_copy_iov.isra': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ fs/io_uring.c:1454:37: note: 'ciov' declared here 1454 | struct compat_iovec ciov; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'io_uring_setup' at fs/io_uring.c:1960:6: include/linux/uaccess.h:112:17: warning: 'p' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'io_uring_setup': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ fs/io_uring.c:1956:32: note: 'p' declared here 1956 | struct io_uring_params p; | ^ In file included from include/linux/uaccess.h:11: In function 'set_fs', inlined from 'io_sq_wq_submit_work' at fs/io_uring.c:1114:3: arch/arm64/include/asm/uaccess.h:59:12: warning: 'old_fs' may be used uninitialized [-Wmaybe-uninitialized] 59 | if (IS_ENABLED(CONFIG_ARM64_UAO) && fs == KERNEL_DS) | ^ fs/io_uring.c: In function 'io_sq_wq_submit_work': fs/io_uring.c:1074:22: note: 'old_fs' was declared here 1074 | mm_segment_t old_fs; | ^~~~~~ vim +/ciov +112 include/linux/uaccess.h d597580d373774b Al Viro 2017-03-20 104 d597580d373774b Al Viro 2017-03-20 105 #ifdef INLINE_COPY_FROM_USER d597580d373774b Al Viro 2017-03-20 106 static inline unsigned long d597580d373774b Al Viro 2017-03-20 107 _copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774b Al Viro 2017-03-20 108 { d597580d373774b Al Viro 2017-03-20 109 unsigned long res = n; 9c5f6908de03a4f Al Viro 2017-06-29 110 might_fault(); 4983cb67a383a73 Linus Torvalds 2019-02-14 111 if (likely(access_ok(from, n))) { 9c5f6908de03a4f Al Viro 2017-06-29 @112 kasan_check_write(to, n); d597580d373774b Al Viro 2017-03-20 113 res = raw_copy_from_user(to, from, n); 9c5f6908de03a4f Al Viro 2017-06-29 114 } d597580d373774b Al Viro 2017-03-20 115 if (unlikely(res)) d597580d373774b Al Viro 2017-03-20 116 memset(to + (n - res), 0, res); d597580d373774b Al Viro 2017-03-20 117 return res; d597580d373774b Al Viro 2017-03-20 118 } d597580d373774b Al Viro 2017-03-20 119 #else d597580d373774b Al Viro 2017-03-20 120 extern unsigned long d597580d373774b Al Viro 2017-03-20 121 _copy_from_user(void *, const void __user *, unsigned long); d597580d373774b Al Viro 2017-03-20 122 #endif d597580d373774b Al Viro 2017-03-20 123 d597580d373774b Al Viro 2017-03-20 124 #ifdef INLINE_COPY_TO_USER d597580d373774b Al Viro 2017-03-20 125 static inline unsigned long d597580d373774b Al Viro 2017-03-20 126 _copy_to_user(void __user *to, const void *from, unsigned long n) d597580d373774b Al Viro 2017-03-20 127 { 9c5f6908de03a4f Al Viro 2017-06-29 128 might_fault(); 4983cb67a383a73 Linus Torvalds 2019-02-14 129 if (access_ok(to, n)) { 9c5f6908de03a4f Al Viro 2017-06-29 130 kasan_check_read(from, n); d597580d373774b Al Viro 2017-03-20 131 n = raw_copy_to_user(to, from, n); 9c5f6908de03a4f Al Viro 2017-06-29 132 } d597580d373774b Al Viro 2017-03-20 133 return n; d597580d373774b Al Viro 2017-03-20 134 } d597580d373774b Al Viro 2017-03-20 135 #else d597580d373774b Al Viro 2017-03-20 136 extern unsigned long d597580d373774b Al Viro 2017-03-20 137 _copy_to_user(void __user *, const void *, unsigned long); d597580d373774b Al Viro 2017-03-20 138 #endif d597580d373774b Al Viro 2017-03-20 139 d597580d373774b Al Viro 2017-03-20 140 static __always_inline unsigned long __must_check d597580d373774b Al Viro 2017-03-20 141 copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774b Al Viro 2017-03-20 142 { b0377fedb652808 Al Viro 2017-06-29 143 if (likely(check_copy_size(to, n, false))) d597580d373774b Al Viro 2017-03-20 @144 n = _copy_from_user(to, from, n); d597580d373774b Al Viro 2017-03-20 145 return n; d597580d373774b Al Viro 2017-03-20 146 } d597580d373774b Al Viro 2017-03-20 147 :::::: The code at line 112 was first introduced by commit :::::: 9c5f6908de03a4f52ba7364b11fcd6116225480c copy_{from,to}_user(): move kasan checks and might_fault() out-of-line :::::: TO: Al Viro <viro(a)zeniv.linux.org.uk> :::::: CC: Al Viro <viro(a)zeniv.linux.org.uk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2528/15331] fs/proc/etmem_scan.c:1261:45: warning: suggest braces around empty body in an 'else' statement
by kernel test robot 28 Oct '24

28 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 9d0af12b79bee784902822ddeec2e1a8cfc18524 commit: 5d3b64fd78b80ec49285f2186e7b5ac5850f76e4 [2528/15331] etmem: add etmem scan feature config: arm64-randconfig-003-20241027 (https://download.01.org/0day-ci/archive/20241028/202410280704.1qI2EjWL-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241028/202410280704.1qI2EjWL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410280704.1qI2EjWL-lkp@intel.com/ All warnings (new ones prefixed by >>): fs/proc/etmem_scan.c: In function 'mm_idle_walk_range': fs/proc/etmem_scan.c:1258:61: warning: suggest braces around empty body in an 'if' statement [-Wempty-body] 1258 | pic->next_hva, end); | ^ >> fs/proc/etmem_scan.c:1261:45: warning: suggest braces around empty body in an 'else' statement [-Wempty-body] 1261 | debug_printk("nothing read"); | ^ vim +/else +1261 fs/proc/etmem_scan.c 1216 1217 static int mm_idle_walk_range(struct page_idle_ctrl *pic, 1218 unsigned long start, 1219 unsigned long end, 1220 struct mm_walk *walk) 1221 { 1222 struct vm_area_struct *vma; 1223 int ret = 0; 1224 1225 ret = init_page_idle_ctrl_buffer(pic); 1226 if (ret) 1227 return ret; 1228 1229 for (; start < end;) { 1230 mmap_read_lock(walk->mm); 1231 vma = find_vma(walk->mm, start); 1232 if (vma) { 1233 if (end > vma->vm_start) { 1234 local_irq_disable(); 1235 ret = walk_page_range(walk->mm, start, end, 1236 walk->ops, walk->private); 1237 local_irq_enable(); 1238 } else 1239 set_restart_gpa(vma->vm_start, "VMA-HOLE"); 1240 } else 1241 set_restart_gpa(TASK_SIZE, "EOF"); 1242 mmap_read_unlock(walk->mm); 1243 WARN_ONCE(pic->gpa_to_hva, "non-zero gpa_to_hva"); 1244 if (ret != PAGE_IDLE_KBUF_FULL && end > pic->restart_gpa) 1245 pic->restart_gpa = end; 1246 start = pic->restart_gpa; 1247 ret = page_idle_copy_user(pic, start, end); 1248 if (ret) 1249 break; 1250 } 1251 1252 if (start > pic->next_hva) 1253 set_next_hva(start, "NEXT-START"); 1254 1255 if (pic->bytes_copied) { 1256 if (ret != PAGE_IDLE_BUF_FULL && pic->next_hva < end) 1257 debug_printk("partial scan: next_hva=%pK end=%pK\n", > 1258 pic->next_hva, end); 1259 ret = 0; 1260 } else > 1261 debug_printk("nothing read"); 1262 return ret; 1263 } 1264 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 687/30000] kernel/locking/rwsem.o: warning: objtool: down_read_nested()+0x181: unreachable instruction
by kernel test robot 28 Oct '24

28 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 412556141b3c12f2f160acc3a09a40c937837ee3 commit: 003a421b04ba85abaf24a92736dc47f76fda0803 [687/30000] disable OPTIMIZE_INLINING by default config: x86_64-buildonly-randconfig-005-20241027 (https://download.01.org/0day-ci/archive/20241028/202410280723.ss4XSDND-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241028/202410280723.ss4XSDND-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410280723.ss4XSDND-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/locking/rwsem.o: warning: objtool: down_read_nested()+0x181: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 25559/30000] arch/arm64/kvm/cvm.c:71:6: warning: no previous prototype for 'kvm_cvm_supports_sve'
by kernel test robot 28 Oct '24

28 Oct '24

Hi Jingxian, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 412556141b3c12f2f160acc3a09a40c937837ee3 commit: ae80c7e2f5cd3e50d1f360c387a33088310d54a0 [25559/30000] kvm: add cvm host feature config: arm64-defconfig (https://download.01.org/0day-ci/archive/20241028/202410280656.1UEnlVVA-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241028/202410280656.1UEnlVVA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410280656.1UEnlVVA-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/arm64/kvm/cvm.c:42:5: warning: no previous prototype for 'cvm_phys_to_phys' [-Wmissing-prototypes] 42 | u64 cvm_phys_to_phys(u64 phys) | ^~~~~~~~~~~~~~~~ >> arch/arm64/kvm/cvm.c:71:6: warning: no previous prototype for 'kvm_cvm_supports_sve' [-Wmissing-prototypes] 71 | bool kvm_cvm_supports_sve(void) | ^~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kvm/cvm.c:76:6: warning: no previous prototype for 'kvm_cvm_supports_pmu' [-Wmissing-prototypes] 76 | bool kvm_cvm_supports_pmu(void) | ^~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kvm/cvm.c:81:5: warning: no previous prototype for 'kvm_cvm_ipa_limit' [-Wmissing-prototypes] 81 | u32 kvm_cvm_ipa_limit(void) | ^~~~~~~~~~~~~~~~~ >> arch/arm64/kvm/cvm.c:86:5: warning: no previous prototype for 'kvm_cvm_get_num_brps' [-Wmissing-prototypes] 86 | u32 kvm_cvm_get_num_brps(void) | ^~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kvm/cvm.c:91:5: warning: no previous prototype for 'kvm_cvm_get_num_wrps' [-Wmissing-prototypes] 91 | u32 kvm_cvm_get_num_wrps(void) | ^~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kvm/cvm.c:240:5: warning: no previous prototype for 'kvm_cvm_create_ttt_levels' [-Wmissing-prototypes] 240 | int kvm_cvm_create_ttt_levels(struct kvm *kvm, struct cvm *cvm, | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kvm/cvm.c:301:5: warning: no previous prototype for 'kvm_cvm_populate_par_region' [-Wmissing-prototypes] 301 | int kvm_cvm_populate_par_region(struct kvm *kvm, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/kvm_cvm_supports_sve +71 arch/arm64/kvm/cvm.c 70 > 71 bool kvm_cvm_supports_sve(void) 72 { 73 return tmm_supports(TMI_FEATURE_REGISTER_0_SVE_EN); 74 } 75 > 76 bool kvm_cvm_supports_pmu(void) 77 { 78 return tmm_supports(TMI_FEATURE_REGISTER_0_PMU_EN); 79 } 80 > 81 u32 kvm_cvm_ipa_limit(void) 82 { 83 return u64_get_bits(tmm_feat_reg0, TMI_FEATURE_REGISTER_0_S2SZ); 84 } 85 > 86 u32 kvm_cvm_get_num_brps(void) 87 { 88 return u64_get_bits(tmm_feat_reg0, TMI_FEATURE_REGISTER_0_NUM_BPS); 89 } 90 > 91 u32 kvm_cvm_get_num_wrps(void) 92 { 93 return u64_get_bits(tmm_feat_reg0, TMI_FEATURE_REGISTER_0_NUM_WPS); 94 } 95 96 static int cvm_vmid_reserve(void) 97 { 98 int ret; 99 unsigned int vmid_count = 1 << kvm_get_vmid_bits(); 100 101 spin_lock(&cvm_vmid_lock); 102 ret = bitmap_find_free_region(cvm_vmid_bitmap, vmid_count, 0); 103 spin_unlock(&cvm_vmid_lock); 104 105 return ret; 106 } 107 108 static void cvm_vmid_release(unsigned int vmid) 109 { 110 spin_lock(&cvm_vmid_lock); 111 bitmap_release_region(cvm_vmid_bitmap, vmid, 0); 112 spin_unlock(&cvm_vmid_lock); 113 } 114 115 static u32 __kvm_pgd_page_idx(struct kvm_pgtable *pgt, u64 addr) 116 { 117 u64 shift = ARM64_HW_PGTABLE_LEVEL_SHIFT(pgt->start_level - 1); 118 u64 mask = BIT(pgt->ia_bits) - 1; 119 120 return (addr & mask) >> shift; 121 } 122 123 static u32 kvm_pgd_pages(u32 ia_bits, u32 start_level) 124 { 125 struct kvm_pgtable pgt = { 126 .ia_bits = ia_bits, 127 .start_level = start_level, 128 }; 129 return __kvm_pgd_page_idx(&pgt, -1ULL) + 1; 130 } 131 132 int kvm_arm_create_cvm(struct kvm *kvm) 133 { 134 int ret; 135 struct kvm_pgtable *pgt = kvm->arch.mmu.pgt; 136 unsigned int pgd_sz; 137 138 if (!kvm_is_cvm(kvm) || kvm_cvm_state(kvm) != CVM_STATE_NONE) 139 return 0; 140 141 ret = cvm_vmid_reserve(); 142 if (ret < 0) 143 return ret; 144 145 kvm->arch.cvm.cvm_vmid = ret; 146 147 pgd_sz = kvm_pgd_pages(pgt->ia_bits, pgt->start_level); 148 149 kvm->arch.cvm.params->ttt_base = phys_to_cvm_phys(kvm->arch.mmu.pgd_phys); 150 kvm->arch.cvm.params->measurement_algo = 0; 151 kvm->arch.cvm.params->ttt_level_start = kvm->arch.mmu.pgt->start_level; 152 kvm->arch.cvm.params->ttt_num_start = pgd_sz; 153 kvm->arch.cvm.params->s2sz = VTCR_EL2_IPA(kvm->arch.vtcr); 154 kvm->arch.cvm.params->vmid = kvm->arch.cvm.cvm_vmid; 155 kvm->arch.cvm.params->ns_vtcr = kvm->arch.vtcr; 156 kvm->arch.cvm.params->vttbr_el2 = kvm->arch.mmu.pgd_phys; 157 ret = tmi_cvm_create(kvm->arch.cvm.rd, __pa(kvm->arch.cvm.params)); 158 if (!ret) 159 kvm_info("KVM creates cVM: %d\n", kvm->arch.cvm.cvm_vmid); 160 161 WRITE_ONCE(kvm->arch.cvm.state, CVM_STATE_NEW); 162 kfree(kvm->arch.cvm.params); 163 kvm->arch.cvm.params = NULL; 164 return ret; 165 } 166 167 int cvm_create_rd(struct kvm *kvm) 168 { 169 if (!static_key_enabled(&kvm_cvm_is_available)) 170 return -EFAULT; 171 172 kvm->arch.cvm.rd = tmi_mem_alloc(kvm->arch.cvm.rd, NO_NUMA, 173 TMM_MEM_TYPE_RD, TMM_MEM_MAP_SIZE_MAX); 174 if (!kvm->arch.cvm.rd) { 175 kvm_err("tmi_mem_alloc for cvm rd failed: %d\n", kvm->arch.cvm.cvm_vmid); 176 return -ENOMEM; 177 } 178 kvm->arch.is_cvm = true; 179 return 0; 180 } 181 182 void kvm_free_rd(struct kvm *kvm) 183 { 184 int ret; 185 186 if (!kvm->arch.cvm.rd) 187 return; 188 189 ret = tmi_mem_free(kvm->arch.cvm.rd, NO_NUMA, TMM_MEM_TYPE_RD, TMM_MEM_MAP_SIZE_MAX); 190 if (ret) 191 kvm_err("tmi_mem_free for cvm rd failed: %d\n", kvm->arch.cvm.cvm_vmid); 192 else 193 kvm->arch.cvm.rd = 0; 194 } 195 196 void kvm_destroy_cvm(struct kvm *kvm) 197 { 198 uint32_t cvm_vmid = kvm->arch.cvm.cvm_vmid; 199 200 kfree(kvm->arch.cvm.params); 201 kvm->arch.cvm.params = NULL; 202 203 if (kvm_cvm_state(kvm) == CVM_STATE_NONE) 204 return; 205 206 cvm_vmid_release(cvm_vmid); 207 208 WRITE_ONCE(kvm->arch.cvm.state, CVM_STATE_DYING); 209 210 if (!tmi_cvm_destroy(kvm->arch.cvm.rd)) 211 kvm_info("KVM has destroyed cVM: %d\n", kvm->arch.cvm.cvm_vmid); 212 213 kvm_free_rd(kvm); 214 } 215 216 static int kvm_get_host_numa_node_by_ipa(uint64_t ipa, struct kvm_vcpu *vcpu) 217 { 218 int i; 219 struct kvm_numa_info *numa_info = &vcpu->kvm->arch.cvm.numa_info; 220 221 for (i = 0; i < numa_info->numa_cnt && i < MAX_NUMA_NODE; i++) { 222 struct kvm_numa_node *numa_node = &numa_info->numa_nodes[i]; 223 224 if (ipa >= numa_node->ipa_start && 225 ipa < (numa_node->ipa_start + numa_node->ipa_size)) 226 return numa_node->host_numa_node; 227 } 228 return NO_NUMA; 229 } 230 231 static int kvm_cvm_ttt_create(struct cvm *cvm, 232 unsigned long addr, 233 int level, 234 phys_addr_t phys) 235 { 236 addr = ALIGN_DOWN(addr, cvm_ttt_level_mapsize(level - 1)); 237 return tmi_ttt_create(phys, cvm->rd, addr, level); 238 } 239 > 240 int kvm_cvm_create_ttt_levels(struct kvm *kvm, struct cvm *cvm, 241 unsigned long ipa, 242 int level, 243 int max_level, 244 struct kvm_mmu_memory_cache *mc) 245 { 246 if (WARN_ON(level == max_level)) 247 return 0; 248 249 while (level++ < max_level) { 250 phys_addr_t ttt; 251 252 ttt = tmi_mem_alloc(cvm->rd, NO_NUMA, 253 TMM_MEM_TYPE_TTT, TMM_MEM_MAP_SIZE_MAX); 254 if (ttt == 0) 255 return -ENOMEM; 256 257 if (kvm_cvm_ttt_create(cvm, ipa, level, ttt)) { 258 (void)tmi_mem_free(ttt, NO_NUMA, TMM_MEM_TYPE_TTT, TMM_MEM_MAP_SIZE_MAX); 259 return -ENXIO; 260 } 261 } 262 263 return 0; 264 } 265 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0