- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 7604/7619] drivers/net/ethernet/bzwx/nce/comm/txrx.c:555:6: warning: no previous prototype for function 'ne6x_alloc_rx_buffers'
by kernel test robot 29 Apr '24

29 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f120c2ab14341c60bcc055c700c0a29dce5837ac commit: 6da1ac3422090c928e2aa5ea5538884a316d3d4e [7604/7619] drivers: fix compiling problem in bzwx N5/N6 series NIC drivers config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20240429/202404290504.ddwqObly-lkp@…) compiler: clang version 19.0.0git (https://github.com/llvm/llvm-project 5ef5eb66fb428aaf61fb51b709f065c069c11242) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240429/202404290504.ddwqObly-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404290504.ddwqObly-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/bzwx/nce/comm/txrx.c:4: In file included from drivers/net/ethernet/bzwx/nce/comm/txrx.h:10: In file included from include/linux/pci.h:1663: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2204: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/bzwx/nce/comm/txrx.c:555:6: warning: no previous prototype for function 'ne6x_alloc_rx_buffers' [-Wmissing-prototypes] 555 | bool ne6x_alloc_rx_buffers(struct ne6x_ring *rx_ring, u16 cleaned_count) | ^ drivers/net/ethernet/bzwx/nce/comm/txrx.c:555:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 555 | bool ne6x_alloc_rx_buffers(struct ne6x_ring *rx_ring, u16 cleaned_count) | ^ | static >> drivers/net/ethernet/bzwx/nce/comm/txrx.c:1122:6: warning: no previous prototype for function 'ne6x_unmap_and_free_tx_resource' [-Wmissing-prototypes] 1122 | void ne6x_unmap_and_free_tx_resource(struct ne6x_ring *ring, | ^ drivers/net/ethernet/bzwx/nce/comm/txrx.c:1122:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1122 | void ne6x_unmap_and_free_tx_resource(struct ne6x_ring *ring, | ^ | static >> drivers/net/ethernet/bzwx/nce/comm/txrx.c:1147:5: warning: no previous prototype for function 'ne6x_fill_jumbo_sgl' [-Wmissing-prototypes] 1147 | int ne6x_fill_jumbo_sgl(struct ne6x_ring *tx_ring, struct sk_buff *skb) | ^ drivers/net/ethernet/bzwx/nce/comm/txrx.c:1147:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1147 | int ne6x_fill_jumbo_sgl(struct ne6x_ring *tx_ring, struct sk_buff *skb) | ^ | static >> drivers/net/ethernet/bzwx/nce/comm/txrx.c:1247:6: warning: no previous prototype for function 'ne6x_fill_tx_desc' [-Wmissing-prototypes] 1247 | void ne6x_fill_tx_desc(struct ne6x_tx_desc *tx_desc, u8 vp, dma_addr_t tag_dma, | ^ drivers/net/ethernet/bzwx/nce/comm/txrx.c:1247:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1247 | void ne6x_fill_tx_desc(struct ne6x_tx_desc *tx_desc, u8 vp, dma_addr_t tag_dma, | ^ | static >> drivers/net/ethernet/bzwx/nce/comm/txrx.c:1266:6: warning: no previous prototype for function 'ne6x_fill_tx_priv_tag' [-Wmissing-prototypes] 1266 | void ne6x_fill_tx_priv_tag(struct ne6x_ring *tx_ring, struct ne6x_tx_tag *tx_tag, | ^ drivers/net/ethernet/bzwx/nce/comm/txrx.c:1266:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1266 | void ne6x_fill_tx_priv_tag(struct ne6x_ring *tx_ring, struct ne6x_tx_tag *tx_tag, | ^ | static >> drivers/net/ethernet/bzwx/nce/comm/txrx.c:1281:6: warning: no previous prototype for function 'ne6x_xmit_jumbo' [-Wmissing-prototypes] 1281 | void ne6x_xmit_jumbo(struct ne6x_ring *tx_ring, struct ne6x_tx_buf *first, | ^ drivers/net/ethernet/bzwx/nce/comm/txrx.c:1281:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1281 | void ne6x_xmit_jumbo(struct ne6x_ring *tx_ring, struct ne6x_tx_buf *first, | ^ | static drivers/net/ethernet/bzwx/nce/comm/txrx.c:1378:33: warning: variable 'first_desc' set but not used [-Wunused-but-set-variable] 1378 | struct ne6x_tx_desc *tx_desc, *first_desc; | ^ drivers/net/ethernet/bzwx/nce/comm/txrx.c:1387:9: warning: variable 'mss' set but not used [-Wunused-but-set-variable] 1387 | __le64 mss = 0; | ^ >> drivers/net/ethernet/bzwx/nce/comm/txrx.c:1373:6: warning: no previous prototype for function 'ne6x_xmit_simple' [-Wmissing-prototypes] 1373 | void ne6x_xmit_simple(struct ne6x_ring *tx_ring, struct ne6x_tx_buf *first, | ^ drivers/net/ethernet/bzwx/nce/comm/txrx.c:1373:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1373 | void ne6x_xmit_simple(struct ne6x_ring *tx_ring, struct ne6x_tx_buf *first, | ^ | static drivers/net/ethernet/bzwx/nce/comm/txrx.c:150:28: warning: unused function 'ne6x_txd_use_count' [-Wunused-function] 150 | static inline unsigned int ne6x_txd_use_count(unsigned int size) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/bzwx/nce/comm/txrx.c:156:20: warning: unused function 'ne6x_chk_linearize' [-Wunused-function] 156 | static inline bool ne6x_chk_linearize(struct sk_buff *skb, int count) | ^~~~~~~~~~~~~~~~~~ 16 warnings generated. -- In file included from drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:4: In file included from include/net/gre.h:5: In file included from include/linux/skbuff.h:17: In file included from include/linux/bvec.h:10: In file included from include/linux/highmem.h:8: In file included from include/linux/cacheflush.h:5: In file included from arch/arm64/include/asm/cacheflush.h:11: In file included from include/linux/kgdb.h:19: In file included from include/linux/kprobes.h:28: In file included from include/linux/ftrace.h:13: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2204: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:68:5: warning: no previous prototype for function 'ne6x_hw_init' [-Wmissing-prototypes] 68 | int ne6x_hw_init(struct ne6x_hw *hw) | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:68:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 68 | int ne6x_hw_init(struct ne6x_hw *hw) | ^ | static >> drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:92:5: warning: no previous prototype for function 'ne6x_aq_get_phy_capabilities' [-Wmissing-prototypes] 92 | int ne6x_aq_get_phy_capabilities(struct ne6x_adapter *adpt, bool is_up, bool get_hw_stats) | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:92:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 92 | int ne6x_aq_get_phy_capabilities(struct ne6x_adapter *adpt, bool is_up, bool get_hw_stats) | ^ | static >> drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:144:5: warning: no previous prototype for function 'ne6x_aq_get_vf_link_status' [-Wmissing-prototypes] 144 | int ne6x_aq_get_vf_link_status(struct ne6x_adapter *adpt, bool is_up) | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:144:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 144 | int ne6x_aq_get_vf_link_status(struct ne6x_adapter *adpt, bool is_up) | ^ | static >> drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:216:6: warning: no previous prototype for function 'ne6x_print_link_message' [-Wmissing-prototypes] 216 | void ne6x_print_link_message(struct ne6x_adapter *adpt, bool isup) | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:216:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 216 | void ne6x_print_link_message(struct ne6x_adapter *adpt, bool isup) | ^ | static >> drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:497:5: warning: no previous prototype for function 'ne6x_pf_init' [-Wmissing-prototypes] 497 | int ne6x_pf_init(struct ne6x_pf *pf) | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:497:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 497 | int ne6x_pf_init(struct ne6x_pf *pf) | ^ | static >> drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:740:6: warning: no previous prototype for function 'ne6x_clean_tx_ring' [-Wmissing-prototypes] 740 | void ne6x_clean_tx_ring(struct ne6x_ring *tx_ring) | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:740:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 740 | void ne6x_clean_tx_ring(struct ne6x_ring *tx_ring) | ^ | static >> drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:770:6: warning: no previous prototype for function 'ne6x_clean_rx_ring' [-Wmissing-prototypes] 770 | void ne6x_clean_rx_ring(struct ne6x_ring *rx_ring) | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:770:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 770 | void ne6x_clean_rx_ring(struct ne6x_ring *rx_ring) | ^ | static >> drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:852:6: warning: no previous prototype for function 'ne6x_free_rx_resources' [-Wmissing-prototypes] 852 | void ne6x_free_rx_resources(struct ne6x_ring *rx_ring) | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:852:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 852 | void ne6x_free_rx_resources(struct ne6x_ring *rx_ring) | ^ | static >> drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:877:6: warning: no previous prototype for function 'ne6x_free_tx_resources' [-Wmissing-prototypes] 877 | void ne6x_free_tx_resources(struct ne6x_ring *tx_ring) | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:877:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 877 | void ne6x_free_tx_resources(struct ne6x_ring *tx_ring) | ^ | static >> drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:889:6: warning: no previous prototype for function 'ne6x_free_cq_resources' [-Wmissing-prototypes] 889 | void ne6x_free_cq_resources(struct ne6x_ring *cq_ring) | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:889:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 889 | void ne6x_free_cq_resources(struct ne6x_ring *cq_ring) | ^ | static drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:1243:28: warning: variable 'ons' set but not used [-Wunused-but-set-variable] 1243 | struct rtnl_link_stats64 *ons; | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:1245:25: warning: variable 'oes' set but not used [-Wunused-but-set-variable] 1245 | struct ne6x_eth_stats *oes; | ^ >> drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:1254:6: warning: variable 'tx_linearize' set but not used [-Wunused-but-set-variable] 1254 | u64 tx_linearize; | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:1255:6: warning: variable 'tx_force_wb' set but not used [-Wunused-but-set-variable] 1255 | u64 tx_force_wb; | ^ >> drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:1852:5: warning: no previous prototype for function 'ne6x_link_speed_to_rate' [-Wmissing-prototypes] 1852 | int ne6x_link_speed_to_rate(int link_speed) | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:1852:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1852 | int ne6x_link_speed_to_rate(int link_speed) | ^ | static >> drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:2063:5: warning: no previous prototype for function 'ne6x_set_vf_port_vlan' [-Wmissing-prototypes] 2063 | int ne6x_set_vf_port_vlan(struct net_device *netdev, int vf_id, u16 vlan_id, | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:2063:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2063 | int ne6x_set_vf_port_vlan(struct net_device *netdev, int vf_id, u16 vlan_id, | ^ | static >> drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:2703:6: warning: no previous prototype for function 'ne6x_adjust_adpt_port_max_queue' [-Wmissing-prototypes] 2703 | void ne6x_adjust_adpt_port_max_queue(struct ne6x_pf *pf) | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:2703:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2703 | void ne6x_adjust_adpt_port_max_queue(struct ne6x_pf *pf) | ^ | static >> drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:2924:5: warning: no previous prototype for function 'ne6x_adpt_release' [-Wmissing-prototypes] 2924 | int ne6x_adpt_release(struct ne6x_adapter *adpt) | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:2924:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2924 | int ne6x_adpt_release(struct ne6x_adapter *adpt) | ^ | static >> drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:3082:12: warning: no previous prototype for function 'ne6x_init_module' [-Wmissing-prototypes] 3082 | int __init ne6x_init_module(void) | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:3082:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3082 | int __init ne6x_init_module(void) | ^ | static >> drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:3103:13: warning: no previous prototype for function 'ne6x_exit_module' [-Wmissing-prototypes] 3103 | void __exit ne6x_exit_module(void) | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:3103:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3103 | void __exit ne6x_exit_module(void) | ^ | static 25 warnings generated. -- In file included from drivers/net/ethernet/bzwx/nce/ne6x/ne6x_procfs.c:6: In file included from drivers/net/ethernet/bzwx/nce/ne6x/ne6x.h:10: In file included from include/linux/pci.h:1663: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2204: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/bzwx/nce/ne6x/ne6x_procfs.c:66:9: warning: no previous prototype for function 'ne6x_proc_i2c_read' [-Wmissing-prototypes] 66 | ssize_t ne6x_proc_i2c_read(struct file *filp, char __user *buf, size_t count, loff_t *ppos) | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_procfs.c:66:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 66 | ssize_t ne6x_proc_i2c_read(struct file *filp, char __user *buf, size_t count, loff_t *ppos) | ^ | static 6 warnings generated. -- In file included from drivers/net/ethernet/bzwx/nce/ne6x/ne6x_interrupt.c:4: In file included from drivers/net/ethernet/bzwx/nce/ne6x/ne6x.h:10: In file included from include/linux/pci.h:1663: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2204: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/bzwx/nce/ne6x/ne6x_interrupt.c:258:5: warning: no previous prototype for function 'ne6x_adpt_request_irq_msix' [-Wmissing-prototypes] 258 | int ne6x_adpt_request_irq_msix(struct ne6x_adapter *adpt, char *basename) | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_interrupt.c:258:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 258 | int ne6x_adpt_request_irq_msix(struct ne6x_adapter *adpt, char *basename) | ^ | static >> drivers/net/ethernet/bzwx/nce/ne6x/ne6x_interrupt.c:340:5: warning: no previous prototype for function 'ne6x_adpt_request_irq_intx' [-Wmissing-prototypes] 340 | int ne6x_adpt_request_irq_intx(struct ne6x_adapter *adpt, char *basename) | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_interrupt.c:340:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 340 | int ne6x_adpt_request_irq_intx(struct ne6x_adapter *adpt, char *basename) | ^ | static >> drivers/net/ethernet/bzwx/nce/ne6x/ne6x_interrupt.c:607:13: warning: no previous prototype for function 'ne6x_msix_clean_vf_mbx' [-Wmissing-prototypes] 607 | irqreturn_t ne6x_msix_clean_vf_mbx(int irq, void *data) | ^ drivers/net/ethernet/bzwx/nce/ne6x/ne6x_interrupt.c:607:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 607 | irqreturn_t ne6x_msix_clean_vf_mbx(int irq, void *data) | ^ | static 8 warnings generated. .. vim +/ne6x_alloc_rx_buffers +555 drivers/net/ethernet/bzwx/nce/comm/txrx.c 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 554 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 @555 bool ne6x_alloc_rx_buffers(struct ne6x_ring *rx_ring, u16 cleaned_count) 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 556 { 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 557 u16 ntu = rx_ring->next_to_use; 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 558 union ne6x_rx_desc *rx_desc; 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 559 struct ne6x_rx_buf *bi; 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 560 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 561 /* do nothing if no valid netdev defined */ 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 562 if (!rx_ring->netdev || !cleaned_count) 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 563 return false; 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 564 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 565 rx_desc = NE6X_RX_DESC(rx_ring, ntu); 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 566 bi = &rx_ring->rx_buf[ntu]; 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 567 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 568 do { 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 569 if (!ne6x_alloc_mapped_page(rx_ring, bi)) 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 570 goto no_buffers; 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 571 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 572 /* sync the buffer for use by the device */ 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 573 dma_sync_single_range_for_device(rx_ring->dev, bi->dma, bi->page_offset, 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 574 rx_ring->rx_buf_len, DMA_FROM_DEVICE); 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 575 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 576 /* Refresh the desc even if buffer_addrs didn't change 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 577 * because each write-back erases this info. 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 578 */ 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 579 rx_desc->wb.u.val = 0; 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 580 rx_desc->w.buffer_mop_addr = cpu_to_le64(bi->dma + bi->page_offset); 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 581 rx_desc->w.buffer_sop_addr = 0; 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 582 rx_desc->w.mop_mem_len = rx_ring->rx_buf_len; 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 583 rx_desc->wb.pkt_len = 0; 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 584 rx_desc->w.vp = rx_ring->reg_idx; 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 585 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 586 rx_desc++; 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 587 bi++; 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 588 ntu++; 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 589 if (unlikely(ntu == rx_ring->count)) { 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 590 rx_desc = NE6X_RX_DESC(rx_ring, 0); 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 591 bi = rx_ring->rx_buf; 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 592 ntu = 0; 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 593 } 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 594 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 595 /* clear the status bits for the next_to_use descriptor */ 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 596 rx_desc->wb.u.val = 0; 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 597 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 598 cleaned_count--; 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 599 } while (cleaned_count); 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 600 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 601 if (rx_ring->next_to_use != ntu) 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 602 ne6x_release_rx_desc(rx_ring, ntu); 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 603 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 604 return false; 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 605 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 606 no_buffers: 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 607 if (rx_ring->next_to_use != ntu) 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 608 ne6x_release_rx_desc(rx_ring, ntu); 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 609 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 610 /* make sure to come back via polling to try again after 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 611 * allocation failure 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 612 */ 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 613 return true; 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 614 } 08f4280700700f xiaohuihui-bzwx-kj 2024-04-11 615 :::::: The code at line 555 was first introduced by commit :::::: 08f4280700700faaa2393cbf9a402d4f51d3a8a8 drivers: add Chengdu BeiZhongWangXin Technology N5/N6 Series Network Card Driver :::::: TO: xiaohuihui-bzwx-kj <xiaohuihui(a)bzwx-kj.com> :::::: CC: xiaohuihui-bzwx-kj <xiaohuihui(a)bzwx-kj.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 7592/7622] fs/ext4/inode.c:3585:24: sparse: sparse: symbol 'ext4_iomap_buffered_read_ops' was not declared. Should it be static?
by kernel test robot 29 Apr '24

29 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f120c2ab14341c60bcc055c700c0a29dce5837ac commit: a38e9381cf2ba6f3300c716b1cff4551bec0fbdf [7592/7622] ext4: implement buffered read iomap path config: x86_64-randconfig-121-20240429 (https://download.01.org/0day-ci/archive/20240429/202404290230.zdcvkbB5-lkp@…) compiler: gcc-8 (Ubuntu 8.4.0-3ubuntu2) 8.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240429/202404290230.zdcvkbB5-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404290230.zdcvkbB5-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> fs/ext4/inode.c:3585:24: sparse: sparse: symbol 'ext4_iomap_buffered_read_ops' was not declared. Should it be static? vim +/ext4_iomap_buffered_read_ops +3585 fs/ext4/inode.c 3584 > 3585 const struct iomap_ops ext4_iomap_buffered_read_ops = { 3586 .iomap_begin = ext4_iomap_buffered_io_begin, 3587 }; 3588 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 1/2] crypto: jitter - change module_init(jent_mod_init) to subsys_initcall(jent_mod_init)
by Cui GaoSheng 28 Apr '24

28 Apr '24

From: Gaosheng Cui <cuigaosheng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9K8D1 -------------------------------- The ecdh-nist-p256 algorithm will depend on jitterentropy_rng, and when they are build into kernel, the order of registration should be done such that the underlying algorithms are ready before the ones on top are registered. We can enable fips=1 and ecdh, the calltrace like below: alg: ecdh-nist-p256: test failed on vector 2, err=-14 Kernel panic - not syncing: alg: self-tests for ecdh-generic (ecdh) failed in fips mode! Call Trace: dump_stack+0x57/0x6e panic+0x109/0x2ca alg_test+0x414/0x420 ? __switch_to_asm+0x3a/0x60 ? __switch_to_asm+0x34/0x60 ? __schedule+0x263/0x640 ? crypto_acomp_scomp_free_ctx+0x30/0x30 cryptomgr_test+0x22/0x40 kthread+0xf9/0x130 ? kthread_park+0x90/0x90 ret_from_fork+0x22/0x30 The module_init(jent_mod_init) is later than subsys_initcall(ecdh_init), so changing module_init(jent_mod_init) to subsys_initcall(jent_mod_init) to fix it. Fixes: c4741b230597 ("crypto: run initcalls for generic implementations earlier") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> --- crypto/jitterentropy-kcapi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/jitterentropy-kcapi.c b/crypto/jitterentropy-kcapi.c index e8a4165a1874..b1d7b5a6e61c 100644 --- a/crypto/jitterentropy-kcapi.c +++ b/crypto/jitterentropy-kcapi.c @@ -214,7 +214,7 @@ static void __exit jent_mod_exit(void) crypto_unregister_rng(&jent_alg); } -module_init(jent_mod_init); +subsys_initcall(jent_mod_init); module_exit(jent_mod_exit); MODULE_LICENSE("Dual BSD/GPL"); -- 2.34.1

2 2

[openeuler:OLK-6.6 7603/7617] drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:8:10: warning: the current #pragma pack alignment value is modified in the included file
by kernel test robot 28 Apr '24

28 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 914551aad506a7dbdf214c9f49956ed47b8769b5 commit: 5bc8dbb5fdf565625b2eea4080dbd70bade992b8 [7603/7617] infiniband/hw/hiroce3: Add Huawei Intelligent Network Card RDMA Driver config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240428/202404282049.k0qBLpt4-lkp@…) compiler: clang version 18.1.4 (https://github.com/llvm/llvm-project e6c3289804a67ea0bb6a86fadbe454dd93b8d855) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240428/202404282049.k0qBLpt4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404282049.k0qBLpt4-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq_common.c:8: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: In file included from drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:7: In file included from drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:8: >> drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h:9:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 9 | #include "roce_ccf_format.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_ccf_format.h:720:9: note: previous '#pragma pack' directive that modifies alignment is here 720 | #pragma pack(0) | ^ In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq_common.c:8: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: In file included from drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:7: In file included from drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:8: In file included from drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h:15: >> drivers/infiniband/hw/hiroce3/include/rdma/roce_dif_format.h:9:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 9 | #include "roce_verbs_mr_attr.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_mr_attr.h:328:9: note: previous '#pragma pack' directive that modifies alignment is here 328 | #pragma pack() | ^ In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq_common.c:8: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: In file included from drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:7: In file included from drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:8: drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h:15:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 15 | #include "roce_dif_format.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_mr_attr.h:328:9: note: previous '#pragma pack' directive that modifies alignment is here 328 | #pragma pack() | ^ In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq_common.c:8: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: In file included from drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:7: >> drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:8:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 8 | #include "rdma_ext_ctx_format.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h:377:9: note: previous '#pragma pack' directive that modifies alignment is here 377 | #pragma pack(0) | ^ In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq_common.c:8: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: >> drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:7:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 7 | #include "rdma_context_format.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:5179:9: note: previous '#pragma pack' directive that modifies alignment is here 5179 | #pragma pack(0) | ^ In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq_common.c:8: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:8:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 8 | #include "roce_verbs_pub.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_pub.h:223:9: note: previous '#pragma pack' directive that modifies alignment is here 223 | #pragma pack() | ^ 6 warnings generated. -- In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq_create.c:4: In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq.h:13: In file included from drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:8: >> drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h:9:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 9 | #include "roce_ccf_format.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_ccf_format.h:720:9: note: previous '#pragma pack' directive that modifies alignment is here 720 | #pragma pack(0) | ^ In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq_create.c:4: In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq.h:13: In file included from drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:8: In file included from drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h:15: >> drivers/infiniband/hw/hiroce3/include/rdma/roce_dif_format.h:9:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 9 | #include "roce_verbs_mr_attr.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_mr_attr.h:328:9: note: previous '#pragma pack' directive that modifies alignment is here 328 | #pragma pack() | ^ In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq_create.c:4: In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq.h:13: In file included from drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:8: drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h:15:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 15 | #include "roce_dif_format.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_mr_attr.h:328:9: note: previous '#pragma pack' directive that modifies alignment is here 328 | #pragma pack() | ^ In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq_create.c:4: In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq.h:13: >> drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:8:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 8 | #include "rdma_ext_ctx_format.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h:377:9: note: previous '#pragma pack' directive that modifies alignment is here 377 | #pragma pack(0) | ^ In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq_create.c:4: >> drivers/infiniband/hw/hiroce3/cq/roce_cq.h:13:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 13 | #include "rdma_context_format.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:5179:9: note: previous '#pragma pack' directive that modifies alignment is here 5179 | #pragma pack(0) | ^ In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq_create.c:4: In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq.h:15: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:8:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 8 | #include "roce_verbs_pub.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_pub.h:223:9: note: previous '#pragma pack' directive that modifies alignment is here 223 | #pragma pack() | ^ In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq_create.c:4: In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq.h:15: >> drivers/infiniband/hw/hiroce3/roce.h:30:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 30 | #include "roce_verbs_cmd.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_pub.h:223:9: note: previous '#pragma pack' directive that modifies alignment is here 223 | #pragma pack() | ^ In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq_create.c:4: drivers/infiniband/hw/hiroce3/cq/roce_cq.h:15:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 15 | #include "roce.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_attr.h:411:9: note: previous '#pragma pack' directive that modifies alignment is here 411 | #pragma pack() | ^ 8 warnings generated. -- In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq_destroy.c:8: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: In file included from drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:7: In file included from drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:8: >> drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h:9:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 9 | #include "roce_ccf_format.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_ccf_format.h:720:9: note: previous '#pragma pack' directive that modifies alignment is here 720 | #pragma pack(0) | ^ In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq_destroy.c:8: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: In file included from drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:7: In file included from drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:8: In file included from drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h:15: >> drivers/infiniband/hw/hiroce3/include/rdma/roce_dif_format.h:9:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 9 | #include "roce_verbs_mr_attr.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_mr_attr.h:328:9: note: previous '#pragma pack' directive that modifies alignment is here 328 | #pragma pack() | ^ In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq_destroy.c:8: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: In file included from drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:7: In file included from drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:8: drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h:15:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 15 | #include "roce_dif_format.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_mr_attr.h:328:9: note: previous '#pragma pack' directive that modifies alignment is here 328 | #pragma pack() | ^ In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq_destroy.c:8: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: In file included from drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:7: >> drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:8:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 8 | #include "rdma_ext_ctx_format.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h:377:9: note: previous '#pragma pack' directive that modifies alignment is here 377 | #pragma pack(0) | ^ In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq_destroy.c:8: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: >> drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:7:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 7 | #include "rdma_context_format.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:5179:9: note: previous '#pragma pack' directive that modifies alignment is here 5179 | #pragma pack(0) | ^ In file included from drivers/infiniband/hw/hiroce3/cq/roce_cq_destroy.c:8: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:8:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 8 | #include "roce_verbs_pub.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_pub.h:223:9: note: previous '#pragma pack' directive that modifies alignment is here 223 | #pragma pack() | ^ >> drivers/infiniband/hw/hiroce3/cq/roce_cq_destroy.c:63:5: warning: no previous prototype for function 'roce3_cq_hw2sw' [-Wmissing-prototypes] 63 | int roce3_cq_hw2sw(struct roce3_device *rdev, struct roce3_cq *cq) | ^ drivers/infiniband/hw/hiroce3/cq/roce_cq_destroy.c:63:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 63 | int roce3_cq_hw2sw(struct roce3_device *rdev, struct roce3_cq *cq) | ^ | static 7 warnings generated. -- In file included from drivers/infiniband/hw/hiroce3/roce_main.c:26: In file included from drivers/infiniband/hw/hiroce3/roce_event.h:20: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: In file included from drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:7: In file included from drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:8: >> drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h:9:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 9 | #include "roce_ccf_format.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_ccf_format.h:720:9: note: previous '#pragma pack' directive that modifies alignment is here 720 | #pragma pack(0) | ^ In file included from drivers/infiniband/hw/hiroce3/roce_main.c:26: In file included from drivers/infiniband/hw/hiroce3/roce_event.h:20: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: In file included from drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:7: In file included from drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:8: In file included from drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h:15: >> drivers/infiniband/hw/hiroce3/include/rdma/roce_dif_format.h:9:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 9 | #include "roce_verbs_mr_attr.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_mr_attr.h:328:9: note: previous '#pragma pack' directive that modifies alignment is here 328 | #pragma pack() | ^ In file included from drivers/infiniband/hw/hiroce3/roce_main.c:26: In file included from drivers/infiniband/hw/hiroce3/roce_event.h:20: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: In file included from drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:7: In file included from drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:8: drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h:15:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 15 | #include "roce_dif_format.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_mr_attr.h:328:9: note: previous '#pragma pack' directive that modifies alignment is here 328 | #pragma pack() | ^ In file included from drivers/infiniband/hw/hiroce3/roce_main.c:26: In file included from drivers/infiniband/hw/hiroce3/roce_event.h:20: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: In file included from drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:7: >> drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:8:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 8 | #include "rdma_ext_ctx_format.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h:377:9: note: previous '#pragma pack' directive that modifies alignment is here 377 | #pragma pack(0) | ^ In file included from drivers/infiniband/hw/hiroce3/roce_main.c:26: In file included from drivers/infiniband/hw/hiroce3/roce_event.h:20: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: >> drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:7:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 7 | #include "rdma_context_format.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:5179:9: note: previous '#pragma pack' directive that modifies alignment is here 5179 | #pragma pack(0) | ^ In file included from drivers/infiniband/hw/hiroce3/roce_main.c:26: In file included from drivers/infiniband/hw/hiroce3/roce_event.h:20: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:8:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 8 | #include "roce_verbs_pub.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_pub.h:223:9: note: previous '#pragma pack' directive that modifies alignment is here 223 | #pragma pack() | ^ >> drivers/infiniband/hw/hiroce3/roce_main.c:1256:6: warning: no previous prototype for function 'roce3_need_proc_link_event' [-Wmissing-prototypes] 1256 | bool roce3_need_proc_link_event(void *hwdev) | ^ drivers/infiniband/hw/hiroce3/roce_main.c:1256:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1256 | bool roce3_need_proc_link_event(void *hwdev) | ^ | static >> drivers/infiniband/hw/hiroce3/roce_main.c:1296:6: warning: no previous prototype for function 'roce3_need_proc_bond_event' [-Wmissing-prototypes] 1296 | bool roce3_need_proc_bond_event(void *hwdev) | ^ drivers/infiniband/hw/hiroce3/roce_main.c:1296:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1296 | bool roce3_need_proc_bond_event(void *hwdev) | ^ | static >> drivers/infiniband/hw/hiroce3/roce_main.c:1401:6: warning: no previous prototype for function 'roce3_event' [-Wmissing-prototypes] 1401 | void roce3_event(struct hinic3_lld_dev *lld_dev, void *uld_dev, struct hinic3_event_info *event) | ^ drivers/infiniband/hw/hiroce3/roce_main.c:1401:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1401 | void roce3_event(struct hinic3_lld_dev *lld_dev, void *uld_dev, struct hinic3_event_info *event) | ^ | static 9 warnings generated. -- In file included from drivers/infiniband/hw/hiroce3/mr/roce_mr.c:4: In file included from drivers/infiniband/hw/hiroce3/mr/roce_mr.h:15: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: In file included from drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:7: In file included from drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:8: >> drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h:9:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 9 | #include "roce_ccf_format.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_ccf_format.h:720:9: note: previous '#pragma pack' directive that modifies alignment is here 720 | #pragma pack(0) | ^ In file included from drivers/infiniband/hw/hiroce3/mr/roce_mr.c:4: In file included from drivers/infiniband/hw/hiroce3/mr/roce_mr.h:15: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: In file included from drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:7: In file included from drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:8: In file included from drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h:15: >> drivers/infiniband/hw/hiroce3/include/rdma/roce_dif_format.h:9:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 9 | #include "roce_verbs_mr_attr.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_mr_attr.h:328:9: note: previous '#pragma pack' directive that modifies alignment is here 328 | #pragma pack() | ^ In file included from drivers/infiniband/hw/hiroce3/mr/roce_mr.c:4: In file included from drivers/infiniband/hw/hiroce3/mr/roce_mr.h:15: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: In file included from drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:7: In file included from drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:8: drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h:15:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 15 | #include "roce_dif_format.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_mr_attr.h:328:9: note: previous '#pragma pack' directive that modifies alignment is here 328 | #pragma pack() | ^ In file included from drivers/infiniband/hw/hiroce3/mr/roce_mr.c:4: In file included from drivers/infiniband/hw/hiroce3/mr/roce_mr.h:15: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: In file included from drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:7: >> drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:8:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 8 | #include "rdma_ext_ctx_format.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h:377:9: note: previous '#pragma pack' directive that modifies alignment is here 377 | #pragma pack(0) | ^ In file included from drivers/infiniband/hw/hiroce3/mr/roce_mr.c:4: In file included from drivers/infiniband/hw/hiroce3/mr/roce_mr.h:15: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: >> drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:7:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 7 | #include "rdma_context_format.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h:5179:9: note: previous '#pragma pack' directive that modifies alignment is here 5179 | #pragma pack(0) | ^ In file included from drivers/infiniband/hw/hiroce3/mr/roce_mr.c:4: In file included from drivers/infiniband/hw/hiroce3/mr/roce_mr.h:15: In file included from drivers/infiniband/hw/hiroce3/roce.h:30: drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h:8:10: warning: the current #pragma pack alignment value is modified in the included file [-Wpragma-pack] 8 | #include "roce_verbs_pub.h" | ^ drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_pub.h:223:9: note: previous '#pragma pack' directive that modifies alignment is here 223 | #pragma pack() | ^ >> drivers/infiniband/hw/hiroce3/mr/roce_mr.c:914:5: warning: no previous prototype for function 'roce3_check_mr_status' [-Wmissing-prototypes] 914 | int roce3_check_mr_status(struct ib_mr *ibmr, u32 check_mask, struct ib_mr_status *mr_status) | ^ drivers/infiniband/hw/hiroce3/mr/roce_mr.c:914:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 914 | int roce3_check_mr_status(struct ib_mr *ibmr, u32 check_mask, struct ib_mr_status *mr_status) | ^ | static 7 warnings generated. .. vim +8 drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h 6 7 #include "roce_hmm_context.h" > 8 #include "rdma_ext_ctx_format.h" 9 10 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/8] add LTS patches to OLK-5.10
by Zhengchao Shao 28 Apr '24

28 Apr '24

Add LTS patches to OLK-5.10. Ido Schimmel (3): genetlink: add CAP_NET_ADMIN test for multicast bind drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group genetlink: Use internal flags for multicast groups Patrick Rohr (3): net: add sysctl accept_ra_min_rtr_lft net: change accept_ra_min_rtr_lft to affect all RA lifetimes net: release reference to inet6_dev pointer Zhengchao Shao (2): genetlink: fix kabi change in struct genl_multicast_group net: fix kabi in struct ipv6_devconf Documentation/networking/ip-sysctl.rst | 8 +++++ include/linux/ipv6.h | 2 +- include/uapi/linux/ipv6.h | 7 ++++ net/core/drop_monitor.c | 4 ++- net/ipv6/addrconf.c | 13 ++++++++ net/ipv6/ndisc.c | 13 ++++++-- net/netlink/genetlink.c | 45 ++++++++++++++++++++++++++ 7 files changed, 88 insertions(+), 4 deletions(-) -- 2.34.1

2 9

[PATCH v2 OLK-6.6] SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP
by Weifeng Su 28 Apr '24

28 Apr '24

From: Chuck Lever <chuck.lever(a)oracle.com> mainline inclusion from mainline-v6.9-rc3 commit 05258a0a69b3c5d2c003f818702c0a52b6fea861 category: bugfix bugzilla: https://gitee.com/src-openeuler/nfs-utils/issues/I9HSXQ?from=project-issue CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------ Jan Schunk reports that his small NFS servers suffer from memory exhaustion after just a few days. A bisect shows that commit e18e157bb5c8 ("SUNRPC: Send RPC message on TCP with a single sock_sendmsg() call") is the first bad commit. That commit assumed that sock_sendmsg() releases all the pages in the underlying bio_vec array, but the reality is that it doesn't. svc_xprt_release() releases the rqst's response pages, but the record marker page fragment isn't one of those, so it is never released. This is a narrow fix that can be applied to stable kernels. A more extensive fix is in the works. Reported-by: Jan Schunk <scpcom(a)gmx.de> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218671 Fixes: e18e157bb5c8 ("SUNRPC: Send RPC message on TCP with a single sock_sendmsg() call") Cc: Alexander Duyck <alexander.duyck(a)gmail.com> Cc: Jakub Kacinski <kuba(a)kernel.org> Cc: David Howells <dhowells(a)redhat.com> Reviewed-by: David Howells <dhowells(a)redhat.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Weifeng Su <suweifeng1(a)huawei.com> --- net/sunrpc/svcsock.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c index e0ce42762..933e12e3a 100644 --- a/net/sunrpc/svcsock.c +++ b/net/sunrpc/svcsock.c @@ -1216,15 +1216,6 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp) * MSG_SPLICE_PAGES is used exclusively to reduce the number of * copy operations in this path. Therefore the caller must ensure * that the pages backing @xdr are unchanging. - * - * Note that the send is non-blocking. The caller has incremented - * the reference count on each page backing the RPC message, and - * the network layer will "put" these pages when transmission is - * complete. - * - * This is safe for our RPC services because the memory backing - * the head and tail components is never kmalloc'd. These always - * come from pages in the svc_rqst::rq_pages array. */ static int svc_tcp_sendmsg(struct svc_sock *svsk, struct svc_rqst *rqstp, rpc_fraghdr marker, unsigned int *sentp) @@ -1254,6 +1245,7 @@ static int svc_tcp_sendmsg(struct svc_sock *svsk, struct svc_rqst *rqstp, iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, rqstp->rq_bvec, 1 + count, sizeof(marker) + rqstp->rq_res.len); ret = sock_sendmsg(svsk->sk_sock, &msg); + page_frag_free(buf); if (ret < 0) return ret; *sentp += ret; -- 2.43.0

2 1

[PATCH OLK-6.6] SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP
by Weifeng Su 28 Apr '24

28 Apr '24

From: Chuck Lever <chuck.lever(a)oracle.com> Jan Schunk reports that his small NFS servers suffer from memory exhaustion after just a few days. A bisect shows that commit e18e157bb5c8 ("SUNRPC: Send RPC message on TCP with a single sock_sendmsg() call") is the first bad commit. That commit assumed that sock_sendmsg() releases all the pages in the underlying bio_vec array, but the reality is that it doesn't. svc_xprt_release() releases the rqst's response pages, but the record marker page fragment isn't one of those, so it is never released. This is a narrow fix that can be applied to stable kernels. A more extensive fix is in the works. Reported-by: Jan Schunk <scpcom(a)gmx.de> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218671 Fixes: e18e157bb5c8 ("SUNRPC: Send RPC message on TCP with a single sock_sendmsg() call") Cc: Alexander Duyck <alexander.duyck(a)gmail.com> Cc: Jakub Kacinski <kuba(a)kernel.org> Cc: David Howells <dhowells(a)redhat.com> Reviewed-by: David Howells <dhowells(a)redhat.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> --- net/sunrpc/svcsock.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c index e0ce42762..933e12e3a 100644 --- a/net/sunrpc/svcsock.c +++ b/net/sunrpc/svcsock.c @@ -1216,15 +1216,6 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp) * MSG_SPLICE_PAGES is used exclusively to reduce the number of * copy operations in this path. Therefore the caller must ensure * that the pages backing @xdr are unchanging. - * - * Note that the send is non-blocking. The caller has incremented - * the reference count on each page backing the RPC message, and - * the network layer will "put" these pages when transmission is - * complete. - * - * This is safe for our RPC services because the memory backing - * the head and tail components is never kmalloc'd. These always - * come from pages in the svc_rqst::rq_pages array. */ static int svc_tcp_sendmsg(struct svc_sock *svsk, struct svc_rqst *rqstp, rpc_fraghdr marker, unsigned int *sentp) @@ -1254,6 +1245,7 @@ static int svc_tcp_sendmsg(struct svc_sock *svsk, struct svc_rqst *rqstp, iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, rqstp->rq_bvec, 1 + count, sizeof(marker) + rqstp->rq_res.len); ret = sock_sendmsg(svsk->sk_sock, &msg); + page_frag_free(buf); if (ret < 0) return ret; *sentp += ret; -- 2.43.0

2 1

[PATCH OLK-6.6] SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP
by Weifeng Su 28 Apr '24

28 Apr '24

From: Chuck Lever <chuck.lever(a)oracle.com> Jan Schunk reports that his small NFS servers suffer from memory exhaustion after just a few days. A bisect shows that commit e18e157bb5c8 ("SUNRPC: Send RPC message on TCP with a single sock_sendmsg() call") is the first bad commit. That commit assumed that sock_sendmsg() releases all the pages in the underlying bio_vec array, but the reality is that it doesn't. svc_xprt_release() releases the rqst's response pages, but the record marker page fragment isn't one of those, so it is never released. This is a narrow fix that can be applied to stable kernels. A more extensive fix is in the works. Reported-by: Jan Schunk <scpcom(a)gmx.de> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218671 Fixes: e18e157bb5c8 ("SUNRPC: Send RPC message on TCP with a single sock_sendmsg() call") Cc: Alexander Duyck <alexander.duyck(a)gmail.com> Cc: Jakub Kacinski <kuba(a)kernel.org> Cc: David Howells <dhowells(a)redhat.com> Reviewed-by: David Howells <dhowells(a)redhat.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> --- net/sunrpc/svcsock.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c index e0ce42762..933e12e3a 100644 --- a/net/sunrpc/svcsock.c +++ b/net/sunrpc/svcsock.c @@ -1216,15 +1216,6 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp) * MSG_SPLICE_PAGES is used exclusively to reduce the number of * copy operations in this path. Therefore the caller must ensure * that the pages backing @xdr are unchanging. - * - * Note that the send is non-blocking. The caller has incremented - * the reference count on each page backing the RPC message, and - * the network layer will "put" these pages when transmission is - * complete. - * - * This is safe for our RPC services because the memory backing - * the head and tail components is never kmalloc'd. These always - * come from pages in the svc_rqst::rq_pages array. */ static int svc_tcp_sendmsg(struct svc_sock *svsk, struct svc_rqst *rqstp, rpc_fraghdr marker, unsigned int *sentp) @@ -1254,6 +1245,7 @@ static int svc_tcp_sendmsg(struct svc_sock *svsk, struct svc_rqst *rqstp, iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, rqstp->rq_bvec, 1 + count, sizeof(marker) + rqstp->rq_res.len); ret = sock_sendmsg(svsk->sk_sock, &msg); + page_frag_free(buf); if (ret < 0) return ret; *sentp += ret; -- 2.43.0

2 1

[PATCH OLK-5.10] random: Workaround for performance degrade
by GUO Zihua 28 Apr '24

28 Apr '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9K8D1 -------------------------------- A performance degrade is observed on boards with certain chips. Debugging shows that degrade is caused by the two line in drivers/char/random.c. The root cause of why these two lines would cause such degrade is still unknown. This patch is meant to be a workaround for said issue. Fixes: 6c315cc252ce ("random: use first 128 bits of input as fast init") Signed-off-by: GUO Zihua <guozihua(a)huawei.com> --- drivers/char/Kconfig | 9 +++++++ drivers/char/random.c | 55 ++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 63 insertions(+), 1 deletion(-) diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig index 677e16195d32..ae35511a78f2 100644 --- a/drivers/char/Kconfig +++ b/drivers/char/Kconfig @@ -513,4 +513,13 @@ config RANDOM_TRUST_BOOTLOADER believe its RNG facilities may be faulty. This may also be configured at boot time with "random.trust_bootloader=on/off". +config FIX_RANDOM_PERFORMANCE + bool "Fix random performance degrade on certain platform" + depends on ARM + default n + help + It's observed that there is a performance degrade related to random on + system with certain chip. The root cause is unknown and this config is + meant to be a workaround for that issue. + endmenu diff --git a/drivers/char/random.c b/drivers/char/random.c index 6aa1c013a2b7..88f3284d3088 100644 --- a/drivers/char/random.c +++ b/drivers/char/random.c @@ -347,8 +347,10 @@ static void crng_make_state(u32 chacha_state[CHACHA_STATE_WORDS], spin_lock_irqsave(&base_crng.lock, flags); ready = crng_ready(); if (!ready) { +#ifndef CONFIG_FIX_RANDOM_PERFORMANCE if (crng_init == CRNG_EMPTY) extract_entropy(base_crng.key, sizeof(base_crng.key)); +#endif crng_fast_key_erasure(base_crng.key, chacha_state, random_data, random_data_len); } @@ -392,6 +394,21 @@ static void crng_make_state(u32 chacha_state[CHACHA_STATE_WORDS], local_unlock_irqrestore(&crngs.lock, flags); } +#ifdef CONFIG_FIX_RANDOM_PERFORMANCE +/* + * Dummy function acting as a placeholder to 1380 performance degrade. + * This is a de-facto workaround produced from bunch of testing. The root + * casue of this performance issue is still unknown. + */ +static __aligned(64) void __used dummy(const void *input, size_t len, bool account) +{ +} + +static __aligned(64) void __used dummy2(const void *input, size_t len, bool account) +{ +} +#endif // CONFIG_FIX_RANDOM_PERFORMANCE + static void _get_random_bytes(void *buf, size_t len) { u32 chacha_state[CHACHA_STATE_WORDS]; @@ -860,6 +877,14 @@ void add_device_randomness(const void *buf, size_t len) _mix_pool_bytes(&entropy, sizeof(entropy)); _mix_pool_bytes(buf, len); spin_unlock_irqrestore(&input_pool.lock, flags); + +#ifdef CONFIG_FIX_RANDOM_PERFORMANCE + if (crng_init == CRNG_EMPTY && len) { + spin_lock_irqsave(&base_crng.lock, flags); + extract_entropy(base_crng.key, sizeof(base_crng.key)); + spin_unlock_irqrestore(&base_crng.lock, flags); + } +#endif } EXPORT_SYMBOL(add_device_randomness); @@ -870,7 +895,17 @@ EXPORT_SYMBOL(add_device_randomness); */ void add_hwgenerator_randomness(const void *buf, size_t len, size_t entropy) { +#ifdef CONFIG_FIX_RANDOM_PERFORMANCE + unsigned long flags; +#endif mix_pool_bytes(buf, len); +#ifdef CONFIG_FIX_RANDOM_PERFORMANCE + if (crng_init == CRNG_EMPTY) { + spin_lock_irqsave(&base_crng.lock, flags); + extract_entropy(base_crng.key, sizeof(base_crng.key)); + spin_unlock_irqrestore(&base_crng.lock, flags); + } +#endif credit_init_bits(entropy); /* @@ -965,6 +1000,9 @@ static void mix_interrupt_randomness(struct timer_list *work) */ unsigned long pool[2]; unsigned int count; +#ifdef CONFIG_FIX_RANDOM_PERFORMANCE + unsigned long flags; +#endif /* Check to see if we're running on the wrong CPU due to hotplug. */ local_irq_disable(); @@ -984,6 +1022,13 @@ static void mix_interrupt_randomness(struct timer_list *work) local_irq_enable(); mix_pool_bytes(pool, sizeof(pool)); +#ifdef CONFIG_FIX_RANDOM_PERFORMANCE + if (crng_init == CRNG_EMPTY) { + spin_lock_irqsave(&base_crng.lock, flags); + extract_entropy(base_crng.key, sizeof(base_crng.key)); + spin_unlock_irqrestore(&base_crng.lock, flags); + } +#endif credit_init_bits(clamp_t(unsigned int, (count & U16_MAX) / 64, 1, sizeof(pool) * 8)); memzero_explicit(pool, sizeof(pool)); @@ -1090,8 +1135,16 @@ static void add_timer_randomness(struct timer_rand_state *state, unsigned int nu */ if (in_irq()) this_cpu_ptr(&irq_randomness)->count += max(1u, bits * 64) - 1; - else + else { +#ifdef CONFIG_FIX_RANDOM_PERFORMANCE + if (crng_init == CRNG_EMPTY) { + spin_lock_irqsave(&base_crng.lock, flags); + extract_entropy(base_crng.key, sizeof(base_crng.key)); + spin_unlock_irqrestore(&base_crng.lock, flags); + } +#endif _credit_init_bits(bits); + } } void add_input_randomness(unsigned int type, unsigned int code, unsigned int value) -- 2.34.1

2 1

[PATCH] SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP
by wguanghao 28 Apr '24

28 Apr '24

From: Chuck Lever <chuck.lever(a)oracle.com> Jan Schunk reports that his small NFS servers suffer from memory exhaustion after just a few days. A bisect shows that commit e18e157bb5c8 ("SUNRPC: Send RPC message on TCP with a single sock_sendmsg() call") is the first bad commit. That commit assumed that sock_sendmsg() releases all the pages in the underlying bio_vec array, but the reality is that it doesn't. svc_xprt_release() releases the rqst's response pages, but the record marker page fragment isn't one of those, so it is never released. This is a narrow fix that can be applied to stable kernels. A more extensive fix is in the works. Reported-by: Jan Schunk <scpcom(a)gmx.de> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218671 Fixes: e18e157bb5c8 ("SUNRPC: Send RPC message on TCP with a single sock_sendmsg() call") Cc: Alexander Duyck <alexander.duyck(a)gmail.com> Cc: Jakub Kacinski <kuba(a)kernel.org> Cc: David Howells <dhowells(a)redhat.com> Reviewed-by: David Howells <dhowells(a)redhat.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> --- net/sunrpc/svcsock.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c index 545017a3daa4..6b3f01beb294 100644 --- a/net/sunrpc/svcsock.c +++ b/net/sunrpc/svcsock.c @@ -1206,15 +1206,6 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp) * MSG_SPLICE_PAGES is used exclusively to reduce the number of * copy operations in this path. Therefore the caller must ensure * that the pages backing @xdr are unchanging. - * - * Note that the send is non-blocking. The caller has incremented - * the reference count on each page backing the RPC message, and - * the network layer will "put" these pages when transmission is - * complete. - * - * This is safe for our RPC services because the memory backing - * the head and tail components is never kmalloc'd. These always - * come from pages in the svc_rqst::rq_pages array. */ static int svc_tcp_sendmsg(struct svc_sock *svsk, struct svc_rqst *rqstp, rpc_fraghdr marker, unsigned int *sentp) @@ -1244,6 +1235,7 @@ static int svc_tcp_sendmsg(struct svc_sock *svsk, struct svc_rqst *rqstp, iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, rqstp->rq_bvec, 1 + count, sizeof(marker) + rqstp->rq_res.len); ret = sock_sendmsg(svsk->sk_sock, &msg); + page_frag_free(buf); if (ret < 0) return ret; *sentp += ret; -- 2.39.2

1 0

[PATCH OLK-6.6] quota: Fix potential NULL pointer dereference
by Baokun Li 28 Apr '24

28 Apr '24

From: Wang Jianjian <wangjianjian3(a)huawei.com> stable inclusion from stable-v6.6.23 commit 40a673b4b07efd6f74ff3ab60f38b26aa91ee5d5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HJX7 CVE: CVE-2024-26878 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d0aa72604fbd80c8aabb46eda00535ed35570f1f ] Below race may cause NULL pointer dereference P1 P2 dquot_free_inode quota_off drop_dquot_ref remove_dquot_ref dquots = i_dquot(inode) dquots = i_dquot(inode) srcu_read_lock dquots[cnt]) != NULL (1) dquots[type] = NULL (2) spin_lock(&dquots[cnt]->dq_dqb_lock) (3) .... If dquot_free_inode(or other routines) checks inode's quota pointers (1) before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer dereference will be triggered. So let's fix it by using a temporary pointer to avoid this issue. Signed-off-by: Wang Jianjian <wangjianjian3(a)huawei.com> Signed-off-by: Jan Kara <jack(a)suse.cz> Message-Id: <20240202081852.2514092-1-wangjianjian3(a)huawei.com> Stable-dep-of: 179b8c97ebf6 ("quota: Fix rcu annotations of inode dquot pointers") Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/quota/dquot.c | 98 ++++++++++++++++++++++++++++-------------------- 1 file changed, 57 insertions(+), 41 deletions(-) diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c index 023b91b4e1f0..9707aa34f52e 100644 --- a/fs/quota/dquot.c +++ b/fs/quota/dquot.c @@ -399,15 +399,17 @@ int dquot_mark_dquot_dirty(struct dquot *dquot) EXPORT_SYMBOL(dquot_mark_dquot_dirty); /* Dirtify all the dquots - this can block when journalling */ -static inline int mark_all_dquot_dirty(struct dquot * const *dquot) +static inline int mark_all_dquot_dirty(struct dquot * const *dquots) { int ret, err, cnt; + struct dquot *dquot; ret = err = 0; for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (dquot[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (dquot) /* Even in case of error we have to continue */ - ret = mark_dquot_dirty(dquot[cnt]); + ret = mark_dquot_dirty(dquot); if (!err) err = ret; } @@ -1684,6 +1686,7 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags) struct dquot_warn warn[MAXQUOTAS]; int reserve = flags & DQUOT_SPACE_RESERVE; struct dquot **dquots; + struct dquot *dquot; if (!inode_quota_active(inode)) { if (reserve) { @@ -1703,27 +1706,26 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags) index = srcu_read_lock(&dquot_srcu); spin_lock(&inode->i_lock); for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; if (reserve) { - ret = dquot_add_space(dquots[cnt], 0, number, flags, - &warn[cnt]); + ret = dquot_add_space(dquot, 0, number, flags, &warn[cnt]); } else { - ret = dquot_add_space(dquots[cnt], number, 0, flags, - &warn[cnt]); + ret = dquot_add_space(dquot, number, 0, flags, &warn[cnt]); } if (ret) { /* Back out changes we already did */ for (cnt--; cnt >= 0; cnt--) { - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - spin_lock(&dquots[cnt]->dq_dqb_lock); + spin_lock(&dquot->dq_dqb_lock); if (reserve) - dquot_free_reserved_space(dquots[cnt], - number); + dquot_free_reserved_space(dquot, number); else - dquot_decr_space(dquots[cnt], number); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + dquot_decr_space(dquot, number); + spin_unlock(&dquot->dq_dqb_lock); } spin_unlock(&inode->i_lock); goto out_flush_warn; @@ -1754,6 +1756,7 @@ int dquot_alloc_inode(struct inode *inode) int cnt, ret = 0, index; struct dquot_warn warn[MAXQUOTAS]; struct dquot * const *dquots; + struct dquot *dquot; if (!inode_quota_active(inode)) return 0; @@ -1764,17 +1767,19 @@ int dquot_alloc_inode(struct inode *inode) index = srcu_read_lock(&dquot_srcu); spin_lock(&inode->i_lock); for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - ret = dquot_add_inodes(dquots[cnt], 1, &warn[cnt]); + ret = dquot_add_inodes(dquot, 1, &warn[cnt]); if (ret) { for (cnt--; cnt >= 0; cnt--) { - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; /* Back out changes we already did */ - spin_lock(&dquots[cnt]->dq_dqb_lock); - dquot_decr_inodes(dquots[cnt], 1); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + spin_lock(&dquot->dq_dqb_lock); + dquot_decr_inodes(dquot, 1); + spin_unlock(&dquot->dq_dqb_lock); } goto warn_put_all; } @@ -1796,6 +1801,7 @@ EXPORT_SYMBOL(dquot_alloc_inode); int dquot_claim_space_nodirty(struct inode *inode, qsize_t number) { struct dquot **dquots; + struct dquot *dquot; int cnt, index; if (!inode_quota_active(inode)) { @@ -1811,9 +1817,8 @@ int dquot_claim_space_nodirty(struct inode *inode, qsize_t number) spin_lock(&inode->i_lock); /* Claim reserved quotas to allocated quotas */ for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (dquots[cnt]) { - struct dquot *dquot = dquots[cnt]; - + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (dquot) { spin_lock(&dquot->dq_dqb_lock); if (WARN_ON_ONCE(dquot->dq_dqb.dqb_rsvspace < number)) number = dquot->dq_dqb.dqb_rsvspace; @@ -1838,6 +1843,7 @@ EXPORT_SYMBOL(dquot_claim_space_nodirty); void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number) { struct dquot **dquots; + struct dquot *dquot; int cnt, index; if (!inode_quota_active(inode)) { @@ -1853,9 +1859,8 @@ void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number) spin_lock(&inode->i_lock); /* Claim reserved quotas to allocated quotas */ for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (dquots[cnt]) { - struct dquot *dquot = dquots[cnt]; - + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (dquot) { spin_lock(&dquot->dq_dqb_lock); if (WARN_ON_ONCE(dquot->dq_dqb.dqb_curspace < number)) number = dquot->dq_dqb.dqb_curspace; @@ -1882,6 +1887,7 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags) unsigned int cnt; struct dquot_warn warn[MAXQUOTAS]; struct dquot **dquots; + struct dquot *dquot; int reserve = flags & DQUOT_SPACE_RESERVE, index; if (!inode_quota_active(inode)) { @@ -1902,17 +1908,18 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags) int wtype; warn[cnt].w_type = QUOTA_NL_NOWARN; - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - spin_lock(&dquots[cnt]->dq_dqb_lock); - wtype = info_bdq_free(dquots[cnt], number); + spin_lock(&dquot->dq_dqb_lock); + wtype = info_bdq_free(dquot, number); if (wtype != QUOTA_NL_NOWARN) - prepare_warning(&warn[cnt], dquots[cnt], wtype); + prepare_warning(&warn[cnt], dquot, wtype); if (reserve) - dquot_free_reserved_space(dquots[cnt], number); + dquot_free_reserved_space(dquot, number); else - dquot_decr_space(dquots[cnt], number); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + dquot_decr_space(dquot, number); + spin_unlock(&dquot->dq_dqb_lock); } if (reserve) *inode_reserved_space(inode) -= number; @@ -1937,6 +1944,7 @@ void dquot_free_inode(struct inode *inode) unsigned int cnt; struct dquot_warn warn[MAXQUOTAS]; struct dquot * const *dquots; + struct dquot *dquot; int index; if (!inode_quota_active(inode)) @@ -1947,16 +1955,16 @@ void dquot_free_inode(struct inode *inode) spin_lock(&inode->i_lock); for (cnt = 0; cnt < MAXQUOTAS; cnt++) { int wtype; - warn[cnt].w_type = QUOTA_NL_NOWARN; - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - spin_lock(&dquots[cnt]->dq_dqb_lock); - wtype = info_idq_free(dquots[cnt], 1); + spin_lock(&dquot->dq_dqb_lock); + wtype = info_idq_free(dquot, 1); if (wtype != QUOTA_NL_NOWARN) - prepare_warning(&warn[cnt], dquots[cnt], wtype); - dquot_decr_inodes(dquots[cnt], 1); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + prepare_warning(&warn[cnt], dquot, wtype); + dquot_decr_inodes(dquot, 1); + spin_unlock(&dquot->dq_dqb_lock); } spin_unlock(&inode->i_lock); mark_all_dquot_dirty(dquots); @@ -1983,7 +1991,7 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to) qsize_t rsv_space = 0; qsize_t inode_usage = 1; struct dquot *transfer_from[MAXQUOTAS] = {}; - int cnt, ret = 0; + int cnt, index, ret = 0; char is_valid[MAXQUOTAS] = {}; struct dquot_warn warn_to[MAXQUOTAS]; struct dquot_warn warn_from_inodes[MAXQUOTAS]; @@ -2072,8 +2080,16 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to) spin_unlock(&inode->i_lock); spin_unlock(&dq_data_lock); + /* + * These arrays are local and we hold dquot references so we don't need + * the srcu protection but still take dquot_srcu to avoid warning in + * mark_all_dquot_dirty(). + */ + index = srcu_read_lock(&dquot_srcu); mark_all_dquot_dirty(transfer_from); mark_all_dquot_dirty(transfer_to); + srcu_read_unlock(&dquot_srcu, index); + flush_warnings(warn_to); flush_warnings(warn_from_inodes); flush_warnings(warn_from_space); -- 2.31.1

2 1

[PATCH OLK-5.10] PCI/IOV: Improve performance of creating VFs concurrently
by Jialin Zhang 28 Apr '24

28 Apr '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9J08D -------------------------------- Previous commit 083577ae9d72 ("PCI/IOV: Add pci_sriov_numvfs_lock to support enable pci sriov concurrently") reduce performance of creating VFs belongs to different PFs. Fix it by checking whether a new bus will be created. Fixes: 083577ae9d72 ("PCI/IOV: Add pci_sriov_numvfs_lock to support enable pci sriov concurrently") Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/pci/iov.c | 40 +++++++++++++++++++++++++++++++++------- include/linux/pci.h | 8 ++++++++ 2 files changed, 41 insertions(+), 7 deletions(-) diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c index 7006413aa0a3..2190a6977c4e 100644 --- a/drivers/pci/iov.c +++ b/drivers/pci/iov.c @@ -240,6 +240,16 @@ int pci_iov_add_virtfn(struct pci_dev *dev, int id) return rc; } +int pci_iov_add_virtfn_locked(struct pci_dev *dev, int id) +{ + int rc; + + mutex_lock(&pci_sriov_numvfs_lock); + rc = pci_iov_add_virtfn(dev, id); + mutex_unlock(&pci_sriov_numvfs_lock); + return rc; +} + void pci_iov_remove_virtfn(struct pci_dev *dev, int id) { char buf[VIRTFN_ID_LEN]; @@ -269,6 +279,13 @@ void pci_iov_remove_virtfn(struct pci_dev *dev, int id) pci_dev_put(dev); } +void pci_iov_remove_virtfn_locked(struct pci_dev *dev, int id) +{ + mutex_lock(&pci_sriov_numvfs_lock); + pci_iov_remove_virtfn(dev, id); + mutex_unlock(&pci_sriov_numvfs_lock); +} + static ssize_t sriov_totalvfs_show(struct device *dev, struct device_attribute *attr, char *buf) @@ -315,7 +332,6 @@ static ssize_t sriov_numvfs_store(struct device *dev, if (num_vfs > pci_sriov_get_totalvfs(pdev)) return -ERANGE; - mutex_lock(&pci_sriov_numvfs_lock); device_lock(&pdev->dev); if (num_vfs == pdev->sriov->num_VFs) @@ -352,7 +368,6 @@ static ssize_t sriov_numvfs_store(struct device *dev, exit: device_unlock(&pdev->dev); - mutex_unlock(&pci_sriov_numvfs_lock); if (ret < 0) return ret; @@ -463,14 +478,21 @@ static int sriov_add_vfs(struct pci_dev *dev, u16 num_vfs) return 0; for (i = 0; i < num_vfs; i++) { - rc = pci_iov_add_virtfn(dev, i); + if (dev->bus->number != pci_iov_virtfn_bus(dev, i)) + rc = pci_iov_add_virtfn_locked(dev, i); + else + rc = pci_iov_add_virtfn(dev, i); if (rc) goto failed; } return 0; failed: - while (i--) - pci_iov_remove_virtfn(dev, i); + while (i--) { + if (dev->bus->number != pci_iov_virtfn_bus(dev, i)) + pci_iov_remove_virtfn_locked(dev, i); + else + pci_iov_remove_virtfn(dev, i); + } return rc; } @@ -590,8 +612,12 @@ static void sriov_del_vfs(struct pci_dev *dev) struct pci_sriov *iov = dev->sriov; int i; - for (i = 0; i < iov->num_VFs; i++) - pci_iov_remove_virtfn(dev, i); + for (i = 0; i < iov->num_VFs; i++) { + if (dev->bus->number != pci_iov_virtfn_bus(dev, i)) + pci_iov_remove_virtfn_locked(dev, i); + else + pci_iov_remove_virtfn(dev, i); + } } static void sriov_disable(struct pci_dev *dev) diff --git a/include/linux/pci.h b/include/linux/pci.h index 0c116b6383ef..1638ac9a557c 100644 --- a/include/linux/pci.h +++ b/include/linux/pci.h @@ -2125,7 +2125,9 @@ void pci_disable_sriov(struct pci_dev *dev); int pci_iov_sysfs_link(struct pci_dev *dev, struct pci_dev *virtfn, int id); int pci_iov_add_virtfn(struct pci_dev *dev, int id); +int pci_iov_add_virtfn_locked(struct pci_dev *dev, int id); void pci_iov_remove_virtfn(struct pci_dev *dev, int id); +void pci_iov_remove_virtfn_locked(struct pci_dev *dev, int id); int pci_num_vf(struct pci_dev *dev); int pci_vfs_assigned(struct pci_dev *dev); int pci_sriov_set_totalvfs(struct pci_dev *dev, u16 numvfs); @@ -2165,8 +2167,14 @@ static inline int pci_iov_add_virtfn(struct pci_dev *dev, int id) { return -ENOSYS; } +static inline int pci_iov_add_virtfn_locked(struct pci_dev *dev, int id) +{ + return -ENOSYS; +} static inline void pci_iov_remove_virtfn(struct pci_dev *dev, int id) { } +static inline void pci_iov_remove_virtfn_locked(struct pci_dev *dev, + int id) { } static inline void pci_disable_sriov(struct pci_dev *dev) { } static inline int pci_num_vf(struct pci_dev *dev) { return 0; } static inline int pci_vfs_assigned(struct pci_dev *dev) -- 2.25.1

2 1

[PATCH] SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP
by wguanghao 28 Apr '24

28 Apr '24

From: Chuck Lever <chuck.lever(a)oracle.com> Jan Schunk reports that his small NFS servers suffer from memory exhaustion after just a few days. A bisect shows that commit e18e157bb5c8 ("SUNRPC: Send RPC message on TCP with a single sock_sendmsg() call") is the first bad commit. That commit assumed that sock_sendmsg() releases all the pages in the underlying bio_vec array, but the reality is that it doesn't. svc_xprt_release() releases the rqst's response pages, but the record marker page fragment isn't one of those, so it is never released. This is a narrow fix that can be applied to stable kernels. A more extensive fix is in the works. Reported-by: Jan Schunk <scpcom(a)gmx.de> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218671 Fixes: e18e157bb5c8 ("SUNRPC: Send RPC message on TCP with a single sock_sendmsg() call") Cc: Alexander Duyck <alexander.duyck(a)gmail.com> Cc: Jakub Kacinski <kuba(a)kernel.org> Cc: David Howells <dhowells(a)redhat.com> Reviewed-by: David Howells <dhowells(a)redhat.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> --- net/sunrpc/svcsock.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c index 545017a3daa4..6b3f01beb294 100644 --- a/net/sunrpc/svcsock.c +++ b/net/sunrpc/svcsock.c @@ -1206,15 +1206,6 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp) * MSG_SPLICE_PAGES is used exclusively to reduce the number of * copy operations in this path. Therefore the caller must ensure * that the pages backing @xdr are unchanging. - * - * Note that the send is non-blocking. The caller has incremented - * the reference count on each page backing the RPC message, and - * the network layer will "put" these pages when transmission is - * complete. - * - * This is safe for our RPC services because the memory backing - * the head and tail components is never kmalloc'd. These always - * come from pages in the svc_rqst::rq_pages array. */ static int svc_tcp_sendmsg(struct svc_sock *svsk, struct svc_rqst *rqstp, rpc_fraghdr marker, unsigned int *sentp) @@ -1244,6 +1235,7 @@ static int svc_tcp_sendmsg(struct svc_sock *svsk, struct svc_rqst *rqstp, iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, rqstp->rq_bvec, 1 + count, sizeof(marker) + rqstp->rq_res.len); ret = sock_sendmsg(svsk->sk_sock, &msg); + page_frag_free(buf); if (ret < 0) return ret; *sentp += ret; -- 2.39.2

1 0

[openeuler:OLK-6.6 7547/7556] drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:860: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
by kernel test robot 28 Apr '24

28 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 6773f12aed5e797a2c93fd0f7632568554503971 commit: 4213ff7957de370c1cfe528c2bad1eb2e499038a [7547/7556] net/ethernet/huawei/hinic3: Add the CQM on which the RDMA depends config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240428/202404281612.QppNPnCk-lkp@…) compiler: clang version 18.1.4 (https://github.com/llvm/llvm-project e6c3289804a67ea0bb6a86fadbe454dd93b8d855) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240428/202404281612.QppNPnCk-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404281612.QppNPnCk-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c:1097: warning: expecting prototype for hinic_set_vf_dev_cap(). Prototype was for hinic3_init_vf_dev_cap() instead -- >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:863:5: warning: no previous prototype for function 'hinic3_global_func_id_hw' [-Wmissing-prototypes] 863 | u16 hinic3_global_func_id_hw(void *hwdev) | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:863:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 863 | u16 hinic3_global_func_id_hw(void *hwdev) | ^ | static >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:880:5: warning: no previous prototype for function 'hinic3_global_func_id_get' [-Wmissing-prototypes] 880 | int hinic3_global_func_id_get(void *hwdev, u16 *func_id) | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:880:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 880 | int hinic3_global_func_id_get(void *hwdev, u16 *func_id) | ^ | static 2 warnings generated. -- drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:312: warning: Function parameter or member 'attr6' not described in 'set_hwif_attr' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:773: warning: Function parameter or member 'hwdev' not described in 'hinic3_init_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:773: warning: Function parameter or member 'cfg_reg_base' not described in 'hinic3_init_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:773: warning: Function parameter or member 'intr_reg_base' not described in 'hinic3_init_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:773: warning: Function parameter or member 'mgmt_regs_base' not described in 'hinic3_init_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:773: warning: Function parameter or member 'db_base_phy' not described in 'hinic3_init_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:773: warning: Function parameter or member 'db_base' not described in 'hinic3_init_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:773: warning: Function parameter or member 'db_dwqe_len' not described in 'hinic3_init_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:773: warning: Excess function parameter 'hwif' description in 'hinic3_init_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:773: warning: Excess function parameter 'pdev' description in 'hinic3_init_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:839: warning: Function parameter or member 'hwdev' not described in 'hinic3_free_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:839: warning: Excess function parameter 'hwif' description in 'hinic3_free_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:839: warning: Excess function parameter 'pdev' description in 'hinic3_free_hwif' >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:860: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * get function id from register,used by sriov hot migration process drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:876: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * get function id, used by sriov hot migratition process. -- >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:46:6: warning: no previous prototype for function 'hinic3_get_master_host_mbox_enable' [-Wmissing-prototypes] 46 | bool hinic3_get_master_host_mbox_enable(void *hwdev) | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:46:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 46 | bool hinic3_get_master_host_mbox_enable(void *hwdev) | ^ | static >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:148:5: warning: no previous prototype for function '__mbox_to_host' [-Wmissing-prototypes] 148 | int __mbox_to_host(struct hinic3_hwdev *hwdev, enum hinic3_mod_type mod, | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:148:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 148 | int __mbox_to_host(struct hinic3_hwdev *hwdev, enum hinic3_mod_type mod, | ^ | static >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:547:5: warning: no previous prototype for function 'sw_func_ppf_mbox_handler' [-Wmissing-prototypes] 547 | int sw_func_ppf_mbox_handler(void *handle, u16 pf_idx, u16 vf_id, u16 cmd, | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:547:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 547 | int sw_func_ppf_mbox_handler(void *handle, u16 pf_idx, u16 vf_id, u16 cmd, | ^ | static >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:570:5: warning: no previous prototype for function '__ppf_process_mbox_msg' [-Wmissing-prototypes] 570 | int __ppf_process_mbox_msg(struct hinic3_hwdev *hwdev, u16 pf_idx, u16 vf_id, | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:570:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 570 | int __ppf_process_mbox_msg(struct hinic3_hwdev *hwdev, u16 pf_idx, u16 vf_id, | ^ | static >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:599:5: warning: no previous prototype for function 'hinic3_ppf_process_mbox_msg' [-Wmissing-prototypes] 599 | int hinic3_ppf_process_mbox_msg(struct hinic3_hwdev *hwdev, u16 pf_idx, u16 vf_id, | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:599:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 599 | int hinic3_ppf_process_mbox_msg(struct hinic3_hwdev *hwdev, u16 pf_idx, u16 vf_id, | ^ | static >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:643:5: warning: no previous prototype for function 'comm_ppf_mbox_handler' [-Wmissing-prototypes] 643 | int comm_ppf_mbox_handler(void *handle, u16 pf_idx, u16 vf_id, u16 cmd, | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:643:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 643 | int comm_ppf_mbox_handler(void *handle, u16 pf_idx, u16 vf_id, u16 cmd, | ^ | static >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:652:5: warning: no previous prototype for function 'hilink_ppf_mbox_handler' [-Wmissing-prototypes] 652 | int hilink_ppf_mbox_handler(void *handle, u16 pf_idx, u16 vf_id, u16 cmd, | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:652:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 652 | int hilink_ppf_mbox_handler(void *handle, u16 pf_idx, u16 vf_id, u16 cmd, | ^ | static >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:661:5: warning: no previous prototype for function 'hinic3_nic_ppf_mbox_handler' [-Wmissing-prototypes] 661 | int hinic3_nic_ppf_mbox_handler(void *handle, u16 pf_idx, u16 vf_id, u16 cmd, | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:661:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 661 | int hinic3_nic_ppf_mbox_handler(void *handle, u16 pf_idx, u16 vf_id, u16 cmd, | ^ | static >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:670:5: warning: no previous prototype for function 'hinic3_register_slave_ppf' [-Wmissing-prototypes] 670 | int hinic3_register_slave_ppf(struct hinic3_hwdev *hwdev, bool registered) | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:670:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 670 | int hinic3_register_slave_ppf(struct hinic3_hwdev *hwdev, bool registered) | ^ | static >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:743:5: warning: no previous prototype for function 'set_slave_func_nic_state' [-Wmissing-prototypes] 743 | int set_slave_func_nic_state(struct hinic3_hwdev *hwdev, | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:743:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 743 | int set_slave_func_nic_state(struct hinic3_hwdev *hwdev, | ^ | static >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:776:5: warning: no previous prototype for function 'get_slave_func_netdev_state' [-Wmissing-prototypes] 776 | int get_slave_func_netdev_state(struct hinic3_hwdev *hwdev, u16 func_idx, | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c:776:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 776 | int get_slave_func_netdev_state(struct hinic3_hwdev *hwdev, u16 func_idx, | ^ | static 11 warnings generated. -- >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:30:25: warning: no previous prototype for function 'cqm3_cmd_alloc' [-Wmissing-prototypes] 30 | struct tag_cqm_cmd_buf *cqm_cmd_alloc(void *ex_handle) | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h:13:44: note: expanded from macro 'cqm_cmd_alloc' 13 | #define cqm_cmd_alloc cqm3_cmd_alloc | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:30:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 30 | struct tag_cqm_cmd_buf *cqm_cmd_alloc(void *ex_handle) | ^ | static >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:55:6: warning: no previous prototype for function 'cqm3_cmd_free' [-Wmissing-prototypes] 55 | void cqm_cmd_free(void *ex_handle, struct tag_cqm_cmd_buf *cmd_buf) | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h:15:44: note: expanded from macro 'cqm_cmd_free' 15 | #define cqm_cmd_free cqm3_cmd_free | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:55:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 55 | void cqm_cmd_free(void *ex_handle, struct tag_cqm_cmd_buf *cmd_buf) | ^ | static >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:95:5: warning: no previous prototype for function 'cqm3_send_cmd_box' [-Wmissing-prototypes] 95 | s32 cqm_send_cmd_box(void *ex_handle, u8 mod, u8 cmd, struct tag_cqm_cmd_buf *buf_in, | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h:16:44: note: expanded from macro 'cqm_send_cmd_box' 16 | #define cqm_send_cmd_box cqm3_send_cmd_box | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:95:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 95 | s32 cqm_send_cmd_box(void *ex_handle, u8 mod, u8 cmd, struct tag_cqm_cmd_buf *buf_in, | ^ | static >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:141:5: warning: no previous prototype for function 'cqm3_lb_send_cmd_box' [-Wmissing-prototypes] 141 | s32 cqm_lb_send_cmd_box(void *ex_handle, u8 mod, u8 cmd, u8 cos_id, | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h:17:44: note: expanded from macro 'cqm_lb_send_cmd_box' 17 | #define cqm_lb_send_cmd_box cqm3_lb_send_cmd_box | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:141:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 141 | s32 cqm_lb_send_cmd_box(void *ex_handle, u8 mod, u8 cmd, u8 cos_id, | ^ | static >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:184:5: warning: no previous prototype for function 'cqm3_lb_send_cmd_box_async' [-Wmissing-prototypes] 184 | s32 cqm_lb_send_cmd_box_async(void *ex_handle, u8 mod, u8 cmd, | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h:18:44: note: expanded from macro 'cqm_lb_send_cmd_box_async' 18 | #define cqm_lb_send_cmd_box_async cqm3_lb_send_cmd_box_async | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:184:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 184 | s32 cqm_lb_send_cmd_box_async(void *ex_handle, u8 mod, u8 cmd, | ^ | static >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:226:5: warning: no previous prototype for function 'cqm3_send_cmd_imm' [-Wmissing-prototypes] 226 | s32 cqm_send_cmd_imm(void *ex_handle, u8 mod, u8 cmd, struct tag_cqm_cmd_buf *buf_in, | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h:19:44: note: expanded from macro 'cqm_send_cmd_imm' 19 | #define cqm_send_cmd_imm cqm3_send_cmd_imm | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:226:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 226 | s32 cqm_send_cmd_imm(void *ex_handle, u8 mod, u8 cmd, struct tag_cqm_cmd_buf *buf_in, | ^ | static 6 warnings generated. -- >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_db.c:75:6: warning: no previous prototype for function 'cqm3_db_addr_free' [-Wmissing-prototypes] 75 | void cqm_db_addr_free(void *ex_handle, const void __iomem *db_addr, | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h:21:44: note: expanded from macro 'cqm_db_addr_free' 21 | #define cqm_db_addr_free cqm3_db_addr_free | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_db.c:75:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 75 | void cqm_db_addr_free(void *ex_handle, const void __iomem *db_addr, | ^ | static >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_db.c:233:5: warning: no previous prototype for function 'cqm3_get_hardware_db_addr' [-Wmissing-prototypes] 233 | s32 cqm_get_hardware_db_addr(void *ex_handle, u64 *addr, | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h:14:44: note: expanded from macro 'cqm_get_hardware_db_addr' 14 | #define cqm_get_hardware_db_addr cqm3_get_hardware_db_addr | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_db.c:233:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 233 | s32 cqm_get_hardware_db_addr(void *ex_handle, u64 *addr, | ^ | static 2 warnings generated. -- >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object.c:1604:5: warning: no previous prototype for function 'cqm3_dtoe_share_recv_queue_create' [-Wmissing-prototypes] 1604 | s32 cqm_dtoe_share_recv_queue_create(void *ex_handle, u32 contex_size, | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h:47:44: note: expanded from macro 'cqm_dtoe_share_recv_queue_create' 47 | #define cqm_dtoe_share_recv_queue_create cqm3_dtoe_share_recv_queue_create | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_object.c:1604:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1604 | s32 cqm_dtoe_share_recv_queue_create(void *ex_handle, u32 contex_size, | ^ | static >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object.c:1649:6: warning: no previous prototype for function 'cqm3_dtoe_free_srq_bitmap_index' [-Wmissing-prototypes] 1649 | void cqm_dtoe_free_srq_bitmap_index(void *ex_handle, u32 index_count, u32 index) | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h:46:44: note: expanded from macro 'cqm_dtoe_free_srq_bitmap_index' 46 | #define cqm_dtoe_free_srq_bitmap_index cqm3_dtoe_free_srq_bitmap_index | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_object.c:1649:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1649 | void cqm_dtoe_free_srq_bitmap_index(void *ex_handle, u32 index_count, u32 index) | ^ | static 2 warnings generated. -- >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c:35: warning: Function parameter or member 'cqm_handle' not described in 'bloomfilter_init_cmd' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c:35: warning: expecting prototype for Prototype(). Prototype was for bloomfilter_init_cmd() instead >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c:207: warning: Function parameter or member 'ex_handle' not described in 'cqm_bloomfilter_init' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c:207: warning: expecting prototype for Prototype(). Prototype was for cqm_bloomfilter_init() instead >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c:242: warning: Function parameter or member 'ex_handle' not described in 'cqm_bloomfilter_uninit' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c:242: warning: expecting prototype for Prototype(). Prototype was for cqm_bloomfilter_uninit() instead >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c:265: warning: Function parameter or member 'ex_handle' not described in 'cqm_bloomfilter_cmd' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c:265: warning: Function parameter or member 'func_id' not described in 'cqm_bloomfilter_cmd' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c:265: warning: Function parameter or member 'op' not described in 'cqm_bloomfilter_cmd' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c:265: warning: Function parameter or member 'k_flag' not described in 'cqm_bloomfilter_cmd' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c:265: warning: Function parameter or member 'id' not described in 'cqm_bloomfilter_cmd' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c:265: warning: expecting prototype for Prototype(). Prototype was for cqm_bloomfilter_cmd() instead >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c:363: warning: Function parameter or member 'ex_handle' not described in 'cqm_bloomfilter_inc' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c:363: warning: Function parameter or member 'func_id' not described in 'cqm_bloomfilter_inc' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c:363: warning: Function parameter or member 'id' not described in 'cqm_bloomfilter_inc' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c:363: warning: expecting prototype for Prototype(). Prototype was for cqm_bloomfilter_inc() instead >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c:460: warning: Function parameter or member 'ex_handle' not described in 'cqm_bloomfilter_dec' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c:460: warning: Function parameter or member 'func_id' not described in 'cqm_bloomfilter_dec' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c:460: warning: Function parameter or member 'id' not described in 'cqm_bloomfilter_dec' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c:460: warning: expecting prototype for Prototype(). Prototype was for cqm_bloomfilter_dec() instead -- >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:31: warning: Function parameter or member 'ex_handle' not described in 'cqm_cmd_alloc' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:31: warning: expecting prototype for Prototype(). Prototype was for cqm_cmd_alloc() instead >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:56: warning: Function parameter or member 'ex_handle' not described in 'cqm_cmd_free' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:56: warning: Function parameter or member 'cmd_buf' not described in 'cqm_cmd_free' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:56: warning: expecting prototype for Prototype(). Prototype was for cqm_cmd_free() instead >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:98: warning: Function parameter or member 'ex_handle' not described in 'cqm_send_cmd_box' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:98: warning: Function parameter or member 'mod' not described in 'cqm_send_cmd_box' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:98: warning: Function parameter or member 'cmd' not described in 'cqm_send_cmd_box' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:98: warning: Function parameter or member 'buf_in' not described in 'cqm_send_cmd_box' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:98: warning: Function parameter or member 'buf_out' not described in 'cqm_send_cmd_box' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:98: warning: Function parameter or member 'out_param' not described in 'cqm_send_cmd_box' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:98: warning: Function parameter or member 'timeout' not described in 'cqm_send_cmd_box' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:98: warning: Function parameter or member 'channel' not described in 'cqm_send_cmd_box' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:98: warning: expecting prototype for Prototype(). Prototype was for cqm_send_cmd_box() instead >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:144: warning: Function parameter or member 'ex_handle' not described in 'cqm_lb_send_cmd_box' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:144: warning: Function parameter or member 'mod' not described in 'cqm_lb_send_cmd_box' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:144: warning: Function parameter or member 'cmd' not described in 'cqm_lb_send_cmd_box' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:144: warning: Function parameter or member 'cos_id' not described in 'cqm_lb_send_cmd_box' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:144: warning: Function parameter or member 'buf_in' not described in 'cqm_lb_send_cmd_box' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:144: warning: Function parameter or member 'buf_out' not described in 'cqm_lb_send_cmd_box' drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:144: warning: Function parameter or member 'out_param' not described in 'cqm_lb_send_cmd_box' drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:144: warning: Function parameter or member 'timeout' not described in 'cqm_lb_send_cmd_box' drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:144: warning: Function parameter or member 'channel' not described in 'cqm_lb_send_cmd_box' drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:144: warning: expecting prototype for Prototype(). Prototype was for cqm_lb_send_cmd_box() instead drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:187: warning: Function parameter or member 'ex_handle' not described in 'cqm_lb_send_cmd_box_async' drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:187: warning: Function parameter or member 'mod' not described in 'cqm_lb_send_cmd_box_async' drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:187: warning: Function parameter or member 'cmd' not described in 'cqm_lb_send_cmd_box_async' drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:187: warning: Function parameter or member 'cos_id' not described in 'cqm_lb_send_cmd_box_async' drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:187: warning: Function parameter or member 'buf_in' not described in 'cqm_lb_send_cmd_box_async' drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:187: warning: Function parameter or member 'channel' not described in 'cqm_lb_send_cmd_box_async' drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:187: warning: expecting prototype for Prototype(). Prototype was for cqm_lb_send_cmd_box_async() instead drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:228: warning: Function parameter or member 'ex_handle' not described in 'cqm_send_cmd_imm' drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:228: warning: Function parameter or member 'mod' not described in 'cqm_send_cmd_imm' drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:228: warning: Function parameter or member 'cmd' not described in 'cqm_send_cmd_imm' drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:228: warning: Function parameter or member 'buf_in' not described in 'cqm_send_cmd_imm' drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:228: warning: Function parameter or member 'out_param' not described in 'cqm_send_cmd_imm' drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:228: warning: Function parameter or member 'timeout' not described in 'cqm_send_cmd_imm' drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:228: warning: Function parameter or member 'channel' not described in 'cqm_send_cmd_imm' drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:228: warning: expecting prototype for Prototype(). Prototype was for cqm_send_cmd_imm() instead -- >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:44: warning: Function parameter or member 'srq_head_container' not described in 'cqm_container_free' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:44: warning: Function parameter or member 'srq_tail_container' not described in 'cqm_container_free' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:44: warning: Function parameter or member 'common' not described in 'cqm_container_free' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:44: warning: expecting prototype for Prototype(). Prototype was for cqm_container_free() instead >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:126: warning: Function parameter or member 'object' not described in 'cqm_container_create' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:126: warning: Function parameter or member 'container_addr' not described in 'cqm_container_create' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:126: warning: Function parameter or member 'link' not described in 'cqm_container_create' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:126: warning: expecting prototype for Prototype(). Prototype was for cqm_container_create() instead >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:228: warning: Function parameter or member 'object' not described in 'cqm_srq_container_init' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:228: warning: expecting prototype for Prototype(). Prototype was for cqm_srq_container_init() instead >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:280: warning: Function parameter or member 'object' not described in 'cqm_share_recv_queue_create' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:280: warning: expecting prototype for Prototype(). Prototype was for cqm_share_recv_queue_create() instead >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:348: warning: Function parameter or member 'object' not described in 'cqm_srq_used_rq_delete' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:348: warning: expecting prototype for Prototype(). Prototype was for cqm_srq_used_rq_delete() instead >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:408: warning: Function parameter or member 'object' not described in 'cqm_share_recv_queue_delete' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:408: warning: expecting prototype for Prototype(). Prototype was for cqm_share_recv_queue_delete() instead >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:458: warning: Function parameter or member 'object' not described in 'cqm_qpc_mpt_bitmap_alloc' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:458: warning: Function parameter or member 'cla_table' not described in 'cqm_qpc_mpt_bitmap_alloc' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:458: warning: Function parameter or member 'low2bit_align_en' not described in 'cqm_qpc_mpt_bitmap_alloc' >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:458: warning: expecting prototype for Prototype(). Prototype was for cqm_qpc_mpt_bitmap_alloc() instead drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:523: warning: Function parameter or member 'object' not described in 'cqm_qpc_mpt_create' drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:523: warning: Function parameter or member 'low2bit_align_en' not described in 'cqm_qpc_mpt_create' drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:523: warning: expecting prototype for Prototype(). Prototype was for cqm_qpc_mpt_create() instead drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:622: warning: Function parameter or member 'object' not described in 'cqm_qpc_mpt_delete' drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:622: warning: expecting prototype for Prototype(). Prototype was for cqm_qpc_mpt_delete() instead drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:704: warning: Function parameter or member 'buf' not described in 'cqm_linkwqe_fill' drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:704: warning: Function parameter or member 'wqe_per_buf' not described in 'cqm_linkwqe_fill' drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:704: warning: Function parameter or member 'wqe_size' not described in 'cqm_linkwqe_fill' drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:704: warning: Function parameter or member 'wqe_number' not described in 'cqm_linkwqe_fill' drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:704: warning: Function parameter or member 'tail' not described in 'cqm_linkwqe_fill' drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:704: warning: Function parameter or member 'link_mode' not described in 'cqm_linkwqe_fill' drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:704: warning: expecting prototype for Prototype(). Prototype was for cqm_linkwqe_fill() instead drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:889: warning: Function parameter or member 'object' not described in 'cqm_nonrdma_queue_create' drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:889: warning: expecting prototype for Prototype(). Prototype was for cqm_nonrdma_queue_create() instead drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:996: warning: Function parameter or member 'object' not described in 'cqm_nonrdma_queue_delete' drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:996: warning: expecting prototype for Prototype(). Prototype was for cqm_nonrdma_queue_delete() instead drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:1174: warning: Function parameter or member 'object' not described in 'cqm_rdma_queue_create' drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:1174: warning: expecting prototype for Prototype(). Prototype was for cqm_rdma_queue_create() instead drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:1258: warning: Function parameter or member 'object' not described in 'cqm_rdma_queue_delete' drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:1258: warning: expecting prototype for Prototype(). Prototype was for cqm_rdma_queue_delete() instead drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:1342: warning: Function parameter or member 'object' not described in 'cqm_rdma_table_create' drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:1342: warning: expecting prototype for Prototype(). Prototype was for cqm_rdma_table_create() instead drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:1391: warning: Function parameter or member 'object' not described in 'cqm_rdma_table_delete' drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:1391: warning: expecting prototype for Prototype(). Prototype was for cqm_rdma_table_delete() instead drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:1426: warning: Function parameter or member 'object' not described in 'cqm_rdma_table_offset_addr' drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:1426: warning: Function parameter or member 'offset' not described in 'cqm_rdma_table_offset_addr' drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:1426: warning: Function parameter or member 'paddr' not described in 'cqm_rdma_table_offset_addr' drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c:1426: warning: expecting prototype for Prototype(). Prototype was for cqm_rdma_table_offset_addr() instead .. vim +860 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c 763 764 /** 765 * hinic3_init_hwif - initialize the hw interface 766 * @hwif: the hardware interface of a pci function device 767 * @pdev: the pci device that will be part of the hwif struct 768 * Return: 0 - success, negative - failure 769 **/ 770 int hinic3_init_hwif(struct hinic3_hwdev *hwdev, void *cfg_reg_base, 771 void *intr_reg_base, void *mgmt_regs_base, u64 db_base_phy, 772 void *db_base, u64 db_dwqe_len) > 773 { 774 struct hinic3_hwif *hwif = NULL; 775 u32 attr1, attr4, attr5; 776 int err; 777 778 err = init_hwif(hwdev, cfg_reg_base, intr_reg_base, mgmt_regs_base); 779 if (err) 780 return err; 781 782 hwif = hwdev->hwif; 783 784 err = init_db_area_idx(hwif, db_base_phy, db_base, db_dwqe_len); 785 if (err) { 786 sdk_err(hwdev->dev_hdl, "Failed to init db area.\n"); 787 goto init_db_area_err; 788 } 789 790 err = wait_hwif_ready(hwdev); 791 if (err) { 792 attr1 = hinic3_hwif_read_reg(hwif, HINIC3_CSR_FUNC_ATTR1_ADDR); 793 sdk_err(hwdev->dev_hdl, "Chip status is not ready, attr1:0x%x\n", attr1); 794 goto hwif_ready_err; 795 } 796 797 err = get_hwif_attr(hwif); 798 if (err) { 799 sdk_err(hwdev->dev_hdl, "Get hwif attr failed\n"); 800 goto hwif_ready_err; 801 } 802 803 err = wait_until_doorbell_and_outbound_enabled(hwif); 804 if (err) { 805 attr4 = hinic3_hwif_read_reg(hwif, HINIC3_CSR_FUNC_ATTR4_ADDR); 806 attr5 = hinic3_hwif_read_reg(hwif, HINIC3_CSR_FUNC_ATTR5_ADDR); 807 sdk_err(hwdev->dev_hdl, "Hw doorbell/outbound is disabled, attr4 0x%x attr5 0x%x\n", 808 attr4, attr5); 809 goto hwif_ready_err; 810 } 811 812 select_ppf_mpf(hwdev); 813 814 disable_all_msix(hwdev); 815 /* disable mgmt cpu report any event */ 816 hinic3_set_pf_status(hwdev->hwif, HINIC3_PF_STATUS_INIT); 817 818 sdk_info(hwdev->dev_hdl, "global_func_idx: %u, func_type: %d, host_id: %u, ppf: %u, mpf: %u\n", 819 hwif->attr.func_global_idx, hwif->attr.func_type, hwif->attr.pci_intf_idx, 820 hwif->attr.ppf_idx, hwif->attr.mpf_idx); 821 822 return 0; 823 824 hwif_ready_err: 825 hinic3_show_chip_err_info(hwdev); 826 free_db_area(&hwif->free_db_area); 827 init_db_area_err: 828 kfree(hwif); 829 830 return err; 831 } 832 833 /** 834 * hinic3_free_hwif - free the hw interface 835 * @hwif: the hardware interface of a pci function device 836 * @pdev: the pci device that will be part of the hwif struct 837 **/ 838 void hinic3_free_hwif(struct hinic3_hwdev *hwdev) 839 { 840 spin_lock_deinit(&hwdev->hwif->free_db_area.idx_lock); 841 free_db_area(&hwdev->hwif->free_db_area); 842 enable_all_msix(hwdev); 843 kfree(hwdev->hwif); 844 } 845 846 u16 hinic3_global_func_id(void *hwdev) 847 { 848 struct hinic3_hwif *hwif = NULL; 849 850 if (!hwdev) 851 return 0; 852 853 hwif = ((struct hinic3_hwdev *)hwdev)->hwif; 854 855 return hwif->attr.func_global_idx; 856 } 857 EXPORT_SYMBOL(hinic3_global_func_id); 858 859 /** > 860 * get function id from register,used by sriov hot migration process 861 * @hwdev: the pointer to hw device 862 */ > 863 u16 hinic3_global_func_id_hw(void *hwdev) 864 { 865 u32 addr, attr0; 866 struct hinic3_hwdev *dev; 867 868 dev = (struct hinic3_hwdev *)hwdev; 869 addr = HINIC3_CSR_FUNC_ATTR0_ADDR; 870 attr0 = hinic3_hwif_read_reg(dev->hwif, addr); 871 872 return HINIC3_AF0_GET(attr0, FUNC_GLOBAL_IDX); 873 } 874 875 /** 876 * get function id, used by sriov hot migratition process. 877 * @hwdev: the pointer to hw device 878 * @func_id: function id 879 */ > 880 int hinic3_global_func_id_get(void *hwdev, u16 *func_id) 881 { 882 struct hinic3_hwdev *dev = (struct hinic3_hwdev *)hwdev; 883 884 if (!hwdev || !func_id) 885 return -EINVAL; 886 887 /* only vf get func_id from chip reg for sriov migrate */ 888 if (!HINIC3_IS_VF(dev)) { 889 *func_id = hinic3_global_func_id(hwdev); 890 return 0; 891 } 892 893 *func_id = hinic3_global_func_id_hw(dev); 894 return 0; 895 } 896 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
by Baogen Shang 28 Apr '24

28 Apr '24

From: Ranjan Kumar <ranjan.kumar(a)broadcom.com> stable inclusion from stable-v5.10.215 commit ba3a55d118bf211f4a7f53f83dafbc3405ea198d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9J6AL CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit ee0017c3ed8a8abfa4d40e42f908fb38c31e7515 ] If the driver detects that the controller is not ready before sending the first IOC facts command, it will wait for a maximum of 10 seconds for it to become ready. However, even if the controller becomes ready within 10 seconds, the driver will still issue a diagnostic reset. Modify the driver to avoid sending a diag reset if the controller becomes ready within the 10-second wait time. Signed-off-by: Ranjan Kumar <ranjan.kumar(a)broadcom.com> Link: https://lore.kernel.org/r/20240221071724.14986-1-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 4bf1ea39d21a..55200f5db150 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -6357,7 +6357,9 @@ _base_wait_for_iocstate(struct MPT3SAS_ADAPTER *ioc, int timeout) return -EFAULT; } - issue_diag_reset: + return 0; + +issue_diag_reset: rc = _base_diag_reset(ioc); return rc; } -- 2.33.0

1 0

[PATCH OLK-5.10] nvme-fc: do not wait in vain when unloading module
by Baogen Shang 28 Apr '24

28 Apr '24

From: Daniel Wagner <dwagner(a)suse.de> stable inclusion from stable-v5.10.215 commit 4f2c95015ec2a1899161be6c0bdaecedd5a7bfb2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9J6AL CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit 70fbfc47a392b98e5f8dba70c6efc6839205c982 ] The module exit path has race between deleting all controllers and freeing 'left over IDs'. To prevent double free a synchronization between nvme_delete_ctrl and ida_destroy has been added by the initial commit. There is some logic around trying to prevent from hanging forever in wait_for_completion, though it does not handling all cases. E.g. blktests is able to reproduce the situation where the module unload hangs forever. If we completely rely on the cleanup code executed from the nvme_delete_ctrl path, all IDs will be freed eventually. This makes calling ida_destroy unnecessary. We only have to ensure that all nvme_delete_ctrl code has been executed before we leave nvme_fc_exit_module. This is done by flushing the nvme_delete_wq workqueue. While at it, remove the unused nvme_fc_wq workqueue too. Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Hannes Reinecke <hare(a)suse.de> Signed-off-by: Daniel Wagner <dwagner(a)suse.de> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/nvme/host/fc.c | 47 ++++++------------------------------------ 1 file changed, 6 insertions(+), 41 deletions(-) diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c index b534a85e2bf1..92db88ceb96f 100644 --- a/drivers/nvme/host/fc.c +++ b/drivers/nvme/host/fc.c @@ -220,11 +220,6 @@ static LIST_HEAD(nvme_fc_lport_list); static DEFINE_IDA(nvme_fc_local_port_cnt); static DEFINE_IDA(nvme_fc_ctrl_cnt); -static struct workqueue_struct *nvme_fc_wq; - -static bool nvme_fc_waiting_to_unload; -static DECLARE_COMPLETION(nvme_fc_unload_proceed); - /* * These items are short-term. They will eventually be moved into * a generic FC class. See comments in module init. @@ -254,8 +249,6 @@ nvme_fc_free_lport(struct kref *ref) /* remove from transport list */ spin_lock_irqsave(&nvme_fc_lock, flags); list_del(&lport->port_list); - if (nvme_fc_waiting_to_unload && list_empty(&nvme_fc_lport_list)) - complete(&nvme_fc_unload_proceed); spin_unlock_irqrestore(&nvme_fc_lock, flags); ida_simple_remove(&nvme_fc_local_port_cnt, lport->localport.port_num); @@ -3823,10 +3816,6 @@ static int __init nvme_fc_init_module(void) { int ret; - nvme_fc_wq = alloc_workqueue("nvme_fc_wq", WQ_MEM_RECLAIM, 0); - if (!nvme_fc_wq) - return -ENOMEM; - /* * NOTE: * It is expected that in the future the kernel will combine @@ -3844,7 +3833,7 @@ static int __init nvme_fc_init_module(void) ret = class_register(&fc_class); if (ret) { pr_err("couldn't register class fc\n"); - goto out_destroy_wq; + return ret; } /* @@ -3868,8 +3857,6 @@ static int __init nvme_fc_init_module(void) device_destroy(&fc_class, MKDEV(0, 0)); out_destroy_class: class_unregister(&fc_class); -out_destroy_wq: - destroy_workqueue(nvme_fc_wq); return ret; } @@ -3889,45 +3876,23 @@ nvme_fc_delete_controllers(struct nvme_fc_rport *rport) spin_unlock(&rport->lock); } -static void -nvme_fc_cleanup_for_unload(void) +static void __exit nvme_fc_exit_module(void) { struct nvme_fc_lport *lport; struct nvme_fc_rport *rport; - - list_for_each_entry(lport, &nvme_fc_lport_list, port_list) { - list_for_each_entry(rport, &lport->endp_list, endp_list) { - nvme_fc_delete_controllers(rport); - } - } -} - -static void __exit nvme_fc_exit_module(void) -{ unsigned long flags; - bool need_cleanup = false; spin_lock_irqsave(&nvme_fc_lock, flags); - nvme_fc_waiting_to_unload = true; - if (!list_empty(&nvme_fc_lport_list)) { - need_cleanup = true; - nvme_fc_cleanup_for_unload(); - } + list_for_each_entry(lport, &nvme_fc_lport_list, port_list) + list_for_each_entry(rport, &lport->endp_list, endp_list) + nvme_fc_delete_controllers(rport); spin_unlock_irqrestore(&nvme_fc_lock, flags); - if (need_cleanup) { - pr_info("%s: waiting for ctlr deletes\n", __func__); - wait_for_completion(&nvme_fc_unload_proceed); - pr_info("%s: ctrl deletes complete\n", __func__); - } + flush_workqueue(nvme_delete_wq); nvmf_unregister_transport(&nvme_fc_transport); - ida_destroy(&nvme_fc_local_port_cnt); - ida_destroy(&nvme_fc_ctrl_cnt); - device_destroy(&fc_class, MKDEV(0, 0)); class_unregister(&fc_class); - destroy_workqueue(nvme_fc_wq); } module_init(nvme_fc_init_module); -- 2.33.0

1 0

[PATCH OLK-5.10] nvme-core: check for too small lba shift
by Baogen Shang 28 Apr '24

28 Apr '24

From: Keith Busch <kbusch(a)kernel.org> stable inclusion from stable-v5.10.215 commit 06a33eec1dc28dfbcd62c1ff94a3229f3ee265bc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9J6AL CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit 74fbc88e161424b3b96a22b23a8e3e1edab9d05c ] The block layer doesn't support logical block sizes smaller than 512 bytes. The nvme spec doesn't support that small either, but the driver isn't checking to make sure the device responded with usable data. Failing to catch this will result in a kernel bug, either from a division by zero when stacking, or a zero length bio. Reviewed-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/nvme/host/core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index 142f3a03509c..9fcc05c4f88c 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -2038,9 +2038,10 @@ static void nvme_update_disk_info(struct gendisk *disk, /* * The block layer can't support LBA sizes larger than the page size - * yet, so catch this early and don't allow block I/O. + * or smaller than a sector size yet, so catch this early and don't + * allow block I/O. */ - if (ns->lba_shift > PAGE_SHIFT) { + if (ns->lba_shift > PAGE_SHIFT || ns->lba_shift < SECTOR_SHIFT) { capacity = 0; bs = (1 << 9); } -- 2.33.0

1 0

[PATCH OLK-5.10] net/tg3: fix race condition in tg3_reset_task()
by Baogen Shang 28 Apr '24

28 Apr '24

From: Thinh Tran <thinhtr(a)linux.vnet.ibm.com> stable inclusion from stable-v5.10.215 commit 1059aa41c5a84abfab4cc7371d6b5ff2b30b6c2d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9J6AL CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit 16b55b1f2269962fb6b5154b8bf43f37c9a96637 ] When an EEH error is encountered by a PCI adapter, the EEH driver modifies the PCI channel's state as shown below: enum { /* I/O channel is in normal state */ pci_channel_io_normal = (__force pci_channel_state_t) 1, /* I/O to channel is blocked */ pci_channel_io_frozen = (__force pci_channel_state_t) 2, /* PCI card is dead */ pci_channel_io_perm_failure = (__force pci_channel_state_t) 3, }; If the same EEH error then causes the tg3 driver's transmit timeout logic to execute, the tg3_tx_timeout() function schedules a reset task via tg3_reset_task_schedule(), which may cause a race condition between the tg3 and EEH driver as both attempt to recover the HW via a reset action. EEH driver gets error event --> eeh_set_channel_state() and set device to one of error state above scheduler: tg3_reset_task() get returned error from tg3_init_hw() --> dev_close() shuts down the interface tg3_io_slot_reset() and tg3_io_resume() fail to reset/resume the device To resolve this issue, we avoid the race condition by checking the PCI channel state in the tg3_reset_task() function and skip the tg3 driver initiated reset when the PCI channel is not in the normal state. (The driver has no access to tg3 device registers at this point and cannot even complete the reset task successfully without external assistance.) We'll leave the reset procedure to be managed by the EEH driver which calls the tg3_io_error_detected(), tg3_io_slot_reset() and tg3_io_resume() functions as appropriate. Adding the same checking in tg3_dump_state() to avoid dumping all device registers when the PCI channel is not in the normal state. Signed-off-by: Thinh Tran <thinhtr(a)linux.vnet.ibm.com> Tested-by: Venkata Sai Duggi <venkata.sai.duggi(a)ibm.com> Reviewed-by: David Christensen <drc(a)linux.vnet.ibm.com> Reviewed-by: Michael Chan <michael.chan(a)broadcom.com> Link: https://lore.kernel.org/r/20231201001911.656-1-thinhtr@linux.vnet.ibm.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/net/ethernet/broadcom/tg3.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c index 4e74a3d44d1e..56ca913f0c2d 100644 --- a/drivers/net/ethernet/broadcom/tg3.c +++ b/drivers/net/ethernet/broadcom/tg3.c @@ -6454,6 +6454,14 @@ static void tg3_dump_state(struct tg3 *tp) int i; u32 *regs; + /* If it is a PCI error, all registers will be 0xffff, + * we don't dump them out, just report the error and return + */ + if (tp->pdev->error_state != pci_channel_io_normal) { + netdev_err(tp->dev, "PCI channel ERROR!\n"); + return; + } + regs = kzalloc(TG3_REG_BLK_SIZE, GFP_ATOMIC); if (!regs) return; @@ -11195,7 +11203,8 @@ static void tg3_reset_task(struct work_struct *work) rtnl_lock(); tg3_full_lock(tp, 0); - if (tp->pcierr_recovery || !netif_running(tp->dev)) { + if (tp->pcierr_recovery || !netif_running(tp->dev) || + tp->pdev->error_state != pci_channel_io_normal) { tg3_flag_clear(tp, RESET_TASK_PENDING); tg3_full_unlock(tp); rtnl_unlock(); -- 2.33.0

1 0

[PATCH OLK-5.10] drm/amd/pm: fix a double-free in si_dpm_init
by Baogen Shang 28 Apr '24

28 Apr '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> stable inclusion from stable-v5.10.215 commit aeed2b4e4a70c7568d4a5eecd6a109713c0dfbf4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9J6AL CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit ac16667237a82e2597e329eb9bc520d1cf9dff30 ] When the allocation of adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries fails, amdgpu_free_extended_power_table is called to free some fields of adev. However, when the control flow returns to si_dpm_sw_init, it goes to label dpm_failed and calls si_dpm_fini, which calls amdgpu_free_extended_power_table again and free those fields again. Thus a double-free is triggered. Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c index d6544a6dabc7..6f0653c81f8f 100644 --- a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c +++ b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c @@ -7349,10 +7349,9 @@ static int si_dpm_init(struct amdgpu_device *adev) kcalloc(4, sizeof(struct amdgpu_clock_voltage_dependency_entry), GFP_KERNEL); - if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) { - amdgpu_free_extended_power_table(adev); + if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) return -ENOMEM; - } + adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.count = 4; adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].clk = 0; adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].v = 0; -- 2.33.0

1 0

[PATCH OLK-5.10] drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
by Baogen Shang 28 Apr '24

28 Apr '24

From: Lu Yao <yaolu(a)kylinos.cn> stable inclusion from stable-v5.10.215 commit 974f127fcf6552ecd5b76c36c7b107e77b2febf9 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9J6AL CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit 2161e09cd05a50d80736fe397145340d2e8f6c05 ] For 'AMDGPU_FAMILY_SI' family cards, in 'si_common_early_init' func, init 'didt_rreg' and 'didt_wreg' to 'NULL'. But in func 'amdgpu_debugfs_regs_didt_read/write', using 'RREG32_DIDT' 'WREG32_DIDT' lacks of relevant judgment. And other 'amdgpu_ip_block_version' that use these two definitions won't be added for 'AMDGPU_FAMILY_SI'. So, add null pointer judgment before calling. Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Lu Yao <yaolu(a)kylinos.cn> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c index 48df32dd352e..3e573077368b 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c @@ -459,6 +459,9 @@ static ssize_t amdgpu_debugfs_regs_didt_read(struct file *f, char __user *buf, if (size & 0x3 || *pos & 0x3) return -EINVAL; + if (!adev->didt_rreg) + return -EOPNOTSUPP; + r = pm_runtime_get_sync(adev_to_drm(adev)->dev); if (r < 0) { pm_runtime_put_autosuspend(adev_to_drm(adev)->dev); @@ -518,6 +521,9 @@ static ssize_t amdgpu_debugfs_regs_didt_write(struct file *f, const char __user if (size & 0x3 || *pos & 0x3) return -EINVAL; + if (!adev->didt_wreg) + return -EOPNOTSUPP; + r = pm_runtime_get_sync(adev_to_drm(adev)->dev); if (r < 0) { pm_runtime_put_autosuspend(adev_to_drm(adev)->dev); -- 2.33.0

1 0

[PATCH OLK-5.10] drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
by Baogen Shang 28 Apr '24

28 Apr '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> stable inclusion from stable-v5.10.215 commit 330caa061af53ea6d287d7c43d0703714e510e08 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9J6AL CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit 9ccfe80d022df7c595f1925afb31de2232900656 ] The 'stream' pointer is used in dcn10_set_output_transfer_func() before the check if 'stream' is NULL. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn10/dcn10_hwseq.c:1892 dcn10_set_output_transfer_func() warn: variable dereferenced before check 'stream' (see line 1875) Fixes: ddef02de0d71 ("drm/amd/display: add null checks before logging") Cc: Wyatt Wood <wyatt.wood(a)amd.com> Cc: Anthony Koo <Anthony.Koo(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Anthony Koo <Anthony.Koo(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c index 1c669f115dd8..8cf6e307ae36 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c @@ -1669,6 +1669,9 @@ bool dcn10_set_output_transfer_func(struct dc *dc, struct pipe_ctx *pipe_ctx, { struct dpp *dpp = pipe_ctx->plane_res.dpp; + if (!stream) + return false; + if (dpp == NULL) return false; @@ -1691,8 +1694,8 @@ bool dcn10_set_output_transfer_func(struct dc *dc, struct pipe_ctx *pipe_ctx, } else dpp->funcs->dpp_program_regamma_pwl(dpp, NULL, OPP_REGAMMA_BYPASS); - if (stream != NULL && stream->ctx != NULL && - stream->out_transfer_func != NULL) { + if (stream->ctx && + stream->out_transfer_func) { log_tf(stream->ctx, stream->out_transfer_func, dpp->regamma_params.hw_points_num); -- 2.33.0

1 0

[PATCH OLK-5.10] drm/amd/display: Fix memory leak in dm_sw_fini()
by Baogen Shang 28 Apr '24

28 Apr '24

From: Armin Wolf <W_Armin(a)gmx.de> stable inclusion from stable-v5.10.215 commit b49b022f7dfce85eb77d0d987008fde5c01d7857 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9J6AL CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit bae67893578d608e35691dcdfa90c4957debf1d3 ] After destroying dmub_srv, the memory associated with it is not freed, causing a memory leak: unreferenced object 0xffff896302b45800 (size 1024): comm "(udev-worker)", pid 222, jiffies 4294894636 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 6265fd77): [<ffffffff993495ed>] kmalloc_trace+0x29d/0x340 [<ffffffffc0ea4a94>] dm_dmub_sw_init+0xb4/0x450 [amdgpu] [<ffffffffc0ea4e55>] dm_sw_init+0x15/0x2b0 [amdgpu] [<ffffffffc0ba8557>] amdgpu_device_init+0x1417/0x24e0 [amdgpu] [<ffffffffc0bab285>] amdgpu_driver_load_kms+0x15/0x190 [amdgpu] [<ffffffffc0ba09c7>] amdgpu_pci_probe+0x187/0x4e0 [amdgpu] [<ffffffff9968fd1e>] local_pci_probe+0x3e/0x90 [<ffffffff996918a3>] pci_device_probe+0xc3/0x230 [<ffffffff99805872>] really_probe+0xe2/0x480 [<ffffffff99805c98>] __driver_probe_device+0x78/0x160 [<ffffffff99805daf>] driver_probe_device+0x1f/0x90 [<ffffffff9980601e>] __driver_attach+0xce/0x1c0 [<ffffffff99803170>] bus_for_each_dev+0x70/0xc0 [<ffffffff99804822>] bus_add_driver+0x112/0x210 [<ffffffff99807245>] driver_register+0x55/0x100 [<ffffffff990012d1>] do_one_initcall+0x41/0x300 Fix this by freeing dmub_srv after destroying it. Fixes: 743b9786b14a ("drm/amd/display: Hook up the DMUB service in DM") Signed-off-by: Armin Wolf <W_Armin(a)gmx.de> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 54d6b4128721..3578e3b3536e 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -1456,6 +1456,7 @@ static int dm_sw_fini(void *handle) if (adev->dm.dmub_srv) { dmub_srv_destroy(adev->dm.dmub_srv); + kfree(adev->dm.dmub_srv); adev->dm.dmub_srv = NULL; } -- 2.33.0

1 0

[PATCH OLK-5.10] drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
by Baogen Shang 28 Apr '24

28 Apr '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> stable inclusion from stable-v5.10.215 commit ff28893c96c5e0927a4da10cd24a3522ca663515 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9J6AL CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit 4b09715f1504f1b6e8dff0e9643630610bc05141 ] Tell snprintf() to store at most 10 bytes in the output buffer instead of 30. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_debugfs.c:1508 dp_dsc_clock_en_read() error: snprintf() is printing too much 30 vs 10 Fixes: c06e09b76639 ("drm/amd/display: Add DSC parameters logging to debugfs") Cc: Alex Hung <alex.hung(a)amd.com> Cc: Qingqing Zhuo <qingqing.zhuo(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c index e43f82bcb231..32dbd2a27088 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c @@ -1179,7 +1179,7 @@ static ssize_t dp_dsc_clock_en_read(struct file *f, char __user *buf, const uint32_t rd_buf_size = 10; struct pipe_ctx *pipe_ctx; ssize_t result = 0; - int i, r, str_len = 30; + int i, r, str_len = 10; rd_buf = kcalloc(rd_buf_size, sizeof(char), GFP_KERNEL); -- 2.33.0

1 0

[PATCH OLK-5.10] drm/amdgpu: validate the parameters of bo mapping operations more clearly
by Guo Mengqi 28 Apr '24

28 Apr '24

From: xinhui pan <xinhui.pan(a)amd.com> mainline inclusion from mainline-v6.9-rc5 commit 6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9J3KG CVE: CVE-2024-26922 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Verify the parameters of amdgpu_vm_bo_(map/replace_map/clearing_mappings) in one common place. Fixes: dc54d3d1744d ("drm/amdgpu: implement AMDGPU_VA_OP_CLEAR v2") Cc: stable(a)vger.kernel.org Reported-by: Vlad Stolyarov <hexed(a)google.com> Suggested-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: xinhui pan <xinhui.pan(a)amd.com> Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 72 ++++++++++++++++---------- 1 file changed, 46 insertions(+), 26 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c index 8445bb7ae06a..ad3de971a087 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c @@ -2201,6 +2201,37 @@ static void amdgpu_vm_bo_insert_map(struct amdgpu_device *adev, trace_amdgpu_vm_bo_map(bo_va, mapping); } +/* Validate operation parameters to prevent potential abuse */ +static int amdgpu_vm_verify_parameters(struct amdgpu_device *adev, + struct amdgpu_bo *bo, + uint64_t saddr, + uint64_t offset, + uint64_t size) +{ + uint64_t tmp, lpfn; + + if (saddr & AMDGPU_GPU_PAGE_MASK + || offset & AMDGPU_GPU_PAGE_MASK + || size & AMDGPU_GPU_PAGE_MASK) + return -EINVAL; + + if (check_add_overflow(saddr, size, &tmp) + || check_add_overflow(offset, size, &tmp) + || size == 0 /* which also leads to end < begin */) + return -EINVAL; + + /* make sure object fit at this offset */ + if (bo && offset + size > amdgpu_bo_size(bo)) + return -EINVAL; + + /* Ensure last pfn not exceed max_pfn */ + lpfn = (saddr + size - 1) >> AMDGPU_GPU_PAGE_SHIFT; + if (lpfn >= adev->vm_manager.max_pfn) + return -EINVAL; + + return 0; +} + /** * amdgpu_vm_bo_map - map bo inside a vm * @@ -2227,21 +2258,14 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev, struct amdgpu_bo *bo = bo_va->base.bo; struct amdgpu_vm *vm = bo_va->base.vm; uint64_t eaddr; + int r; - /* validate the parameters */ - if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || size & ~PAGE_MASK) - return -EINVAL; - if (saddr + size <= saddr || offset + size <= offset) - return -EINVAL; - - /* make sure object fit at this offset */ - eaddr = saddr + size - 1; - if ((bo && offset + size > amdgpu_bo_size(bo)) || - (eaddr >= adev->vm_manager.max_pfn << AMDGPU_GPU_PAGE_SHIFT)) - return -EINVAL; + r = amdgpu_vm_verify_parameters(adev, bo, saddr, offset, size); + if (r) + return r; saddr /= AMDGPU_GPU_PAGE_SIZE; - eaddr /= AMDGPU_GPU_PAGE_SIZE; + eaddr = saddr + (size - 1) / AMDGPU_GPU_PAGE_SIZE; tmp = amdgpu_vm_it_iter_first(&vm->va, saddr, eaddr); if (tmp) { @@ -2294,17 +2318,9 @@ int amdgpu_vm_bo_replace_map(struct amdgpu_device *adev, uint64_t eaddr; int r; - /* validate the parameters */ - if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || size & ~PAGE_MASK) - return -EINVAL; - if (saddr + size <= saddr || offset + size <= offset) - return -EINVAL; - - /* make sure object fit at this offset */ - eaddr = saddr + size - 1; - if ((bo && offset + size > amdgpu_bo_size(bo)) || - (eaddr >= adev->vm_manager.max_pfn << AMDGPU_GPU_PAGE_SHIFT)) - return -EINVAL; + r = amdgpu_vm_verify_parameters(adev, bo, saddr, offset, size); + if (r) + return r; /* Allocate all the needed memory */ mapping = kmalloc(sizeof(*mapping), GFP_KERNEL); @@ -2318,7 +2334,7 @@ int amdgpu_vm_bo_replace_map(struct amdgpu_device *adev, } saddr /= AMDGPU_GPU_PAGE_SIZE; - eaddr /= AMDGPU_GPU_PAGE_SIZE; + eaddr = saddr + (size - 1) / AMDGPU_GPU_PAGE_SIZE; mapping->start = saddr; mapping->last = eaddr; @@ -2405,10 +2421,14 @@ int amdgpu_vm_bo_clear_mappings(struct amdgpu_device *adev, struct amdgpu_bo_va_mapping *before, *after, *tmp, *next; LIST_HEAD(removed); uint64_t eaddr; + int r; + + r = amdgpu_vm_verify_parameters(adev, NULL, saddr, 0, size); + if (r) + return r; - eaddr = saddr + size - 1; saddr /= AMDGPU_GPU_PAGE_SIZE; - eaddr /= AMDGPU_GPU_PAGE_SIZE; + eaddr = saddr + (size - 1) / AMDGPU_GPU_PAGE_SIZE; /* Allocate all the needed memory */ before = kzalloc(sizeof(*before), GFP_KERNEL); -- 2.17.1

2 1

[PATCH OLK-5.10 0/8] add LTS patches to OLK-5.10
by Zhengchao Shao 28 Apr '24

28 Apr '24

Add LTS patches to OLK-5.10. Ido Schimmel (3): genetlink: add CAP_NET_ADMIN test for multicast bind drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group genetlink: Use internal flags for multicast groups Patrick Rohr (3): net: add sysctl accept_ra_min_rtr_lft net: change accept_ra_min_rtr_lft to affect all RA lifetimes net: release reference to inet6_dev pointer Zhengchao Shao (2): genetlink: fix kabi change in struct genl_multicast_group net: fix kabi in struct ipv6_devconf Documentation/networking/ip-sysctl.rst | 8 +++++ include/linux/ipv6.h | 2 +- include/uapi/linux/ipv6.h | 7 ++++ net/core/drop_monitor.c | 4 ++- net/ipv6/addrconf.c | 13 ++++++++ net/ipv6/ndisc.c | 13 ++++++-- net/netlink/genetlink.c | 45 ++++++++++++++++++++++++++ 7 files changed, 88 insertions(+), 4 deletions(-) -- 2.34.1

2 9

[PATCH OLK-5.10 0/2] Fix random performance degrade on certain
by GUO Zihua 28 Apr '24

28 Apr '24

This patcset fixes performance degrades caused by random refactor on certain platforms. GUO Zihua (2): random: Workaround for performance degrade random: Update workaround for performance degrade drivers/char/Kconfig | 9 +++++++ drivers/char/random.c | 55 ++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 63 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/4] CVE-2024-26922
by Guo Mengqi 28 Apr '24

28 Apr '24

CVE-2024-26922 Chia-I Wu (1): amdgpu: validate offset_in_bo of drm_amdgpu_gem_va Rajneesh Bhardwaj (1): drm/amdgpu: restrict bo mapping within gpu address limits Xℹ Ruoyao (1): drm/amdgpu: check alignment on CPU page for bo map xinhui pan (1): drm/amdgpu: validate the parameters of bo mapping operations more clearly drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 70 +++++++++++++++++--------- 1 file changed, 46 insertions(+), 24 deletions(-) -- 2.17.1

2 5

[PATCH OLK-5.10 v2] Control KABI reservation codes with config
by GUO Zihua 28 Apr '24

28 Apr '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9K8D1 -------------------------------- Control KABI reservation codes with CONFIG_KABI_RESERVE. Minimizing risk. Signed-off-by: GUO Zihua <guozihua(a)huawei.com> --- v2: Fixed bugzilla. --- include/linux/proc_ns.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/include/linux/proc_ns.h b/include/linux/proc_ns.h index 81e99aa97cd7..737c98ebb7b3 100644 --- a/include/linux/proc_ns.h +++ b/include/linux/proc_ns.h @@ -16,7 +16,11 @@ struct inode; struct proc_ns_operations { const char *name; const char *real_ns_name; +#ifdef CONFIG_KABI_RESERVE u64 type; +#else + int type; +#endif struct ns_common *(*get)(struct task_struct *task); void (*put)(struct ns_common *ns); int (*install)(struct nsset *nsset, struct ns_common *ns); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/3] quota: fix CVE-2024-26878
by Baokun Li 28 Apr '24

28 Apr '24

Chengguang Xu (2): quota: code cleanup for __dquot_alloc_space() quota: check time limit when back out space/inode change Wang Jianjian (1): quota: Fix potential NULL pointer dereference fs/quota/dquot.c | 106 +++++++++++++++++++++++++++-------------------- 1 file changed, 60 insertions(+), 46 deletions(-) -- 2.31.1

2 4

[PATCH OLK-5.10] x86/thermal: Fix LVT thermal setup for SMI delivery mode
by liwei 28 Apr '24

28 Apr '24

From: Borislav Petkov <bp(a)suse.de> mainline inclusion from mainline-v5.13-rc5 commit 9a90ed065a155d13db0d0ffeaad5cc54e51c90c6 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9JNPZ CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------ There are machines out there with added value crap^WBIOS which provide an SMI handler for the local APIC thermal sensor interrupt. Out of reset, the BSP on those machines has something like 0x200 in that APIC register (timestamps left in because this whole issue is timing sensitive): [ 0.033858] read lvtthmr: 0x330, val: 0x200 which means: - bit 16 - the interrupt mask bit is clear and thus that interrupt is enabled - bits [10:8] have 010b which means SMI delivery mode. Now, later during boot, when the kernel programs the local APIC, it soft-disables it temporarily through the spurious vector register: setup_local_APIC: ... /* * If this comes from kexec/kcrash the APIC might be enabled in * SPIV. Soft disable it before doing further initialization. */ value = apic_read(APIC_SPIV); value &= ~APIC_SPIV_APIC_ENABLED; apic_write(APIC_SPIV, value); which means (from the SDM): "10.4.7.2 Local APIC State After It Has Been Software Disabled ... * The mask bits for all the LVT entries are set. Attempts to reset these bits will be ignored." And this happens too: [ 0.124111] APIC: Switch to symmetric I/O mode setup [ 0.124117] lvtthmr 0x200 before write 0xf to APIC 0xf0 [ 0.124118] lvtthmr 0x10200 after write 0xf to APIC 0xf0 This results in CPU 0 soft lockups depending on the placement in time when the APIC soft-disable happens. Those soft lockups are not 100% reproducible and the reason for that can only be speculated as no one tells you what SMM does. Likely, it confuses the SMM code that the APIC is disabled and the thermal interrupt doesn't doesn't fire at all, leading to CPU 0 stuck in SMM forever... Now, before 4f432e8bb15b ("x86/mce: Get rid of mcheck_intel_therm_init()") due to how the APIC_LVTTHMR was read before APIC initialization in mcheck_intel_therm_init(), it would read the value with the mask bit 16 clear and then intel_init_thermal() would replicate it onto the APs and all would be peachy - the thermal interrupt would remain enabled. But that commit moved that reading to a later moment in intel_init_thermal(), resulting in reading APIC_LVTTHMR on the BSP too late and with its interrupt mask bit set. Thus, revert back to the old behavior of reading the thermal LVT register before the APIC gets initialized. Fixes: 4f432e8bb15b ("x86/mce: Get rid of mcheck_intel_therm_init()") Reported-by: James Feeney <james(a)nurealm.net> Signed-off-by: Borislav Petkov <bp(a)suse.de> Cc: <stable(a)vger.kernel.org> Cc: Zhang Rui <rui.zhang(a)intel.com> Cc: Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> Link: https://lkml.kernel.org/r/YKIqDdFNaXYd39wz@zn.tnic Signed-off-by: liwei <liwei728(a)huawei.com> --- arch/x86/include/asm/thermal.h | 4 +++- arch/x86/kernel/setup.c | 9 +++++++++ drivers/thermal/intel/therm_throt.c | 15 +++++++++++---- 3 files changed, 23 insertions(+), 5 deletions(-) diff --git a/arch/x86/include/asm/thermal.h b/arch/x86/include/asm/thermal.h index ddbdefd5b94f..91a7b6687c3b 100644 --- a/arch/x86/include/asm/thermal.h +++ b/arch/x86/include/asm/thermal.h @@ -3,11 +3,13 @@ #define _ASM_X86_THERMAL_H #ifdef CONFIG_X86_THERMAL_VECTOR +void therm_lvt_init(void); void intel_init_thermal(struct cpuinfo_x86 *c); bool x86_thermal_enabled(void); void intel_thermal_interrupt(void); #else -static inline void intel_init_thermal(struct cpuinfo_x86 *c) { } +static inline void therm_lvt_init(void) { } +static inline void intel_init_thermal(struct cpuinfo_x86 *c) { } #endif #endif /* _ASM_X86_THERMAL_H */ diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c index 767eda3da5db..ab1fc9a65cac 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c @@ -47,6 +47,7 @@ #include <asm/pci-direct.h> #include <asm/prom.h> #include <asm/proto.h> +#include <asm/thermal.h> #include <asm/unwind.h> #include <asm/vsyscall.h> #include <linux/vmalloc.h> @@ -1100,6 +1101,14 @@ void __init setup_arch(char **cmdline_p) x86_init.timers.wallclock_init(); + /* + * This needs to run before setup_local_APIC() which soft-disables the + * local APIC temporarily and that masks the thermal LVT interrupt, + * leading to softlockups on machines which have configured SMI + * interrupt delivery. + */ + therm_lvt_init(); + mcheck_init(); register_refined_jiffies(CLOCK_TICK_RATE); diff --git a/drivers/thermal/intel/therm_throt.c b/drivers/thermal/intel/therm_throt.c index 8cc35a9f3862..2b06b9e59dcf 100644 --- a/drivers/thermal/intel/therm_throt.c +++ b/drivers/thermal/intel/therm_throt.c @@ -637,6 +637,17 @@ bool x86_thermal_enabled(void) return atomic_read(&therm_throt_en); } +void __init therm_lvt_init(void) +{ + /* + * This function is only called on boot CPU. Save the init thermal + * LVT value on BSP and use that value to restore APs' thermal LVT + * entry BIOS programmed later + */ + if (intel_thermal_supported(&boot_cpu_data)) + lvtthmr_init = apic_read(APIC_LVTTHMR); +} + void intel_init_thermal(struct cpuinfo_x86 *c) { unsigned int cpu = smp_processor_id(); @@ -646,10 +657,6 @@ void intel_init_thermal(struct cpuinfo_x86 *c) if (!intel_thermal_supported(c)) return; - /* On the BSP? */ - if (c == &boot_cpu_data) - lvtthmr_init = apic_read(APIC_LVTTHMR); - /* * First check if its enabled already, in which case there might * be some SMM goo which handles it, so we can't even put a handler -- 2.25.1

2 1

[PATCH OLK-5.10] x86: PM: Register syscore_ops for scale invariance
by liwei 28 Apr '24

28 Apr '24

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v5.11-rc5 commit 9c7d9017a49fb8516c13b7bff59b7da2abed23e1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9JNPZ CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------ On x86 scale invariace tends to be disabled during resume from suspend-to-RAM, because the MPERF or APERF MSR values are not as expected then due to updates taking place after the platform firmware has been invoked to complete the suspend transition. That, of course, is not desirable, especially if the schedutil scaling governor is in use, because the lack of scale invariance causes it to be less reliable. To counter that effect, modify init_freq_invariance() to register a syscore_ops object for scale invariance with the ->resume callback pointing to init_counter_refs() which will run on the CPU starting the resume transition (the other CPUs will be taken care of the "online" operations taking place later). Fixes: e2b0d619b400 ("x86, sched: check for counters overflow in frequency invariant accounting") Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Acked-by: Giovanni Gherdovich <ggherdovich(a)suse.cz> Link: https://lkml.kernel.org/r/1803209.Mvru99baaF@kreacher Conflicts: arch/x86/kernel/smpboot.c Signed-off-by: liwei <liwei728(a)huawei.com> --- arch/x86/kernel/smpboot.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c index df96e3f81d85..ab3ad40b2ce8 100644 --- a/arch/x86/kernel/smpboot.c +++ b/arch/x86/kernel/smpboot.c @@ -56,7 +56,11 @@ #include <linux/numa.h> #include <linux/pgtable.h> #include <linux/overflow.h> +<<<<<<< HEAD #include <linux/cpuset.h> +======= +#include <linux/syscore_ops.h> +>>>>>>> 9c7d9017a49f... x86: PM: Register syscore_ops for scale invariance #include <asm/acpi.h> #include <asm/desc.h> @@ -2115,6 +2119,23 @@ static void init_counter_refs(void) this_cpu_write(arch_prev_mperf, mperf); } +#ifdef CONFIG_PM_SLEEP +static struct syscore_ops freq_invariance_syscore_ops = { + .resume = init_counter_refs, +}; + +static void register_freq_invariance_syscore_ops(void) +{ + /* Bail out if registered already. */ + if (freq_invariance_syscore_ops.node.prev) + return; + + register_syscore_ops(&freq_invariance_syscore_ops); +} +#else +static inline void register_freq_invariance_syscore_ops(void) {} +#endif + static void init_freq_invariance(bool secondary) { bool ret = false; @@ -2135,6 +2156,7 @@ static void init_freq_invariance(bool secondary) if (ret) { init_counter_refs(); static_branch_enable(&arch_scale_freq_key); + register_freq_invariance_syscore_ops(); } else { pr_debug("Couldn't determine max cpu frequency, necessary for scale-invariant accounting.\n"); } -- 2.25.1

2 1

[PATCH OLK-5.10] static_call: Don't make __static_call_return0 static
by liwei 28 Apr '24

28 Apr '24

From: Christophe Leroy <christophe.leroy(a)csgroup.eu> mainline inclusion from mainline-v5.18-rc2 commit 8fd4ddda2f49a66bf5dd3d0c01966c4b1971308b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9JNPZ CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------ System.map shows that vmlinux contains several instances of __static_call_return0(): c0004fc0 t __static_call_return0 c0011518 t __static_call_return0 c00d8160 t __static_call_return0 arch_static_call_transform() uses the middle one to check whether we are setting a call to __static_call_return0 or not: c0011520 <arch_static_call_transform>: c0011520: 3d 20 c0 01 lis r9,-16383 <== r9 = 0xc001 << 16 c0011524: 39 29 15 18 addi r9,r9,5400 <== r9 += 0x1518 c0011528: 7c 05 48 00 cmpw r5,r9 <== r9 has value 0xc0011518 here So if static_call_update() is called with one of the other instances of __static_call_return0(), arch_static_call_transform() won't recognise it. In order to work properly, global single instance of __static_call_return0() is required. Fixes: 3f2a8fc4b15d ("static_call/x86: Add __static_call_return0()") Signed-off-by: Christophe Leroy <christophe.leroy(a)csgroup.eu> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Acked-by: Josh Poimboeuf <jpoimboe(a)redhat.com> Link: https://lkml.kernel.org/r/30821468a0e7d28251954b578e5051dc09300d04.16472584… Conflicts: kernel/Makefile kernel/static_call.c kernel/static_call_inline.c Signed-off-by: liwei <liwei728(a)huawei.com> --- include/linux/static_call.h | 5 +- kernel/Makefile | 3 +- kernel/static_call.c | 560 ----------------------------------- kernel/static_call_inline.c | 561 ++++++++++++++++++++++++++++++++++++ 4 files changed, 564 insertions(+), 565 deletions(-) create mode 100644 kernel/static_call_inline.c diff --git a/include/linux/static_call.h b/include/linux/static_call.h index 85ecc789f4ff..242a7924af18 100644 --- a/include/linux/static_call.h +++ b/include/linux/static_call.h @@ -221,10 +221,7 @@ static inline int static_call_text_reserved(void *start, void *end) return 0; } -static inline long __static_call_return0(void) -{ - return 0; -} +extern long __static_call_return0(void); #define EXPORT_STATIC_CALL(name) \ EXPORT_SYMBOL(STATIC_CALL_KEY(name)); \ diff --git a/kernel/Makefile b/kernel/Makefile index 3ae3b70c46e8..74be2e38d604 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -107,7 +107,8 @@ obj-$(CONFIG_CPU_PM) += cpu_pm.o obj-$(CONFIG_BPF) += bpf/ obj-$(CONFIG_KCSAN) += kcsan/ obj-$(CONFIG_SHADOW_CALL_STACK) += scs.o -obj-$(CONFIG_HAVE_STATIC_CALL_INLINE) += static_call.o +obj-$(CONFIG_HAVE_STATIC_CALL) += static_call.o +obj-$(CONFIG_HAVE_STATIC_CALL_INLINE) += static_call_inline.o obj-$(CONFIG_PERF_EVENTS) += events/ diff --git a/kernel/static_call.c b/kernel/static_call.c index d38f6a92e3e4..dae74642b3e1 100644 --- a/kernel/static_call.c +++ b/kernel/static_call.c @@ -1,567 +1,7 @@ // SPDX-License-Identifier: GPL-2.0 -#include <linux/init.h> #include <linux/static_call.h> -#include <linux/bug.h> -#include <linux/smp.h> -#include <linux/sort.h> -#include <linux/slab.h> -#include <linux/module.h> -#include <linux/cpu.h> -#include <linux/processor.h> -#include <asm/sections.h> - -extern struct static_call_site __start_static_call_sites[], - __stop_static_call_sites[]; -extern struct static_call_tramp_key __start_static_call_tramp_key[], - __stop_static_call_tramp_key[]; - -static bool static_call_initialized; - -/* mutex to protect key modules/sites */ -static DEFINE_MUTEX(static_call_mutex); - -static void static_call_lock(void) -{ - mutex_lock(&static_call_mutex); -} - -static void static_call_unlock(void) -{ - mutex_unlock(&static_call_mutex); -} - -static inline void *static_call_addr(struct static_call_site *site) -{ - return (void *)((long)site->addr + (long)&site->addr); -} - -static inline unsigned long __static_call_key(const struct static_call_site *site) -{ - return (long)site->key + (long)&site->key; -} - -static inline struct static_call_key *static_call_key(const struct static_call_site *site) -{ - return (void *)(__static_call_key(site) & ~STATIC_CALL_SITE_FLAGS); -} - -/* These assume the key is word-aligned. */ -static inline bool static_call_is_init(struct static_call_site *site) -{ - return __static_call_key(site) & STATIC_CALL_SITE_INIT; -} - -static inline bool static_call_is_tail(struct static_call_site *site) -{ - return __static_call_key(site) & STATIC_CALL_SITE_TAIL; -} - -static inline void static_call_set_init(struct static_call_site *site) -{ - site->key = (__static_call_key(site) | STATIC_CALL_SITE_INIT) - - (long)&site->key; -} - -static int static_call_site_cmp(const void *_a, const void *_b) -{ - const struct static_call_site *a = _a; - const struct static_call_site *b = _b; - const struct static_call_key *key_a = static_call_key(a); - const struct static_call_key *key_b = static_call_key(b); - - if (key_a < key_b) - return -1; - - if (key_a > key_b) - return 1; - - return 0; -} - -static void static_call_site_swap(void *_a, void *_b, int size) -{ - long delta = (unsigned long)_a - (unsigned long)_b; - struct static_call_site *a = _a; - struct static_call_site *b = _b; - struct static_call_site tmp = *a; - - a->addr = b->addr - delta; - a->key = b->key - delta; - - b->addr = tmp.addr + delta; - b->key = tmp.key + delta; -} - -static inline void static_call_sort_entries(struct static_call_site *start, - struct static_call_site *stop) -{ - sort(start, stop - start, sizeof(struct static_call_site), - static_call_site_cmp, static_call_site_swap); -} - -static inline bool static_call_key_has_mods(struct static_call_key *key) -{ - return !(key->type & 1); -} - -static inline struct static_call_mod *static_call_key_next(struct static_call_key *key) -{ - if (!static_call_key_has_mods(key)) - return NULL; - - return key->mods; -} - -static inline struct static_call_site *static_call_key_sites(struct static_call_key *key) -{ - if (static_call_key_has_mods(key)) - return NULL; - - return (struct static_call_site *)(key->type & ~1); -} - -void __static_call_update(struct static_call_key *key, void *tramp, void *func) -{ - struct static_call_site *site, *stop; - struct static_call_mod *site_mod, first; - - cpus_read_lock(); - static_call_lock(); - - if (key->func == func) - goto done; - - key->func = func; - - arch_static_call_transform(NULL, tramp, func, false); - - /* - * If uninitialized, we'll not update the callsites, but they still - * point to the trampoline and we just patched that. - */ - if (WARN_ON_ONCE(!static_call_initialized)) - goto done; - - first = (struct static_call_mod){ - .next = static_call_key_next(key), - .mod = NULL, - .sites = static_call_key_sites(key), - }; - - for (site_mod = &first; site_mod; site_mod = site_mod->next) { - bool init = system_state < SYSTEM_RUNNING; - struct module *mod = site_mod->mod; - - if (!site_mod->sites) { - /* - * This can happen if the static call key is defined in - * a module which doesn't use it. - * - * It also happens in the has_mods case, where the - * 'first' entry has no sites associated with it. - */ - continue; - } - - stop = __stop_static_call_sites; - - if (mod) { -#ifdef CONFIG_MODULES - stop = mod->static_call_sites + - mod->num_static_call_sites; - init = mod->state == MODULE_STATE_COMING; -#endif - } - - for (site = site_mod->sites; - site < stop && static_call_key(site) == key; site++) { - void *site_addr = static_call_addr(site); - - if (!init && static_call_is_init(site)) - continue; - - if (!kernel_text_address((unsigned long)site_addr)) { - /* - * This skips patching built-in __exit, which - * is part of init_section_contains() but is - * not part of kernel_text_address(). - * - * Skipping built-in __exit is fine since it - * will never be executed. - */ - WARN_ONCE(!static_call_is_init(site), - "can't patch static call site at %pS", - site_addr); - continue; - } - - arch_static_call_transform(site_addr, NULL, func, - static_call_is_tail(site)); - } - } - -done: - static_call_unlock(); - cpus_read_unlock(); -} -EXPORT_SYMBOL_GPL(__static_call_update); - -static int __static_call_init(struct module *mod, - struct static_call_site *start, - struct static_call_site *stop) -{ - struct static_call_site *site; - struct static_call_key *key, *prev_key = NULL; - struct static_call_mod *site_mod; - - if (start == stop) - return 0; - - static_call_sort_entries(start, stop); - - for (site = start; site < stop; site++) { - void *site_addr = static_call_addr(site); - - if ((mod && within_module_init((unsigned long)site_addr, mod)) || - (!mod && init_section_contains(site_addr, 1))) - static_call_set_init(site); - - key = static_call_key(site); - if (key != prev_key) { - prev_key = key; - - /* - * For vmlinux (!mod) avoid the allocation by storing - * the sites pointer in the key itself. Also see - * __static_call_update()'s @first. - * - * This allows architectures (eg. x86) to call - * static_call_init() before memory allocation works. - */ - if (!mod) { - key->sites = site; - key->type |= 1; - goto do_transform; - } - - site_mod = kzalloc(sizeof(*site_mod), GFP_KERNEL); - if (!site_mod) - return -ENOMEM; - - /* - * When the key has a direct sites pointer, extract - * that into an explicit struct static_call_mod, so we - * can have a list of modules. - */ - if (static_call_key_sites(key)) { - site_mod->mod = NULL; - site_mod->next = NULL; - site_mod->sites = static_call_key_sites(key); - - key->mods = site_mod; - - site_mod = kzalloc(sizeof(*site_mod), GFP_KERNEL); - if (!site_mod) - return -ENOMEM; - } - - site_mod->mod = mod; - site_mod->sites = site; - site_mod->next = static_call_key_next(key); - key->mods = site_mod; - } - -do_transform: - arch_static_call_transform(site_addr, NULL, key->func, - static_call_is_tail(site)); - } - - return 0; -} - -static int addr_conflict(struct static_call_site *site, void *start, void *end) -{ - unsigned long addr = (unsigned long)static_call_addr(site); - - if (addr <= (unsigned long)end && - addr + CALL_INSN_SIZE > (unsigned long)start) - return 1; - - return 0; -} - -static int __static_call_text_reserved(struct static_call_site *iter_start, - struct static_call_site *iter_stop, - void *start, void *end, bool init) -{ - struct static_call_site *iter = iter_start; - - while (iter < iter_stop) { - if (init || !static_call_is_init(iter)) { - if (addr_conflict(iter, start, end)) - return 1; - } - iter++; - } - - return 0; -} - -#ifdef CONFIG_MODULES - -static int __static_call_mod_text_reserved(void *start, void *end) -{ - struct module *mod; - int ret; - - preempt_disable(); - mod = __module_text_address((unsigned long)start); - WARN_ON_ONCE(__module_text_address((unsigned long)end) != mod); - if (!try_module_get(mod)) - mod = NULL; - preempt_enable(); - - if (!mod) - return 0; - - ret = __static_call_text_reserved(mod->static_call_sites, - mod->static_call_sites + mod->num_static_call_sites, - start, end, mod->state == MODULE_STATE_COMING); - - module_put(mod); - - return ret; -} - -static unsigned long tramp_key_lookup(unsigned long addr) -{ - struct static_call_tramp_key *start = __start_static_call_tramp_key; - struct static_call_tramp_key *stop = __stop_static_call_tramp_key; - struct static_call_tramp_key *tramp_key; - - for (tramp_key = start; tramp_key != stop; tramp_key++) { - unsigned long tramp; - - tramp = (long)tramp_key->tramp + (long)&tramp_key->tramp; - if (tramp == addr) - return (long)tramp_key->key + (long)&tramp_key->key; - } - - return 0; -} - -static int static_call_add_module(struct module *mod) -{ - struct static_call_site *start = mod->static_call_sites; - struct static_call_site *stop = start + mod->num_static_call_sites; - struct static_call_site *site; - - if (unlikely(!mod_klp_rel_completed(mod))) - return 0; - - for (site = start; site != stop; site++) { - unsigned long s_key = __static_call_key(site); - unsigned long addr = s_key & ~STATIC_CALL_SITE_FLAGS; - unsigned long key; - - /* - * Is the key is exported, 'addr' points to the key, which - * means modules are allowed to call static_call_update() on - * it. - * - * Otherwise, the key isn't exported, and 'addr' points to the - * trampoline so we need to lookup the key. - * - * We go through this dance to prevent crazy modules from - * abusing sensitive static calls. - */ - if (!kernel_text_address(addr)) - continue; - - key = tramp_key_lookup(addr); - if (!key) { - pr_warn("Failed to fixup __raw_static_call() usage at: %ps\n", - static_call_addr(site)); - return -EINVAL; - } - - key |= s_key & STATIC_CALL_SITE_FLAGS; - site->key = key - (long)&site->key; - } - - return __static_call_init(mod, start, stop); -} - -static void static_call_del_module(struct module *mod) -{ - struct static_call_site *start = mod->static_call_sites; - struct static_call_site *stop = mod->static_call_sites + - mod->num_static_call_sites; - struct static_call_key *key, *prev_key = NULL; - struct static_call_mod *site_mod, **prev; - struct static_call_site *site; - - if (unlikely(!mod_klp_rel_completed(mod))) - return; - - for (site = start; site < stop; site++) { - key = static_call_key(site); - if (key == prev_key) - continue; - - prev_key = key; - - for (prev = &key->mods, site_mod = key->mods; - site_mod && site_mod->mod != mod; - prev = &site_mod->next, site_mod = site_mod->next) - ; - - if (!site_mod) - continue; - - *prev = site_mod->next; - kfree(site_mod); - } -} - -static int static_call_module_notify(struct notifier_block *nb, - unsigned long val, void *data) -{ - struct module *mod = data; - int ret = 0; - - cpus_read_lock(); - static_call_lock(); - - switch (val) { - case MODULE_STATE_COMING: - ret = static_call_add_module(mod); - if (ret) { - WARN(1, "Failed to allocate memory for static calls"); - static_call_del_module(mod); - } - break; - case MODULE_STATE_GOING: - static_call_del_module(mod); - break; - } - - static_call_unlock(); - cpus_read_unlock(); - - return notifier_from_errno(ret); -} - -static struct notifier_block static_call_module_nb = { - .notifier_call = static_call_module_notify, -}; - -int klp_static_call_register(struct module *mod) -{ - int ret; - - ret = static_call_module_notify(&static_call_module_nb, MODULE_STATE_COMING, mod); - return notifier_to_errno(ret); -} - -#else - -int klp_static_call_register(struct module *mod) -{ - return 0; -} - -static inline int __static_call_mod_text_reserved(void *start, void *end) -{ - return 0; -} - -#endif /* CONFIG_MODULES */ - -int static_call_text_reserved(void *start, void *end) -{ - bool init = system_state < SYSTEM_RUNNING; - int ret = __static_call_text_reserved(__start_static_call_sites, - __stop_static_call_sites, start, end, init); - - if (ret) - return ret; - - return __static_call_mod_text_reserved(start, end); -} - -int __init static_call_init(void) -{ - int ret; - - if (static_call_initialized) - return 0; - - cpus_read_lock(); - static_call_lock(); - ret = __static_call_init(NULL, __start_static_call_sites, - __stop_static_call_sites); - static_call_unlock(); - cpus_read_unlock(); - - if (ret) { - pr_err("Failed to allocate memory for static_call!\n"); - BUG(); - } - - static_call_initialized = true; - -#ifdef CONFIG_MODULES - register_module_notifier(&static_call_module_nb); -#endif - return 0; -} -early_initcall(static_call_init); long __static_call_return0(void) { return 0; } - -#ifdef CONFIG_STATIC_CALL_SELFTEST - -static int func_a(int x) -{ - return x+1; -} - -static int func_b(int x) -{ - return x+2; -} - -DEFINE_STATIC_CALL(sc_selftest, func_a); - -static struct static_call_data { - int (*func)(int); - int val; - int expect; -} static_call_data [] __initdata = { - { NULL, 2, 3 }, - { func_b, 2, 4 }, - { func_a, 2, 3 } -}; - -static int __init test_static_call_init(void) -{ - int i; - - for (i = 0; i < ARRAY_SIZE(static_call_data); i++ ) { - struct static_call_data *scd = &static_call_data[i]; - - if (scd->func) - static_call_update(sc_selftest, scd->func); - - WARN_ON(static_call(sc_selftest)(scd->val) != scd->expect); - } - - return 0; -} -early_initcall(test_static_call_init); - -#endif /* CONFIG_STATIC_CALL_SELFTEST */ diff --git a/kernel/static_call_inline.c b/kernel/static_call_inline.c new file mode 100644 index 000000000000..6daefd258845 --- /dev/null +++ b/kernel/static_call_inline.c @@ -0,0 +1,561 @@ +// SPDX-License-Identifier: GPL-2.0 +#include <linux/static_call.h> +#include <linux/bug.h> +#include <linux/smp.h> +#include <linux/sort.h> +#include <linux/slab.h> +#include <linux/module.h> +#include <linux/cpu.h> +#include <linux/processor.h> +#include <asm/sections.h> + +extern struct static_call_site __start_static_call_sites[], + __stop_static_call_sites[]; +extern struct static_call_tramp_key __start_static_call_tramp_key[], + __stop_static_call_tramp_key[]; + +static bool static_call_initialized; + +/* mutex to protect key modules/sites */ +static DEFINE_MUTEX(static_call_mutex); + +static void static_call_lock(void) +{ + mutex_lock(&static_call_mutex); +} + +static void static_call_unlock(void) +{ + mutex_unlock(&static_call_mutex); +} + +static inline void *static_call_addr(struct static_call_site *site) +{ + return (void *)((long)site->addr + (long)&site->addr); +} + +static inline unsigned long __static_call_key(const struct static_call_site *site) +{ + return (long)site->key + (long)&site->key; +} + +static inline struct static_call_key *static_call_key(const struct static_call_site *site) +{ + return (void *)(__static_call_key(site) & ~STATIC_CALL_SITE_FLAGS); +} + +/* These assume the key is word-aligned. */ +static inline bool static_call_is_init(struct static_call_site *site) +{ + return __static_call_key(site) & STATIC_CALL_SITE_INIT; +} + +static inline bool static_call_is_tail(struct static_call_site *site) +{ + return __static_call_key(site) & STATIC_CALL_SITE_TAIL; +} + +static inline void static_call_set_init(struct static_call_site *site) +{ + site->key = (__static_call_key(site) | STATIC_CALL_SITE_INIT) - + (long)&site->key; +} + +static int static_call_site_cmp(const void *_a, const void *_b) +{ + const struct static_call_site *a = _a; + const struct static_call_site *b = _b; + const struct static_call_key *key_a = static_call_key(a); + const struct static_call_key *key_b = static_call_key(b); + + if (key_a < key_b) + return -1; + + if (key_a > key_b) + return 1; + + return 0; +} + +static void static_call_site_swap(void *_a, void *_b, int size) +{ + long delta = (unsigned long)_a - (unsigned long)_b; + struct static_call_site *a = _a; + struct static_call_site *b = _b; + struct static_call_site tmp = *a; + + a->addr = b->addr - delta; + a->key = b->key - delta; + + b->addr = tmp.addr + delta; + b->key = tmp.key + delta; +} + +static inline void static_call_sort_entries(struct static_call_site *start, + struct static_call_site *stop) +{ + sort(start, stop - start, sizeof(struct static_call_site), + static_call_site_cmp, static_call_site_swap); +} + +static inline bool static_call_key_has_mods(struct static_call_key *key) +{ + return !(key->type & 1); +} + +static inline struct static_call_mod *static_call_key_next(struct static_call_key *key) +{ + if (!static_call_key_has_mods(key)) + return NULL; + + return key->mods; +} + +static inline struct static_call_site *static_call_key_sites(struct static_call_key *key) +{ + if (static_call_key_has_mods(key)) + return NULL; + + return (struct static_call_site *)(key->type & ~1); +} + +void __static_call_update(struct static_call_key *key, void *tramp, void *func) +{ + struct static_call_site *site, *stop; + struct static_call_mod *site_mod, first; + + cpus_read_lock(); + static_call_lock(); + + if (key->func == func) + goto done; + + key->func = func; + + arch_static_call_transform(NULL, tramp, func, false); + + /* + * If uninitialized, we'll not update the callsites, but they still + * point to the trampoline and we just patched that. + */ + if (WARN_ON_ONCE(!static_call_initialized)) + goto done; + + first = (struct static_call_mod){ + .next = static_call_key_next(key), + .mod = NULL, + .sites = static_call_key_sites(key), + }; + + for (site_mod = &first; site_mod; site_mod = site_mod->next) { + bool init = system_state < SYSTEM_RUNNING; + struct module *mod = site_mod->mod; + + if (!site_mod->sites) { + /* + * This can happen if the static call key is defined in + * a module which doesn't use it. + * + * It also happens in the has_mods case, where the + * 'first' entry has no sites associated with it. + */ + continue; + } + + stop = __stop_static_call_sites; + + if (mod) { +#ifdef CONFIG_MODULES + stop = mod->static_call_sites + + mod->num_static_call_sites; + init = mod->state == MODULE_STATE_COMING; +#endif + } + + for (site = site_mod->sites; + site < stop && static_call_key(site) == key; site++) { + void *site_addr = static_call_addr(site); + + if (!init && static_call_is_init(site)) + continue; + + if (!kernel_text_address((unsigned long)site_addr)) { + /* + * This skips patching built-in __exit, which + * is part of init_section_contains() but is + * not part of kernel_text_address(). + * + * Skipping built-in __exit is fine since it + * will never be executed. + */ + WARN_ONCE(!static_call_is_init(site), + "can't patch static call site at %pS", + site_addr); + continue; + } + + arch_static_call_transform(site_addr, NULL, func, + static_call_is_tail(site)); + } + } + +done: + static_call_unlock(); + cpus_read_unlock(); +} +EXPORT_SYMBOL_GPL(__static_call_update); + +static int __static_call_init(struct module *mod, + struct static_call_site *start, + struct static_call_site *stop) +{ + struct static_call_site *site; + struct static_call_key *key, *prev_key = NULL; + struct static_call_mod *site_mod; + + if (start == stop) + return 0; + + static_call_sort_entries(start, stop); + + for (site = start; site < stop; site++) { + void *site_addr = static_call_addr(site); + + if ((mod && within_module_init((unsigned long)site_addr, mod)) || + (!mod && init_section_contains(site_addr, 1))) + static_call_set_init(site); + + key = static_call_key(site); + if (key != prev_key) { + prev_key = key; + + /* + * For vmlinux (!mod) avoid the allocation by storing + * the sites pointer in the key itself. Also see + * __static_call_update()'s @first. + * + * This allows architectures (eg. x86) to call + * static_call_init() before memory allocation works. + */ + if (!mod) { + key->sites = site; + key->type |= 1; + goto do_transform; + } + + site_mod = kzalloc(sizeof(*site_mod), GFP_KERNEL); + if (!site_mod) + return -ENOMEM; + + /* + * When the key has a direct sites pointer, extract + * that into an explicit struct static_call_mod, so we + * can have a list of modules. + */ + if (static_call_key_sites(key)) { + site_mod->mod = NULL; + site_mod->next = NULL; + site_mod->sites = static_call_key_sites(key); + + key->mods = site_mod; + + site_mod = kzalloc(sizeof(*site_mod), GFP_KERNEL); + if (!site_mod) + return -ENOMEM; + } + + site_mod->mod = mod; + site_mod->sites = site; + site_mod->next = static_call_key_next(key); + key->mods = site_mod; + } + +do_transform: + arch_static_call_transform(site_addr, NULL, key->func, + static_call_is_tail(site)); + } + + return 0; +} + +static int addr_conflict(struct static_call_site *site, void *start, void *end) +{ + unsigned long addr = (unsigned long)static_call_addr(site); + + if (addr <= (unsigned long)end && + addr + CALL_INSN_SIZE > (unsigned long)start) + return 1; + + return 0; +} + +static int __static_call_text_reserved(struct static_call_site *iter_start, + struct static_call_site *iter_stop, + void *start, void *end, bool init) +{ + struct static_call_site *iter = iter_start; + + while (iter < iter_stop) { + if (init || !static_call_is_init(iter)) { + if (addr_conflict(iter, start, end)) + return 1; + } + iter++; + } + + return 0; +} + +#ifdef CONFIG_MODULES + +static int __static_call_mod_text_reserved(void *start, void *end) +{ + struct module *mod; + int ret; + + preempt_disable(); + mod = __module_text_address((unsigned long)start); + WARN_ON_ONCE(__module_text_address((unsigned long)end) != mod); + if (!try_module_get(mod)) + mod = NULL; + preempt_enable(); + + if (!mod) + return 0; + + ret = __static_call_text_reserved(mod->static_call_sites, + mod->static_call_sites + mod->num_static_call_sites, + start, end, mod->state == MODULE_STATE_COMING); + + module_put(mod); + + return ret; +} + +static unsigned long tramp_key_lookup(unsigned long addr) +{ + struct static_call_tramp_key *start = __start_static_call_tramp_key; + struct static_call_tramp_key *stop = __stop_static_call_tramp_key; + struct static_call_tramp_key *tramp_key; + + for (tramp_key = start; tramp_key != stop; tramp_key++) { + unsigned long tramp; + + tramp = (long)tramp_key->tramp + (long)&tramp_key->tramp; + if (tramp == addr) + return (long)tramp_key->key + (long)&tramp_key->key; + } + + return 0; +} + +static int static_call_add_module(struct module *mod) +{ + struct static_call_site *start = mod->static_call_sites; + struct static_call_site *stop = start + mod->num_static_call_sites; + struct static_call_site *site; + + if (unlikely(!mod_klp_rel_completed(mod))) + return 0; + + for (site = start; site != stop; site++) { + unsigned long s_key = __static_call_key(site); + unsigned long addr = s_key & ~STATIC_CALL_SITE_FLAGS; + unsigned long key; + + /* + * Is the key is exported, 'addr' points to the key, which + * means modules are allowed to call static_call_update() on + * it. + * + * Otherwise, the key isn't exported, and 'addr' points to the + * trampoline so we need to lookup the key. + * + * We go through this dance to prevent crazy modules from + * abusing sensitive static calls. + */ + if (!kernel_text_address(addr)) + continue; + + key = tramp_key_lookup(addr); + if (!key) { + pr_warn("Failed to fixup __raw_static_call() usage at: %ps\n", + static_call_addr(site)); + return -EINVAL; + } + + key |= s_key & STATIC_CALL_SITE_FLAGS; + site->key = key - (long)&site->key; + } + + return __static_call_init(mod, start, stop); +} + +static void static_call_del_module(struct module *mod) +{ + struct static_call_site *start = mod->static_call_sites; + struct static_call_site *stop = mod->static_call_sites + + mod->num_static_call_sites; + struct static_call_key *key, *prev_key = NULL; + struct static_call_mod *site_mod, **prev; + struct static_call_site *site; + + if (unlikely(!mod_klp_rel_completed(mod))) + return; + + for (site = start; site < stop; site++) { + key = static_call_key(site); + if (key == prev_key) + continue; + + prev_key = key; + + for (prev = &key->mods, site_mod = key->mods; + site_mod && site_mod->mod != mod; + prev = &site_mod->next, site_mod = site_mod->next) + ; + + if (!site_mod) + continue; + + *prev = site_mod->next; + kfree(site_mod); + } +} + +static int static_call_module_notify(struct notifier_block *nb, + unsigned long val, void *data) +{ + struct module *mod = data; + int ret = 0; + + cpus_read_lock(); + static_call_lock(); + + switch (val) { + case MODULE_STATE_COMING: + ret = static_call_add_module(mod); + if (ret) { + WARN(1, "Failed to allocate memory for static calls"); + static_call_del_module(mod); + } + break; + case MODULE_STATE_GOING: + static_call_del_module(mod); + break; + } + + static_call_unlock(); + cpus_read_unlock(); + + return notifier_from_errno(ret); +} + +static struct notifier_block static_call_module_nb = { + .notifier_call = static_call_module_notify, +}; + +int klp_static_call_register(struct module *mod) +{ + int ret; + + ret = static_call_module_notify(&static_call_module_nb, MODULE_STATE_COMING, mod); + return notifier_to_errno(ret); +} + +#else + +int klp_static_call_register(struct module *mod) +{ + return 0; +} + +static inline int __static_call_mod_text_reserved(void *start, void *end) +{ + return 0; +} + +#endif /* CONFIG_MODULES */ + +int static_call_text_reserved(void *start, void *end) +{ + bool init = system_state < SYSTEM_RUNNING; + int ret = __static_call_text_reserved(__start_static_call_sites, + __stop_static_call_sites, start, end, init); + + if (ret) + return ret; + + return __static_call_mod_text_reserved(start, end); +} + +int __init static_call_init(void) +{ + int ret; + + if (static_call_initialized) + return 0; + + cpus_read_lock(); + static_call_lock(); + ret = __static_call_init(NULL, __start_static_call_sites, + __stop_static_call_sites); + static_call_unlock(); + cpus_read_unlock(); + + if (ret) { + pr_err("Failed to allocate memory for static_call!\n"); + BUG(); + } + + static_call_initialized = true; + +#ifdef CONFIG_MODULES + register_module_notifier(&static_call_module_nb); +#endif + return 0; +} +early_initcall(static_call_init); + +#ifdef CONFIG_STATIC_CALL_SELFTEST + +static int func_a(int x) +{ + return x+1; +} + +static int func_b(int x) +{ + return x+2; +} + +DEFINE_STATIC_CALL(sc_selftest, func_a); + +static struct static_call_data { + int (*func)(int); + int val; + int expect; +} static_call_data [] __initdata = { + { NULL, 2, 3 }, + { func_b, 2, 4 }, + { func_a, 2, 3 } +}; + +static int __init test_static_call_init(void) +{ + int i; + + for (i = 0; i < ARRAY_SIZE(static_call_data); i++ ) { + struct static_call_data *scd = &static_call_data[i]; + + if (scd->func) + static_call_update(sc_selftest, scd->func); + + WARN_ON(static_call(sc_selftest)(scd->val) != scd->expect); + } + + return 0; +} +early_initcall(test_static_call_init); + +#endif /* CONFIG_STATIC_CALL_SELFTEST */ -- 2.25.1

2 1

[PATCH OLK-5.10] drm/amd/pm: fix a double-free in si_dpm_init
by Baogen Shang 28 Apr '24

28 Apr '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> stable inclusion from stable-v5.10.215 commit aeed2b4e4a70c7568d4a5eecd6a109713c0dfbf4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9J6AL CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit ac16667237a82e2597e329eb9bc520d1cf9dff30 ] When the allocation of adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries fails, amdgpu_free_extended_power_table is called to free some fields of adev. However, when the control flow returns to si_dpm_sw_init, it goes to label dpm_failed and calls si_dpm_fini, which calls amdgpu_free_extended_power_table again and free those fields again. Thus a double-free is triggered. Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c index d6544a6dabc7..6f0653c81f8f 100644 --- a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c +++ b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c @@ -7349,10 +7349,9 @@ static int si_dpm_init(struct amdgpu_device *adev) kcalloc(4, sizeof(struct amdgpu_clock_voltage_dependency_entry), GFP_KERNEL); - if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) { - amdgpu_free_extended_power_table(adev); + if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) return -ENOMEM; - } + adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.count = 4; adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].clk = 0; adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].v = 0; -- 2.33.0

1 0

[PATCH OLK-5.10] drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
by Baogen Shang 28 Apr '24

28 Apr '24

From: Lu Yao <yaolu(a)kylinos.cn> stable inclusion from stable-v5.10.215 commit 974f127fcf6552ecd5b76c36c7b107e77b2febf9 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9J6AL CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit 2161e09cd05a50d80736fe397145340d2e8f6c05 ] For 'AMDGPU_FAMILY_SI' family cards, in 'si_common_early_init' func, init 'didt_rreg' and 'didt_wreg' to 'NULL'. But in func 'amdgpu_debugfs_regs_didt_read/write', using 'RREG32_DIDT' 'WREG32_DIDT' lacks of relevant judgment. And other 'amdgpu_ip_block_version' that use these two definitions won't be added for 'AMDGPU_FAMILY_SI'. So, add null pointer judgment before calling. Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Lu Yao <yaolu(a)kylinos.cn> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c index 48df32dd352e..3e573077368b 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c @@ -459,6 +459,9 @@ static ssize_t amdgpu_debugfs_regs_didt_read(struct file *f, char __user *buf, if (size & 0x3 || *pos & 0x3) return -EINVAL; + if (!adev->didt_rreg) + return -EOPNOTSUPP; + r = pm_runtime_get_sync(adev_to_drm(adev)->dev); if (r < 0) { pm_runtime_put_autosuspend(adev_to_drm(adev)->dev); @@ -518,6 +521,9 @@ static ssize_t amdgpu_debugfs_regs_didt_write(struct file *f, const char __user if (size & 0x3 || *pos & 0x3) return -EINVAL; + if (!adev->didt_wreg) + return -EOPNOTSUPP; + r = pm_runtime_get_sync(adev_to_drm(adev)->dev); if (r < 0) { pm_runtime_put_autosuspend(adev_to_drm(adev)->dev); -- 2.33.0

1 0

[PATCH OLK-5.10] PCI/IOV: Enlarge virtfn sysfs name buffer
by liwei 28 Apr '24

28 Apr '24

From: "Alexey V. Vissarionov" <gremlin(a)altlinux.org> mainline inclusion from mainline-v6.3-rc1 commit ea0b5aa5f184cf8293c93163f0fb00505190d431 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9JNPZ CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------ The sysfs link name "virtfn%u" constructed by pci_iov_sysfs_link() requires 17 bytes to contain the longest possible string. Increase VIRTFN_ID_LEN to accommodate that. Found by Linux Verification Center (linuxtesting.org) with SVACE. [bhelgaas: commit log, comment at #define] Fixes: dd7cc44d0bce ("PCI: add SR-IOV API for Physical Function driver") Link: https://lore.kernel.org/r/20221218033347.23743-1-gremlin@altlinux.org Signed-off-by: Alexey V. Vissarionov <gremlin(a)altlinux.org> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/iov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c index 7006413aa0a3..c1ca66eda86e 100644 --- a/drivers/pci/iov.c +++ b/drivers/pci/iov.c @@ -14,7 +14,7 @@ #include <linux/delay.h> #include "pci.h" -#define VIRTFN_ID_LEN 16 +#define VIRTFN_ID_LEN 17 /* "virtfn%u\0" for 2^32 - 1 */ static DEFINE_MUTEX(pci_sriov_numvfs_lock); -- 2.25.1

2 1

[PATCH OLK-5.10] drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
by Baogen Shang 28 Apr '24

28 Apr '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> stable inclusion from stable-v5.10.215 commit 330caa061af53ea6d287d7c43d0703714e510e08 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9J6AL CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit 9ccfe80d022df7c595f1925afb31de2232900656 ] The 'stream' pointer is used in dcn10_set_output_transfer_func() before the check if 'stream' is NULL. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn10/dcn10_hwseq.c:1892 dcn10_set_output_transfer_func() warn: variable dereferenced before check 'stream' (see line 1875) Fixes: ddef02de0d71 ("drm/amd/display: add null checks before logging") Cc: Wyatt Wood <wyatt.wood(a)amd.com> Cc: Anthony Koo <Anthony.Koo(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Anthony Koo <Anthony.Koo(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c index 1c669f115dd8..8cf6e307ae36 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c @@ -1669,6 +1669,9 @@ bool dcn10_set_output_transfer_func(struct dc *dc, struct pipe_ctx *pipe_ctx, { struct dpp *dpp = pipe_ctx->plane_res.dpp; + if (!stream) + return false; + if (dpp == NULL) return false; @@ -1691,8 +1694,8 @@ bool dcn10_set_output_transfer_func(struct dc *dc, struct pipe_ctx *pipe_ctx, } else dpp->funcs->dpp_program_regamma_pwl(dpp, NULL, OPP_REGAMMA_BYPASS); - if (stream != NULL && stream->ctx != NULL && - stream->out_transfer_func != NULL) { + if (stream->ctx && + stream->out_transfer_func) { log_tf(stream->ctx, stream->out_transfer_func, dpp->regamma_params.hw_points_num); -- 2.33.0

1 0

[PATCH OLK-5.10] drm/amd/display: Fix memory leak in dm_sw_fini()
by Baogen Shang 28 Apr '24

28 Apr '24

From: Armin Wolf <W_Armin(a)gmx.de> stable inclusion from stable-v5.10.215 commit b49b022f7dfce85eb77d0d987008fde5c01d7857 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9J6AL CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit bae67893578d608e35691dcdfa90c4957debf1d3 ] After destroying dmub_srv, the memory associated with it is not freed, causing a memory leak: unreferenced object 0xffff896302b45800 (size 1024): comm "(udev-worker)", pid 222, jiffies 4294894636 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 6265fd77): [<ffffffff993495ed>] kmalloc_trace+0x29d/0x340 [<ffffffffc0ea4a94>] dm_dmub_sw_init+0xb4/0x450 [amdgpu] [<ffffffffc0ea4e55>] dm_sw_init+0x15/0x2b0 [amdgpu] [<ffffffffc0ba8557>] amdgpu_device_init+0x1417/0x24e0 [amdgpu] [<ffffffffc0bab285>] amdgpu_driver_load_kms+0x15/0x190 [amdgpu] [<ffffffffc0ba09c7>] amdgpu_pci_probe+0x187/0x4e0 [amdgpu] [<ffffffff9968fd1e>] local_pci_probe+0x3e/0x90 [<ffffffff996918a3>] pci_device_probe+0xc3/0x230 [<ffffffff99805872>] really_probe+0xe2/0x480 [<ffffffff99805c98>] __driver_probe_device+0x78/0x160 [<ffffffff99805daf>] driver_probe_device+0x1f/0x90 [<ffffffff9980601e>] __driver_attach+0xce/0x1c0 [<ffffffff99803170>] bus_for_each_dev+0x70/0xc0 [<ffffffff99804822>] bus_add_driver+0x112/0x210 [<ffffffff99807245>] driver_register+0x55/0x100 [<ffffffff990012d1>] do_one_initcall+0x41/0x300 Fix this by freeing dmub_srv after destroying it. Fixes: 743b9786b14a ("drm/amd/display: Hook up the DMUB service in DM") Signed-off-by: Armin Wolf <W_Armin(a)gmx.de> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 54d6b4128721..3578e3b3536e 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -1456,6 +1456,7 @@ static int dm_sw_fini(void *handle) if (adev->dm.dmub_srv) { dmub_srv_destroy(adev->dm.dmub_srv); + kfree(adev->dm.dmub_srv); adev->dm.dmub_srv = NULL; } -- 2.33.0

1 0

[PATCH OLK-5.10] drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
by Baogen Shang 28 Apr '24

28 Apr '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> stable inclusion from stable-v5.10.215 commit ff28893c96c5e0927a4da10cd24a3522ca663515 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9J6AL CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit 4b09715f1504f1b6e8dff0e9643630610bc05141 ] Tell snprintf() to store at most 10 bytes in the output buffer instead of 30. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_debugfs.c:1508 dp_dsc_clock_en_read() error: snprintf() is printing too much 30 vs 10 Fixes: c06e09b76639 ("drm/amd/display: Add DSC parameters logging to debugfs") Cc: Alex Hung <alex.hung(a)amd.com> Cc: Qingqing Zhuo <qingqing.zhuo(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c index e43f82bcb231..32dbd2a27088 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c @@ -1179,7 +1179,7 @@ static ssize_t dp_dsc_clock_en_read(struct file *f, char __user *buf, const uint32_t rd_buf_size = 10; struct pipe_ctx *pipe_ctx; ssize_t result = 0; - int i, r, str_len = 30; + int i, r, str_len = 10; rd_buf = kcalloc(rd_buf_size, sizeof(char), GFP_KERNEL); -- 2.33.0

1 0

[PATCH OLK-5.10] nvme-fc: do not wait in vain when unloading module
by Baogen Shang 28 Apr '24

28 Apr '24

From: Daniel Wagner <dwagner(a)suse.de> stable inclusion from stable-v5.10.215 commit 4f2c95015ec2a1899161be6c0bdaecedd5a7bfb2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9J6AL CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit 70fbfc47a392b98e5f8dba70c6efc6839205c982 ] The module exit path has race between deleting all controllers and freeing 'left over IDs'. To prevent double free a synchronization between nvme_delete_ctrl and ida_destroy has been added by the initial commit. There is some logic around trying to prevent from hanging forever in wait_for_completion, though it does not handling all cases. E.g. blktests is able to reproduce the situation where the module unload hangs forever. If we completely rely on the cleanup code executed from the nvme_delete_ctrl path, all IDs will be freed eventually. This makes calling ida_destroy unnecessary. We only have to ensure that all nvme_delete_ctrl code has been executed before we leave nvme_fc_exit_module. This is done by flushing the nvme_delete_wq workqueue. While at it, remove the unused nvme_fc_wq workqueue too. Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Hannes Reinecke <hare(a)suse.de> Signed-off-by: Daniel Wagner <dwagner(a)suse.de> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/nvme/host/fc.c | 47 ++++++------------------------------------ 1 file changed, 6 insertions(+), 41 deletions(-) diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c index b534a85e2bf1..92db88ceb96f 100644 --- a/drivers/nvme/host/fc.c +++ b/drivers/nvme/host/fc.c @@ -220,11 +220,6 @@ static LIST_HEAD(nvme_fc_lport_list); static DEFINE_IDA(nvme_fc_local_port_cnt); static DEFINE_IDA(nvme_fc_ctrl_cnt); -static struct workqueue_struct *nvme_fc_wq; - -static bool nvme_fc_waiting_to_unload; -static DECLARE_COMPLETION(nvme_fc_unload_proceed); - /* * These items are short-term. They will eventually be moved into * a generic FC class. See comments in module init. @@ -254,8 +249,6 @@ nvme_fc_free_lport(struct kref *ref) /* remove from transport list */ spin_lock_irqsave(&nvme_fc_lock, flags); list_del(&lport->port_list); - if (nvme_fc_waiting_to_unload && list_empty(&nvme_fc_lport_list)) - complete(&nvme_fc_unload_proceed); spin_unlock_irqrestore(&nvme_fc_lock, flags); ida_simple_remove(&nvme_fc_local_port_cnt, lport->localport.port_num); @@ -3823,10 +3816,6 @@ static int __init nvme_fc_init_module(void) { int ret; - nvme_fc_wq = alloc_workqueue("nvme_fc_wq", WQ_MEM_RECLAIM, 0); - if (!nvme_fc_wq) - return -ENOMEM; - /* * NOTE: * It is expected that in the future the kernel will combine @@ -3844,7 +3833,7 @@ static int __init nvme_fc_init_module(void) ret = class_register(&fc_class); if (ret) { pr_err("couldn't register class fc\n"); - goto out_destroy_wq; + return ret; } /* @@ -3868,8 +3857,6 @@ static int __init nvme_fc_init_module(void) device_destroy(&fc_class, MKDEV(0, 0)); out_destroy_class: class_unregister(&fc_class); -out_destroy_wq: - destroy_workqueue(nvme_fc_wq); return ret; } @@ -3889,45 +3876,23 @@ nvme_fc_delete_controllers(struct nvme_fc_rport *rport) spin_unlock(&rport->lock); } -static void -nvme_fc_cleanup_for_unload(void) +static void __exit nvme_fc_exit_module(void) { struct nvme_fc_lport *lport; struct nvme_fc_rport *rport; - - list_for_each_entry(lport, &nvme_fc_lport_list, port_list) { - list_for_each_entry(rport, &lport->endp_list, endp_list) { - nvme_fc_delete_controllers(rport); - } - } -} - -static void __exit nvme_fc_exit_module(void) -{ unsigned long flags; - bool need_cleanup = false; spin_lock_irqsave(&nvme_fc_lock, flags); - nvme_fc_waiting_to_unload = true; - if (!list_empty(&nvme_fc_lport_list)) { - need_cleanup = true; - nvme_fc_cleanup_for_unload(); - } + list_for_each_entry(lport, &nvme_fc_lport_list, port_list) + list_for_each_entry(rport, &lport->endp_list, endp_list) + nvme_fc_delete_controllers(rport); spin_unlock_irqrestore(&nvme_fc_lock, flags); - if (need_cleanup) { - pr_info("%s: waiting for ctlr deletes\n", __func__); - wait_for_completion(&nvme_fc_unload_proceed); - pr_info("%s: ctrl deletes complete\n", __func__); - } + flush_workqueue(nvme_delete_wq); nvmf_unregister_transport(&nvme_fc_transport); - ida_destroy(&nvme_fc_local_port_cnt); - ida_destroy(&nvme_fc_ctrl_cnt); - device_destroy(&fc_class, MKDEV(0, 0)); class_unregister(&fc_class); - destroy_workqueue(nvme_fc_wq); } module_init(nvme_fc_init_module); -- 2.33.0

1 0

[PATCH OLK-5.10] nvme-core: check for too small lba shift
by Baogen Shang 28 Apr '24

28 Apr '24

From: Keith Busch <kbusch(a)kernel.org> stable inclusion from stable-v5.10.215 commit 06a33eec1dc28dfbcd62c1ff94a3229f3ee265bc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9J6AL CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit 74fbc88e161424b3b96a22b23a8e3e1edab9d05c ] The block layer doesn't support logical block sizes smaller than 512 bytes. The nvme spec doesn't support that small either, but the driver isn't checking to make sure the device responded with usable data. Failing to catch this will result in a kernel bug, either from a division by zero when stacking, or a zero length bio. Reviewed-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/nvme/host/core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index 142f3a03509c..9fcc05c4f88c 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -2038,9 +2038,10 @@ static void nvme_update_disk_info(struct gendisk *disk, /* * The block layer can't support LBA sizes larger than the page size - * yet, so catch this early and don't allow block I/O. + * or smaller than a sector size yet, so catch this early and don't + * allow block I/O. */ - if (ns->lba_shift > PAGE_SHIFT) { + if (ns->lba_shift > PAGE_SHIFT || ns->lba_shift < SECTOR_SHIFT) { capacity = 0; bs = (1 << 9); } -- 2.33.0

1 0

[PATCH OLK-5.10] net/tg3: fix race condition in tg3_reset_task()
by Baogen Shang 28 Apr '24

28 Apr '24

From: Thinh Tran <thinhtr(a)linux.vnet.ibm.com> stable inclusion from stable-v5.10.215 commit 1059aa41c5a84abfab4cc7371d6b5ff2b30b6c2d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9J6AL CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit 16b55b1f2269962fb6b5154b8bf43f37c9a96637 ] When an EEH error is encountered by a PCI adapter, the EEH driver modifies the PCI channel's state as shown below: enum { /* I/O channel is in normal state */ pci_channel_io_normal = (__force pci_channel_state_t) 1, /* I/O to channel is blocked */ pci_channel_io_frozen = (__force pci_channel_state_t) 2, /* PCI card is dead */ pci_channel_io_perm_failure = (__force pci_channel_state_t) 3, }; If the same EEH error then causes the tg3 driver's transmit timeout logic to execute, the tg3_tx_timeout() function schedules a reset task via tg3_reset_task_schedule(), which may cause a race condition between the tg3 and EEH driver as both attempt to recover the HW via a reset action. EEH driver gets error event --> eeh_set_channel_state() and set device to one of error state above scheduler: tg3_reset_task() get returned error from tg3_init_hw() --> dev_close() shuts down the interface tg3_io_slot_reset() and tg3_io_resume() fail to reset/resume the device To resolve this issue, we avoid the race condition by checking the PCI channel state in the tg3_reset_task() function and skip the tg3 driver initiated reset when the PCI channel is not in the normal state. (The driver has no access to tg3 device registers at this point and cannot even complete the reset task successfully without external assistance.) We'll leave the reset procedure to be managed by the EEH driver which calls the tg3_io_error_detected(), tg3_io_slot_reset() and tg3_io_resume() functions as appropriate. Adding the same checking in tg3_dump_state() to avoid dumping all device registers when the PCI channel is not in the normal state. Signed-off-by: Thinh Tran <thinhtr(a)linux.vnet.ibm.com> Tested-by: Venkata Sai Duggi <venkata.sai.duggi(a)ibm.com> Reviewed-by: David Christensen <drc(a)linux.vnet.ibm.com> Reviewed-by: Michael Chan <michael.chan(a)broadcom.com> Link: https://lore.kernel.org/r/20231201001911.656-1-thinhtr@linux.vnet.ibm.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/net/ethernet/broadcom/tg3.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c index 4e74a3d44d1e..56ca913f0c2d 100644 --- a/drivers/net/ethernet/broadcom/tg3.c +++ b/drivers/net/ethernet/broadcom/tg3.c @@ -6454,6 +6454,14 @@ static void tg3_dump_state(struct tg3 *tp) int i; u32 *regs; + /* If it is a PCI error, all registers will be 0xffff, + * we don't dump them out, just report the error and return + */ + if (tp->pdev->error_state != pci_channel_io_normal) { + netdev_err(tp->dev, "PCI channel ERROR!\n"); + return; + } + regs = kzalloc(TG3_REG_BLK_SIZE, GFP_ATOMIC); if (!regs) return; @@ -11195,7 +11203,8 @@ static void tg3_reset_task(struct work_struct *work) rtnl_lock(); tg3_full_lock(tp, 0); - if (tp->pcierr_recovery || !netif_running(tp->dev)) { + if (tp->pcierr_recovery || !netif_running(tp->dev) || + tp->pdev->error_state != pci_channel_io_normal) { tg3_flag_clear(tp, RESET_TASK_PENDING); tg3_full_unlock(tp); rtnl_unlock(); -- 2.33.0

1 0

[PATCH OLK-5.10] scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
by Baogen Shang 28 Apr '24

28 Apr '24

From: Ranjan Kumar <ranjan.kumar(a)broadcom.com> stable inclusion from stable-v5.10.215 commit ba3a55d118bf211f4a7f53f83dafbc3405ea198d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9J6AL CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit ee0017c3ed8a8abfa4d40e42f908fb38c31e7515 ] If the driver detects that the controller is not ready before sending the first IOC facts command, it will wait for a maximum of 10 seconds for it to become ready. However, even if the controller becomes ready within 10 seconds, the driver will still issue a diagnostic reset. Modify the driver to avoid sending a diag reset if the controller becomes ready within the 10-second wait time. Signed-off-by: Ranjan Kumar <ranjan.kumar(a)broadcom.com> Link: https://lore.kernel.org/r/20240221071724.14986-1-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 4bf1ea39d21a..55200f5db150 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -6357,7 +6357,9 @@ _base_wait_for_iocstate(struct MPT3SAS_ADAPTER *ioc, int timeout) return -EFAULT; } - issue_diag_reset: + return 0; + +issue_diag_reset: rc = _base_diag_reset(ioc); return rc; } -- 2.33.0

1 0

[PATCH OLK-5.10 0/8] add LTS patches to OLK-5.10
by Zhengchao Shao 28 Apr '24

28 Apr '24

Add LTS patches to OLK-5.10. Ido Schimmel (3): genetlink: add CAP_NET_ADMIN test for multicast bind drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group genetlink: Use internal flags for multicast groups Patrick Rohr (3): net: add sysctl accept_ra_min_rtr_lft net: change accept_ra_min_rtr_lft to affect all RA lifetimes net: release reference to inet6_dev pointer Zhengchao Shao (2): genetlink: fix kabi change in struct genl_multicast_group net: fix kabi in struct ipv6_devconf Documentation/networking/ip-sysctl.rst | 8 +++++ include/linux/ipv6.h | 2 +- include/uapi/linux/ipv6.h | 7 ++++ net/core/drop_monitor.c | 4 ++- net/ipv6/addrconf.c | 13 ++++++++ net/ipv6/ndisc.c | 13 ++++++-- net/netlink/genetlink.c | 45 ++++++++++++++++++++++++++ 7 files changed, 88 insertions(+), 4 deletions(-) -- 2.34.1

2 9

[PATCH OLK-5.10] netfilter: nft_set_pipapo: do not free live element
by Wei Li 28 Apr '24

28 Apr '24

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.9-rc5 commit 3cfc9ec039af60dbd8965ae085b2c2ccdcfbe1cc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9JFG2 CVE: CVE-2024-26924 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?i… -------------------------------- Pablo reports a crash with large batches of elements with a back-to-back add/remove pattern. Quoting Pablo: add_elem("00000000") timeout 100 ms ... add_elem("0000000X") timeout 100 ms del_elem("0000000X") <---------------- delete one that was just added ... add_elem("00005000") timeout 100 ms 1) nft_pipapo_remove() removes element 0000000X Then, KASAN shows a splat. Looking at the remove function there is a chance that we will drop a rule that maps to a non-deactivated element. Removal happens in two steps, first we do a lookup for key k and return the to-be-removed element and mark it as inactive in the next generation. Then, in a second step, the element gets removed from the set/map. The _remove function does not work correctly if we have more than one element that share the same key. This can happen if we insert an element into a set when the set already holds an element with same key, but the element mapping to the existing key has timed out or is not active in the next generation. In such case its possible that removal will unmap the wrong element. If this happens, we will leak the non-deactivated element, it becomes unreachable. The element that got deactivated (and will be freed later) will remain reachable in the set data structure, this can result in a crash when such an element is retrieved during lookup (stale pointer). Add a check that the fully matching key does in fact map to the element that we have marked as inactive in the deactivation step. If not, we need to continue searching. Add a bug/warn trap at the end of the function as well, the remove function must not ever be called with an invisible/unreachable/non-existent element. v2: avoid uneeded temporary variable (Stefano) Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Reported-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Reviewed-by: Stefano Brivio <sbrivio(a)redhat.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Wei Li <liwei391(a)huawei.com> --- net/netfilter/nft_set_pipapo.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index b9682e085fce..5a8521abd8f5 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1980,6 +1980,8 @@ static void nft_pipapo_remove(const struct net *net, const struct nft_set *set, rules_fx = rules_f0; nft_pipapo_for_each_field(f, i, m) { + bool last = i == m->field_count - 1; + if (!pipapo_match_field(f, start, rules_fx, match_start, match_end)) break; @@ -1992,16 +1994,18 @@ static void nft_pipapo_remove(const struct net *net, const struct nft_set *set, match_start += NFT_PIPAPO_GROUPS_PADDED_SIZE(f); match_end += NFT_PIPAPO_GROUPS_PADDED_SIZE(f); - } - if (i == m->field_count) { - priv->dirty = true; - pipapo_drop(m, rulemap); - return; + if (last && f->mt[rulemap[i].to].e == e) { + priv->dirty = true; + pipapo_drop(m, rulemap); + return; + } } first_rule += rules_f0; } + + WARN_ON_ONCE(1); /* elem_priv not found */ } /** -- 2.25.1

2 1

[PATCH OLK-5.10] Control KABI reservation codes with config
by GUO Zihua 28 Apr '24

28 Apr '24

hulk inclusion category: feature bugzilla: 187957 -------------------------------- Control KABI reservation codes with CONFIG_KABI_RESERVE. Minimizing risk. Signed-off-by: GUO Zihua <guozihua(a)huawei.com> --- include/linux/proc_ns.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/include/linux/proc_ns.h b/include/linux/proc_ns.h index 81e99aa97cd7..737c98ebb7b3 100644 --- a/include/linux/proc_ns.h +++ b/include/linux/proc_ns.h @@ -16,7 +16,11 @@ struct inode; struct proc_ns_operations { const char *name; const char *real_ns_name; +#ifdef CONFIG_KABI_RESERVE u64 type; +#else + int type; +#endif struct ns_common *(*get)(struct task_struct *task); void (*put)(struct ns_common *ns); int (*install)(struct nsset *nsset, struct ns_common *ns); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS] quota: Fix potential NULL pointer dereference
by Baokun Li 28 Apr '24

28 Apr '24

From: Wang Jianjian <wangjianjian3(a)huawei.com> stable inclusion from stable-v5.10.214 commit 61380537aa6dd32d8a723d98b8f1bd1b11d8fee0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HJX7 CVE: CVE-2024-26878 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d0aa72604fbd80c8aabb46eda00535ed35570f1f ] Below race may cause NULL pointer dereference P1 P2 dquot_free_inode quota_off drop_dquot_ref remove_dquot_ref dquots = i_dquot(inode) dquots = i_dquot(inode) srcu_read_lock dquots[cnt]) != NULL (1) dquots[type] = NULL (2) spin_lock(&dquots[cnt]->dq_dqb_lock) (3) .... If dquot_free_inode(or other routines) checks inode's quota pointers (1) before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer dereference will be triggered. So let's fix it by using a temporary pointer to avoid this issue. Signed-off-by: Wang Jianjian <wangjianjian3(a)huawei.com> Signed-off-by: Jan Kara <jack(a)suse.cz> Message-Id: <20240202081852.2514092-1-wangjianjian3(a)huawei.com> Stable-dep-of: 179b8c97ebf6 ("quota: Fix rcu annotations of inode dquot pointers") Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/quota/dquot.c | 98 ++++++++++++++++++++++++++++-------------------- 1 file changed, 57 insertions(+), 41 deletions(-) diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c index 47aaf8328c97..9ec12c9ab96b 100644 --- a/fs/quota/dquot.c +++ b/fs/quota/dquot.c @@ -399,15 +399,17 @@ int dquot_mark_dquot_dirty(struct dquot *dquot) EXPORT_SYMBOL(dquot_mark_dquot_dirty); /* Dirtify all the dquots - this can block when journalling */ -static inline int mark_all_dquot_dirty(struct dquot * const *dquot) +static inline int mark_all_dquot_dirty(struct dquot * const *dquots) { int ret, err, cnt; + struct dquot *dquot; ret = err = 0; for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (dquot[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (dquot) /* Even in case of error we have to continue */ - ret = mark_dquot_dirty(dquot[cnt]); + ret = mark_dquot_dirty(dquot); if (!err) err = ret; } @@ -1674,6 +1676,7 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags) struct dquot_warn warn[MAXQUOTAS]; int reserve = flags & DQUOT_SPACE_RESERVE; struct dquot **dquots; + struct dquot *dquot; if (!inode_quota_active(inode)) { if (reserve) { @@ -1693,27 +1696,26 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags) index = srcu_read_lock(&dquot_srcu); spin_lock(&inode->i_lock); for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; if (reserve) { - ret = dquot_add_space(dquots[cnt], 0, number, flags, - &warn[cnt]); + ret = dquot_add_space(dquot, 0, number, flags, &warn[cnt]); } else { - ret = dquot_add_space(dquots[cnt], number, 0, flags, - &warn[cnt]); + ret = dquot_add_space(dquot, number, 0, flags, &warn[cnt]); } if (ret) { /* Back out changes we already did */ for (cnt--; cnt >= 0; cnt--) { - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - spin_lock(&dquots[cnt]->dq_dqb_lock); + spin_lock(&dquot->dq_dqb_lock); if (reserve) - dquot_free_reserved_space(dquots[cnt], - number); + dquot_free_reserved_space(dquot, number); else - dquot_decr_space(dquots[cnt], number); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + dquot_decr_space(dquot, number); + spin_unlock(&dquot->dq_dqb_lock); } spin_unlock(&inode->i_lock); goto out_flush_warn; @@ -1744,6 +1746,7 @@ int dquot_alloc_inode(struct inode *inode) int cnt, ret = 0, index; struct dquot_warn warn[MAXQUOTAS]; struct dquot * const *dquots; + struct dquot *dquot; if (!inode_quota_active(inode)) return 0; @@ -1754,17 +1757,19 @@ int dquot_alloc_inode(struct inode *inode) index = srcu_read_lock(&dquot_srcu); spin_lock(&inode->i_lock); for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - ret = dquot_add_inodes(dquots[cnt], 1, &warn[cnt]); + ret = dquot_add_inodes(dquot, 1, &warn[cnt]); if (ret) { for (cnt--; cnt >= 0; cnt--) { - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; /* Back out changes we already did */ - spin_lock(&dquots[cnt]->dq_dqb_lock); - dquot_decr_inodes(dquots[cnt], 1); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + spin_lock(&dquot->dq_dqb_lock); + dquot_decr_inodes(dquot, 1); + spin_unlock(&dquot->dq_dqb_lock); } goto warn_put_all; } @@ -1786,6 +1791,7 @@ EXPORT_SYMBOL(dquot_alloc_inode); int dquot_claim_space_nodirty(struct inode *inode, qsize_t number) { struct dquot **dquots; + struct dquot *dquot; int cnt, index; if (!inode_quota_active(inode)) { @@ -1801,9 +1807,8 @@ int dquot_claim_space_nodirty(struct inode *inode, qsize_t number) spin_lock(&inode->i_lock); /* Claim reserved quotas to allocated quotas */ for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (dquots[cnt]) { - struct dquot *dquot = dquots[cnt]; - + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (dquot) { spin_lock(&dquot->dq_dqb_lock); if (WARN_ON_ONCE(dquot->dq_dqb.dqb_rsvspace < number)) number = dquot->dq_dqb.dqb_rsvspace; @@ -1828,6 +1833,7 @@ EXPORT_SYMBOL(dquot_claim_space_nodirty); void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number) { struct dquot **dquots; + struct dquot *dquot; int cnt, index; if (!inode_quota_active(inode)) { @@ -1843,9 +1849,8 @@ void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number) spin_lock(&inode->i_lock); /* Claim reserved quotas to allocated quotas */ for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (dquots[cnt]) { - struct dquot *dquot = dquots[cnt]; - + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (dquot) { spin_lock(&dquot->dq_dqb_lock); if (WARN_ON_ONCE(dquot->dq_dqb.dqb_curspace < number)) number = dquot->dq_dqb.dqb_curspace; @@ -1872,6 +1877,7 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags) unsigned int cnt; struct dquot_warn warn[MAXQUOTAS]; struct dquot **dquots; + struct dquot *dquot; int reserve = flags & DQUOT_SPACE_RESERVE, index; if (!inode_quota_active(inode)) { @@ -1892,17 +1898,18 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags) int wtype; warn[cnt].w_type = QUOTA_NL_NOWARN; - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - spin_lock(&dquots[cnt]->dq_dqb_lock); - wtype = info_bdq_free(dquots[cnt], number); + spin_lock(&dquot->dq_dqb_lock); + wtype = info_bdq_free(dquot, number); if (wtype != QUOTA_NL_NOWARN) - prepare_warning(&warn[cnt], dquots[cnt], wtype); + prepare_warning(&warn[cnt], dquot, wtype); if (reserve) - dquot_free_reserved_space(dquots[cnt], number); + dquot_free_reserved_space(dquot, number); else - dquot_decr_space(dquots[cnt], number); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + dquot_decr_space(dquot, number); + spin_unlock(&dquot->dq_dqb_lock); } if (reserve) *inode_reserved_space(inode) -= number; @@ -1927,6 +1934,7 @@ void dquot_free_inode(struct inode *inode) unsigned int cnt; struct dquot_warn warn[MAXQUOTAS]; struct dquot * const *dquots; + struct dquot *dquot; int index; if (!inode_quota_active(inode)) @@ -1937,16 +1945,16 @@ void dquot_free_inode(struct inode *inode) spin_lock(&inode->i_lock); for (cnt = 0; cnt < MAXQUOTAS; cnt++) { int wtype; - warn[cnt].w_type = QUOTA_NL_NOWARN; - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - spin_lock(&dquots[cnt]->dq_dqb_lock); - wtype = info_idq_free(dquots[cnt], 1); + spin_lock(&dquot->dq_dqb_lock); + wtype = info_idq_free(dquot, 1); if (wtype != QUOTA_NL_NOWARN) - prepare_warning(&warn[cnt], dquots[cnt], wtype); - dquot_decr_inodes(dquots[cnt], 1); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + prepare_warning(&warn[cnt], dquot, wtype); + dquot_decr_inodes(dquot, 1); + spin_unlock(&dquot->dq_dqb_lock); } spin_unlock(&inode->i_lock); mark_all_dquot_dirty(dquots); @@ -1973,7 +1981,7 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to) qsize_t rsv_space = 0; qsize_t inode_usage = 1; struct dquot *transfer_from[MAXQUOTAS] = {}; - int cnt, ret = 0; + int cnt, index, ret = 0; char is_valid[MAXQUOTAS] = {}; struct dquot_warn warn_to[MAXQUOTAS]; struct dquot_warn warn_from_inodes[MAXQUOTAS]; @@ -2062,8 +2070,16 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to) spin_unlock(&inode->i_lock); spin_unlock(&dq_data_lock); + /* + * These arrays are local and we hold dquot references so we don't need + * the srcu protection but still take dquot_srcu to avoid warning in + * mark_all_dquot_dirty(). + */ + index = srcu_read_lock(&dquot_srcu); mark_all_dquot_dirty(transfer_from); mark_all_dquot_dirty(transfer_to); + srcu_read_unlock(&dquot_srcu, index); + flush_warnings(warn_to); flush_warnings(warn_from_inodes); flush_warnings(warn_from_space); -- 2.31.1

2 1

[PATCH OLK-6.6] ipvlan: enable CONFIG_IPVLAN_L2E option in openeuler config
by Zhengchao Shao 28 Apr '24

28 Apr '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9H3TZ ------------------------------- Enable CONFIG_IPVLAN_L2E option in openeuler config to fix the issue that ipvlan.conf file is incorrectly configured. Fixes: 53f51b3cd1e4 ("ipvlan: Introduce l2e mode") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index e0ffdeb0481b..a0db9074b4e1 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -2778,7 +2778,7 @@ CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m CONFIG_NET_TEAM_MODE_LOADBALANCE=m CONFIG_MACVLAN=m CONFIG_MACVTAP=m -# CONFIG_IPVLAN_L2E is not set +CONFIG_IPVLAN_L2E=y CONFIG_IPVLAN_L3S=y CONFIG_IPVLAN=m CONFIG_IPVTAP=m diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 02222f3ce5e8..3810101d2b56 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -2775,7 +2775,7 @@ CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m CONFIG_NET_TEAM_MODE_LOADBALANCE=m CONFIG_MACVLAN=m CONFIG_MACVTAP=m -# CONFIG_IPVLAN_L2E is not set +CONFIG_IPVLAN_L2E=y CONFIG_IPVLAN_L3S=y CONFIG_IPVLAN=m CONFIG_IPVTAP=m -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] quota: Fix potential NULL pointer dereference
by Baokun Li 28 Apr '24

28 Apr '24

From: Wang Jianjian <wangjianjian3(a)huawei.com> stable inclusion from stable-v5.10.214 commit 61380537aa6dd32d8a723d98b8f1bd1b11d8fee0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HJX7 CVE: CVE-2024-26878 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d0aa72604fbd80c8aabb46eda00535ed35570f1f ] Below race may cause NULL pointer dereference P1 P2 dquot_free_inode quota_off drop_dquot_ref remove_dquot_ref dquots = i_dquot(inode) dquots = i_dquot(inode) srcu_read_lock dquots[cnt]) != NULL (1) dquots[type] = NULL (2) spin_lock(&dquots[cnt]->dq_dqb_lock) (3) .... If dquot_free_inode(or other routines) checks inode's quota pointers (1) before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer dereference will be triggered. So let's fix it by using a temporary pointer to avoid this issue. Signed-off-by: Wang Jianjian <wangjianjian3(a)huawei.com> Signed-off-by: Jan Kara <jack(a)suse.cz> Message-Id: <20240202081852.2514092-1-wangjianjian3(a)huawei.com> Stable-dep-of: 179b8c97ebf6 ("quota: Fix rcu annotations of inode dquot pointers") Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/quota/dquot.c | 98 ++++++++++++++++++++++++++++-------------------- 1 file changed, 57 insertions(+), 41 deletions(-) diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c index 47aaf8328c97..9ec12c9ab96b 100644 --- a/fs/quota/dquot.c +++ b/fs/quota/dquot.c @@ -399,15 +399,17 @@ int dquot_mark_dquot_dirty(struct dquot *dquot) EXPORT_SYMBOL(dquot_mark_dquot_dirty); /* Dirtify all the dquots - this can block when journalling */ -static inline int mark_all_dquot_dirty(struct dquot * const *dquot) +static inline int mark_all_dquot_dirty(struct dquot * const *dquots) { int ret, err, cnt; + struct dquot *dquot; ret = err = 0; for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (dquot[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (dquot) /* Even in case of error we have to continue */ - ret = mark_dquot_dirty(dquot[cnt]); + ret = mark_dquot_dirty(dquot); if (!err) err = ret; } @@ -1674,6 +1676,7 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags) struct dquot_warn warn[MAXQUOTAS]; int reserve = flags & DQUOT_SPACE_RESERVE; struct dquot **dquots; + struct dquot *dquot; if (!inode_quota_active(inode)) { if (reserve) { @@ -1693,27 +1696,26 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags) index = srcu_read_lock(&dquot_srcu); spin_lock(&inode->i_lock); for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; if (reserve) { - ret = dquot_add_space(dquots[cnt], 0, number, flags, - &warn[cnt]); + ret = dquot_add_space(dquot, 0, number, flags, &warn[cnt]); } else { - ret = dquot_add_space(dquots[cnt], number, 0, flags, - &warn[cnt]); + ret = dquot_add_space(dquot, number, 0, flags, &warn[cnt]); } if (ret) { /* Back out changes we already did */ for (cnt--; cnt >= 0; cnt--) { - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - spin_lock(&dquots[cnt]->dq_dqb_lock); + spin_lock(&dquot->dq_dqb_lock); if (reserve) - dquot_free_reserved_space(dquots[cnt], - number); + dquot_free_reserved_space(dquot, number); else - dquot_decr_space(dquots[cnt], number); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + dquot_decr_space(dquot, number); + spin_unlock(&dquot->dq_dqb_lock); } spin_unlock(&inode->i_lock); goto out_flush_warn; @@ -1744,6 +1746,7 @@ int dquot_alloc_inode(struct inode *inode) int cnt, ret = 0, index; struct dquot_warn warn[MAXQUOTAS]; struct dquot * const *dquots; + struct dquot *dquot; if (!inode_quota_active(inode)) return 0; @@ -1754,17 +1757,19 @@ int dquot_alloc_inode(struct inode *inode) index = srcu_read_lock(&dquot_srcu); spin_lock(&inode->i_lock); for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - ret = dquot_add_inodes(dquots[cnt], 1, &warn[cnt]); + ret = dquot_add_inodes(dquot, 1, &warn[cnt]); if (ret) { for (cnt--; cnt >= 0; cnt--) { - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; /* Back out changes we already did */ - spin_lock(&dquots[cnt]->dq_dqb_lock); - dquot_decr_inodes(dquots[cnt], 1); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + spin_lock(&dquot->dq_dqb_lock); + dquot_decr_inodes(dquot, 1); + spin_unlock(&dquot->dq_dqb_lock); } goto warn_put_all; } @@ -1786,6 +1791,7 @@ EXPORT_SYMBOL(dquot_alloc_inode); int dquot_claim_space_nodirty(struct inode *inode, qsize_t number) { struct dquot **dquots; + struct dquot *dquot; int cnt, index; if (!inode_quota_active(inode)) { @@ -1801,9 +1807,8 @@ int dquot_claim_space_nodirty(struct inode *inode, qsize_t number) spin_lock(&inode->i_lock); /* Claim reserved quotas to allocated quotas */ for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (dquots[cnt]) { - struct dquot *dquot = dquots[cnt]; - + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (dquot) { spin_lock(&dquot->dq_dqb_lock); if (WARN_ON_ONCE(dquot->dq_dqb.dqb_rsvspace < number)) number = dquot->dq_dqb.dqb_rsvspace; @@ -1828,6 +1833,7 @@ EXPORT_SYMBOL(dquot_claim_space_nodirty); void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number) { struct dquot **dquots; + struct dquot *dquot; int cnt, index; if (!inode_quota_active(inode)) { @@ -1843,9 +1849,8 @@ void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number) spin_lock(&inode->i_lock); /* Claim reserved quotas to allocated quotas */ for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (dquots[cnt]) { - struct dquot *dquot = dquots[cnt]; - + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (dquot) { spin_lock(&dquot->dq_dqb_lock); if (WARN_ON_ONCE(dquot->dq_dqb.dqb_curspace < number)) number = dquot->dq_dqb.dqb_curspace; @@ -1872,6 +1877,7 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags) unsigned int cnt; struct dquot_warn warn[MAXQUOTAS]; struct dquot **dquots; + struct dquot *dquot; int reserve = flags & DQUOT_SPACE_RESERVE, index; if (!inode_quota_active(inode)) { @@ -1892,17 +1898,18 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags) int wtype; warn[cnt].w_type = QUOTA_NL_NOWARN; - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - spin_lock(&dquots[cnt]->dq_dqb_lock); - wtype = info_bdq_free(dquots[cnt], number); + spin_lock(&dquot->dq_dqb_lock); + wtype = info_bdq_free(dquot, number); if (wtype != QUOTA_NL_NOWARN) - prepare_warning(&warn[cnt], dquots[cnt], wtype); + prepare_warning(&warn[cnt], dquot, wtype); if (reserve) - dquot_free_reserved_space(dquots[cnt], number); + dquot_free_reserved_space(dquot, number); else - dquot_decr_space(dquots[cnt], number); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + dquot_decr_space(dquot, number); + spin_unlock(&dquot->dq_dqb_lock); } if (reserve) *inode_reserved_space(inode) -= number; @@ -1927,6 +1934,7 @@ void dquot_free_inode(struct inode *inode) unsigned int cnt; struct dquot_warn warn[MAXQUOTAS]; struct dquot * const *dquots; + struct dquot *dquot; int index; if (!inode_quota_active(inode)) @@ -1937,16 +1945,16 @@ void dquot_free_inode(struct inode *inode) spin_lock(&inode->i_lock); for (cnt = 0; cnt < MAXQUOTAS; cnt++) { int wtype; - warn[cnt].w_type = QUOTA_NL_NOWARN; - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - spin_lock(&dquots[cnt]->dq_dqb_lock); - wtype = info_idq_free(dquots[cnt], 1); + spin_lock(&dquot->dq_dqb_lock); + wtype = info_idq_free(dquot, 1); if (wtype != QUOTA_NL_NOWARN) - prepare_warning(&warn[cnt], dquots[cnt], wtype); - dquot_decr_inodes(dquots[cnt], 1); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + prepare_warning(&warn[cnt], dquot, wtype); + dquot_decr_inodes(dquot, 1); + spin_unlock(&dquot->dq_dqb_lock); } spin_unlock(&inode->i_lock); mark_all_dquot_dirty(dquots); @@ -1973,7 +1981,7 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to) qsize_t rsv_space = 0; qsize_t inode_usage = 1; struct dquot *transfer_from[MAXQUOTAS] = {}; - int cnt, ret = 0; + int cnt, index, ret = 0; char is_valid[MAXQUOTAS] = {}; struct dquot_warn warn_to[MAXQUOTAS]; struct dquot_warn warn_from_inodes[MAXQUOTAS]; @@ -2062,8 +2070,16 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to) spin_unlock(&inode->i_lock); spin_unlock(&dq_data_lock); + /* + * These arrays are local and we hold dquot references so we don't need + * the srcu protection but still take dquot_srcu to avoid warning in + * mark_all_dquot_dirty(). + */ + index = srcu_read_lock(&dquot_srcu); mark_all_dquot_dirty(transfer_from); mark_all_dquot_dirty(transfer_to); + srcu_read_unlock(&dquot_srcu, index); + flush_warnings(warn_to); flush_warnings(warn_from_inodes); flush_warnings(warn_from_space); -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP2] quota: Fix potential NULL pointer dereference
by Baokun Li 28 Apr '24

28 Apr '24

From: Wang Jianjian <wangjianjian3(a)huawei.com> stable inclusion from stable-v5.10.214 commit 61380537aa6dd32d8a723d98b8f1bd1b11d8fee0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HJX7 CVE: CVE-2024-26878 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d0aa72604fbd80c8aabb46eda00535ed35570f1f ] Below race may cause NULL pointer dereference P1 P2 dquot_free_inode quota_off drop_dquot_ref remove_dquot_ref dquots = i_dquot(inode) dquots = i_dquot(inode) srcu_read_lock dquots[cnt]) != NULL (1) dquots[type] = NULL (2) spin_lock(&dquots[cnt]->dq_dqb_lock) (3) .... If dquot_free_inode(or other routines) checks inode's quota pointers (1) before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer dereference will be triggered. So let's fix it by using a temporary pointer to avoid this issue. Signed-off-by: Wang Jianjian <wangjianjian3(a)huawei.com> Signed-off-by: Jan Kara <jack(a)suse.cz> Message-Id: <20240202081852.2514092-1-wangjianjian3(a)huawei.com> Stable-dep-of: 179b8c97ebf6 ("quota: Fix rcu annotations of inode dquot pointers") Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/quota/dquot.c | 98 ++++++++++++++++++++++++++++-------------------- 1 file changed, 57 insertions(+), 41 deletions(-) diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c index 47aaf8328c97..9ec12c9ab96b 100644 --- a/fs/quota/dquot.c +++ b/fs/quota/dquot.c @@ -399,15 +399,17 @@ int dquot_mark_dquot_dirty(struct dquot *dquot) EXPORT_SYMBOL(dquot_mark_dquot_dirty); /* Dirtify all the dquots - this can block when journalling */ -static inline int mark_all_dquot_dirty(struct dquot * const *dquot) +static inline int mark_all_dquot_dirty(struct dquot * const *dquots) { int ret, err, cnt; + struct dquot *dquot; ret = err = 0; for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (dquot[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (dquot) /* Even in case of error we have to continue */ - ret = mark_dquot_dirty(dquot[cnt]); + ret = mark_dquot_dirty(dquot); if (!err) err = ret; } @@ -1674,6 +1676,7 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags) struct dquot_warn warn[MAXQUOTAS]; int reserve = flags & DQUOT_SPACE_RESERVE; struct dquot **dquots; + struct dquot *dquot; if (!inode_quota_active(inode)) { if (reserve) { @@ -1693,27 +1696,26 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags) index = srcu_read_lock(&dquot_srcu); spin_lock(&inode->i_lock); for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; if (reserve) { - ret = dquot_add_space(dquots[cnt], 0, number, flags, - &warn[cnt]); + ret = dquot_add_space(dquot, 0, number, flags, &warn[cnt]); } else { - ret = dquot_add_space(dquots[cnt], number, 0, flags, - &warn[cnt]); + ret = dquot_add_space(dquot, number, 0, flags, &warn[cnt]); } if (ret) { /* Back out changes we already did */ for (cnt--; cnt >= 0; cnt--) { - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - spin_lock(&dquots[cnt]->dq_dqb_lock); + spin_lock(&dquot->dq_dqb_lock); if (reserve) - dquot_free_reserved_space(dquots[cnt], - number); + dquot_free_reserved_space(dquot, number); else - dquot_decr_space(dquots[cnt], number); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + dquot_decr_space(dquot, number); + spin_unlock(&dquot->dq_dqb_lock); } spin_unlock(&inode->i_lock); goto out_flush_warn; @@ -1744,6 +1746,7 @@ int dquot_alloc_inode(struct inode *inode) int cnt, ret = 0, index; struct dquot_warn warn[MAXQUOTAS]; struct dquot * const *dquots; + struct dquot *dquot; if (!inode_quota_active(inode)) return 0; @@ -1754,17 +1757,19 @@ int dquot_alloc_inode(struct inode *inode) index = srcu_read_lock(&dquot_srcu); spin_lock(&inode->i_lock); for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - ret = dquot_add_inodes(dquots[cnt], 1, &warn[cnt]); + ret = dquot_add_inodes(dquot, 1, &warn[cnt]); if (ret) { for (cnt--; cnt >= 0; cnt--) { - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; /* Back out changes we already did */ - spin_lock(&dquots[cnt]->dq_dqb_lock); - dquot_decr_inodes(dquots[cnt], 1); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + spin_lock(&dquot->dq_dqb_lock); + dquot_decr_inodes(dquot, 1); + spin_unlock(&dquot->dq_dqb_lock); } goto warn_put_all; } @@ -1786,6 +1791,7 @@ EXPORT_SYMBOL(dquot_alloc_inode); int dquot_claim_space_nodirty(struct inode *inode, qsize_t number) { struct dquot **dquots; + struct dquot *dquot; int cnt, index; if (!inode_quota_active(inode)) { @@ -1801,9 +1807,8 @@ int dquot_claim_space_nodirty(struct inode *inode, qsize_t number) spin_lock(&inode->i_lock); /* Claim reserved quotas to allocated quotas */ for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (dquots[cnt]) { - struct dquot *dquot = dquots[cnt]; - + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (dquot) { spin_lock(&dquot->dq_dqb_lock); if (WARN_ON_ONCE(dquot->dq_dqb.dqb_rsvspace < number)) number = dquot->dq_dqb.dqb_rsvspace; @@ -1828,6 +1833,7 @@ EXPORT_SYMBOL(dquot_claim_space_nodirty); void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number) { struct dquot **dquots; + struct dquot *dquot; int cnt, index; if (!inode_quota_active(inode)) { @@ -1843,9 +1849,8 @@ void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number) spin_lock(&inode->i_lock); /* Claim reserved quotas to allocated quotas */ for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (dquots[cnt]) { - struct dquot *dquot = dquots[cnt]; - + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (dquot) { spin_lock(&dquot->dq_dqb_lock); if (WARN_ON_ONCE(dquot->dq_dqb.dqb_curspace < number)) number = dquot->dq_dqb.dqb_curspace; @@ -1872,6 +1877,7 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags) unsigned int cnt; struct dquot_warn warn[MAXQUOTAS]; struct dquot **dquots; + struct dquot *dquot; int reserve = flags & DQUOT_SPACE_RESERVE, index; if (!inode_quota_active(inode)) { @@ -1892,17 +1898,18 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags) int wtype; warn[cnt].w_type = QUOTA_NL_NOWARN; - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - spin_lock(&dquots[cnt]->dq_dqb_lock); - wtype = info_bdq_free(dquots[cnt], number); + spin_lock(&dquot->dq_dqb_lock); + wtype = info_bdq_free(dquot, number); if (wtype != QUOTA_NL_NOWARN) - prepare_warning(&warn[cnt], dquots[cnt], wtype); + prepare_warning(&warn[cnt], dquot, wtype); if (reserve) - dquot_free_reserved_space(dquots[cnt], number); + dquot_free_reserved_space(dquot, number); else - dquot_decr_space(dquots[cnt], number); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + dquot_decr_space(dquot, number); + spin_unlock(&dquot->dq_dqb_lock); } if (reserve) *inode_reserved_space(inode) -= number; @@ -1927,6 +1934,7 @@ void dquot_free_inode(struct inode *inode) unsigned int cnt; struct dquot_warn warn[MAXQUOTAS]; struct dquot * const *dquots; + struct dquot *dquot; int index; if (!inode_quota_active(inode)) @@ -1937,16 +1945,16 @@ void dquot_free_inode(struct inode *inode) spin_lock(&inode->i_lock); for (cnt = 0; cnt < MAXQUOTAS; cnt++) { int wtype; - warn[cnt].w_type = QUOTA_NL_NOWARN; - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - spin_lock(&dquots[cnt]->dq_dqb_lock); - wtype = info_idq_free(dquots[cnt], 1); + spin_lock(&dquot->dq_dqb_lock); + wtype = info_idq_free(dquot, 1); if (wtype != QUOTA_NL_NOWARN) - prepare_warning(&warn[cnt], dquots[cnt], wtype); - dquot_decr_inodes(dquots[cnt], 1); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + prepare_warning(&warn[cnt], dquot, wtype); + dquot_decr_inodes(dquot, 1); + spin_unlock(&dquot->dq_dqb_lock); } spin_unlock(&inode->i_lock); mark_all_dquot_dirty(dquots); @@ -1973,7 +1981,7 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to) qsize_t rsv_space = 0; qsize_t inode_usage = 1; struct dquot *transfer_from[MAXQUOTAS] = {}; - int cnt, ret = 0; + int cnt, index, ret = 0; char is_valid[MAXQUOTAS] = {}; struct dquot_warn warn_to[MAXQUOTAS]; struct dquot_warn warn_from_inodes[MAXQUOTAS]; @@ -2062,8 +2070,16 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to) spin_unlock(&inode->i_lock); spin_unlock(&dq_data_lock); + /* + * These arrays are local and we hold dquot references so we don't need + * the srcu protection but still take dquot_srcu to avoid warning in + * mark_all_dquot_dirty(). + */ + index = srcu_read_lock(&dquot_srcu); mark_all_dquot_dirty(transfer_from); mark_all_dquot_dirty(transfer_to); + srcu_read_unlock(&dquot_srcu, index); + flush_warnings(warn_to); flush_warnings(warn_from_inodes); flush_warnings(warn_from_space); -- 2.31.1

2 1

[PATCH OLK-5.10] quota: Fix potential NULL pointer dereference
by Baokun Li 28 Apr '24

28 Apr '24

From: Wang Jianjian <wangjianjian3(a)huawei.com> stable inclusion from stable-v5.10.214 commit 61380537aa6dd32d8a723d98b8f1bd1b11d8fee0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HJX7 CVE: CVE-2024-26878 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d0aa72604fbd80c8aabb46eda00535ed35570f1f ] Below race may cause NULL pointer dereference P1 P2 dquot_free_inode quota_off drop_dquot_ref remove_dquot_ref dquots = i_dquot(inode) dquots = i_dquot(inode) srcu_read_lock dquots[cnt]) != NULL (1) dquots[type] = NULL (2) spin_lock(&dquots[cnt]->dq_dqb_lock) (3) .... If dquot_free_inode(or other routines) checks inode's quota pointers (1) before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer dereference will be triggered. So let's fix it by using a temporary pointer to avoid this issue. Signed-off-by: Wang Jianjian <wangjianjian3(a)huawei.com> Signed-off-by: Jan Kara <jack(a)suse.cz> Message-Id: <20240202081852.2514092-1-wangjianjian3(a)huawei.com> Stable-dep-of: 179b8c97ebf6 ("quota: Fix rcu annotations of inode dquot pointers") Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/quota/dquot.c | 98 ++++++++++++++++++++++++++++-------------------- 1 file changed, 57 insertions(+), 41 deletions(-) diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c index 19f38237e62d..001482fac9fd 100644 --- a/fs/quota/dquot.c +++ b/fs/quota/dquot.c @@ -399,15 +399,17 @@ int dquot_mark_dquot_dirty(struct dquot *dquot) EXPORT_SYMBOL(dquot_mark_dquot_dirty); /* Dirtify all the dquots - this can block when journalling */ -static inline int mark_all_dquot_dirty(struct dquot * const *dquot) +static inline int mark_all_dquot_dirty(struct dquot * const *dquots) { int ret, err, cnt; + struct dquot *dquot; ret = err = 0; for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (dquot[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (dquot) /* Even in case of error we have to continue */ - ret = mark_dquot_dirty(dquot[cnt]); + ret = mark_dquot_dirty(dquot); if (!err) err = ret; } @@ -1674,6 +1676,7 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags) struct dquot_warn warn[MAXQUOTAS]; int reserve = flags & DQUOT_SPACE_RESERVE; struct dquot **dquots; + struct dquot *dquot; if (!inode_quota_active(inode)) { if (reserve) { @@ -1693,27 +1696,26 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags) index = srcu_read_lock(&dquot_srcu); spin_lock(&inode->i_lock); for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; if (reserve) { - ret = dquot_add_space(dquots[cnt], 0, number, flags, - &warn[cnt]); + ret = dquot_add_space(dquot, 0, number, flags, &warn[cnt]); } else { - ret = dquot_add_space(dquots[cnt], number, 0, flags, - &warn[cnt]); + ret = dquot_add_space(dquot, number, 0, flags, &warn[cnt]); } if (ret) { /* Back out changes we already did */ for (cnt--; cnt >= 0; cnt--) { - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - spin_lock(&dquots[cnt]->dq_dqb_lock); + spin_lock(&dquot->dq_dqb_lock); if (reserve) - dquot_free_reserved_space(dquots[cnt], - number); + dquot_free_reserved_space(dquot, number); else - dquot_decr_space(dquots[cnt], number); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + dquot_decr_space(dquot, number); + spin_unlock(&dquot->dq_dqb_lock); } spin_unlock(&inode->i_lock); goto out_flush_warn; @@ -1744,6 +1746,7 @@ int dquot_alloc_inode(struct inode *inode) int cnt, ret = 0, index; struct dquot_warn warn[MAXQUOTAS]; struct dquot * const *dquots; + struct dquot *dquot; if (!inode_quota_active(inode)) return 0; @@ -1754,17 +1757,19 @@ int dquot_alloc_inode(struct inode *inode) index = srcu_read_lock(&dquot_srcu); spin_lock(&inode->i_lock); for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - ret = dquot_add_inodes(dquots[cnt], 1, &warn[cnt]); + ret = dquot_add_inodes(dquot, 1, &warn[cnt]); if (ret) { for (cnt--; cnt >= 0; cnt--) { - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; /* Back out changes we already did */ - spin_lock(&dquots[cnt]->dq_dqb_lock); - dquot_decr_inodes(dquots[cnt], 1); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + spin_lock(&dquot->dq_dqb_lock); + dquot_decr_inodes(dquot, 1); + spin_unlock(&dquot->dq_dqb_lock); } goto warn_put_all; } @@ -1786,6 +1791,7 @@ EXPORT_SYMBOL(dquot_alloc_inode); int dquot_claim_space_nodirty(struct inode *inode, qsize_t number) { struct dquot **dquots; + struct dquot *dquot; int cnt, index; if (!inode_quota_active(inode)) { @@ -1801,9 +1807,8 @@ int dquot_claim_space_nodirty(struct inode *inode, qsize_t number) spin_lock(&inode->i_lock); /* Claim reserved quotas to allocated quotas */ for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (dquots[cnt]) { - struct dquot *dquot = dquots[cnt]; - + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (dquot) { spin_lock(&dquot->dq_dqb_lock); if (WARN_ON_ONCE(dquot->dq_dqb.dqb_rsvspace < number)) number = dquot->dq_dqb.dqb_rsvspace; @@ -1828,6 +1833,7 @@ EXPORT_SYMBOL(dquot_claim_space_nodirty); void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number) { struct dquot **dquots; + struct dquot *dquot; int cnt, index; if (!inode_quota_active(inode)) { @@ -1843,9 +1849,8 @@ void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number) spin_lock(&inode->i_lock); /* Claim reserved quotas to allocated quotas */ for (cnt = 0; cnt < MAXQUOTAS; cnt++) { - if (dquots[cnt]) { - struct dquot *dquot = dquots[cnt]; - + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (dquot) { spin_lock(&dquot->dq_dqb_lock); if (WARN_ON_ONCE(dquot->dq_dqb.dqb_curspace < number)) number = dquot->dq_dqb.dqb_curspace; @@ -1872,6 +1877,7 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags) unsigned int cnt; struct dquot_warn warn[MAXQUOTAS]; struct dquot **dquots; + struct dquot *dquot; int reserve = flags & DQUOT_SPACE_RESERVE, index; if (!inode_quota_active(inode)) { @@ -1892,17 +1898,18 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags) int wtype; warn[cnt].w_type = QUOTA_NL_NOWARN; - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - spin_lock(&dquots[cnt]->dq_dqb_lock); - wtype = info_bdq_free(dquots[cnt], number); + spin_lock(&dquot->dq_dqb_lock); + wtype = info_bdq_free(dquot, number); if (wtype != QUOTA_NL_NOWARN) - prepare_warning(&warn[cnt], dquots[cnt], wtype); + prepare_warning(&warn[cnt], dquot, wtype); if (reserve) - dquot_free_reserved_space(dquots[cnt], number); + dquot_free_reserved_space(dquot, number); else - dquot_decr_space(dquots[cnt], number); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + dquot_decr_space(dquot, number); + spin_unlock(&dquot->dq_dqb_lock); } if (reserve) *inode_reserved_space(inode) -= number; @@ -1927,6 +1934,7 @@ void dquot_free_inode(struct inode *inode) unsigned int cnt; struct dquot_warn warn[MAXQUOTAS]; struct dquot * const *dquots; + struct dquot *dquot; int index; if (!inode_quota_active(inode)) @@ -1937,16 +1945,16 @@ void dquot_free_inode(struct inode *inode) spin_lock(&inode->i_lock); for (cnt = 0; cnt < MAXQUOTAS; cnt++) { int wtype; - warn[cnt].w_type = QUOTA_NL_NOWARN; - if (!dquots[cnt]) + dquot = srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - spin_lock(&dquots[cnt]->dq_dqb_lock); - wtype = info_idq_free(dquots[cnt], 1); + spin_lock(&dquot->dq_dqb_lock); + wtype = info_idq_free(dquot, 1); if (wtype != QUOTA_NL_NOWARN) - prepare_warning(&warn[cnt], dquots[cnt], wtype); - dquot_decr_inodes(dquots[cnt], 1); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + prepare_warning(&warn[cnt], dquot, wtype); + dquot_decr_inodes(dquot, 1); + spin_unlock(&dquot->dq_dqb_lock); } spin_unlock(&inode->i_lock); mark_all_dquot_dirty(dquots); @@ -1973,7 +1981,7 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to) qsize_t rsv_space = 0; qsize_t inode_usage = 1; struct dquot *transfer_from[MAXQUOTAS] = {}; - int cnt, ret = 0; + int cnt, index, ret = 0; char is_valid[MAXQUOTAS] = {}; struct dquot_warn warn_to[MAXQUOTAS]; struct dquot_warn warn_from_inodes[MAXQUOTAS]; @@ -2062,8 +2070,16 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to) spin_unlock(&inode->i_lock); spin_unlock(&dq_data_lock); + /* + * These arrays are local and we hold dquot references so we don't need + * the srcu protection but still take dquot_srcu to avoid warning in + * mark_all_dquot_dirty(). + */ + index = srcu_read_lock(&dquot_srcu); mark_all_dquot_dirty(transfer_from); mark_all_dquot_dirty(transfer_to); + srcu_read_unlock(&dquot_srcu, index); + flush_warnings(warn_to); flush_warnings(warn_from_inodes); flush_warnings(warn_from_space); -- 2.31.1

2 1

[PATCH OLK-5.10 v2] char: imx-rngc: fix clk_disable_unprepare missing in error path
by Ye Weihua 28 Apr '24

28 Apr '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9K8D1 -------------------------------- Function clk_prepare_enable(rngc->clk) is called in imx_rngc_probe, but clk_disable_unprepare(rngc->clk) is missing in error path. Use goto exchange return to fix it. Fixes: cd1da72d0c29 ("hwrng: imx-rngc - Moving IRQ handler registering after imx_rngc_irq_mask_clear()") Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> --- drivers/char/hw_random/imx-rngc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/char/hw_random/imx-rngc.c b/drivers/char/hw_random/imx-rngc.c index dbb2da630611..112616996a4e 100644 --- a/drivers/char/hw_random/imx-rngc.c +++ b/drivers/char/hw_random/imx-rngc.c @@ -287,7 +287,7 @@ static int imx_rngc_probe(struct platform_device *pdev) irq, imx_rngc_irq, 0, pdev->name, (void *)rngc); if (ret) { dev_err(rngc->dev, "Can't get interrupt working.\n"); - return ret; + goto err; } if (self_test) { -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] infiniband/hw/hiroce3: Add Huawei Intelligent Network Card RDMA Driver
by Shuai Wu 28 Apr '24

28 Apr '24

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9H643 CVE: NA --------------------------------- The RDMA driver supports the following features: Supports Huawei SP600 series NICs; Supports RoCEv2; Supports RoCE XRC, UD, UC, and RC modes; Supports RoCE UC, RC, and UD local switching; Supports RoCE MR, PD, CQ, QoS, QP, and SRQ management; Supports RoCE congestion control; Supports RoCE Bond; Supports RoCE FLR; Supports RoCE entry specifications; Supports RoCE error detection and reporting; Signed-off-by: Shuai Wu <wushuai51(a)huawei.com> Shuai Wu (2): net/ethernet/huawei/hinic3: Add the CQM on which the RDMA depends infiniband/hw/hiroce3: Add Huawei Intelligent Network Card RDMA Driver Documentation/networking/hinic3.txt | 15 + arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/infiniband/Kconfig | 1 + drivers/infiniband/hw/Makefile | 1 + drivers/infiniband/hw/hiroce3/Kconfig | 14 + drivers/infiniband/hw/hiroce3/Makefile | 98 + .../infiniband/hw/hiroce3/bond/roce_bond.h | 147 + .../hw/hiroce3/bond/roce_bond_common.c | 938 +++ drivers/infiniband/hw/hiroce3/cq/roce_cq.h | 250 + .../infiniband/hw/hiroce3/cq/roce_cq_common.c | 195 + .../infiniband/hw/hiroce3/cq/roce_cq_cqe.c | 744 +++ .../infiniband/hw/hiroce3/cq/roce_cq_create.c | 629 ++ .../infiniband/hw/hiroce3/cq/roce_cq_ctrl.c | 930 +++ .../hw/hiroce3/cq/roce_cq_destroy.c | 247 + drivers/infiniband/hw/hiroce3/dfx/roce_dfx.c | 122 + drivers/infiniband/hw/hiroce3/dfx/roce_dfx.h | 177 + .../infiniband/hw/hiroce3/dfx/roce_dfx_cap.c | 688 +++ .../infiniband/hw/hiroce3/dfx/roce_dfx_cap.h | 181 + .../hw/hiroce3/dfx/roce_dfx_query.c | 643 ++ .../hiroce3/extension/roce_cdev_extension.c | 11 + .../hiroce3/extension/roce_event_extension.c | 23 + .../hiroce3/extension/roce_main_extension.c | 188 + .../hw/hiroce3/extension/roce_mr_extension.c | 31 + .../hiroce3/extension/roce_netdev_extension.c | 121 + .../hw/hiroce3/extension/roce_qp_extension.c | 241 + .../extension/roce_qp_post_send_extension.c | 11 + .../hw/hiroce3/extension/roce_srq_extension.c | 27 + .../hw/hiroce3/host/hmm/hmm_buddy.c | 161 + .../hw/hiroce3/host/hmm/hmm_buddy.h | 32 + .../infiniband/hw/hiroce3/host/hmm/hmm_comp.c | 164 + .../infiniband/hw/hiroce3/host/hmm/hmm_comp.h | 228 + .../hw/hiroce3/host/hmm/hmm_comp_init.c | 123 + .../hw/hiroce3/host/hmm/hmm_comp_mtt.c | 494 ++ .../hw/hiroce3/host/hmm/hmm_comp_mw_mr.c | 220 + .../hw/hiroce3/host/hmm/hmm_comp_res.c | 58 + .../infiniband/hw/hiroce3/host/hmm/hmm_em.c | 348 ++ .../infiniband/hw/hiroce3/host/hmm/hmm_em.h | 47 + .../infiniband/hw/hiroce3/host/hmm/hmm_mr.c | 429 ++ .../infiniband/hw/hiroce3/host/hmm/hmm_mr.h | 32 + .../infiniband/hw/hiroce3/host/hmm/hmm_umem.c | 273 + .../infiniband/hw/hiroce3/host/hmm/hmm_umem.h | 124 + .../hw/hiroce3/include/hinic3_hmm.h | 93 + .../hw/hiroce3/include/hinic3_rdma.h | 202 + .../hw/hiroce3/include/nic/nic_mpu_cmd.h | 181 + .../hw/hiroce3/include/nic/nic_npu_cmd.h | 29 + .../hw/hiroce3/include/nic/nic_npu_cmd_defs.h | 134 + .../infiniband/hw/hiroce3/include/node_id.h | 52 + .../include/rdma/rdma_context_format.h | 5181 +++++++++++++++++ .../include/rdma/rdma_ext_ctx_format.h | 379 ++ .../hw/hiroce3/include/rdma/roce_ccf_format.h | 722 +++ .../hiroce3/include/rdma/roce_compile_macro.h | 66 + .../hw/hiroce3/include/rdma/roce_ctx_api.h | 258 + .../hw/hiroce3/include/rdma/roce_dif_format.h | 492 ++ .../hw/hiroce3/include/rdma/roce_err_type.h | 122 + .../hiroce3/include/rdma/roce_hmm_context.h | 210 + .../hw/hiroce3/include/rdma/roce_mpu_common.h | 234 + .../hw/hiroce3/include/rdma/roce_pub.h | 259 + .../hw/hiroce3/include/rdma/roce_pub_cmd.h | 261 + .../hw/hiroce3/include/rdma/roce_ulp.h | 178 + .../hw/hiroce3/include/rdma/roce_vbs_format.h | 206 + .../hw/hiroce3/include/rdma/roce_verbs_attr.h | 413 ++ .../include/rdma/roce_verbs_attr_qpc_chip.h | 360 ++ .../hw/hiroce3/include/rdma/roce_verbs_cmd.h | 248 + .../hiroce3/include/rdma/roce_verbs_cq_attr.h | 196 + .../include/rdma/roce_verbs_ext_attr.h | 48 + .../hiroce3/include/rdma/roce_verbs_format.h | 132 + .../include/rdma/roce_verbs_gid_attr.h | 111 + .../hiroce3/include/rdma/roce_verbs_mr_attr.h | 330 ++ .../hw/hiroce3/include/rdma/roce_verbs_pub.h | 225 + .../include/rdma/roce_verbs_srq_attr.h | 264 + .../include/rdma/roce_verbs_ulp_format.h | 91 + .../hw/hiroce3/include/rdma/roce_wqe_format.h | 930 +++ .../hw/hiroce3/include/rdma/roce_xqe_format.h | 722 +++ .../hw/hiroce3/include/roce_cdev_extension.h | 13 + .../hw/hiroce3/include/roce_event_extension.h | 13 + .../hw/hiroce3/include/roce_main_extension.h | 78 + .../hw/hiroce3/include/roce_mr_extension.h | 17 + .../hiroce3/include/roce_netdev_extension.h | 19 + .../hw/hiroce3/include/roce_qp_extension.h | 64 + .../include/roce_qp_post_send_extension.h | 13 + .../hw/hiroce3/include/roce_srq_extension.h | 14 + drivers/infiniband/hw/hiroce3/mr/roce_mr.c | 949 +++ drivers/infiniband/hw/hiroce3/mr/roce_mr.h | 97 + drivers/infiniband/hw/hiroce3/qp/roce_post.h | 167 + drivers/infiniband/hw/hiroce3/qp/roce_qp.h | 244 + .../infiniband/hw/hiroce3/qp/roce_qp_create.c | 1239 ++++ .../hw/hiroce3/qp/roce_qp_destroy.c | 260 + .../infiniband/hw/hiroce3/qp/roce_qp_exp.h | 80 + .../infiniband/hw/hiroce3/qp/roce_qp_modify.c | 2243 +++++++ .../hw/hiroce3/qp/roce_qp_post_recv.c | 223 + .../hw/hiroce3/qp/roce_qp_post_send.c | 1315 +++++ .../infiniband/hw/hiroce3/qp/roce_qp_query.c | 393 ++ .../infiniband/hw/hiroce3/rdma/rdma_bitmap.c | 129 + .../infiniband/hw/hiroce3/rdma/rdma_bitmap.h | 36 + .../infiniband/hw/hiroce3/rdma/rdma_comp.c | 22 + .../infiniband/hw/hiroce3/rdma/rdma_comp.h | 131 + .../hw/hiroce3/rdma/rdma_comp_gid.c | 281 + .../hw/hiroce3/rdma/rdma_comp_init.c | 366 ++ .../hw/hiroce3/rdma/rdma_comp_mw_mr.c | 242 + .../infiniband/hw/hiroce3/rdma/rdma_comp_pd.c | 50 + .../hw/hiroce3/rdma/rdma_comp_res.c | 245 + drivers/infiniband/hw/hiroce3/roce.h | 574 ++ drivers/infiniband/hw/hiroce3/roce_cdev.c | 1259 ++++ drivers/infiniband/hw/hiroce3/roce_cmd.c | 722 +++ drivers/infiniband/hw/hiroce3/roce_cmd.h | 74 + drivers/infiniband/hw/hiroce3/roce_compat.h | 60 + drivers/infiniband/hw/hiroce3/roce_cqm_cmd.c | 52 + drivers/infiniband/hw/hiroce3/roce_cqm_cmd.h | 17 + drivers/infiniband/hw/hiroce3/roce_db.c | 88 + drivers/infiniband/hw/hiroce3/roce_db.h | 29 + drivers/infiniband/hw/hiroce3/roce_event.c | 566 ++ drivers/infiniband/hw/hiroce3/roce_event.h | 36 + drivers/infiniband/hw/hiroce3/roce_k_ioctl.h | 89 + drivers/infiniband/hw/hiroce3/roce_main.c | 1609 +++++ drivers/infiniband/hw/hiroce3/roce_mix.c | 1194 ++++ drivers/infiniband/hw/hiroce3/roce_mix.h | 205 + drivers/infiniband/hw/hiroce3/roce_netdev.c | 786 +++ drivers/infiniband/hw/hiroce3/roce_netdev.h | 59 + drivers/infiniband/hw/hiroce3/roce_netlink.c | 352 ++ drivers/infiniband/hw/hiroce3/roce_netlink.h | 164 + drivers/infiniband/hw/hiroce3/roce_pd.c | 66 + drivers/infiniband/hw/hiroce3/roce_pd.h | 24 + drivers/infiniband/hw/hiroce3/roce_sysfs.c | 1800 ++++++ drivers/infiniband/hw/hiroce3/roce_sysfs.h | 108 + drivers/infiniband/hw/hiroce3/roce_user.h | 65 + drivers/infiniband/hw/hiroce3/roce_xrc.c | 128 + drivers/infiniband/hw/hiroce3/roce_xrc.h | 23 + drivers/infiniband/hw/hiroce3/srq/roce_srq.h | 201 + .../infiniband/hw/hiroce3/srq/roce_srq_comm.c | 93 + .../hw/hiroce3/srq/roce_srq_create.c | 635 ++ .../infiniband/hw/hiroce3/srq/roce_srq_ctrl.c | 570 ++ drivers/net/ethernet/huawei/hinic3/Makefile | 22 +- .../ethernet/huawei/hinic3/bond/hinic3_bond.c | 1042 ++++ .../ethernet/huawei/hinic3/bond/hinic3_bond.h | 98 + .../ethernet/huawei/hinic3/comm_msg_intf.h | 565 +- .../ethernet/huawei/hinic3/cqm/cqm_bat_cla.c | 2056 +++++++ .../ethernet/huawei/hinic3/cqm/cqm_bat_cla.h | 214 + .../huawei/hinic3/cqm/cqm_bitmap_table.c | 1454 +++++ .../huawei/hinic3/cqm/cqm_bitmap_table.h | 66 + .../huawei/hinic3/cqm/cqm_bloomfilter.c | 535 ++ .../huawei/hinic3/cqm/cqm_bloomfilter.h | 53 + .../net/ethernet/huawei/hinic3/cqm/cqm_cmd.c | 250 + .../net/ethernet/huawei/hinic3/cqm/cqm_cmd.h | 39 + .../net/ethernet/huawei/hinic3/cqm/cqm_db.c | 506 ++ .../net/ethernet/huawei/hinic3/cqm/cqm_db.h | 36 + .../ethernet/huawei/hinic3/cqm/cqm_define.h | 54 + .../net/ethernet/huawei/hinic3/cqm/cqm_main.c | 1743 ++++++ .../net/ethernet/huawei/hinic3/cqm/cqm_main.h | 380 ++ .../ethernet/huawei/hinic3/cqm/cqm_memsec.c | 665 +++ .../ethernet/huawei/hinic3/cqm/cqm_memsec.h | 23 + .../ethernet/huawei/hinic3/cqm/cqm_object.c | 1664 ++++++ .../ethernet/huawei/hinic3/cqm/cqm_object.h | 714 +++ .../huawei/hinic3/cqm/cqm_object_intern.c | 1467 +++++ .../huawei/hinic3/cqm/cqm_object_intern.h | 93 + .../net/ethernet/huawei/hinic3/cqm/readme.txt | 3 + .../net/ethernet/huawei/hinic3/hinic3_crm.h | 110 +- .../net/ethernet/huawei/hinic3/hinic3_dbg.c | 2 + .../net/ethernet/huawei/hinic3/hinic3_hw.h | 51 +- .../ethernet/huawei/hinic3/hinic3_mag_cfg.c | 4 +- .../huawei/hinic3/hinic3_mgmt_interface.h | 377 +- .../net/ethernet/huawei/hinic3/hinic3_nic.h | 1 - .../ethernet/huawei/hinic3/hinic3_nic_cfg.h | 1 + .../ethernet/huawei/hinic3/hinic3_srv_nic.h | 5 + .../ethernet/huawei/hinic3/hw/hinic3_cmdq.c | 33 +- .../ethernet/huawei/hinic3/hw/hinic3_cmdq.h | 7 +- .../ethernet/huawei/hinic3/hw/hinic3_csr.h | 1 + .../huawei/hinic3/hw/hinic3_devlink.h | 24 + .../ethernet/huawei/hinic3/hw/hinic3_eqs.c | 35 + .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c | 155 +- .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h | 17 +- .../huawei/hinic3/hw/hinic3_hw_comm.c | 148 +- .../huawei/hinic3/hw/hinic3_hw_comm.h | 2 +- .../ethernet/huawei/hinic3/hw/hinic3_hw_mt.c | 39 +- .../ethernet/huawei/hinic3/hw/hinic3_hwdev.c | 212 +- .../ethernet/huawei/hinic3/hw/hinic3_hwdev.h | 33 +- .../ethernet/huawei/hinic3/hw/hinic3_hwif.c | 54 + .../ethernet/huawei/hinic3/hw/hinic3_mbox.c | 113 +- .../ethernet/huawei/hinic3/hw/hinic3_mbox.h | 82 +- .../ethernet/huawei/hinic3/hw/hinic3_mgmt.c | 76 +- .../ethernet/huawei/hinic3/hw/hinic3_mgmt.h | 5 +- .../huawei/hinic3/hw/hinic3_multi_host_mgmt.c | 1231 ++++ .../huawei/hinic3/hw/hinic3_multi_host_mgmt.h | 124 + .../huawei/hinic3/hw/hinic3_nictool.c | 1 + .../huawei/hinic3/hw/hinic3_pci_id_tbl.h | 30 +- .../huawei/hinic3/hw/ossl_knl_linux.c | 20 +- .../hinic3/include/bond/bond_common_defs.h | 69 + .../include/cfg_mgmt/cfg_mgmt_mpu_cmd.h | 12 + .../include/cfg_mgmt/cfg_mgmt_mpu_cmd_defs.h | 212 + .../huawei/hinic3/include/cqm/cqm_npu_cmd.h | 31 + .../hinic3/include/cqm/cqm_npu_cmd_defs.h | 61 + .../huawei/hinic3/include/hinic3_common.h | 181 + .../huawei/hinic3/include/hinic3_cqm.h | 364 ++ .../huawei/hinic3/include/hinic3_cqm_define.h | 52 + .../huawei/hinic3/include/hinic3_lld.h | 223 + .../huawei/hinic3/include/hinic3_profile.h | 148 + .../huawei/hinic3/include/mpu/mag_mpu_cmd.h | 70 + .../hinic3/include/mpu/mpu_board_defs.h | 71 + .../hinic3/include/mpu/mpu_cmd_base_defs.h | 116 + .../hinic3/include/mpu/mpu_inband_cmd.h | 187 + .../hinic3/include/mpu/mpu_inband_cmd_defs.h | 1078 ++++ .../include/mpu/mpu_outband_ncsi_cmd_defs.h | 205 + .../huawei/hinic3/include/mpu/nic_cfg_comm.h | 55 + .../huawei/hinic3/include/ossl_types.h | 144 + .../include/public/npu_cmdq_base_defs.h | 232 + .../ethernet/huawei/hinic3/include/readme.txt | 1 + .../hinic3/include/vmsec/vmsec_mpu_common.h | 107 + .../huawei/hinic3/include/vram_common.h | 65 + drivers/net/ethernet/huawei/hinic3/mag_cmd.h | 272 +- drivers/net/ethernet/huawei/hinic3/ossl_knl.h | 4 + .../ethernet/huawei/hinic3/ossl_knl_linux.h | 29 +- openEuler/MAINTAINERS | 18 + 212 files changed, 62945 insertions(+), 1125 deletions(-) create mode 100644 drivers/infiniband/hw/hiroce3/Kconfig create mode 100644 drivers/infiniband/hw/hiroce3/Makefile create mode 100644 drivers/infiniband/hw/hiroce3/bond/roce_bond.h create mode 100644 drivers/infiniband/hw/hiroce3/bond/roce_bond_common.c create mode 100644 drivers/infiniband/hw/hiroce3/cq/roce_cq.h create mode 100644 drivers/infiniband/hw/hiroce3/cq/roce_cq_common.c create mode 100644 drivers/infiniband/hw/hiroce3/cq/roce_cq_cqe.c create mode 100644 drivers/infiniband/hw/hiroce3/cq/roce_cq_create.c create mode 100644 drivers/infiniband/hw/hiroce3/cq/roce_cq_ctrl.c create mode 100644 drivers/infiniband/hw/hiroce3/cq/roce_cq_destroy.c create mode 100644 drivers/infiniband/hw/hiroce3/dfx/roce_dfx.c create mode 100644 drivers/infiniband/hw/hiroce3/dfx/roce_dfx.h create mode 100644 drivers/infiniband/hw/hiroce3/dfx/roce_dfx_cap.c create mode 100644 drivers/infiniband/hw/hiroce3/dfx/roce_dfx_cap.h create mode 100644 drivers/infiniband/hw/hiroce3/dfx/roce_dfx_query.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_cdev_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_event_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_main_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_mr_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_netdev_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_qp_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_qp_post_send_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_srq_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_buddy.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_buddy.h create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_comp.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_comp.h create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_comp_init.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_comp_mtt.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_comp_mw_mr.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_comp_res.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_em.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_em.h create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_mr.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_mr.h create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_umem.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_umem.h create mode 100644 drivers/infiniband/hw/hiroce3/include/hinic3_hmm.h create mode 100644 drivers/infiniband/hw/hiroce3/include/hinic3_rdma.h create mode 100644 drivers/infiniband/hw/hiroce3/include/nic/nic_mpu_cmd.h create mode 100644 drivers/infiniband/hw/hiroce3/include/nic/nic_npu_cmd.h create mode 100644 drivers/infiniband/hw/hiroce3/include/nic/nic_npu_cmd_defs.h create mode 100644 drivers/infiniband/hw/hiroce3/include/node_id.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_ccf_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_compile_macro.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_ctx_api.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_dif_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_err_type.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_hmm_context.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_mpu_common.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_pub.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_pub_cmd.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_ulp.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_vbs_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_attr.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_attr_qpc_chip.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cq_attr.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_ext_attr.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_gid_attr.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_mr_attr.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_pub.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_srq_attr.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_ulp_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_wqe_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_xqe_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_cdev_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_event_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_main_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_mr_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_netdev_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_qp_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_qp_post_send_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_srq_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/mr/roce_mr.c create mode 100644 drivers/infiniband/hw/hiroce3/mr/roce_mr.h create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_post.h create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp.h create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp_create.c create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp_destroy.c create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp_exp.h create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp_modify.c create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp_post_recv.c create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp_post_send.c create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp_query.c create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_bitmap.c create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_bitmap.h create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_comp.c create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_comp.h create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_comp_gid.c create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_comp_init.c create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_comp_mw_mr.c create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_comp_pd.c create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_comp_res.c create mode 100644 drivers/infiniband/hw/hiroce3/roce.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_cdev.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_cmd.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_cmd.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_compat.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_cqm_cmd.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_cqm_cmd.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_db.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_db.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_event.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_event.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_k_ioctl.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_main.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_mix.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_mix.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_netdev.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_netdev.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_netlink.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_netlink.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_pd.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_pd.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_sysfs.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_sysfs.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_user.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_xrc.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_xrc.h create mode 100644 drivers/infiniband/hw/hiroce3/srq/roce_srq.h create mode 100644 drivers/infiniband/hw/hiroce3/srq/roce_srq_comm.c create mode 100644 drivers/infiniband/hw/hiroce3/srq/roce_srq_create.c create mode 100644 drivers/infiniband/hw/hiroce3/srq/roce_srq_ctrl.c create mode 100644 drivers/net/ethernet/huawei/hinic3/bond/hinic3_bond.c create mode 100644 drivers/net/ethernet/huawei/hinic3/bond/hinic3_bond.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_bat_cla.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_bat_cla.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_bitmap_table.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_bitmap_table.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_db.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_db.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_main.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_main.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_memsec.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_memsec.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_object.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_object.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/readme.txt create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/bond/bond_common_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/cfg_mgmt/cfg_mgmt_mpu_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/cfg_mgmt/cfg_mgmt_mpu_cmd_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/cqm/cqm_npu_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/cqm/cqm_npu_cmd_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/hinic3_common.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/hinic3_cqm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/hinic3_cqm_define.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/hinic3_lld.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/hinic3_profile.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/mpu/mag_mpu_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/mpu/mpu_board_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/mpu/mpu_cmd_base_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/mpu/mpu_inband_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/mpu/mpu_inband_cmd_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/mpu/mpu_outband_ncsi_cmd_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/mpu/nic_cfg_comm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/ossl_types.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/public/npu_cmdq_base_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/readme.txt create mode 100644 drivers/net/ethernet/huawei/hinic3/include/vmsec/vmsec_mpu_common.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/vram_common.h -- 2.33.0

2 3

[openeuler:OLK-6.6 7548/7556] versioncheck: ./drivers/infiniband/hw/hiroce3/host/hmm/hmm_umem.c: 11 linux/version.h not needed.
by kernel test robot 28 Apr '24

28 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 6773f12aed5e797a2c93fd0f7632568554503971 commit: 5bc8dbb5fdf565625b2eea4080dbd70bade992b8 [7548/7556] infiniband/hw/hiroce3: Add Huawei Intelligent Network Card RDMA Driver reproduce: (https://download.01.org/0day-ci/archive/20240428/202404281218.3X9ID2Lw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404281218.3X9ID2Lw-lkp@intel.com/ versioncheck warnings: (new ones prefixed by >>) INFO PATH=/opt/cross/rustc-1.73.0-bindgen-0.65.1/cargo/bin:/opt/cross/clang-18/bin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin /usr/bin/timeout -k 100 3h /usr/bin/make KCFLAGS= -Wtautological-compare -Wno-error=return-type -Wreturn-type -Wcast-function-type -funsigned-char -Wundef -fstrict-flex-arrays=3 -Wformat-overflow -Wformat-truncation -Wenum-conversion W=1 --keep-going LLVM=1 -j32 ARCH=x86_64 versioncheck find ./* $ -name SCCS -o -name BitKeeper -o -name .svn -o -name CVS -o -name .pc -o -name .hg -o -name .git $ -prune -o \ -name '*.[hcS]' -type f -print | sort \ | xargs perl -w ./scripts/checkversion.pl ./drivers/accessibility/speakup/genmap.c: 13 linux/version.h not needed. ./drivers/accessibility/speakup/makemapdata.c: 13 linux/version.h not needed. ./drivers/char/ipmi/ipmi_si_ls2k500.c: 19 linux/version.h not needed. ./drivers/crypto/montage/tsse/tsse_vuart.c: 21 linux/version.h not needed. ./drivers/gpu/drm/phytium/phytium_gem.c: 9 linux/version.h not needed. ./drivers/i2c/busses/i2c-zhaoxin.c: 18 linux/version.h not needed. >> ./drivers/infiniband/hw/hiroce3/host/hmm/hmm_umem.c: 11 linux/version.h not needed. >> ./drivers/infiniband/hw/hiroce3/roce.h: 11 linux/version.h not needed. ./drivers/net/ethernet/3snic/sssnic/include/kernel/sss_linux_kernel.h: 13 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_include.h: 32 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c: 17 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h: 20 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_main.c: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_mce.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic/ossl_knl.h: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic3/bond/hinic3_bond.c: 12 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic3/ossl_knl_linux.h: 11 linux/version.h not needed. ./drivers/net/ethernet/mucse/rnpm/rnpm_common.h: 7 linux/version.h not needed. ./drivers/scsi/hisi_raid/hiraid_main.c: 9 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_fw.c: 6 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_os.c: 6 linux/version.h not needed. ./drivers/staging/media/atomisp/include/linux/atomisp.h: 23 linux/version.h not needed. ./fs/proc/etmem_scan.c: 13 linux/version.h not needed. ./samples/bpf/spintest.bpf.c: 8 linux/version.h not needed. ./samples/trace_events/trace_custom_sched.c: 11 linux/version.h not needed. ./sound/soc/codecs/cs42l42.c: 14 linux/version.h not needed. ./tools/lib/bpf/bpf_helpers.h: 402: need linux/version.h ./tools/testing/selftests/bpf/progs/dev_cgroup.c: 9 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/netcnt_prog.c: 3 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_map_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_send_signal_kern.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_spin_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_tcp_estats.c: 37 linux/version.h not needed. ./tools/testing/selftests/wireguard/qemu/init.c: 27 linux/version.h not needed. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 7547/7556] versioncheck: ./drivers/net/ethernet/huawei/hinic3/bond/hinic3_bond.c: 12 linux/version.h not needed.
by kernel test robot 28 Apr '24

28 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 6773f12aed5e797a2c93fd0f7632568554503971 commit: 4213ff7957de370c1cfe528c2bad1eb2e499038a [7547/7556] net/ethernet/huawei/hinic3: Add the CQM on which the RDMA depends reproduce: (https://download.01.org/0day-ci/archive/20240428/202404281213.ck83MEim-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404281213.ck83MEim-lkp@intel.com/ versioncheck warnings: (new ones prefixed by >>) INFO PATH=/opt/cross/rustc-1.73.0-bindgen-0.65.1/cargo/bin:/opt/cross/clang-18/bin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin /usr/bin/timeout -k 100 3h /usr/bin/make KCFLAGS= -Wtautological-compare -Wno-error=return-type -Wreturn-type -Wcast-function-type -funsigned-char -Wundef -fstrict-flex-arrays=3 -Wformat-overflow -Wformat-truncation -Wenum-conversion W=1 --keep-going LLVM=1 -j32 ARCH=x86_64 versioncheck find ./* $ -name SCCS -o -name BitKeeper -o -name .svn -o -name CVS -o -name .pc -o -name .hg -o -name .git $ -prune -o \ -name '*.[hcS]' -type f -print | sort \ | xargs perl -w ./scripts/checkversion.pl ./drivers/accessibility/speakup/genmap.c: 13 linux/version.h not needed. ./drivers/accessibility/speakup/makemapdata.c: 13 linux/version.h not needed. ./drivers/char/ipmi/ipmi_si_ls2k500.c: 19 linux/version.h not needed. ./drivers/crypto/montage/tsse/tsse_vuart.c: 21 linux/version.h not needed. ./drivers/gpu/drm/phytium/phytium_gem.c: 9 linux/version.h not needed. ./drivers/i2c/busses/i2c-zhaoxin.c: 18 linux/version.h not needed. ./drivers/net/ethernet/3snic/sssnic/include/kernel/sss_linux_kernel.h: 13 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_include.h: 32 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c: 17 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h: 20 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_main.c: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_mce.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic/ossl_knl.h: 22 linux/version.h not needed. >> ./drivers/net/ethernet/huawei/hinic3/bond/hinic3_bond.c: 12 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic3/ossl_knl_linux.h: 11 linux/version.h not needed. ./drivers/net/ethernet/mucse/rnpm/rnpm_common.h: 7 linux/version.h not needed. ./drivers/scsi/hisi_raid/hiraid_main.c: 9 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_fw.c: 6 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_os.c: 6 linux/version.h not needed. ./drivers/staging/media/atomisp/include/linux/atomisp.h: 23 linux/version.h not needed. ./fs/proc/etmem_scan.c: 13 linux/version.h not needed. ./samples/bpf/spintest.bpf.c: 8 linux/version.h not needed. ./samples/trace_events/trace_custom_sched.c: 11 linux/version.h not needed. ./sound/soc/codecs/cs42l42.c: 14 linux/version.h not needed. ./tools/lib/bpf/bpf_helpers.h: 402: need linux/version.h ./tools/testing/selftests/bpf/progs/dev_cgroup.c: 9 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/netcnt_prog.c: 3 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_map_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_send_signal_kern.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_spin_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_tcp_estats.c: 37 linux/version.h not needed. ./tools/testing/selftests/wireguard/qemu/init.c: 27 linux/version.h not needed. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 v2 0/5] CVE-2024-26921
by Ziyang Xuan 28 Apr '24

28 Apr '24

Patchset of CVE-2024-26921. v2: - Fix comment head for KABI bugfix patch. Florian Westphal (1): inet: inet_defrag: prevent sk release while still in use Vasily Averin (2): skbuff: introduce skb_expand_head() skb_expand_head() adjust skb->truesize incorrectly Ziyang Xuan (2): net: Fix KABI break for introducing is_skb_wmem() sk_buff: Fix KABI break for the modification of struct sk_buff include/linux/skbuff.h | 1 + include/net/tcp.h | 2 +- include/net/tcp_ext.h | 14 +++++ net/core/skbuff.c | 52 ++++++++++++++++++ net/ipv4/inet_fragment.c | 70 ++++++++++++++++++++----- net/ipv4/ip_fragment.c | 2 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- 7 files changed, 127 insertions(+), 16 deletions(-) create mode 100644 include/net/tcp_ext.h -- 2.25.1

2 6

[PATCH OLK-5.10] char: imx-rngc: fix clk_disable_unprepare missing in error path
by Ye Weihua 28 Apr '24

28 Apr '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9K8D1 -------------------------------- Function clk_prepare_enable(rngc->clk) is called in imx_rngc_probe, but clk_disable_unprepare(rngc->clk) is missing in error path. Use goto exchange return to fix it. Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> --- drivers/char/hw_random/imx-rngc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/char/hw_random/imx-rngc.c b/drivers/char/hw_random/imx-rngc.c index dbb2da630611..112616996a4e 100644 --- a/drivers/char/hw_random/imx-rngc.c +++ b/drivers/char/hw_random/imx-rngc.c @@ -287,7 +287,7 @@ static int imx_rngc_probe(struct platform_device *pdev) irq, imx_rngc_irq, 0, pdev->name, (void *)rngc); if (ret) { dev_err(rngc->dev, "Can't get interrupt working.\n"); - return ret; + goto err; } if (self_test) { -- 2.34.1

2 1

[PATCH OLK-6.6 v2] btrfs: fix data races when accessing the reserved amount of block reserves
by Baokun Li 28 Apr '24

28 Apr '24

From: Filipe Manana <fdmanana(a)suse.com> stable inclusion from stable-v6.6.23 commit 82220b1835baaebf4ae2e490f56353a341a09bd2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HKBL CVE: CVE-2024-26905 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e06cc89475eddc1f3a7a4d471524256152c68166 ] At space_info.c we have several places where we access the ->reserved field of a block reserve without taking the block reserve's spinlock first, which makes KCSAN warn about a data race since that field is always updated while holding the spinlock. The reports from KCSAN are like the following: [117.193526] BUG: KCSAN: data-race in btrfs_block_rsv_release [btrfs] / need_preemptive_reclaim [btrfs] [117.195148] read to 0x000000017f587190 of 8 bytes by task 6303 on cpu 3: [117.195172] need_preemptive_reclaim+0x222/0x2f0 [btrfs] [117.195992] __reserve_bytes+0xbb0/0xdc8 [btrfs] [117.196807] btrfs_reserve_metadata_bytes+0x4c/0x120 [btrfs] [117.197620] btrfs_block_rsv_add+0x78/0xa8 [btrfs] [117.198434] btrfs_delayed_update_inode+0x154/0x368 [btrfs] [117.199300] btrfs_update_inode+0x108/0x1c8 [btrfs] [117.200122] btrfs_dirty_inode+0xb4/0x140 [btrfs] [117.200937] btrfs_update_time+0x8c/0xb0 [btrfs] [117.201754] touch_atime+0x16c/0x1e0 [117.201789] filemap_read+0x674/0x728 [117.201823] btrfs_file_read_iter+0xf8/0x410 [btrfs] [117.202653] vfs_read+0x2b6/0x498 [117.203454] ksys_read+0xa2/0x150 [117.203473] __s390x_sys_read+0x68/0x88 [117.203495] do_syscall+0x1c6/0x210 [117.203517] __do_syscall+0xc8/0xf0 [117.203539] system_call+0x70/0x98 [117.203579] write to 0x000000017f587190 of 8 bytes by task 11 on cpu 0: [117.203604] btrfs_block_rsv_release+0x2e8/0x578 [btrfs] [117.204432] btrfs_delayed_inode_release_metadata+0x7c/0x1d0 [btrfs] [117.205259] __btrfs_update_delayed_inode+0x37c/0x5e0 [btrfs] [117.206093] btrfs_async_run_delayed_root+0x356/0x498 [btrfs] [117.206917] btrfs_work_helper+0x160/0x7a0 [btrfs] [117.207738] process_one_work+0x3b6/0x838 [117.207768] worker_thread+0x75e/0xb10 [117.207797] kthread+0x21a/0x230 [117.207830] __ret_from_fork+0x6c/0xb8 [117.207861] ret_from_fork+0xa/0x30 So add a helper to get the reserved amount of a block reserve while holding the lock. The value may be not be up to date anymore when used by need_preemptive_reclaim() and btrfs_preempt_reclaim_metadata_space(), but that's ok since the worst it can do is cause more reclaim work do be done sooner rather than later. Reading the field while holding the lock instead of using the data_race() annotation is used in order to prevent load tearing. Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/btrfs/block-rsv.h [ The subsequent c7bb26b847e5("btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve") was merged in earlier. ] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- V1->V2: Resolved new conflicts. fs/btrfs/block-rsv.h | 16 ++++++++++++++++ fs/btrfs/space-info.c | 26 +++++++++++++------------- 2 files changed, 29 insertions(+), 13 deletions(-) diff --git a/fs/btrfs/block-rsv.h b/fs/btrfs/block-rsv.h index 7e13579f182d..43a9a6b5a79f 100644 --- a/fs/btrfs/block-rsv.h +++ b/fs/btrfs/block-rsv.h @@ -101,6 +101,22 @@ static inline bool btrfs_block_rsv_full(const struct btrfs_block_rsv *rsv) return data_race(rsv->full); } +/* + * Get the reserved mount of a block reserve in a context where getting a stale + * value is acceptable, instead of accessing it directly and trigger data race + * warning from KCSAN. + */ +static inline u64 btrfs_block_rsv_reserved(struct btrfs_block_rsv *rsv) +{ + u64 ret; + + spin_lock(&rsv->lock); + ret = rsv->reserved; + spin_unlock(&rsv->lock); + + return ret; +} + /* * Get the size of a block reserve in a context where getting a stale value is * acceptable, instead of accessing it directly and trigger data race warning diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c index d7e8cd4f140c..3f7a9605e2d3 100644 --- a/fs/btrfs/space-info.c +++ b/fs/btrfs/space-info.c @@ -837,7 +837,7 @@ btrfs_calc_reclaim_metadata_size(struct btrfs_fs_info *fs_info, static bool need_preemptive_reclaim(struct btrfs_fs_info *fs_info, struct btrfs_space_info *space_info) { - u64 global_rsv_size = fs_info->global_block_rsv.reserved; + const u64 global_rsv_size = btrfs_block_rsv_reserved(&fs_info->global_block_rsv); u64 ordered, delalloc; u64 thresh; u64 used; @@ -937,8 +937,8 @@ static bool need_preemptive_reclaim(struct btrfs_fs_info *fs_info, ordered = percpu_counter_read_positive(&fs_info->ordered_bytes) >> 1; delalloc = percpu_counter_read_positive(&fs_info->delalloc_bytes); if (ordered >= delalloc) - used += fs_info->delayed_refs_rsv.reserved + - fs_info->delayed_block_rsv.reserved; + used += btrfs_block_rsv_reserved(&fs_info->delayed_refs_rsv) + + btrfs_block_rsv_reserved(&fs_info->delayed_block_rsv); else used += space_info->bytes_may_use - global_rsv_size; @@ -1153,7 +1153,7 @@ static void btrfs_preempt_reclaim_metadata_space(struct work_struct *work) enum btrfs_flush_state flush; u64 delalloc_size = 0; u64 to_reclaim, block_rsv_size; - u64 global_rsv_size = global_rsv->reserved; + const u64 global_rsv_size = btrfs_block_rsv_reserved(global_rsv); loops++; @@ -1165,9 +1165,9 @@ static void btrfs_preempt_reclaim_metadata_space(struct work_struct *work) * assume it's tied up in delalloc reservations. */ block_rsv_size = global_rsv_size + - delayed_block_rsv->reserved + - delayed_refs_rsv->reserved + - trans_rsv->reserved; + btrfs_block_rsv_reserved(delayed_block_rsv) + + btrfs_block_rsv_reserved(delayed_refs_rsv) + + btrfs_block_rsv_reserved(trans_rsv); if (block_rsv_size < space_info->bytes_may_use) delalloc_size = space_info->bytes_may_use - block_rsv_size; @@ -1187,16 +1187,16 @@ static void btrfs_preempt_reclaim_metadata_space(struct work_struct *work) to_reclaim = delalloc_size; flush = FLUSH_DELALLOC; } else if (space_info->bytes_pinned > - (delayed_block_rsv->reserved + - delayed_refs_rsv->reserved)) { + (btrfs_block_rsv_reserved(delayed_block_rsv) + + btrfs_block_rsv_reserved(delayed_refs_rsv))) { to_reclaim = space_info->bytes_pinned; flush = COMMIT_TRANS; - } else if (delayed_block_rsv->reserved > - delayed_refs_rsv->reserved) { - to_reclaim = delayed_block_rsv->reserved; + } else if (btrfs_block_rsv_reserved(delayed_block_rsv) > + btrfs_block_rsv_reserved(delayed_refs_rsv)) { + to_reclaim = btrfs_block_rsv_reserved(delayed_block_rsv); flush = FLUSH_DELAYED_ITEMS_NR; } else { - to_reclaim = delayed_refs_rsv->reserved; + to_reclaim = btrfs_block_rsv_reserved(delayed_refs_rsv); flush = FLUSH_DELAYED_REFS_NR; } -- 2.31.1

2 1

[PATCH OLK-5.10] cifs: fix underflow in parse_server_interfaces()
by Long Li 28 Apr '24

28 Apr '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> mainline inclusion from mainline-v6.8-rc4 commit cffe487026be13eaf37ea28b783d9638ab147204 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HJRD CVE: CVE-2024-26828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In this loop, we step through the buffer and after each item we check if the size_left is greater than the minimum size we need. However, the problem is that "bytes_left" is type ssize_t while sizeof() is type size_t. That means that because of type promotion, the comparison is done as an unsigned and if we have negative bytes left the loop continues instead of ending. Fixes: fe856be475f7 ("CIFS: parse and store info on iface queries") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Reviewed-by: Shyam Prasad N <sprasad(a)microsoft.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflict: fs/cifs/smb2ops.c Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/cifs/smb2ops.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index b4c73d453533..5e773fa0443a 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -462,7 +462,7 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, bytes_left = buf_len; p = buf; - while (bytes_left >= sizeof(*p)) { + while (bytes_left >= (ssize_t)sizeof(*p)) { nb_iface++; next = le32_to_cpu(p->Next); if (!next) { @@ -497,7 +497,7 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, info = *iface_list; bytes_left = buf_len; p = buf; - while (bytes_left >= sizeof(*p)) { + while (bytes_left >= (ssize_t)sizeof(*p)) { info->speed = le64_to_cpu(p->LinkSpeed); info->rdma_capable = le32_to_cpu(p->Capability & RDMA_CAPABLE) ? 1 : 0; info->rss_capable = le32_to_cpu(p->Capability & RSS_CAPABLE) ? 1 : 0; -- 2.31.1

2 1

[PATCH OLK-5.10] char: imx-rngc: fix clk_disable_unprepare missing in error path
by Ye Weihua 28 Apr '24

28 Apr '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9K8D1 -------------------------------- Function clk_prepare_enable(rngc->clk) is called in imx_rngc_probe, but clk_disable_unprepare(rngc->clk) is missing in error path. Use goto exchange return to fix it. Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> --- drivers/char/hw_random/imx-rngc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/char/hw_random/imx-rngc.c b/drivers/char/hw_random/imx-rngc.c index dbb2da630611..112616996a4e 100644 --- a/drivers/char/hw_random/imx-rngc.c +++ b/drivers/char/hw_random/imx-rngc.c @@ -287,7 +287,7 @@ static int imx_rngc_probe(struct platform_device *pdev) irq, imx_rngc_irq, 0, pdev->name, (void *)rngc); if (ret) { dev_err(rngc->dev, "Can't get interrupt working.\n"); - return ret; + goto err; } if (self_test) { -- 2.34.1

2 1

[PATCH v2 openEuler-1.0-LTS 0/1] openEuler-1.0-LTS: bugfix for mm
by Wupeng Ma 28 Apr '24

28 Apr '24

From: Ma Wupeng <mawupeng1(a)huawei.com> mm/madvise: fix potential pte_unmap_unlock pte error. Changelog since v1: - fix style problem. Miaohe Lin (1): mm/madvise: fix potential pte_unmap_unlock pte error mm/madvise.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.25.1

2 2

[PATCH v3 OLK-5.10 0/2] olk-5.10: bugfix for mm
by Wupeng Ma 28 Apr '24

28 Apr '24

From: Ma Wupeng <mawupeng1(a)huawei.com> backport minor bugfix for mm. Changelog since v2: - fix style problem. Changelog since v1: - fix style problem. Mel Gorman (1): mm/page_alloc: always attempt to allocate at least one page during bulk allocation Miaohe Lin (1): mm/madvise: fix potential pte_unmap_unlock pte error mm/madvise.c | 8 ++++---- mm/page_alloc.c | 7 ++++--- 2 files changed, 8 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/8] cvm feature patches
by hejingxian 28 Apr '24

28 Apr '24

From: Jingxian He <hejingxian(a)huawei.com> Add cvm feature patches:: kvm: add cvm host feature pmu: enable pmu phys irq inject for cvm kvm: add support for multi-numa and fix kabi change swiotlb: Add restricted DMA alloc/free support swiotlb: add swiotlb io_tlb_list release slots methd mm: enable swiotlb alloc for cvm share mem config: modify arm64 defconfig for cvm feature gicv3: add lpi support for cvm guest arch/arm64/Kconfig | 8 + arch/arm64/configs/defconfig | 3 + arch/arm64/configs/openeuler_defconfig | 3 + arch/arm64/include/asm/Kbuild | 1 - arch/arm64/include/asm/cvm_guest.h | 46 ++ arch/arm64/include/asm/kvm_emulate.h | 18 + arch/arm64/include/asm/kvm_host.h | 28 +- arch/arm64/include/asm/kvm_tmi.h | 377 +++++++++++ arch/arm64/include/asm/kvm_tmm.h | 73 ++ arch/arm64/include/asm/set_memory.h | 9 + arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/cvm_guest.c | 93 +++ arch/arm64/kvm/Kconfig | 7 + arch/arm64/kvm/Makefile | 4 + arch/arm64/kvm/arch_timer.c | 104 ++- arch/arm64/kvm/arm.c | 157 ++++- arch/arm64/kvm/cvm.c | 892 +++++++++++++++++++++++++ arch/arm64/kvm/cvm_exit.c | 240 +++++++ arch/arm64/kvm/guest.c | 8 + arch/arm64/kvm/hisilicon/hisi_virt.c | 7 + arch/arm64/kvm/hyp/vgic-v3-sr.c | 19 + arch/arm64/kvm/mmio.c | 19 + arch/arm64/kvm/mmu.c | 7 + arch/arm64/kvm/pmu-emul.c | 12 + arch/arm64/kvm/psci.c | 12 +- arch/arm64/kvm/reset.c | 10 + arch/arm64/kvm/tmi.c | 168 +++++ arch/arm64/kvm/vgic/vgic-v3.c | 18 +- arch/arm64/kvm/vgic/vgic.c | 59 +- arch/arm64/mm/init.c | 3 + arch/arm64/mm/mmu.c | 6 +- arch/arm64/mm/pageattr.c | 3 + drivers/irqchip/irq-gic-v3-its.c | 229 ++++++- drivers/perf/arm_pmu.c | 17 + include/kvm/arm_arch_timer.h | 4 + include/linux/kvm_host.h | 23 + include/linux/perf/arm_pmu.h | 3 + include/linux/swiotlb.h | 17 + include/uapi/linux/kvm.h | 27 + kernel/dma/Kconfig | 10 + kernel/dma/direct.c | 56 +- kernel/dma/swiotlb.c | 92 +++ virt/kvm/kvm_main.c | 7 +- 43 files changed, 2843 insertions(+), 57 deletions(-) create mode 100644 arch/arm64/include/asm/cvm_guest.h create mode 100644 arch/arm64/include/asm/kvm_tmi.h create mode 100644 arch/arm64/include/asm/kvm_tmm.h create mode 100644 arch/arm64/include/asm/set_memory.h create mode 100644 arch/arm64/kernel/cvm_guest.c create mode 100644 arch/arm64/kvm/cvm.c create mode 100644 arch/arm64/kvm/cvm_exit.c create mode 100644 arch/arm64/kvm/tmi.c -- 2.33.0

2 9

[PATCH openEuler-1.0-LTS 0/1] openEuler-1.0-LTS: bugfix for mm
by Wupeng Ma 28 Apr '24

28 Apr '24

From: Ma Wupeng <mawupeng1(a)huawei.com> mm/madvise: fix potential pte_unmap_unlock pte error Miaohe Lin (1): mm/madvise: fix potential pte_unmap_unlock pte error mm/madvise.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.25.1

2 2

[PATCH openEuler-1.0-LTS] cifs: fix underflow in parse_server_interfaces()
by Long Li 28 Apr '24

28 Apr '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> mainline inclusion from mainline-v6.8-rc4 commit cffe487026be13eaf37ea28b783d9638ab147204 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HJRD CVE: CVE-2024-26828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In this loop, we step through the buffer and after each item we check if the size_left is greater than the minimum size we need. However, the problem is that "bytes_left" is type ssize_t while sizeof() is type size_t. That means that because of type promotion, the comparison is done as an unsigned and if we have negative bytes left the loop continues instead of ending. Fixes: fe856be475f7 ("CIFS: parse and store info on iface queries") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Reviewed-by: Shyam Prasad N <sprasad(a)microsoft.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflict: fs/cifs/smb2ops.c Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/cifs/smb2ops.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index eba4bdfff08a..58d9554e74ce 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -351,7 +351,7 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, bytes_left = buf_len; p = buf; - while (bytes_left >= sizeof(*p)) { + while (bytes_left >= (ssize_t)sizeof(*p)) { nb_iface++; next = le32_to_cpu(p->Next); if (!next) { @@ -385,7 +385,7 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, info = *iface_list; bytes_left = buf_len; p = buf; - while (bytes_left >= sizeof(*p)) { + while (bytes_left >= (ssize_t)sizeof(*p)) { info->speed = le64_to_cpu(p->LinkSpeed); info->rdma_capable = le32_to_cpu(p->Capability & RDMA_CAPABLE); info->rss_capable = le32_to_cpu(p->Capability & RSS_CAPABLE); -- 2.31.1

2 1

[PATCH v2 OLK-5.10 0/2] olk-5.10: bugfix for mm
by Wupeng Ma 28 Apr '24

28 Apr '24

From: Ma Wupeng <mawupeng1(a)huawei.com> backport minor bugfix for mm. Changelog since v1: - fix style problem. Mel Gorman (1): mm/page_alloc: always attempt to allocate at least one page during bulk allocation Miaohe Lin (1): mm/madvise: fix potential pte_unmap_unlock pte error mm/madvise.c | 8 ++++---- mm/page_alloc.c | 7 ++++--- 2 files changed, 8 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/5] CVE-2024-26921
by Ziyang Xuan 28 Apr '24

28 Apr '24

Patchset of CVE-2024-26921. Florian Westphal (1): inet: inet_defrag: prevent sk release while still in use Vasily Averin (2): skbuff: introduce skb_expand_head() skb_expand_head() adjust skb->truesize incorrectly Ziyang Xuan (2): net: Fix KABI break for introducing is_skb_wmem() sk_buff: Fix KABI break for the modification of struct sk_buff include/linux/skbuff.h | 1 + include/net/tcp.h | 2 +- include/net/tcp_ext.h | 14 +++++ net/core/skbuff.c | 52 ++++++++++++++++++ net/ipv4/inet_fragment.c | 70 ++++++++++++++++++++----- net/ipv4/ip_fragment.c | 2 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- 7 files changed, 127 insertions(+), 16 deletions(-) create mode 100644 include/net/tcp_ext.h -- 2.25.1

2 6

[PATCH OLK-5.10 0/5] Apply patches of ses from stable
by Li Lingfeng 28 Apr '24

28 Apr '24

Jiri Kosina (1): scsi: ses: Handle enclosure with just a primary component gracefully Li Lingfeng (3): Revert "scsi: ses: fix slab-out-of-bounds in ses_enclosure_data_process" Revert "scsi: ses: Fix crash caused by kfree an invalid pointer" Revert "scsi: ses: Handle enclosure with just a primary component gracefully" Tomas Henzl (1): scsi: ses: Fix possible desc_ptr out-of-bounds accesses drivers/scsi/ses.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) -- 2.31.1

2 6

[PATCH OLK-5.10 0/2] olk-5.10: bugfix for mm
by Wupeng Ma 28 Apr '24

28 Apr '24

From: Ma Wupeng <mawupeng1(a)huawei.com> backport minor bugfix for mm. Mel Gorman (1): mm/page_alloc: always attempt to allocate at least one page during bulk allocation Miaohe Lin (1): mm/madvise: fix potential pte_unmap_unlock pte error mm/madvise.c | 8 ++++---- mm/page_alloc.c | 7 ++++--- 2 files changed, 8 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10] NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
by Long Li 28 Apr '24

28 Apr '24

From: Jorge Mora <jmora1300(a)gmail.com> stable inclusion from stable-v5.10.167 commit 4403438eaca6e91f02d272211c4d6b045092396b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HK78 CVE: CVE-2024-26870 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 251a658bbfceafb4d58c76b77682c8bf7bcfad65 ] A call to listxattr() with a buffer size = 0 returns the actual size of the buffer needed for a subsequent call. When size > 0, nfs4_listxattr() does not return an error because either generic_listxattr() or nfs4_listxattr_nfs4_label() consumes exactly all the bytes then size is 0 when calling nfs4_listxattr_nfs4_user() which then triggers the following kernel BUG: [ 99.403778] kernel BUG at mm/usercopy.c:102! [ 99.404063] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 99.408463] CPU: 0 PID: 3310 Comm: python3 Not tainted 6.6.0-61.fc40.aarch64 #1 [ 99.415827] Call trace: [ 99.415985] usercopy_abort+0x70/0xa0 [ 99.416227] __check_heap_object+0x134/0x158 [ 99.416505] check_heap_object+0x150/0x188 [ 99.416696] __check_object_size.part.0+0x78/0x168 [ 99.416886] __check_object_size+0x28/0x40 [ 99.417078] listxattr+0x8c/0x120 [ 99.417252] path_listxattr+0x78/0xe0 [ 99.417476] __arm64_sys_listxattr+0x28/0x40 [ 99.417723] invoke_syscall+0x78/0x100 [ 99.417929] el0_svc_common.constprop.0+0x48/0xf0 [ 99.418186] do_el0_svc+0x24/0x38 [ 99.418376] el0_svc+0x3c/0x110 [ 99.418554] el0t_64_sync_handler+0x120/0x130 [ 99.418788] el0t_64_sync+0x194/0x198 [ 99.418994] Code: aa0003e3 d000a3e0 91310000 97f49bdb (d4210000) Issue is reproduced when generic_listxattr() returns 'system.nfs4_acl', thus calling lisxattr() with size = 16 will trigger the bug. Add check on nfs4_listxattr() to return ERANGE error when it is called with size > 0 and the return value is greater than size. Fixes: 012a211abd5d ("NFSv4.2: hook in the user extended attribute handlers") Signed-off-by: Jorge Mora <mora(a)netapp.com> Reviewed-by: Benjamin Coddington <bcodding(a)redhat.com> Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/nfs/nfs4proc.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index f3f41027f697..62c227eb75bd 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -10367,29 +10367,33 @@ const struct nfs4_minor_version_ops *nfs_v4_minor_ops[] = { static ssize_t nfs4_listxattr(struct dentry *dentry, char *list, size_t size) { ssize_t error, error2, error3; + size_t left = size; - error = generic_listxattr(dentry, list, size); + error = generic_listxattr(dentry, list, left); if (error < 0) return error; if (list) { list += error; - size -= error; + left -= error; } - error2 = nfs4_listxattr_nfs4_label(d_inode(dentry), list, size); + error2 = nfs4_listxattr_nfs4_label(d_inode(dentry), list, left); if (error2 < 0) return error2; if (list) { list += error2; - size -= error2; + left -= error2; } - error3 = nfs4_listxattr_nfs4_user(d_inode(dentry), list, size); + error3 = nfs4_listxattr_nfs4_user(d_inode(dentry), list, left); if (error3 < 0) return error3; - return error + error2 + error3; + error += error2 + error3; + if (size && error > size) + return -ERANGE; + return error; } static void nfs4_enable_swap(struct inode *inode) -- 2.31.1

2 1

[PATCH OLK-5.10 0/8] cvm feature patches
by hejingxian 28 Apr '24

28 Apr '24

From: Jingxian He <hejingxian(a)huawei.com> Add cvm feature patches:: kvm: add cvm host feature pmu: enable pmu phys irq inject for cvm kvm: add support for multi-numa and fix kabi change swiotlb: Add restricted DMA alloc/free support swiotlb: add swiotlb io_tlb_list release slots methd mm: enable swiotlb alloc for cvm share mem config: modify arm64 defconfig for cvm feature gicv3: add lpi support for cvm guest arch/arm64/Kconfig | 8 + arch/arm64/configs/defconfig | 3 + arch/arm64/configs/openeuler_defconfig | 3 + arch/arm64/include/asm/Kbuild | 1 - arch/arm64/include/asm/cvm_guest.h | 46 ++ arch/arm64/include/asm/kvm_emulate.h | 18 + arch/arm64/include/asm/kvm_host.h | 28 +- arch/arm64/include/asm/kvm_tmi.h | 377 +++++++++++ arch/arm64/include/asm/kvm_tmm.h | 73 ++ arch/arm64/include/asm/set_memory.h | 9 + arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/cvm_guest.c | 93 +++ arch/arm64/kvm/Kconfig | 7 + arch/arm64/kvm/Makefile | 4 + arch/arm64/kvm/arch_timer.c | 104 ++- arch/arm64/kvm/arm.c | 157 ++++- arch/arm64/kvm/cvm.c | 892 +++++++++++++++++++++++++ arch/arm64/kvm/cvm_exit.c | 240 +++++++ arch/arm64/kvm/guest.c | 8 + arch/arm64/kvm/hisilicon/hisi_virt.c | 7 + arch/arm64/kvm/hyp/vgic-v3-sr.c | 19 + arch/arm64/kvm/mmio.c | 19 + arch/arm64/kvm/mmu.c | 7 + arch/arm64/kvm/pmu-emul.c | 12 + arch/arm64/kvm/psci.c | 12 +- arch/arm64/kvm/reset.c | 10 + arch/arm64/kvm/tmi.c | 168 +++++ arch/arm64/kvm/vgic/vgic-v3.c | 18 +- arch/arm64/kvm/vgic/vgic.c | 59 +- arch/arm64/mm/init.c | 3 + arch/arm64/mm/mmu.c | 6 +- arch/arm64/mm/pageattr.c | 3 + drivers/irqchip/irq-gic-v3-its.c | 229 ++++++- drivers/perf/arm_pmu.c | 17 + include/kvm/arm_arch_timer.h | 4 + include/linux/kvm_host.h | 23 + include/linux/perf/arm_pmu.h | 3 + include/linux/swiotlb.h | 17 + include/uapi/linux/kvm.h | 27 + kernel/dma/Kconfig | 10 + kernel/dma/direct.c | 56 +- kernel/dma/swiotlb.c | 92 +++ virt/kvm/kvm_main.c | 7 +- 43 files changed, 2843 insertions(+), 57 deletions(-) create mode 100644 arch/arm64/include/asm/cvm_guest.h create mode 100644 arch/arm64/include/asm/kvm_tmi.h create mode 100644 arch/arm64/include/asm/kvm_tmm.h create mode 100644 arch/arm64/include/asm/set_memory.h create mode 100644 arch/arm64/kernel/cvm_guest.c create mode 100644 arch/arm64/kvm/cvm.c create mode 100644 arch/arm64/kvm/cvm_exit.c create mode 100644 arch/arm64/kvm/tmi.c -- 2.33.0

2 9

[PATCH openEuler-1.0-LTS] drm/bridge: adv7511: fix crash on irq during probe
by Zhao Wenhui 27 Apr '24

27 Apr '24

From: Mads Bligaard Nielsen <bli(a)bang-olufsen.dk> mainline inclusion from mainline-v6.9-rc1 commit aeedaee5ef5468caf59e2bb1265c2116e0c9a924 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HKEE CVE: CVE-2024-26876 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Moved IRQ registration down to end of adv7511_probe(). If an IRQ already is pending during adv7511_probe (before adv7511_cec_init) then cec_received_msg_ts could crash using uninitialized data: Unable to handle kernel read from unreadable memory at virtual address 00000000000003d5 Internal error: Oops: 96000004 [#1] PREEMPT_RT SMP Call trace: cec_received_msg_ts+0x48/0x990 [cec] adv7511_cec_irq_process+0x1cc/0x308 [adv7511] adv7511_irq_process+0xd8/0x120 [adv7511] adv7511_irq_handler+0x1c/0x30 [adv7511] irq_thread_fn+0x30/0xa0 irq_thread+0x14c/0x238 kthread+0x190/0x1a8 Fixes: 3b1b975003e4 ("drm: adv7511/33: add HDMI CEC support") Signed-off-by: Mads Bligaard Nielsen <bli(a)bang-olufsen.dk> Signed-off-by: Alvin Šipraga <alsi(a)bang-olufsen.dk> Reviewed-by: Robert Foss <rfoss(a)kernel.org> Signed-off-by: Robert Foss <rfoss(a)kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20240219-adv7511-cec-irq-cras… Conflicts: drivers/gpu/drm/bridge/adv7511/adv7511_drv.c Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 23 ++++++++++---------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c index e7ddd3e3db92..31bce3a37b20 100644 --- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c @@ -1194,17 +1194,6 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id) INIT_WORK(&adv7511->hpd_work, adv7511_hpd_work); - if (i2c->irq) { - init_waitqueue_head(&adv7511->wq); - - ret = devm_request_threaded_irq(dev, i2c->irq, NULL, - adv7511_irq_handler, - IRQF_ONESHOT, dev_name(dev), - adv7511); - if (ret) - goto err_unregister_cec; - } - adv7511_power_off(adv7511); i2c_set_clientdata(i2c, adv7511); @@ -1222,6 +1211,18 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id) drm_bridge_add(&adv7511->bridge); adv7511_audio_init(dev, adv7511); + + if (i2c->irq) { + init_waitqueue_head(&adv7511->wq); + + ret = devm_request_threaded_irq(dev, i2c->irq, NULL, + adv7511_irq_handler, + IRQF_ONESHOT, dev_name(dev), + adv7511); + if (ret) + goto err_unregister_cec; + } + return 0; err_unregister_cec: -- 2.34.1

2 1

[PATCH OLK-5.10 0/8] cvm feature patches
by hejingxian 27 Apr '24

27 Apr '24

From: Jingxian He <hejingxian(a)huawei.com> Add cvm feature patches:: kvm: add cvm host feature pmu: enable pmu phys irq inject for cvm kvm: add support for multi-numa and fix kabi change swiotlb: Add restricted DMA alloc/free support swiotlb: add swiotlb io_tlb_list release slots methd mm: enable swiotlb alloc for cvm share mem config: modify arm64 defconfig for cvm featue gicv3: add lpi support for cvm guest arch/arm64/Kconfig | 8 + arch/arm64/configs/defconfig | 3 + arch/arm64/configs/openeuler_defconfig | 3 + arch/arm64/include/asm/Kbuild | 1 - arch/arm64/include/asm/cvm_guest.h | 46 ++ arch/arm64/include/asm/kvm_emulate.h | 18 + arch/arm64/include/asm/kvm_host.h | 28 +- arch/arm64/include/asm/kvm_tmi.h | 377 +++++++++++ arch/arm64/include/asm/kvm_tmm.h | 73 ++ arch/arm64/include/asm/set_memory.h | 9 + arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/cvm_guest.c | 93 +++ arch/arm64/kvm/Kconfig | 7 + arch/arm64/kvm/Makefile | 4 + arch/arm64/kvm/arch_timer.c | 104 ++- arch/arm64/kvm/arm.c | 157 ++++- arch/arm64/kvm/cvm.c | 892 +++++++++++++++++++++++++ arch/arm64/kvm/cvm_exit.c | 240 +++++++ arch/arm64/kvm/guest.c | 8 + arch/arm64/kvm/hisilicon/hisi_virt.c | 7 + arch/arm64/kvm/hyp/vgic-v3-sr.c | 19 + arch/arm64/kvm/mmio.c | 19 + arch/arm64/kvm/mmu.c | 7 + arch/arm64/kvm/pmu-emul.c | 12 + arch/arm64/kvm/psci.c | 12 +- arch/arm64/kvm/reset.c | 10 + arch/arm64/kvm/tmi.c | 168 +++++ arch/arm64/kvm/vgic/vgic-v3.c | 18 +- arch/arm64/kvm/vgic/vgic.c | 59 +- arch/arm64/mm/init.c | 3 + arch/arm64/mm/mmu.c | 6 +- arch/arm64/mm/pageattr.c | 3 + drivers/irqchip/irq-gic-v3-its.c | 229 ++++++- drivers/perf/arm_pmu.c | 17 + include/kvm/arm_arch_timer.h | 4 + include/linux/kvm_host.h | 23 + include/linux/perf/arm_pmu.h | 3 + include/linux/swiotlb.h | 17 + include/uapi/linux/kvm.h | 27 + kernel/dma/Kconfig | 10 + kernel/dma/direct.c | 56 +- kernel/dma/swiotlb.c | 92 +++ virt/kvm/kvm_main.c | 7 +- 43 files changed, 2843 insertions(+), 57 deletions(-) create mode 100644 arch/arm64/include/asm/cvm_guest.h create mode 100644 arch/arm64/include/asm/kvm_tmi.h create mode 100644 arch/arm64/include/asm/kvm_tmm.h create mode 100644 arch/arm64/include/asm/set_memory.h create mode 100644 arch/arm64/kernel/cvm_guest.c create mode 100644 arch/arm64/kvm/cvm.c create mode 100644 arch/arm64/kvm/cvm_exit.c create mode 100644 arch/arm64/kvm/tmi.c -- 2.33.0

2 9

[PATCH openEuler-1.0-LTS V1] sched/rt: Disallow writing invalid values to sched_rt_period_us
by Cheng Yu 27 Apr '24

27 Apr '24

From: Cyril Hrubis <chrubis(a)suse.cz> stable inclusion from stable-v4.19.308 commit 2d931472d4740d3ada7011cc4c3499948d3a22fa category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9K4JZ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 079be8fc630943d9fc70a97807feb73d169ee3fc ] The validation of the value written to sched_rt_period_us was broken because: - the sysclt_sched_rt_period is declared as unsigned int - parsed by proc_do_intvec() - the range is asserted after the value parsed by proc_do_intvec() Because of this negative values written to the file were written into a unsigned integer that were later on interpreted as large positive integers which did passed the check: if (sysclt_sched_rt_period <= 0) return EINVAL; This commit fixes the parsing by setting explicit range for both perid_us and runtime_us into the sched_rt_sysctls table and processes the values with proc_dointvec_minmax() instead. Alternatively if we wanted to use full range of unsigned int for the period value we would have to split the proc_handler and use proc_douintvec() for it however even the Documentation/scheduller/sched-rt-group.rst describes the range as 1 to INT_MAX. As far as I can tell the only problem this causes is that the sysctl file allows writing negative values which when read back may confuse userspace. There is also a LTP test being submitted for these sysctl files at: http://patchwork.ozlabs.org/project/ltp/patch/20230901144433.2526-1-chrubis… Signed-off-by: Cyril Hrubis <chrubis(a)suse.cz> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://lore.kernel.org/r/20231002115553.3007-2-chrubis@suse.cz [ pvorel: rebased for 4.19 ] Reviewed-by: Petr Vorel <pvorel(a)suse.cz> Signed-off-by: Petr Vorel <pvorel(a)suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: kernel/sysctl.c Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/rt.c | 5 +---- kernel/sysctl.c | 5 +++++ 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c index 5dff9a6fe2cf..724a31e0b2a3 100644 --- a/kernel/sched/rt.c +++ b/kernel/sched/rt.c @@ -2655,9 +2655,6 @@ static int sched_rt_global_constraints(void) static int sched_rt_global_validate(void) { - if (sysctl_sched_rt_period <= 0) - return -EINVAL; - if ((sysctl_sched_rt_runtime != RUNTIME_INF) && (sysctl_sched_rt_runtime > sysctl_sched_rt_period)) return -EINVAL; @@ -2687,7 +2684,7 @@ int sched_rt_handler(struct ctl_table *table, int write, old_period = sysctl_sched_rt_period; old_runtime = sysctl_sched_rt_runtime; - ret = proc_dointvec(table, write, buffer, lenp, ppos); + ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); if (!ret && write) { ret = sched_rt_global_validate(); diff --git a/kernel/sysctl.c b/kernel/sysctl.c index c7064f67f4a5..f64c4495bc54 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -131,6 +131,7 @@ static int __maybe_unused three = 3; static int __maybe_unused four = 4; static int __maybe_unused five = 5; static int __maybe_unused uce_kernel_recovery_max = 31; +static int int_max = INT_MAX; static unsigned long zero_ul; static unsigned long one_ul = 1; static unsigned long long_max = LONG_MAX; @@ -463,6 +464,8 @@ static struct ctl_table kern_table[] = { .maxlen = sizeof(unsigned int), .mode = 0644, .proc_handler = sched_rt_handler, + .extra1 = &one, + .extra2 = &int_max, }, { .procname = "sched_rt_runtime_us", @@ -470,6 +473,8 @@ static struct ctl_table kern_table[] = { .maxlen = sizeof(int), .mode = 0644, .proc_handler = sched_rt_handler, + .extra1 = &neg_one, + .extra2 = &int_max, }, { .procname = "sched_rr_timeslice_ms", -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS V1] sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset
by Cheng Yu 27 Apr '24

27 Apr '24

From: Cyril Hrubis <chrubis(a)suse.cz> stable inclusion from stable-v4.19.308 commit 1f80bc015277247c9fd9646f7c21f1c728b5d908 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9K4H3 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit c1fc6484e1fb7cc2481d169bfef129a1b0676abe ] The sched_rr_timeslice can be reset to default by writing value that is <= 0. However after reading from this file we always got the last value written, which is not useful at all. $ echo -1 > /proc/sys/kernel/sched_rr_timeslice_ms $ cat /proc/sys/kernel/sched_rr_timeslice_ms -1 Fix this by setting the variable that holds the sysctl file value to the jiffies_to_msecs(RR_TIMESLICE) in case that <= 0 value was written. Signed-off-by: Cyril Hrubis <chrubis(a)suse.cz> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Petr Vorel <pvorel(a)suse.cz> Acked-by: Mel Gorman <mgorman(a)suse.de> Tested-by: Petr Vorel <pvorel(a)suse.cz> Link: https://lore.kernel.org/r/20230802151906.25258-3-chrubis@suse.cz Signed-off-by: Petr Vorel <pvorel(a)suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/rt.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c index 5dff9a6fe2cf..d98adf048bb6 100644 --- a/kernel/sched/rt.c +++ b/kernel/sched/rt.c @@ -2732,6 +2732,9 @@ int sched_rr_handler(struct ctl_table *table, int write, sched_rr_timeslice = sysctl_sched_rr_timeslice <= 0 ? RR_TIMESLICE : msecs_to_jiffies(sysctl_sched_rr_timeslice); + + if (sysctl_sched_rr_timeslice <= 0) + sysctl_sched_rr_timeslice = jiffies_to_msecs(RR_TIMESLICE); } mutex_unlock(&mutex); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS V1] sched/rt: Fix sysctl_sched_rr_timeslice intial value
by Cheng Yu 27 Apr '24

27 Apr '24

From: Cyril Hrubis <chrubis(a)suse.cz> stable inclusion from stable-v4.19.308 commit 41b7572dea9f7196d075b40d5ac8aafdb5f4b0d4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9K34B Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit c7fcb99877f9f542c918509b2801065adcaf46fa ] There is a 10% rounding error in the intial value of the sysctl_sched_rr_timeslice with CONFIG_HZ_300=y. This was found with LTP test sched_rr_get_interval01: sched_rr_get_interval01.c:57: TPASS: sched_rr_get_interval() passed sched_rr_get_interval01.c:64: TPASS: Time quantum 0s 99999990ns sched_rr_get_interval01.c:72: TFAIL: /proc/sys/kernel/sched_rr_timeslice_ms != 100 got 90 sched_rr_get_interval01.c:57: TPASS: sched_rr_get_interval() passed sched_rr_get_interval01.c:64: TPASS: Time quantum 0s 99999990ns sched_rr_get_interval01.c:72: TFAIL: /proc/sys/kernel/sched_rr_timeslice_ms != 100 got 90 What this test does is to compare the return value from the sched_rr_get_interval() and the sched_rr_timeslice_ms sysctl file and fails if they do not match. The problem it found is the intial sysctl file value which was computed as: static int sysctl_sched_rr_timeslice = (MSEC_PER_SEC / HZ) * RR_TIMESLICE; which works fine as long as MSEC_PER_SEC is multiple of HZ, however it introduces 10% rounding error for CONFIG_HZ_300: (MSEC_PER_SEC / HZ) * (100 * HZ / 1000) (1000 / 300) * (100 * 300 / 1000) 3 * 30 = 90 This can be easily fixed by reversing the order of the multiplication and division. After this fix we get: (MSEC_PER_SEC * (100 * HZ / 1000)) / HZ (1000 * (100 * 300 / 1000)) / 300 (1000 * 30) / 300 = 100 Fixes: 975e155ed873 ("sched/rt: Show the 'sched_rr_timeslice' SCHED_RR timeslice tuning knob in milliseconds") Signed-off-by: Cyril Hrubis <chrubis(a)suse.cz> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Petr Vorel <pvorel(a)suse.cz> Acked-by: Mel Gorman <mgorman(a)suse.de> Tested-by: Petr Vorel <pvorel(a)suse.cz> Link: https://lore.kernel.org/r/20230802151906.25258-2-chrubis@suse.cz [ pvorel: rebased for 4.19 ] Signed-off-by: Petr Vorel <pvorel(a)suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/rt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c index 5dff9a6fe2cf..7f66f28d36a8 100644 --- a/kernel/sched/rt.c +++ b/kernel/sched/rt.c @@ -8,7 +8,7 @@ #include "pelt.h" int sched_rr_timeslice = RR_TIMESLICE; -int sysctl_sched_rr_timeslice = (MSEC_PER_SEC / HZ) * RR_TIMESLICE; +int sysctl_sched_rr_timeslice = (MSEC_PER_SEC * RR_TIMESLICE) / HZ; static int do_sched_rt_period_timer(struct rt_bandwidth *rt_b, int overrun); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS V1] sched/rt: Fix sysctl_sched_rr_timeslice intial value
by Cheng Yu 27 Apr '24

27 Apr '24

From: Cyril Hrubis <chrubis(a)suse.cz> stable inclusion from stable-v4.19.308 commit 41b7572dea9f7196d075b40d5ac8aafdb5f4b0d4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9K34B Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit c7fcb99877f9f542c918509b2801065adcaf46fa ] There is a 10% rounding error in the intial value of the sysctl_sched_rr_timeslice with CONFIG_HZ_300=y. This was found with LTP test sched_rr_get_interval01: sched_rr_get_interval01.c:57: TPASS: sched_rr_get_interval() passed sched_rr_get_interval01.c:64: TPASS: Time quantum 0s 99999990ns sched_rr_get_interval01.c:72: TFAIL: /proc/sys/kernel/sched_rr_timeslice_ms != 100 got 90 sched_rr_get_interval01.c:57: TPASS: sched_rr_get_interval() passed sched_rr_get_interval01.c:64: TPASS: Time quantum 0s 99999990ns sched_rr_get_interval01.c:72: TFAIL: /proc/sys/kernel/sched_rr_timeslice_ms != 100 got 90 What this test does is to compare the return value from the sched_rr_get_interval() and the sched_rr_timeslice_ms sysctl file and fails if they do not match. The problem it found is the intial sysctl file value which was computed as: static int sysctl_sched_rr_timeslice = (MSEC_PER_SEC / HZ) * RR_TIMESLICE; which works fine as long as MSEC_PER_SEC is multiple of HZ, however it introduces 10% rounding error for CONFIG_HZ_300: (MSEC_PER_SEC / HZ) * (100 * HZ / 1000) (1000 / 300) * (100 * 300 / 1000) 3 * 30 = 90 This can be easily fixed by reversing the order of the multiplication and division. After this fix we get: (MSEC_PER_SEC * (100 * HZ / 1000)) / HZ (1000 * (100 * 300 / 1000)) / 300 (1000 * 30) / 300 = 100 Fixes: 975e155ed873 ("sched/rt: Show the 'sched_rr_timeslice' SCHED_RR timeslice tuning knob in milliseconds") Signed-off-by: Cyril Hrubis <chrubis(a)suse.cz> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Petr Vorel <pvorel(a)suse.cz> Acked-by: Mel Gorman <mgorman(a)suse.de> Tested-by: Petr Vorel <pvorel(a)suse.cz> Link: https://lore.kernel.org/r/20230802151906.25258-2-chrubis@suse.cz [ pvorel: rebased for 4.19 ] Signed-off-by: Petr Vorel <pvorel(a)suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/rt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c index 5dff9a6fe2cf..7f66f28d36a8 100644 --- a/kernel/sched/rt.c +++ b/kernel/sched/rt.c @@ -8,7 +8,7 @@ #include "pelt.h" int sched_rr_timeslice = RR_TIMESLICE; -int sysctl_sched_rr_timeslice = (MSEC_PER_SEC / HZ) * RR_TIMESLICE; +int sysctl_sched_rr_timeslice = (MSEC_PER_SEC * RR_TIMESLICE) / HZ; static int do_sched_rt_period_timer(struct rt_bandwidth *rt_b, int overrun); -- 2.25.1

2 5

[PATCH openEuler-1.0-LTS V1] sched/rt: Fix sysctl_sched_rr_timeslice intial value
by Cheng Yu 27 Apr '24

27 Apr '24

From: Cyril Hrubis <chrubis(a)suse.cz> stable inclusion from stable-v4.19.308 commit 41b7572dea9f7196d075b40d5ac8aafdb5f4b0d4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9K34B Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit c7fcb99877f9f542c918509b2801065adcaf46fa ] There is a 10% rounding error in the intial value of the sysctl_sched_rr_timeslice with CONFIG_HZ_300=y. This was found with LTP test sched_rr_get_interval01: sched_rr_get_interval01.c:57: TPASS: sched_rr_get_interval() passed sched_rr_get_interval01.c:64: TPASS: Time quantum 0s 99999990ns sched_rr_get_interval01.c:72: TFAIL: /proc/sys/kernel/sched_rr_timeslice_ms != 100 got 90 sched_rr_get_interval01.c:57: TPASS: sched_rr_get_interval() passed sched_rr_get_interval01.c:64: TPASS: Time quantum 0s 99999990ns sched_rr_get_interval01.c:72: TFAIL: /proc/sys/kernel/sched_rr_timeslice_ms != 100 got 90 What this test does is to compare the return value from the sched_rr_get_interval() and the sched_rr_timeslice_ms sysctl file and fails if they do not match. The problem it found is the intial sysctl file value which was computed as: static int sysctl_sched_rr_timeslice = (MSEC_PER_SEC / HZ) * RR_TIMESLICE; which works fine as long as MSEC_PER_SEC is multiple of HZ, however it introduces 10% rounding error for CONFIG_HZ_300: (MSEC_PER_SEC / HZ) * (100 * HZ / 1000) (1000 / 300) * (100 * 300 / 1000) 3 * 30 = 90 This can be easily fixed by reversing the order of the multiplication and division. After this fix we get: (MSEC_PER_SEC * (100 * HZ / 1000)) / HZ (1000 * (100 * 300 / 1000)) / 300 (1000 * 30) / 300 = 100 Fixes: 975e155ed873 ("sched/rt: Show the 'sched_rr_timeslice' SCHED_RR timeslice tuning knob in milliseconds") Signed-off-by: Cyril Hrubis <chrubis(a)suse.cz> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Petr Vorel <pvorel(a)suse.cz> Acked-by: Mel Gorman <mgorman(a)suse.de> Tested-by: Petr Vorel <pvorel(a)suse.cz> Link: https://lore.kernel.org/r/20230802151906.25258-2-chrubis@suse.cz [ pvorel: rebased for 4.19 ] Signed-off-by: Petr Vorel <pvorel(a)suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/rt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c index 5dff9a6fe2cf..7f66f28d36a8 100644 --- a/kernel/sched/rt.c +++ b/kernel/sched/rt.c @@ -8,7 +8,7 @@ #include "pelt.h" int sched_rr_timeslice = RR_TIMESLICE; -int sysctl_sched_rr_timeslice = (MSEC_PER_SEC / HZ) * RR_TIMESLICE; +int sysctl_sched_rr_timeslice = (MSEC_PER_SEC * RR_TIMESLICE) / HZ; static int do_sched_rt_period_timer(struct rt_bandwidth *rt_b, int overrun); -- 2.25.1

2 5

[openeuler:OLK-6.6] BUILD REGRESSION f4d50d4f9bc91cbaa9c837485c041bd3d585ba79
by kernel test robot 27 Apr '24

27 Apr '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: f4d50d4f9bc91cbaa9c837485c041bd3d585ba79 !6658 sched: disable sched_autogroup by default Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allnoconfig | `-- arch-arm64-kernel-cpufeature.c:error:enable_pseudo_nmi-undeclared-(first-use-in-this-function) |-- arm64-randconfig-002-20240426 | `-- include-linux-fortify-string.h:warning:__builtin_memcpy-reading-between-and-bytes-from-a-region-of-size `-- loongarch-allmodconfig |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:fatal-error:ne6x_trace.h:No-such-file-or-directory |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x.h:fatal-error:reg.h:No-such-file-or-directory |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf.h:fatal-error:reg.h:No-such-file-or-directory |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-netdev-not-described-in-rnp_netpoll |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-Polling-interrupt-().-Prototype-was-for-rnp_netpoll()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and `-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_alloc_rx_buffers clang_recent_errors |-- arm64-allmodconfig | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_deinit_hwdev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_detach | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_shutdown | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_stop | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_init_hwdev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:variable-fault_level-set-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:variable-pcie_src-set-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_io_flush.c:warning:no-previous-prototype-for-function-sss_hwdev_flush_io | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_mgmt_info.c:warning:no-previous-prototype-for-function-sss_deinit_mgmt_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_mgmt_info.c:warning:no-previous-prototype-for-function-sss_init_mgmt_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read_ack | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write_nack | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_sync_send_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_complete_adm_event | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_destroy_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_hwif_deinit_adm | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_hwif_init_adm | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ceq.c:warning:no-previous-prototype-for-function-sss_ceq_intr_handle | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ceq.c:warning:no-previous-prototype-for-function-sss_init_ceqe_desc | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_ctrlq_flush_sync_cmd | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_deinit_ctrlq | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_deinit_ctrlq_channel | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_init_ctrlq_channel | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_reinit_ctrlq_ctx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_wait_ctrlq_stop | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_alloc_db_addr | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_chip_set_msix_auto_mask | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_chip_set_msix_state | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_free_db_addr | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_glb_pf_vf_offset | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_global_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_pcie_itf_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_pf_id_of_vf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_ppf_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_irq.c:warning:no-previous-prototype-for-function-sss_deinit_irq_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_irq.c:warning:no-previous-prototype-for-function-sss_init_irq_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_hwif_deinit_mbx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_hwif_init_mbx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_init_func_mbx_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_recv_mbx_aeq_handler | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_flush_mgmt_workq | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_force_complete_all | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_mgmt_msg_aeqe_handler | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_error.c:warning:no-previous-prototype-for-function-sss_detect_pci_error | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_attach_is_enable | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_get_uld_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_get_uld_names | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_init_uld_lock | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_lock_uld | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_unlock_uld | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_probe.c:warning:no-previous-prototype-for-function-sss_attach_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_probe.c:warning:no-previous-prototype-for-function-sss_pci_probe | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_adapter | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_function | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_pci_dev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_detach_all_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_detach_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_dettach_uld_dev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_pci_remove | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_unmap_pci_bar | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_shutdown.c:warning:no-previous-prototype-for-function-sss_pci_shutdown | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_rd32 | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_wr32 | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_send_clp_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_in_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_out_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_copy_to_user | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_in_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_out_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_hw_driver_stats | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_api_cmd.c:warning:expecting-prototype-for-alloc_cmd_buf().-Prototype-was-for-alloc_resp_buf()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_devlink.c:warning:variable-pdev-set-but-not-used | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mbox.c:warning:expecting-prototype-for-hinic3_unregister_ppf_mbox_cb().-Prototype-was-for-hinic3_unregister_pf_mbox_cb()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mbox.c:warning:expecting-prototype-for-hinic3_unregister_ppf_mbox_cb().-Prototype-was-for-hinic3_unregister_ppf_to_pf_mbox_cb()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:expecting-prototype-for-hinic_pf_to_mgmt_free().-Prototype-was-for-hinic3_pf_to_mgmt_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:expecting-prototype-for-hinic_pf_to_mgmt_init().-Prototype-was-for-hinic3_pf_to_mgmt_init()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-netdev-not-described-in-rnp_netpoll | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-Polling-interrupt-().-Prototype-was-for-rnp_netpoll()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-scsi-hisi_raid-hiraid_main.c:warning:expecting-prototype-for-hiraid_create_cq().-Prototype-was-for-hiraid_create_complete_queue()-instead | `-- drivers-scsi-hisi_raid-hiraid_main.c:warning:expecting-prototype-for-hiraid_create_sq().-Prototype-was-for-hiraid_create_send_queue()-instead |-- arm64-randconfig-003-20240426 | `-- ld.lld:error:undefined-symbol:__memcpy_mc `-- x86_64-buildonly-randconfig-006-20240427 |-- drivers-net-ethernet-huawei-hinic-hinic_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:incomplete-definition-of-type-struct-ieee_ets |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:incomplete-definition-of-type-struct-ieee_pfc |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:invalid-application-of-sizeof-to-an-incomplete-type-struct-ieee_ets |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:invalid-application-of-sizeof-to-an-incomplete-type-struct-ieee_pfc |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:use-of-undeclared-identifier-DCB_ATTR_VALUE_UNDEFINED |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:use-of-undeclared-identifier-DCB_CAP_DCBX_HOST |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:use-of-undeclared-identifier-DCB_CAP_DCBX_VER_CEE |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_register_sw_cb().-Prototype-was-for-hinic_aeq_register_swe_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_unregister_sw_cb().-Prototype-was-for-hinic_aeq_unregister_swe_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_ceq_register_sw_cb().-Prototype-was-for-hinic_ceq_register_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_hwif.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- drivers-net-ethernet-huawei-hinic-hinic_main.c:error:no-member-named-dcbnl_ops-in-struct-net_device |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_pf_mbox_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_ppf_to_pf_mbox_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- drivers-net-ethernet-huawei-hinic-hinic_nic_dev.h:error:field-has-incomplete-type-struct-ieee_ets `-- drivers-net-ethernet-huawei-hinic-hinic_nic_dev.h:error:field-has-incomplete-type-struct-ieee_pfc elapsed time: 728m configs tested: 40 configs skipped: 143 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240426 gcc arm64 randconfig-002-20240426 gcc arm64 randconfig-003-20240426 clang arm64 randconfig-004-20240426 gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240426 gcc loongarch randconfig-002-20240426 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240427 clang x86_64 buildonly-randconfig-002-20240427 clang x86_64 buildonly-randconfig-003-20240427 gcc x86_64 buildonly-randconfig-004-20240427 clang x86_64 buildonly-randconfig-005-20240427 clang x86_64 buildonly-randconfig-006-20240427 clang x86_64 defconfig gcc x86_64 randconfig-001-20240427 clang x86_64 randconfig-002-20240427 clang x86_64 randconfig-003-20240427 gcc x86_64 randconfig-004-20240427 clang x86_64 randconfig-005-20240427 gcc x86_64 randconfig-006-20240427 gcc x86_64 randconfig-011-20240427 gcc x86_64 randconfig-012-20240427 clang x86_64 randconfig-013-20240427 clang x86_64 randconfig-014-20240427 clang x86_64 randconfig-015-20240427 gcc x86_64 randconfig-016-20240427 gcc x86_64 randconfig-071-20240427 gcc x86_64 randconfig-072-20240427 clang x86_64 randconfig-073-20240427 clang x86_64 randconfig-074-20240427 clang x86_64 randconfig-075-20240427 clang x86_64 randconfig-076-20240427 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 5d7f26cfc376496f4e43967c78f7c5976d25c337
by kernel test robot 27 Apr '24

27 Apr '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 5d7f26cfc376496f4e43967c78f7c5976d25c337 !6642 v3 x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-randconfig-002-20240426 | `-- drivers-perf-arm_smmuv3_pmu.c:warning:no-previous-prototype-for-smmu_pmu_event_show |-- x86_64-buildonly-randconfig-006-20240426 | |-- fs-proc-array.c:warning:gtime-may-be-used-uninitialized-in-this-function | |-- fs-proc-array.c:warning:maj_flt-may-be-used-uninitialized-in-this-function | `-- fs-proc-array.c:warning:min_flt-may-be-used-uninitialized-in-this-function |-- x86_64-defconfig | |-- include-linux-list.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | |-- include-linux-plist.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | `-- mm-swapfile.c:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node |-- x86_64-randconfig-014-20240426 | |-- include-linux-compiler.h:warning:array-subscript-index-is-outside-array-bounds-of-u32-aka-unsigned-int | `-- include-linux-compiler.h:warning:array-subscript-unknown-is-outside-array-bounds-of-const-u32-aka-const-unsigned-int |-- x86_64-randconfig-015-20240426 | |-- include-linux-compiler.h:warning:array-subscript-index-is-outside-array-bounds-of-u32-aka-unsigned-int | |-- include-linux-compiler.h:warning:array-subscript-unknown-is-outside-array-bounds-of-const-u32-aka-const-unsigned-int | |-- include-linux-list.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | |-- include-linux-plist.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | `-- mm-swapfile.c:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node |-- x86_64-randconfig-075-20240426 | |-- include-linux-compiler.h:warning:array-subscript-index-is-outside-array-bounds-of-u32-aka-unsigned-int | |-- include-linux-compiler.h:warning:array-subscript-unknown-is-outside-array-bounds-of-const-u32-aka-const-unsigned-int | |-- include-linux-list.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | |-- include-linux-plist.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | `-- mm-swapfile.c:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node |-- x86_64-randconfig-076-20240426 | |-- include-linux-compiler.h:warning:array-subscript-index-is-outside-array-bounds-of-u32-aka-unsigned-int | `-- include-linux-compiler.h:warning:array-subscript-unknown-is-outside-array-bounds-of-const-u32-aka-const-unsigned-int |-- x86_64-randconfig-122-20240427 | |-- drivers-pci-controller-hisi-pcie-customer-hisi_pcie_cae.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-to-got-void | |-- drivers-pci-rom.c:sparse:sparse:incorrect-type-in-return-expression-(different-address-spaces)-expected-void-noderef-asn-got-void | |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-long-long-noderef-usertype-asn-off_in-got-long-long-usertype-assigned-poff_in | |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-long-long-noderef-usertype-asn-off_out-got-long-long-usertype-assigned-poff_out | |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-file-assigned-file-got-struct-file-noderef-asn | |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-return-expression-(different-address-spaces)-expected-void-noderef-asn-got-struct-io_buffer-assigned-kbuf | |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-got-int-noderef-pmu_disable_count | |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-got-struct-perf_cpu_context-noderef-pmu_cpu_context | |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-asn-got-int | |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-asn-got-struct-perf_cpu_context | `-- net-ipv4-arp.c:sparse:sparse:incompatible-types-in-comparison-expression-(different-type-sizes): `-- x86_64-randconfig-123-20240427 |-- drivers-pci-controller-hisi-pcie-customer-hisi_pcie_cae.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-to-got-void |-- drivers-pci-rom.c:sparse:sparse:incorrect-type-in-return-expression-(different-address-spaces)-expected-void-noderef-asn-got-void |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-long-long-noderef-usertype-asn-off_in-got-long-long-usertype-assigned-poff_in |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-long-long-noderef-usertype-asn-off_out-got-long-long-usertype-assigned-poff_out |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-file-assigned-file-got-struct-file-noderef-asn |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-return-expression-(different-address-spaces)-expected-void-noderef-asn-got-struct-io_buffer-assigned-kbuf |-- include-linux-compiler.h:warning:array-subscript-index-is-outside-array-bounds-of-u32-aka-unsigned-int |-- include-linux-compiler.h:warning:array-subscript-unknown-is-outside-array-bounds-of-const-u32-aka-const-unsigned-int |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-got-int-noderef-pmu_disable_count |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-got-struct-perf_cpu_context-noderef-pmu_cpu_context |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-asn-got-int |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-asn-got-struct-perf_cpu_context `-- net-ipv4-arp.c:sparse:sparse:incompatible-types-in-comparison-expression-(different-type-sizes): clang_recent_errors |-- x86_64-allyesconfig | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-buildonly-randconfig-003-20240426 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-buildonly-randconfig-004-20240426 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-004-20240426 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-005-20240426 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-006-20240426 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-011-20240426 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-016-20240426 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-071-20240426 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-072-20240426 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-073-20240426 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-121-20240427 | |-- drivers-pci-controller-hisi-pcie-customer-hisi_pcie_cae.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-to-got-void | |-- drivers-pci-rom.c:sparse:sparse:incorrect-type-in-return-expression-(different-address-spaces)-expected-void-noderef-asn-got-void | |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-long-long-noderef-usertype-asn-off_in-got-long-long-usertype-assigned-poff_in | |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-long-long-noderef-usertype-asn-off_out-got-long-long-usertype-assigned-poff_out | |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-file-assigned-file-got-struct-file-noderef-asn | |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-return-expression-(different-address-spaces)-expected-void-noderef-asn-got-struct-io_buffer-assigned-kbuf | |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-got-int-noderef-pmu_disable_count | |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-got-struct-perf_cpu_context-noderef-pmu_cpu_context | |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-asn-got-int | |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-asn-got-struct-perf_cpu_context | |-- net-ipv4-arp.c:sparse:sparse:incompatible-types-in-comparison-expression-(different-type-sizes): | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-161-20240427 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) `-- x86_64-rhel-8.3-rust `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) elapsed time: 739m configs tested: 35 configs skipped: 147 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240426 gcc arm64 randconfig-002-20240426 gcc arm64 randconfig-003-20240426 gcc arm64 randconfig-004-20240426 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240426 clang x86_64 buildonly-randconfig-002-20240426 gcc x86_64 buildonly-randconfig-003-20240426 clang x86_64 buildonly-randconfig-004-20240426 clang x86_64 buildonly-randconfig-005-20240426 gcc x86_64 buildonly-randconfig-006-20240426 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240426 gcc x86_64 randconfig-002-20240426 gcc x86_64 randconfig-003-20240426 gcc x86_64 randconfig-004-20240426 clang x86_64 randconfig-005-20240426 clang x86_64 randconfig-006-20240426 clang x86_64 randconfig-011-20240426 clang x86_64 randconfig-012-20240426 gcc x86_64 randconfig-013-20240426 gcc x86_64 randconfig-014-20240426 gcc x86_64 randconfig-015-20240426 gcc x86_64 randconfig-016-20240426 clang x86_64 randconfig-071-20240426 clang x86_64 randconfig-072-20240426 clang x86_64 randconfig-073-20240426 clang x86_64 randconfig-074-20240426 gcc x86_64 randconfig-075-20240426 gcc x86_64 randconfig-076-20240426 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS a37954d8555018369c90d18616f65c3d9830a9aa
by kernel test robot 27 Apr '24

27 Apr '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: a37954d8555018369c90d18616f65c3d9830a9aa !6620 packet: annotate data-races around ignore_outgoing Warning ids grouped by kconfigs: clang_recent_errors |-- arm64-allyesconfig | |-- Documentation-devicetree-bindings-arm-cpu.yaml:properties:capacity-dmips-mhz:ref-should-not-be-valid-under-const:ref | |-- Documentation-devicetree-bindings-arm-cpu.yaml:title:ARM-CPUs-bindings-should-not-be-valid-under-pattern:(-Bb-inding-Ss-chema) | |-- Documentation-devicetree-bindings-arm-cpus.yaml:examples:cpus-arm-pbha-performance-only-bits-arm-pbha-no-aliases-bits-ncpu-device_type-cpu-compatible-arm-cortex-a57-...-n-is-not-of-type-array | |-- Documentation-devicetree-bindings-arm-cpus.yaml:maintainers-is-a-required-property | |-- description:Display-controller-reference-clock-source-is-not-of-type-object-boolean | |-- description:Display-controller-reference-clock-source-is-too-short | |-- description:Offset-and-length-of-the-memory-mapped-registers-is-too-short | |-- items-is-not-one-of-type-description-dependencies-dependentRequired-dependentSchemas-properties-patternProperties-additionalProperties-unevaluatedProperties-deprecated-required-not-allOf-anyOf-oneOf-r | `-- minItems-is-not-one-of-type-description-dependencies-dependentRequired-dependentSchemas-properties-patternProperties-additionalProperties-unevaluatedProperties-deprecated-required-not-allOf-anyOf-oneO `-- x86_64-allnoconfig `-- drivers-net-ethernet-mucse-rnpm-rnpm_common.h:linux-version.h-not-needed. elapsed time: 730m configs tested: 35 configs skipped: 147 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240426 gcc arm64 randconfig-002-20240426 gcc arm64 randconfig-003-20240426 clang arm64 randconfig-004-20240426 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240426 clang x86_64 buildonly-randconfig-002-20240426 gcc x86_64 buildonly-randconfig-003-20240426 clang x86_64 buildonly-randconfig-004-20240426 clang x86_64 buildonly-randconfig-005-20240426 gcc x86_64 buildonly-randconfig-006-20240426 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240426 gcc x86_64 randconfig-002-20240426 gcc x86_64 randconfig-003-20240426 gcc x86_64 randconfig-004-20240426 clang x86_64 randconfig-005-20240426 clang x86_64 randconfig-006-20240426 clang x86_64 randconfig-011-20240426 clang x86_64 randconfig-012-20240426 gcc x86_64 randconfig-013-20240426 gcc x86_64 randconfig-014-20240426 gcc x86_64 randconfig-015-20240426 gcc x86_64 randconfig-016-20240426 clang x86_64 randconfig-071-20240426 clang x86_64 randconfig-072-20240426 clang x86_64 randconfig-073-20240426 clang x86_64 randconfig-074-20240426 gcc x86_64 randconfig-075-20240426 gcc x86_64 randconfig-076-20240426 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] sched: disable sched_autogroup by default
by Zhang Qiao 26 Apr '24

26 Apr '24

From: Jialin Zhang <zhangjialin11(a)huawei.com> hulk inclusion category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/I9JZXF CVE: NA -------------------------------- This option optimizes the scheduler for common desktop workloads by automatically creating and populating task groups. This separation of workloads isolates aggressive CPU burners (like build jobs) from desktop applications. Task group autogeneration is currently based upon task session. We do not need this for mostly server workloads, so just disable by default. If you need this feature really, just enable it by sysctl: sysctl -w kernel.sched_autogroup_enabled=1 Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com> --- kernel/sched/autogroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sched/autogroup.c b/kernel/sched/autogroup.c index 991fc9002535..e2c2d4e5735f 100644 --- a/kernel/sched/autogroup.c +++ b/kernel/sched/autogroup.c @@ -4,7 +4,7 @@ * Auto-group scheduling implementation: */ -unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1; +unsigned int __read_mostly sysctl_sched_autogroup_enabled; static struct autogroup autogroup_default; static atomic_t autogroup_seq_nr; -- 2.18.0.huawei.25

2 1

[PATCH OLK-5.10] geneve: make sure to pull inner header in geneve_rx()
by Ziyang Xuan 26 Apr '24

26 Apr '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.213 commit c7137900691f5692fe3de54566ea7b30bb35d66c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HK9B CVE: CVE-2024-26857 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1ca1ba465e55b9460e4e75dec9fff31e708fec74 ] syzbot triggered a bug in geneve_rx() [1] Issue is similar to the one I fixed in commit 8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()") We have to save skb->network_header in a temporary variable in order to be able to recompute the network_header pointer after a pskb_inet_may_pull() call. pskb_inet_may_pull() makes sure the needed headers are in skb->head. [1] BUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] BUG: KMSAN: uninit-value in geneve_rx drivers/net/geneve.c:279 [inline] BUG: KMSAN: uninit-value in geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391 IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] geneve_rx drivers/net/geneve.c:279 [inline] geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391 udp_queue_rcv_one_skb+0x1d39/0x1f20 net/ipv4/udp.c:2108 udp_queue_rcv_skb+0x6ae/0x6e0 net/ipv4/udp.c:2186 udp_unicast_rcv_skb+0x184/0x4b0 net/ipv4/udp.c:2346 __udp4_lib_rcv+0x1c6b/0x3010 net/ipv4/udp.c:2422 udp_rcv+0x7d/0xa0 net/ipv4/udp.c:2604 ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:461 [inline] ip_rcv_finish net/ipv4/ip_input.c:449 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core net/core/dev.c:5534 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648 process_backlog+0x480/0x8b0 net/core/dev.c:5976 __napi_poll+0xe3/0x980 net/core/dev.c:6576 napi_poll net/core/dev.c:6645 [inline] net_rx_action+0x8b8/0x1870 net/core/dev.c:6778 __do_softirq+0x1b7/0x7c5 kernel/softirq.c:553 do_softirq+0x9a/0xf0 kernel/softirq.c:454 __local_bh_enable_ip+0x9b/0xa0 kernel/softirq.c:381 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:820 [inline] __dev_queue_xmit+0x2768/0x51c0 net/core/dev.c:4378 dev_queue_xmit include/linux/netdevice.h:3171 [inline] packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: slab_post_alloc_hook mm/slub.c:3819 [inline] slab_alloc_node mm/slub.c:3860 [inline] kmem_cache_alloc_node+0x5cb/0xbc0 mm/slub.c:3903 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560 __alloc_skb+0x352/0x790 net/core/skbuff.c:651 alloc_skb include/linux/skbuff.h:1296 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6394 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2783 packet_alloc_skb net/packet/af_packet.c:2930 [inline] packet_snd net/packet/af_packet.c:3024 [inline] packet_sendmsg+0x70c2/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fixes: 2d07dc79fe04 ("geneve: add initial netdev driver for GENEVE tunnels") Reported-and-tested-by: syzbot+6a1423ff3f97159aae64(a)syzkaller.appspotmail.com Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- drivers/net/geneve.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c index 081939cb420b..2bb9820c6664 100644 --- a/drivers/net/geneve.c +++ b/drivers/net/geneve.c @@ -218,7 +218,7 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs, struct genevehdr *gnvh = geneve_hdr(skb); struct metadata_dst *tun_dst = NULL; unsigned int len; - int err = 0; + int nh, err = 0; void *oiph; if (ip_tunnel_collect_metadata() || gs->collect_md) { @@ -262,9 +262,23 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs, goto drop; } - oiph = skb_network_header(skb); + /* Save offset of outer header relative to skb->head, + * because we are going to reset the network header to the inner header + * and might change skb->head. + */ + nh = skb_network_header(skb) - skb->head; + skb_reset_network_header(skb); + if (!pskb_inet_may_pull(skb)) { + DEV_STATS_INC(geneve->dev, rx_length_errors); + DEV_STATS_INC(geneve->dev, rx_errors); + goto drop; + } + + /* Get the outer header. */ + oiph = skb->head + nh; + if (geneve_get_sk_family(gs) == AF_INET) err = IP_ECN_decapsulate(oiph, skb); #if IS_ENABLED(CONFIG_IPV6) -- 2.25.1

2 1

[PATCH OLK-5.10] net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
by Ziyang Xuan 26 Apr '24

26 Apr '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.213 commit 79ce2e54cc0ae366f45516c00bf1b19aa43e9abe category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HK9R CVE: CVE-2024-26852 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 685f7d531264599b3f167f1e94bbd22f120e5fab ] syzbot found another use-after-free in ip6_route_mpath_notify() [1] Commit f7225172f25a ("net/ipv6: prevent use after free in ip6_route_mpath_notify") was not able to fix the root cause. We need to defer the fib6_info_release() calls after ip6_route_mpath_notify(), in the cleanup phase. [1] BUG: KASAN: slab-use-after-free in rt6_fill_node+0x1460/0x1ac0 Read of size 4 at addr ffff88809a07fc64 by task syz-executor.2/23037 CPU: 0 PID: 23037 Comm: syz-executor.2 Not tainted 6.8.0-rc4-syzkaller-01035-gea7f3cfaa588 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0x167/0x540 mm/kasan/report.c:488 kasan_report+0x142/0x180 mm/kasan/report.c:601 rt6_fill_node+0x1460/0x1ac0 inet6_rt_notify+0x13b/0x290 net/ipv6/route.c:6184 ip6_route_mpath_notify net/ipv6/route.c:5198 [inline] ip6_route_multipath_add net/ipv6/route.c:5404 [inline] inet6_rtm_newroute+0x1d0f/0x2300 net/ipv6/route.c:5517 rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367 netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667 do_syscall_64+0xf9/0x240 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7f73dd87dda9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f73de6550c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f73dd9ac050 RCX: 00007f73dd87dda9 RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000005 RBP: 00007f73dd8ca47a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000006e R14: 00007f73dd9ac050 R15: 00007ffdbdeb7858 </TASK> Allocated by task 23037: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:372 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:389 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:3981 [inline] __kmalloc+0x22e/0x490 mm/slub.c:3994 kmalloc include/linux/slab.h:594 [inline] kzalloc include/linux/slab.h:711 [inline] fib6_info_alloc+0x2e/0xf0 net/ipv6/ip6_fib.c:155 ip6_route_info_create+0x445/0x12b0 net/ipv6/route.c:3758 ip6_route_multipath_add net/ipv6/route.c:5298 [inline] inet6_rtm_newroute+0x744/0x2300 net/ipv6/route.c:5517 rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367 netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667 do_syscall_64+0xf9/0x240 entry_SYSCALL_64_after_hwframe+0x6f/0x77 Freed by task 16: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x4e/0x60 mm/kasan/generic.c:640 poison_slab_object+0xa6/0xe0 mm/kasan/common.c:241 __kasan_slab_free+0x34/0x70 mm/kasan/common.c:257 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2121 [inline] slab_free mm/slub.c:4299 [inline] kfree+0x14a/0x380 mm/slub.c:4409 rcu_do_batch kernel/rcu/tree.c:2190 [inline] rcu_core+0xd76/0x1810 kernel/rcu/tree.c:2465 __do_softirq+0x2bb/0x942 kernel/softirq.c:553 Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xae/0x100 mm/kasan/generic.c:586 __call_rcu_common kernel/rcu/tree.c:2715 [inline] call_rcu+0x167/0xa80 kernel/rcu/tree.c:2829 fib6_info_release include/net/ip6_fib.h:341 [inline] ip6_route_multipath_add net/ipv6/route.c:5344 [inline] inet6_rtm_newroute+0x114d/0x2300 net/ipv6/route.c:5517 rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367 netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667 do_syscall_64+0xf9/0x240 entry_SYSCALL_64_after_hwframe+0x6f/0x77 The buggy address belongs to the object at ffff88809a07fc00 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 100 bytes inside of freed 512-byte region [ffff88809a07fc00, ffff88809a07fe00) The buggy address belongs to the physical page: page:ffffea0002681f00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9a07c head:ffffea0002681f00 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000840 ffff888014c41c80 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 23028, tgid 23027 (syz-executor.4), ts 2340253595219, free_ts 2339107097036 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c:1540 [inline] get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311 __alloc_pages+0x255/0x680 mm/page_alloc.c:4567 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page+0x5f/0x160 mm/slub.c:2190 allocate_slab mm/slub.c:2354 [inline] new_slab+0x84/0x2f0 mm/slub.c:2407 ___slab_alloc+0xd17/0x13e0 mm/slub.c:3540 __slab_alloc mm/slub.c:3625 [inline] __slab_alloc_node mm/slub.c:3678 [inline] slab_alloc_node mm/slub.c:3850 [inline] __do_kmalloc_node mm/slub.c:3980 [inline] __kmalloc+0x2e0/0x490 mm/slub.c:3994 kmalloc include/linux/slab.h:594 [inline] kzalloc include/linux/slab.h:711 [inline] new_dir fs/proc/proc_sysctl.c:956 [inline] get_subdir fs/proc/proc_sysctl.c:1000 [inline] sysctl_mkdir_p fs/proc/proc_sysctl.c:1295 [inline] __register_sysctl_table+0xb30/0x1440 fs/proc/proc_sysctl.c:1376 neigh_sysctl_register+0x416/0x500 net/core/neighbour.c:3859 devinet_sysctl_register+0xaf/0x1f0 net/ipv4/devinet.c:2644 inetdev_init+0x296/0x4d0 net/ipv4/devinet.c:286 inetdev_event+0x338/0x15c0 net/ipv4/devinet.c:1555 notifier_call_chain+0x18f/0x3b0 kernel/notifier.c:93 call_netdevice_notifiers_extack net/core/dev.c:1987 [inline] call_netdevice_notifiers net/core/dev.c:2001 [inline] register_netdevice+0x15b2/0x1a20 net/core/dev.c:10340 br_dev_newlink+0x27/0x100 net/bridge/br_netlink.c:1563 rtnl_newlink_create net/core/rtnetlink.c:3497 [inline] __rtnl_newlink net/core/rtnetlink.c:3717 [inline] rtnl_newlink+0x158f/0x20a0 net/core/rtnetlink.c:3730 page last free pid 11583 tgid 11583 stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1140 [inline] free_unref_page_prepare+0x968/0xa90 mm/page_alloc.c:2346 free_unref_page+0x37/0x3f0 mm/page_alloc.c:2486 kasan_depopulate_vmalloc_pte+0x74/0x90 mm/kasan/shadow.c:415 apply_to_pte_range mm/memory.c:2619 [inline] apply_to_pmd_range mm/memory.c:2663 [inline] apply_to_pud_range mm/memory.c:2699 [inline] apply_to_p4d_range mm/memory.c:2735 [inline] __apply_to_page_range+0x8ec/0xe40 mm/memory.c:2769 kasan_release_vmalloc+0x9a/0xb0 mm/kasan/shadow.c:532 __purge_vmap_area_lazy+0x163f/0x1a10 mm/vmalloc.c:1770 drain_vmap_area_work+0x40/0xd0 mm/vmalloc.c:1804 process_one_work kernel/workqueue.c:2633 [inline] process_scheduled_works+0x913/0x1420 kernel/workqueue.c:2706 worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787 kthread+0x2ef/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242 Memory state around the buggy address: ffff88809a07fb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88809a07fb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88809a07fc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88809a07fc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88809a07fd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fixes: 3b1137fe7482 ("net: ipv6: Change notifications for multipath add to RTA_MULTIPATH") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://lore.kernel.org/r/20240303144801.702646-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/ipv6/route.c | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 9603e009cd23..38c820e5c00a 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5230,19 +5230,7 @@ static int ip6_route_multipath_add(struct fib6_config *cfg, err_nh = NULL; list_for_each_entry(nh, &rt6_nh_list, next) { err = __ip6_ins_rt(nh->fib6_info, info, extack); - fib6_info_release(nh->fib6_info); - - if (!err) { - /* save reference to last route successfully inserted */ - rt_last = nh->fib6_info; - - /* save reference to first route for notification */ - if (!rt_notif) - rt_notif = nh->fib6_info; - } - /* nh->fib6_info is used or freed at this point, reset to NULL*/ - nh->fib6_info = NULL; if (err) { if (replace && nhn) NL_SET_ERR_MSG_MOD(extack, @@ -5250,6 +5238,12 @@ static int ip6_route_multipath_add(struct fib6_config *cfg, err_nh = nh; goto add_errout; } + /* save reference to last route successfully inserted */ + rt_last = nh->fib6_info; + + /* save reference to first route for notification */ + if (!rt_notif) + rt_notif = nh->fib6_info; /* Because each route is added like a single route we remove * these flags after the first nexthop: if there is a collision, @@ -5310,8 +5304,7 @@ static int ip6_route_multipath_add(struct fib6_config *cfg, cleanup: list_for_each_entry_safe(nh, nh_safe, &rt6_nh_list, next) { - if (nh->fib6_info) - fib6_info_release(nh->fib6_info); + fib6_info_release(nh->fib6_info); list_del(&nh->next); kfree(nh); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
by Ziyang Xuan 26 Apr '24

26 Apr '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v4.19.310 commit 31ea5bcc7d4cd1423de6be327a2c034725704136 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HK9R CVE: CVE-2024-26852 -------------------------------- [ Upstream commit 685f7d531264599b3f167f1e94bbd22f120e5fab ] syzbot found another use-after-free in ip6_route_mpath_notify() [1] Commit f7225172f25a ("net/ipv6: prevent use after free in ip6_route_mpath_notify") was not able to fix the root cause. We need to defer the fib6_info_release() calls after ip6_route_mpath_notify(), in the cleanup phase. [1] BUG: KASAN: slab-use-after-free in rt6_fill_node+0x1460/0x1ac0 Read of size 4 at addr ffff88809a07fc64 by task syz-executor.2/23037 CPU: 0 PID: 23037 Comm: syz-executor.2 Not tainted 6.8.0-rc4-syzkaller-01035-gea7f3cfaa588 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0x167/0x540 mm/kasan/report.c:488 kasan_report+0x142/0x180 mm/kasan/report.c:601 rt6_fill_node+0x1460/0x1ac0 inet6_rt_notify+0x13b/0x290 net/ipv6/route.c:6184 ip6_route_mpath_notify net/ipv6/route.c:5198 [inline] ip6_route_multipath_add net/ipv6/route.c:5404 [inline] inet6_rtm_newroute+0x1d0f/0x2300 net/ipv6/route.c:5517 rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367 netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667 do_syscall_64+0xf9/0x240 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7f73dd87dda9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f73de6550c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f73dd9ac050 RCX: 00007f73dd87dda9 RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000005 RBP: 00007f73dd8ca47a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000006e R14: 00007f73dd9ac050 R15: 00007ffdbdeb7858 </TASK> Allocated by task 23037: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:372 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:389 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:3981 [inline] __kmalloc+0x22e/0x490 mm/slub.c:3994 kmalloc include/linux/slab.h:594 [inline] kzalloc include/linux/slab.h:711 [inline] fib6_info_alloc+0x2e/0xf0 net/ipv6/ip6_fib.c:155 ip6_route_info_create+0x445/0x12b0 net/ipv6/route.c:3758 ip6_route_multipath_add net/ipv6/route.c:5298 [inline] inet6_rtm_newroute+0x744/0x2300 net/ipv6/route.c:5517 rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367 netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667 do_syscall_64+0xf9/0x240 entry_SYSCALL_64_after_hwframe+0x6f/0x77 Freed by task 16: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x4e/0x60 mm/kasan/generic.c:640 poison_slab_object+0xa6/0xe0 mm/kasan/common.c:241 __kasan_slab_free+0x34/0x70 mm/kasan/common.c:257 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2121 [inline] slab_free mm/slub.c:4299 [inline] kfree+0x14a/0x380 mm/slub.c:4409 rcu_do_batch kernel/rcu/tree.c:2190 [inline] rcu_core+0xd76/0x1810 kernel/rcu/tree.c:2465 __do_softirq+0x2bb/0x942 kernel/softirq.c:553 Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xae/0x100 mm/kasan/generic.c:586 __call_rcu_common kernel/rcu/tree.c:2715 [inline] call_rcu+0x167/0xa80 kernel/rcu/tree.c:2829 fib6_info_release include/net/ip6_fib.h:341 [inline] ip6_route_multipath_add net/ipv6/route.c:5344 [inline] inet6_rtm_newroute+0x114d/0x2300 net/ipv6/route.c:5517 rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367 netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667 do_syscall_64+0xf9/0x240 entry_SYSCALL_64_after_hwframe+0x6f/0x77 The buggy address belongs to the object at ffff88809a07fc00 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 100 bytes inside of freed 512-byte region [ffff88809a07fc00, ffff88809a07fe00) The buggy address belongs to the physical page: page:ffffea0002681f00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9a07c head:ffffea0002681f00 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000840 ffff888014c41c80 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 23028, tgid 23027 (syz-executor.4), ts 2340253595219, free_ts 2339107097036 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c:1540 [inline] get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311 __alloc_pages+0x255/0x680 mm/page_alloc.c:4567 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page+0x5f/0x160 mm/slub.c:2190 allocate_slab mm/slub.c:2354 [inline] new_slab+0x84/0x2f0 mm/slub.c:2407 ___slab_alloc+0xd17/0x13e0 mm/slub.c:3540 __slab_alloc mm/slub.c:3625 [inline] __slab_alloc_node mm/slub.c:3678 [inline] slab_alloc_node mm/slub.c:3850 [inline] __do_kmalloc_node mm/slub.c:3980 [inline] __kmalloc+0x2e0/0x490 mm/slub.c:3994 kmalloc include/linux/slab.h:594 [inline] kzalloc include/linux/slab.h:711 [inline] new_dir fs/proc/proc_sysctl.c:956 [inline] get_subdir fs/proc/proc_sysctl.c:1000 [inline] sysctl_mkdir_p fs/proc/proc_sysctl.c:1295 [inline] __register_sysctl_table+0xb30/0x1440 fs/proc/proc_sysctl.c:1376 neigh_sysctl_register+0x416/0x500 net/core/neighbour.c:3859 devinet_sysctl_register+0xaf/0x1f0 net/ipv4/devinet.c:2644 inetdev_init+0x296/0x4d0 net/ipv4/devinet.c:286 inetdev_event+0x338/0x15c0 net/ipv4/devinet.c:1555 notifier_call_chain+0x18f/0x3b0 kernel/notifier.c:93 call_netdevice_notifiers_extack net/core/dev.c:1987 [inline] call_netdevice_notifiers net/core/dev.c:2001 [inline] register_netdevice+0x15b2/0x1a20 net/core/dev.c:10340 br_dev_newlink+0x27/0x100 net/bridge/br_netlink.c:1563 rtnl_newlink_create net/core/rtnetlink.c:3497 [inline] __rtnl_newlink net/core/rtnetlink.c:3717 [inline] rtnl_newlink+0x158f/0x20a0 net/core/rtnetlink.c:3730 page last free pid 11583 tgid 11583 stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1140 [inline] free_unref_page_prepare+0x968/0xa90 mm/page_alloc.c:2346 free_unref_page+0x37/0x3f0 mm/page_alloc.c:2486 kasan_depopulate_vmalloc_pte+0x74/0x90 mm/kasan/shadow.c:415 apply_to_pte_range mm/memory.c:2619 [inline] apply_to_pmd_range mm/memory.c:2663 [inline] apply_to_pud_range mm/memory.c:2699 [inline] apply_to_p4d_range mm/memory.c:2735 [inline] __apply_to_page_range+0x8ec/0xe40 mm/memory.c:2769 kasan_release_vmalloc+0x9a/0xb0 mm/kasan/shadow.c:532 __purge_vmap_area_lazy+0x163f/0x1a10 mm/vmalloc.c:1770 drain_vmap_area_work+0x40/0xd0 mm/vmalloc.c:1804 process_one_work kernel/workqueue.c:2633 [inline] process_scheduled_works+0x913/0x1420 kernel/workqueue.c:2706 worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787 kthread+0x2ef/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242 Memory state around the buggy address: ffff88809a07fb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88809a07fb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88809a07fc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88809a07fc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88809a07fd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fixes: 3b1137fe7482 ("net: ipv6: Change notifications for multipath add to RTA_MULTIPATH") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://lore.kernel.org/r/20240303144801.702646-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/ipv6/route.c | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 83eba35adba9..b0aaac94d7f8 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -4530,25 +4530,19 @@ static int ip6_route_multipath_add(struct fib6_config *cfg, err_nh = NULL; list_for_each_entry(nh, &rt6_nh_list, next) { err = __ip6_ins_rt(nh->fib6_info, info, extack); - fib6_info_release(nh->fib6_info); - - if (!err) { - /* save reference to last route successfully inserted */ - rt_last = nh->fib6_info; - - /* save reference to first route for notification */ - if (!rt_notif) - rt_notif = nh->fib6_info; - } - /* nh->fib6_info is used or freed at this point, reset to NULL*/ - nh->fib6_info = NULL; if (err) { if (replace && nhn) ip6_print_replace_route_err(&rt6_nh_list); err_nh = nh; goto add_errout; } + /* save reference to last route successfully inserted */ + rt_last = nh->fib6_info; + + /* save reference to first route for notification */ + if (!rt_notif) + rt_notif = nh->fib6_info; /* Because each route is added like a single route we remove * these flags after the first nexthop: if there is a collision, @@ -4586,8 +4580,7 @@ static int ip6_route_multipath_add(struct fib6_config *cfg, cleanup: list_for_each_entry_safe(nh, nh_safe, &rt6_nh_list, next) { - if (nh->fib6_info) - fib6_info_release(nh->fib6_info); + fib6_info_release(nh->fib6_info); list_del(&nh->next); kfree(nh); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] geneve: make sure to pull inner header in geneve_rx()
by Ziyang Xuan 26 Apr '24

26 Apr '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v4.19.310 commit e431c3227864b5646601c97f5f898d99472f2914 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HK9B CVE: CVE-2024-26857 -------------------------------- [ Upstream commit 1ca1ba465e55b9460e4e75dec9fff31e708fec74 ] syzbot triggered a bug in geneve_rx() [1] Issue is similar to the one I fixed in commit 8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()") We have to save skb->network_header in a temporary variable in order to be able to recompute the network_header pointer after a pskb_inet_may_pull() call. pskb_inet_may_pull() makes sure the needed headers are in skb->head. [1] BUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] BUG: KMSAN: uninit-value in geneve_rx drivers/net/geneve.c:279 [inline] BUG: KMSAN: uninit-value in geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391 IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] geneve_rx drivers/net/geneve.c:279 [inline] geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391 udp_queue_rcv_one_skb+0x1d39/0x1f20 net/ipv4/udp.c:2108 udp_queue_rcv_skb+0x6ae/0x6e0 net/ipv4/udp.c:2186 udp_unicast_rcv_skb+0x184/0x4b0 net/ipv4/udp.c:2346 __udp4_lib_rcv+0x1c6b/0x3010 net/ipv4/udp.c:2422 udp_rcv+0x7d/0xa0 net/ipv4/udp.c:2604 ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:461 [inline] ip_rcv_finish net/ipv4/ip_input.c:449 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core net/core/dev.c:5534 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648 process_backlog+0x480/0x8b0 net/core/dev.c:5976 __napi_poll+0xe3/0x980 net/core/dev.c:6576 napi_poll net/core/dev.c:6645 [inline] net_rx_action+0x8b8/0x1870 net/core/dev.c:6778 __do_softirq+0x1b7/0x7c5 kernel/softirq.c:553 do_softirq+0x9a/0xf0 kernel/softirq.c:454 __local_bh_enable_ip+0x9b/0xa0 kernel/softirq.c:381 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:820 [inline] __dev_queue_xmit+0x2768/0x51c0 net/core/dev.c:4378 dev_queue_xmit include/linux/netdevice.h:3171 [inline] packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: slab_post_alloc_hook mm/slub.c:3819 [inline] slab_alloc_node mm/slub.c:3860 [inline] kmem_cache_alloc_node+0x5cb/0xbc0 mm/slub.c:3903 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560 __alloc_skb+0x352/0x790 net/core/skbuff.c:651 alloc_skb include/linux/skbuff.h:1296 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6394 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2783 packet_alloc_skb net/packet/af_packet.c:2930 [inline] packet_snd net/packet/af_packet.c:3024 [inline] packet_sendmsg+0x70c2/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fixes: 2d07dc79fe04 ("geneve: add initial netdev driver for GENEVE tunnels") Reported-and-tested-by: syzbot+6a1423ff3f97159aae64(a)syzkaller.appspotmail.com Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- drivers/net/geneve.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c index a83a7e6fb9ca..386d8a86bbdb 100644 --- a/drivers/net/geneve.c +++ b/drivers/net/geneve.c @@ -217,7 +217,7 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs, struct metadata_dst *tun_dst = NULL; struct pcpu_sw_netstats *stats; unsigned int len; - int err = 0; + int nh, err = 0; void *oiph; if (ip_tunnel_collect_metadata() || gs->collect_md) { @@ -261,9 +261,23 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs, goto drop; } - oiph = skb_network_header(skb); + /* Save offset of outer header relative to skb->head, + * because we are going to reset the network header to the inner header + * and might change skb->head. + */ + nh = skb_network_header(skb) - skb->head; + skb_reset_network_header(skb); + if (!pskb_inet_may_pull(skb)) { + DEV_STATS_INC(geneve->dev, rx_length_errors); + DEV_STATS_INC(geneve->dev, rx_errors); + goto drop; + } + + /* Get the outer header. */ + oiph = skb->head + nh; + if (geneve_get_sk_family(gs) == AF_INET) err = IP_ECN_decapsulate(oiph, skb); #if IS_ENABLED(CONFIG_IPV6) -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] infiniband/hw/hiroce3: Add Huawei Intelligent Network Card RDMA Driver
by Shuai Wu 26 Apr '24

26 Apr '24

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9H643 CVE: NA --------------------------------- The RDMA driver supports the following features: Supports Huawei SP600 series NICs; Supports RoCEv2; Supports RoCE XRC, UD, UC, and RC modes; Supports RoCE UC, RC, and UD local switching; Supports RoCE MR, PD, CQ, QoS, QP, and SRQ management; Supports RoCE congestion control; Supports RoCE Bond; Supports RoCE FLR; Supports RoCE entry specifications; Supports RoCE error detection and reporting; Signed-off-by: Shuai Wu <wushuai51(a)huawei.com> Shuai Wu (2): net/ethernet/huawei/hinic3: Add the CQM on which the RDMA depends infiniband/hw/hiroce3: Add Huawei Intelligent Network Card RDMA Driver Documentation/networking/hinic3.txt | 15 + MAINTAINERS | 11 + arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/infiniband/Kconfig | 1 + drivers/infiniband/hw/Makefile | 1 + drivers/infiniband/hw/hiroce3/Kconfig | 14 + drivers/infiniband/hw/hiroce3/Makefile | 98 + .../infiniband/hw/hiroce3/bond/roce_bond.h | 147 + .../hw/hiroce3/bond/roce_bond_common.c | 938 +++ drivers/infiniband/hw/hiroce3/cq/roce_cq.h | 250 + .../infiniband/hw/hiroce3/cq/roce_cq_common.c | 195 + .../infiniband/hw/hiroce3/cq/roce_cq_cqe.c | 744 +++ .../infiniband/hw/hiroce3/cq/roce_cq_create.c | 629 ++ .../infiniband/hw/hiroce3/cq/roce_cq_ctrl.c | 930 +++ .../hw/hiroce3/cq/roce_cq_destroy.c | 247 + drivers/infiniband/hw/hiroce3/dfx/roce_dfx.c | 122 + drivers/infiniband/hw/hiroce3/dfx/roce_dfx.h | 177 + .../infiniband/hw/hiroce3/dfx/roce_dfx_cap.c | 688 +++ .../infiniband/hw/hiroce3/dfx/roce_dfx_cap.h | 181 + .../hw/hiroce3/dfx/roce_dfx_query.c | 643 ++ .../hiroce3/extension/roce_cdev_extension.c | 11 + .../hiroce3/extension/roce_event_extension.c | 23 + .../hiroce3/extension/roce_main_extension.c | 188 + .../hw/hiroce3/extension/roce_mr_extension.c | 31 + .../hiroce3/extension/roce_netdev_extension.c | 121 + .../hw/hiroce3/extension/roce_qp_extension.c | 241 + .../extension/roce_qp_post_send_extension.c | 11 + .../hw/hiroce3/extension/roce_srq_extension.c | 27 + .../hw/hiroce3/host/hmm/hmm_buddy.c | 161 + .../hw/hiroce3/host/hmm/hmm_buddy.h | 32 + .../infiniband/hw/hiroce3/host/hmm/hmm_comp.c | 164 + .../infiniband/hw/hiroce3/host/hmm/hmm_comp.h | 228 + .../hw/hiroce3/host/hmm/hmm_comp_init.c | 123 + .../hw/hiroce3/host/hmm/hmm_comp_mtt.c | 494 ++ .../hw/hiroce3/host/hmm/hmm_comp_mw_mr.c | 220 + .../hw/hiroce3/host/hmm/hmm_comp_res.c | 58 + .../infiniband/hw/hiroce3/host/hmm/hmm_em.c | 348 ++ .../infiniband/hw/hiroce3/host/hmm/hmm_em.h | 47 + .../infiniband/hw/hiroce3/host/hmm/hmm_mr.c | 429 ++ .../infiniband/hw/hiroce3/host/hmm/hmm_mr.h | 32 + .../infiniband/hw/hiroce3/host/hmm/hmm_umem.c | 273 + .../infiniband/hw/hiroce3/host/hmm/hmm_umem.h | 124 + .../hw/hiroce3/include/hinic3_hmm.h | 93 + .../hw/hiroce3/include/hinic3_rdma.h | 202 + .../hw/hiroce3/include/nic/nic_mpu_cmd.h | 181 + .../hw/hiroce3/include/nic/nic_npu_cmd.h | 29 + .../hw/hiroce3/include/nic/nic_npu_cmd_defs.h | 134 + .../infiniband/hw/hiroce3/include/node_id.h | 52 + .../include/rdma/rdma_context_format.h | 5181 +++++++++++++++++ .../include/rdma/rdma_ext_ctx_format.h | 379 ++ .../hw/hiroce3/include/rdma/roce_ccf_format.h | 722 +++ .../hiroce3/include/rdma/roce_compile_macro.h | 66 + .../hw/hiroce3/include/rdma/roce_ctx_api.h | 258 + .../hw/hiroce3/include/rdma/roce_dif_format.h | 492 ++ .../hw/hiroce3/include/rdma/roce_err_type.h | 122 + .../hiroce3/include/rdma/roce_hmm_context.h | 210 + .../hw/hiroce3/include/rdma/roce_mpu_common.h | 234 + .../hw/hiroce3/include/rdma/roce_pub.h | 259 + .../hw/hiroce3/include/rdma/roce_pub_cmd.h | 261 + .../hw/hiroce3/include/rdma/roce_ulp.h | 178 + .../hw/hiroce3/include/rdma/roce_vbs_format.h | 206 + .../hw/hiroce3/include/rdma/roce_verbs_attr.h | 413 ++ .../include/rdma/roce_verbs_attr_qpc_chip.h | 360 ++ .../hw/hiroce3/include/rdma/roce_verbs_cmd.h | 248 + .../hiroce3/include/rdma/roce_verbs_cq_attr.h | 196 + .../include/rdma/roce_verbs_ext_attr.h | 48 + .../hiroce3/include/rdma/roce_verbs_format.h | 132 + .../include/rdma/roce_verbs_gid_attr.h | 111 + .../hiroce3/include/rdma/roce_verbs_mr_attr.h | 330 ++ .../hw/hiroce3/include/rdma/roce_verbs_pub.h | 225 + .../include/rdma/roce_verbs_srq_attr.h | 264 + .../include/rdma/roce_verbs_ulp_format.h | 91 + .../hw/hiroce3/include/rdma/roce_wqe_format.h | 930 +++ .../hw/hiroce3/include/rdma/roce_xqe_format.h | 722 +++ .../hw/hiroce3/include/roce_cdev_extension.h | 13 + .../hw/hiroce3/include/roce_event_extension.h | 13 + .../hw/hiroce3/include/roce_main_extension.h | 78 + .../hw/hiroce3/include/roce_mr_extension.h | 17 + .../hiroce3/include/roce_netdev_extension.h | 19 + .../hw/hiroce3/include/roce_qp_extension.h | 64 + .../include/roce_qp_post_send_extension.h | 13 + .../hw/hiroce3/include/roce_srq_extension.h | 14 + drivers/infiniband/hw/hiroce3/mr/roce_mr.c | 949 +++ drivers/infiniband/hw/hiroce3/mr/roce_mr.h | 97 + drivers/infiniband/hw/hiroce3/qp/roce_post.h | 167 + drivers/infiniband/hw/hiroce3/qp/roce_qp.h | 244 + .../infiniband/hw/hiroce3/qp/roce_qp_create.c | 1239 ++++ .../hw/hiroce3/qp/roce_qp_destroy.c | 260 + .../infiniband/hw/hiroce3/qp/roce_qp_exp.h | 80 + .../infiniband/hw/hiroce3/qp/roce_qp_modify.c | 2243 +++++++ .../hw/hiroce3/qp/roce_qp_post_recv.c | 223 + .../hw/hiroce3/qp/roce_qp_post_send.c | 1315 +++++ .../infiniband/hw/hiroce3/qp/roce_qp_query.c | 393 ++ .../infiniband/hw/hiroce3/rdma/rdma_bitmap.c | 129 + .../infiniband/hw/hiroce3/rdma/rdma_bitmap.h | 36 + .../infiniband/hw/hiroce3/rdma/rdma_comp.c | 22 + .../infiniband/hw/hiroce3/rdma/rdma_comp.h | 131 + .../hw/hiroce3/rdma/rdma_comp_gid.c | 281 + .../hw/hiroce3/rdma/rdma_comp_init.c | 366 ++ .../hw/hiroce3/rdma/rdma_comp_mw_mr.c | 242 + .../infiniband/hw/hiroce3/rdma/rdma_comp_pd.c | 50 + .../hw/hiroce3/rdma/rdma_comp_res.c | 245 + drivers/infiniband/hw/hiroce3/roce.h | 574 ++ drivers/infiniband/hw/hiroce3/roce_cdev.c | 1259 ++++ drivers/infiniband/hw/hiroce3/roce_cmd.c | 722 +++ drivers/infiniband/hw/hiroce3/roce_cmd.h | 74 + drivers/infiniband/hw/hiroce3/roce_compat.h | 60 + drivers/infiniband/hw/hiroce3/roce_cqm_cmd.c | 52 + drivers/infiniband/hw/hiroce3/roce_cqm_cmd.h | 17 + drivers/infiniband/hw/hiroce3/roce_db.c | 88 + drivers/infiniband/hw/hiroce3/roce_db.h | 29 + drivers/infiniband/hw/hiroce3/roce_event.c | 566 ++ drivers/infiniband/hw/hiroce3/roce_event.h | 36 + drivers/infiniband/hw/hiroce3/roce_k_ioctl.h | 89 + drivers/infiniband/hw/hiroce3/roce_main.c | 1609 +++++ drivers/infiniband/hw/hiroce3/roce_mix.c | 1194 ++++ drivers/infiniband/hw/hiroce3/roce_mix.h | 205 + drivers/infiniband/hw/hiroce3/roce_netdev.c | 786 +++ drivers/infiniband/hw/hiroce3/roce_netdev.h | 59 + drivers/infiniband/hw/hiroce3/roce_netlink.c | 352 ++ drivers/infiniband/hw/hiroce3/roce_netlink.h | 164 + drivers/infiniband/hw/hiroce3/roce_pd.c | 66 + drivers/infiniband/hw/hiroce3/roce_pd.h | 24 + drivers/infiniband/hw/hiroce3/roce_sysfs.c | 1800 ++++++ drivers/infiniband/hw/hiroce3/roce_sysfs.h | 108 + drivers/infiniband/hw/hiroce3/roce_user.h | 65 + drivers/infiniband/hw/hiroce3/roce_xrc.c | 128 + drivers/infiniband/hw/hiroce3/roce_xrc.h | 23 + drivers/infiniband/hw/hiroce3/srq/roce_srq.h | 201 + .../infiniband/hw/hiroce3/srq/roce_srq_comm.c | 93 + .../hw/hiroce3/srq/roce_srq_create.c | 635 ++ .../infiniband/hw/hiroce3/srq/roce_srq_ctrl.c | 570 ++ drivers/net/ethernet/huawei/hinic3/Makefile | 22 +- .../ethernet/huawei/hinic3/bond/hinic3_bond.c | 1042 ++++ .../ethernet/huawei/hinic3/bond/hinic3_bond.h | 98 + .../ethernet/huawei/hinic3/comm_msg_intf.h | 565 +- .../ethernet/huawei/hinic3/cqm/cqm_bat_cla.c | 2056 +++++++ .../ethernet/huawei/hinic3/cqm/cqm_bat_cla.h | 214 + .../huawei/hinic3/cqm/cqm_bitmap_table.c | 1454 +++++ .../huawei/hinic3/cqm/cqm_bitmap_table.h | 66 + .../huawei/hinic3/cqm/cqm_bloomfilter.c | 535 ++ .../huawei/hinic3/cqm/cqm_bloomfilter.h | 53 + .../net/ethernet/huawei/hinic3/cqm/cqm_cmd.c | 250 + .../net/ethernet/huawei/hinic3/cqm/cqm_cmd.h | 39 + .../net/ethernet/huawei/hinic3/cqm/cqm_db.c | 506 ++ .../net/ethernet/huawei/hinic3/cqm/cqm_db.h | 36 + .../ethernet/huawei/hinic3/cqm/cqm_define.h | 54 + .../net/ethernet/huawei/hinic3/cqm/cqm_main.c | 1743 ++++++ .../net/ethernet/huawei/hinic3/cqm/cqm_main.h | 380 ++ .../ethernet/huawei/hinic3/cqm/cqm_memsec.c | 665 +++ .../ethernet/huawei/hinic3/cqm/cqm_memsec.h | 23 + .../ethernet/huawei/hinic3/cqm/cqm_object.c | 1664 ++++++ .../ethernet/huawei/hinic3/cqm/cqm_object.h | 714 +++ .../huawei/hinic3/cqm/cqm_object_intern.c | 1467 +++++ .../huawei/hinic3/cqm/cqm_object_intern.h | 93 + .../net/ethernet/huawei/hinic3/cqm/readme.txt | 3 + .../net/ethernet/huawei/hinic3/hinic3_crm.h | 110 +- .../net/ethernet/huawei/hinic3/hinic3_dbg.c | 2 + .../net/ethernet/huawei/hinic3/hinic3_hw.h | 51 +- .../ethernet/huawei/hinic3/hinic3_mag_cfg.c | 4 +- .../huawei/hinic3/hinic3_mgmt_interface.h | 377 +- .../net/ethernet/huawei/hinic3/hinic3_nic.h | 1 - .../ethernet/huawei/hinic3/hinic3_nic_cfg.h | 1 + .../ethernet/huawei/hinic3/hinic3_srv_nic.h | 5 + .../ethernet/huawei/hinic3/hw/hinic3_cmdq.c | 33 +- .../ethernet/huawei/hinic3/hw/hinic3_cmdq.h | 7 +- .../ethernet/huawei/hinic3/hw/hinic3_csr.h | 1 + .../huawei/hinic3/hw/hinic3_devlink.h | 24 + .../ethernet/huawei/hinic3/hw/hinic3_eqs.c | 35 + .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c | 155 +- .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h | 17 +- .../huawei/hinic3/hw/hinic3_hw_comm.c | 148 +- .../huawei/hinic3/hw/hinic3_hw_comm.h | 2 +- .../ethernet/huawei/hinic3/hw/hinic3_hw_mt.c | 39 +- .../ethernet/huawei/hinic3/hw/hinic3_hwdev.c | 212 +- .../ethernet/huawei/hinic3/hw/hinic3_hwdev.h | 33 +- .../ethernet/huawei/hinic3/hw/hinic3_hwif.c | 54 + .../ethernet/huawei/hinic3/hw/hinic3_mbox.c | 113 +- .../ethernet/huawei/hinic3/hw/hinic3_mbox.h | 82 +- .../ethernet/huawei/hinic3/hw/hinic3_mgmt.c | 76 +- .../ethernet/huawei/hinic3/hw/hinic3_mgmt.h | 5 +- .../huawei/hinic3/hw/hinic3_multi_host_mgmt.c | 1231 ++++ .../huawei/hinic3/hw/hinic3_multi_host_mgmt.h | 124 + .../huawei/hinic3/hw/hinic3_nictool.c | 1 + .../huawei/hinic3/hw/hinic3_pci_id_tbl.h | 30 +- .../huawei/hinic3/hw/ossl_knl_linux.c | 20 +- .../hinic3/include/bond/bond_common_defs.h | 69 + .../include/cfg_mgmt/cfg_mgmt_mpu_cmd.h | 12 + .../include/cfg_mgmt/cfg_mgmt_mpu_cmd_defs.h | 212 + .../huawei/hinic3/include/cqm/cqm_npu_cmd.h | 31 + .../hinic3/include/cqm/cqm_npu_cmd_defs.h | 61 + .../huawei/hinic3/include/hinic3_common.h | 181 + .../huawei/hinic3/include/hinic3_cqm.h | 364 ++ .../huawei/hinic3/include/hinic3_cqm_define.h | 52 + .../huawei/hinic3/include/hinic3_lld.h | 223 + .../huawei/hinic3/include/hinic3_profile.h | 148 + .../huawei/hinic3/include/mpu/mag_mpu_cmd.h | 70 + .../hinic3/include/mpu/mpu_board_defs.h | 71 + .../hinic3/include/mpu/mpu_cmd_base_defs.h | 116 + .../hinic3/include/mpu/mpu_inband_cmd.h | 187 + .../hinic3/include/mpu/mpu_inband_cmd_defs.h | 1078 ++++ .../include/mpu/mpu_outband_ncsi_cmd_defs.h | 205 + .../huawei/hinic3/include/mpu/nic_cfg_comm.h | 55 + .../huawei/hinic3/include/ossl_types.h | 144 + .../include/public/npu_cmdq_base_defs.h | 232 + .../ethernet/huawei/hinic3/include/readme.txt | 1 + .../hinic3/include/vmsec/vmsec_mpu_common.h | 107 + .../huawei/hinic3/include/vram_common.h | 65 + drivers/net/ethernet/huawei/hinic3/mag_cmd.h | 272 +- drivers/net/ethernet/huawei/hinic3/ossl_knl.h | 4 + .../ethernet/huawei/hinic3/ossl_knl_linux.h | 29 +- 212 files changed, 62938 insertions(+), 1125 deletions(-) create mode 100644 drivers/infiniband/hw/hiroce3/Kconfig create mode 100644 drivers/infiniband/hw/hiroce3/Makefile create mode 100644 drivers/infiniband/hw/hiroce3/bond/roce_bond.h create mode 100644 drivers/infiniband/hw/hiroce3/bond/roce_bond_common.c create mode 100644 drivers/infiniband/hw/hiroce3/cq/roce_cq.h create mode 100644 drivers/infiniband/hw/hiroce3/cq/roce_cq_common.c create mode 100644 drivers/infiniband/hw/hiroce3/cq/roce_cq_cqe.c create mode 100644 drivers/infiniband/hw/hiroce3/cq/roce_cq_create.c create mode 100644 drivers/infiniband/hw/hiroce3/cq/roce_cq_ctrl.c create mode 100644 drivers/infiniband/hw/hiroce3/cq/roce_cq_destroy.c create mode 100644 drivers/infiniband/hw/hiroce3/dfx/roce_dfx.c create mode 100644 drivers/infiniband/hw/hiroce3/dfx/roce_dfx.h create mode 100644 drivers/infiniband/hw/hiroce3/dfx/roce_dfx_cap.c create mode 100644 drivers/infiniband/hw/hiroce3/dfx/roce_dfx_cap.h create mode 100644 drivers/infiniband/hw/hiroce3/dfx/roce_dfx_query.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_cdev_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_event_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_main_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_mr_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_netdev_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_qp_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_qp_post_send_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_srq_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_buddy.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_buddy.h create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_comp.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_comp.h create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_comp_init.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_comp_mtt.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_comp_mw_mr.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_comp_res.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_em.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_em.h create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_mr.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_mr.h create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_umem.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_umem.h create mode 100644 drivers/infiniband/hw/hiroce3/include/hinic3_hmm.h create mode 100644 drivers/infiniband/hw/hiroce3/include/hinic3_rdma.h create mode 100644 drivers/infiniband/hw/hiroce3/include/nic/nic_mpu_cmd.h create mode 100644 drivers/infiniband/hw/hiroce3/include/nic/nic_npu_cmd.h create mode 100644 drivers/infiniband/hw/hiroce3/include/nic/nic_npu_cmd_defs.h create mode 100644 drivers/infiniband/hw/hiroce3/include/node_id.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_ccf_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_compile_macro.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_ctx_api.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_dif_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_err_type.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_hmm_context.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_mpu_common.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_pub.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_pub_cmd.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_ulp.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_vbs_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_attr.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_attr_qpc_chip.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cq_attr.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_ext_attr.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_gid_attr.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_mr_attr.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_pub.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_srq_attr.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_ulp_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_wqe_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_xqe_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_cdev_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_event_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_main_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_mr_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_netdev_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_qp_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_qp_post_send_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_srq_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/mr/roce_mr.c create mode 100644 drivers/infiniband/hw/hiroce3/mr/roce_mr.h create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_post.h create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp.h create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp_create.c create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp_destroy.c create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp_exp.h create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp_modify.c create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp_post_recv.c create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp_post_send.c create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp_query.c create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_bitmap.c create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_bitmap.h create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_comp.c create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_comp.h create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_comp_gid.c create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_comp_init.c create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_comp_mw_mr.c create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_comp_pd.c create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_comp_res.c create mode 100644 drivers/infiniband/hw/hiroce3/roce.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_cdev.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_cmd.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_cmd.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_compat.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_cqm_cmd.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_cqm_cmd.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_db.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_db.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_event.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_event.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_k_ioctl.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_main.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_mix.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_mix.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_netdev.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_netdev.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_netlink.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_netlink.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_pd.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_pd.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_sysfs.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_sysfs.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_user.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_xrc.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_xrc.h create mode 100644 drivers/infiniband/hw/hiroce3/srq/roce_srq.h create mode 100644 drivers/infiniband/hw/hiroce3/srq/roce_srq_comm.c create mode 100644 drivers/infiniband/hw/hiroce3/srq/roce_srq_create.c create mode 100644 drivers/infiniband/hw/hiroce3/srq/roce_srq_ctrl.c create mode 100644 drivers/net/ethernet/huawei/hinic3/bond/hinic3_bond.c create mode 100644 drivers/net/ethernet/huawei/hinic3/bond/hinic3_bond.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_bat_cla.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_bat_cla.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_bitmap_table.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_bitmap_table.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_db.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_db.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_main.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_main.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_memsec.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_memsec.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_object.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_object.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/readme.txt create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/bond/bond_common_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/cfg_mgmt/cfg_mgmt_mpu_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/cfg_mgmt/cfg_mgmt_mpu_cmd_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/cqm/cqm_npu_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/cqm/cqm_npu_cmd_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/hinic3_common.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/hinic3_cqm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/hinic3_cqm_define.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/hinic3_lld.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/hinic3_profile.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/mpu/mag_mpu_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/mpu/mpu_board_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/mpu/mpu_cmd_base_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/mpu/mpu_inband_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/mpu/mpu_inband_cmd_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/mpu/mpu_outband_ncsi_cmd_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/mpu/nic_cfg_comm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/ossl_types.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/public/npu_cmdq_base_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/readme.txt create mode 100644 drivers/net/ethernet/huawei/hinic3/include/vmsec/vmsec_mpu_common.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/vram_common.h -- 2.33.0

2 3

[PATCH OLK-6.6 0/2] infiniband/hw/hiroce3: Add Huawei Intelligent Network Card RDMA Driver
by Shuai Wu 26 Apr '24

26 Apr '24

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9EMOF CVE: NA --------------------------------- The RDMA driver supports the following features: Supports Huawei SP600 series NICs; Supports RoCEv2; Supports RoCE XRC, UD, UC, and RC modes; Supports RoCE UC, RC, and UD local switching; Supports RoCE MR, PD, CQ, QoS, QP, and SRQ management; Supports RoCE congestion control; Supports RoCE Bond; Supports RoCE FLR; Supports RoCE entry specifications; Supports RoCE error detection and reporting; Signed-off-by: Shuai Wu <wushuai51(a)huawei.com> Shuai Wu (2): net/ethernet/huawei/hinic3: Add the CQM on which the RDMA depends infiniband/hw/hiroce3: Add Huawei Intelligent Network Card RDMA Driver Documentation/networking/hinic3.rst | 15 + MAINTAINERS | 11 + arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/infiniband/Kconfig | 1 + drivers/infiniband/hw/Makefile | 1 + drivers/infiniband/hw/hiroce3/Kconfig | 14 + drivers/infiniband/hw/hiroce3/Makefile | 98 + .../infiniband/hw/hiroce3/bond/roce_bond.h | 147 + .../hw/hiroce3/bond/roce_bond_common.c | 938 +++ drivers/infiniband/hw/hiroce3/cq/roce_cq.h | 250 + .../infiniband/hw/hiroce3/cq/roce_cq_common.c | 195 + .../infiniband/hw/hiroce3/cq/roce_cq_cqe.c | 744 +++ .../infiniband/hw/hiroce3/cq/roce_cq_create.c | 629 ++ .../infiniband/hw/hiroce3/cq/roce_cq_ctrl.c | 930 +++ .../hw/hiroce3/cq/roce_cq_destroy.c | 247 + drivers/infiniband/hw/hiroce3/dfx/roce_dfx.c | 122 + drivers/infiniband/hw/hiroce3/dfx/roce_dfx.h | 177 + .../infiniband/hw/hiroce3/dfx/roce_dfx_cap.c | 688 +++ .../infiniband/hw/hiroce3/dfx/roce_dfx_cap.h | 181 + .../hw/hiroce3/dfx/roce_dfx_query.c | 643 ++ .../hiroce3/extension/roce_cdev_extension.c | 11 + .../hiroce3/extension/roce_event_extension.c | 23 + .../hiroce3/extension/roce_main_extension.c | 188 + .../hw/hiroce3/extension/roce_mr_extension.c | 31 + .../hiroce3/extension/roce_netdev_extension.c | 121 + .../hw/hiroce3/extension/roce_qp_extension.c | 241 + .../extension/roce_qp_post_send_extension.c | 11 + .../hw/hiroce3/extension/roce_srq_extension.c | 27 + .../hw/hiroce3/host/hmm/hmm_buddy.c | 161 + .../hw/hiroce3/host/hmm/hmm_buddy.h | 32 + .../infiniband/hw/hiroce3/host/hmm/hmm_comp.c | 164 + .../infiniband/hw/hiroce3/host/hmm/hmm_comp.h | 228 + .../hw/hiroce3/host/hmm/hmm_comp_init.c | 123 + .../hw/hiroce3/host/hmm/hmm_comp_mtt.c | 494 ++ .../hw/hiroce3/host/hmm/hmm_comp_mw_mr.c | 220 + .../hw/hiroce3/host/hmm/hmm_comp_res.c | 58 + .../infiniband/hw/hiroce3/host/hmm/hmm_em.c | 348 ++ .../infiniband/hw/hiroce3/host/hmm/hmm_em.h | 47 + .../infiniband/hw/hiroce3/host/hmm/hmm_mr.c | 429 ++ .../infiniband/hw/hiroce3/host/hmm/hmm_mr.h | 32 + .../infiniband/hw/hiroce3/host/hmm/hmm_umem.c | 273 + .../infiniband/hw/hiroce3/host/hmm/hmm_umem.h | 124 + .../hw/hiroce3/include/hinic3_hmm.h | 93 + .../hw/hiroce3/include/hinic3_rdma.h | 202 + .../hw/hiroce3/include/nic/nic_mpu_cmd.h | 181 + .../hw/hiroce3/include/nic/nic_npu_cmd.h | 29 + .../hw/hiroce3/include/nic/nic_npu_cmd_defs.h | 135 + .../infiniband/hw/hiroce3/include/node_id.h | 52 + .../include/rdma/rdma_context_format.h | 5181 +++++++++++++++++ .../include/rdma/rdma_ext_ctx_format.h | 379 ++ .../hw/hiroce3/include/rdma/roce_ccf_format.h | 722 +++ .../hiroce3/include/rdma/roce_compile_macro.h | 66 + .../hw/hiroce3/include/rdma/roce_ctx_api.h | 258 + .../hw/hiroce3/include/rdma/roce_dif_format.h | 492 ++ .../hw/hiroce3/include/rdma/roce_err_type.h | 122 + .../hiroce3/include/rdma/roce_hmm_context.h | 210 + .../hw/hiroce3/include/rdma/roce_mpu_common.h | 234 + .../hw/hiroce3/include/rdma/roce_pub.h | 259 + .../hw/hiroce3/include/rdma/roce_pub_cmd.h | 261 + .../hw/hiroce3/include/rdma/roce_ulp.h | 178 + .../hw/hiroce3/include/rdma/roce_vbs_format.h | 206 + .../hw/hiroce3/include/rdma/roce_verbs_attr.h | 413 ++ .../include/rdma/roce_verbs_attr_qpc_chip.h | 360 ++ .../hw/hiroce3/include/rdma/roce_verbs_cmd.h | 248 + .../hiroce3/include/rdma/roce_verbs_cq_attr.h | 196 + .../include/rdma/roce_verbs_ext_attr.h | 48 + .../hiroce3/include/rdma/roce_verbs_format.h | 132 + .../include/rdma/roce_verbs_gid_attr.h | 111 + .../hiroce3/include/rdma/roce_verbs_mr_attr.h | 330 ++ .../hw/hiroce3/include/rdma/roce_verbs_pub.h | 225 + .../include/rdma/roce_verbs_srq_attr.h | 264 + .../include/rdma/roce_verbs_ulp_format.h | 91 + .../hw/hiroce3/include/rdma/roce_wqe_format.h | 930 +++ .../hw/hiroce3/include/rdma/roce_xqe_format.h | 722 +++ .../hw/hiroce3/include/roce_cdev_extension.h | 13 + .../hw/hiroce3/include/roce_event_extension.h | 13 + .../hw/hiroce3/include/roce_main_extension.h | 78 + .../hw/hiroce3/include/roce_mr_extension.h | 17 + .../hiroce3/include/roce_netdev_extension.h | 19 + .../hw/hiroce3/include/roce_qp_extension.h | 64 + .../include/roce_qp_post_send_extension.h | 13 + .../hw/hiroce3/include/roce_srq_extension.h | 14 + drivers/infiniband/hw/hiroce3/mr/roce_mr.c | 949 +++ drivers/infiniband/hw/hiroce3/mr/roce_mr.h | 97 + drivers/infiniband/hw/hiroce3/qp/roce_post.h | 167 + drivers/infiniband/hw/hiroce3/qp/roce_qp.h | 244 + .../infiniband/hw/hiroce3/qp/roce_qp_create.c | 1218 ++++ .../hw/hiroce3/qp/roce_qp_destroy.c | 260 + .../infiniband/hw/hiroce3/qp/roce_qp_exp.h | 80 + .../infiniband/hw/hiroce3/qp/roce_qp_modify.c | 2241 +++++++ .../hw/hiroce3/qp/roce_qp_post_recv.c | 223 + .../hw/hiroce3/qp/roce_qp_post_send.c | 1315 +++++ .../infiniband/hw/hiroce3/qp/roce_qp_query.c | 392 ++ .../infiniband/hw/hiroce3/rdma/rdma_bitmap.c | 129 + .../infiniband/hw/hiroce3/rdma/rdma_bitmap.h | 35 + .../infiniband/hw/hiroce3/rdma/rdma_comp.c | 22 + .../infiniband/hw/hiroce3/rdma/rdma_comp.h | 131 + .../hw/hiroce3/rdma/rdma_comp_gid.c | 281 + .../hw/hiroce3/rdma/rdma_comp_init.c | 366 ++ .../hw/hiroce3/rdma/rdma_comp_mw_mr.c | 242 + .../infiniband/hw/hiroce3/rdma/rdma_comp_pd.c | 50 + .../hw/hiroce3/rdma/rdma_comp_res.c | 245 + drivers/infiniband/hw/hiroce3/roce.h | 574 ++ drivers/infiniband/hw/hiroce3/roce_cdev.c | 1260 ++++ drivers/infiniband/hw/hiroce3/roce_cmd.c | 722 +++ drivers/infiniband/hw/hiroce3/roce_cmd.h | 74 + drivers/infiniband/hw/hiroce3/roce_compat.h | 60 + drivers/infiniband/hw/hiroce3/roce_cqm_cmd.c | 52 + drivers/infiniband/hw/hiroce3/roce_cqm_cmd.h | 17 + drivers/infiniband/hw/hiroce3/roce_db.c | 88 + drivers/infiniband/hw/hiroce3/roce_db.h | 29 + drivers/infiniband/hw/hiroce3/roce_event.c | 566 ++ drivers/infiniband/hw/hiroce3/roce_event.h | 36 + drivers/infiniband/hw/hiroce3/roce_k_ioctl.h | 89 + drivers/infiniband/hw/hiroce3/roce_main.c | 1610 +++++ drivers/infiniband/hw/hiroce3/roce_mix.c | 1194 ++++ drivers/infiniband/hw/hiroce3/roce_mix.h | 205 + drivers/infiniband/hw/hiroce3/roce_netdev.c | 786 +++ drivers/infiniband/hw/hiroce3/roce_netdev.h | 59 + drivers/infiniband/hw/hiroce3/roce_netlink.c | 352 ++ drivers/infiniband/hw/hiroce3/roce_netlink.h | 164 + drivers/infiniband/hw/hiroce3/roce_pd.c | 66 + drivers/infiniband/hw/hiroce3/roce_pd.h | 24 + drivers/infiniband/hw/hiroce3/roce_sysfs.c | 1800 ++++++ drivers/infiniband/hw/hiroce3/roce_sysfs.h | 108 + drivers/infiniband/hw/hiroce3/roce_user.h | 65 + drivers/infiniband/hw/hiroce3/roce_xrc.c | 128 + drivers/infiniband/hw/hiroce3/roce_xrc.h | 23 + drivers/infiniband/hw/hiroce3/srq/roce_srq.h | 201 + .../infiniband/hw/hiroce3/srq/roce_srq_comm.c | 93 + .../hw/hiroce3/srq/roce_srq_create.c | 635 ++ .../infiniband/hw/hiroce3/srq/roce_srq_ctrl.c | 570 ++ drivers/net/ethernet/huawei/hinic3/Makefile | 22 +- .../ethernet/huawei/hinic3/bond/hinic3_bond.c | 1042 ++++ .../ethernet/huawei/hinic3/bond/hinic3_bond.h | 98 + .../ethernet/huawei/hinic3/comm_msg_intf.h | 565 +- .../ethernet/huawei/hinic3/cqm/cqm_bat_cla.c | 2056 +++++++ .../ethernet/huawei/hinic3/cqm/cqm_bat_cla.h | 214 + .../huawei/hinic3/cqm/cqm_bitmap_table.c | 1454 +++++ .../huawei/hinic3/cqm/cqm_bitmap_table.h | 66 + .../huawei/hinic3/cqm/cqm_bloomfilter.c | 535 ++ .../huawei/hinic3/cqm/cqm_bloomfilter.h | 53 + .../net/ethernet/huawei/hinic3/cqm/cqm_cmd.c | 250 + .../net/ethernet/huawei/hinic3/cqm/cqm_cmd.h | 39 + .../net/ethernet/huawei/hinic3/cqm/cqm_db.c | 506 ++ .../net/ethernet/huawei/hinic3/cqm/cqm_db.h | 36 + .../ethernet/huawei/hinic3/cqm/cqm_define.h | 54 + .../net/ethernet/huawei/hinic3/cqm/cqm_main.c | 1743 ++++++ .../net/ethernet/huawei/hinic3/cqm/cqm_main.h | 380 ++ .../ethernet/huawei/hinic3/cqm/cqm_memsec.c | 665 +++ .../ethernet/huawei/hinic3/cqm/cqm_memsec.h | 23 + .../ethernet/huawei/hinic3/cqm/cqm_object.c | 1664 ++++++ .../ethernet/huawei/hinic3/cqm/cqm_object.h | 714 +++ .../huawei/hinic3/cqm/cqm_object_intern.c | 1467 +++++ .../huawei/hinic3/cqm/cqm_object_intern.h | 93 + .../net/ethernet/huawei/hinic3/cqm/readme.txt | 3 + .../net/ethernet/huawei/hinic3/hinic3_crm.h | 110 +- .../net/ethernet/huawei/hinic3/hinic3_dbg.c | 2 + .../net/ethernet/huawei/hinic3/hinic3_hw.h | 51 +- .../ethernet/huawei/hinic3/hinic3_mag_cfg.c | 4 +- .../huawei/hinic3/hinic3_mgmt_interface.h | 377 +- .../net/ethernet/huawei/hinic3/hinic3_nic.h | 1 - .../ethernet/huawei/hinic3/hinic3_nic_cfg.h | 1 + .../ethernet/huawei/hinic3/hinic3_srv_nic.h | 5 + .../ethernet/huawei/hinic3/hw/hinic3_cmdq.c | 33 +- .../ethernet/huawei/hinic3/hw/hinic3_cmdq.h | 7 +- .../ethernet/huawei/hinic3/hw/hinic3_csr.h | 1 + .../huawei/hinic3/hw/hinic3_devlink.h | 24 + .../ethernet/huawei/hinic3/hw/hinic3_eqs.c | 35 + .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c | 155 +- .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h | 17 +- .../huawei/hinic3/hw/hinic3_hw_comm.c | 148 +- .../huawei/hinic3/hw/hinic3_hw_comm.h | 2 +- .../ethernet/huawei/hinic3/hw/hinic3_hw_mt.c | 39 +- .../ethernet/huawei/hinic3/hw/hinic3_hwdev.c | 212 +- .../ethernet/huawei/hinic3/hw/hinic3_hwdev.h | 33 +- .../ethernet/huawei/hinic3/hw/hinic3_hwif.c | 54 + .../ethernet/huawei/hinic3/hw/hinic3_mbox.c | 113 +- .../ethernet/huawei/hinic3/hw/hinic3_mbox.h | 82 +- .../ethernet/huawei/hinic3/hw/hinic3_mgmt.c | 76 +- .../ethernet/huawei/hinic3/hw/hinic3_mgmt.h | 5 +- .../huawei/hinic3/hw/hinic3_multi_host_mgmt.c | 1231 ++++ .../huawei/hinic3/hw/hinic3_multi_host_mgmt.h | 124 + .../huawei/hinic3/hw/hinic3_nictool.c | 1 + .../huawei/hinic3/hw/hinic3_pci_id_tbl.h | 30 +- .../huawei/hinic3/hw/ossl_knl_linux.c | 20 +- .../hinic3/include/bond/bond_common_defs.h | 69 + .../include/cfg_mgmt/cfg_mgmt_mpu_cmd.h | 12 + .../include/cfg_mgmt/cfg_mgmt_mpu_cmd_defs.h | 212 + .../huawei/hinic3/include/cqm/cqm_npu_cmd.h | 31 + .../hinic3/include/cqm/cqm_npu_cmd_defs.h | 61 + .../huawei/hinic3/include/hinic3_common.h | 181 + .../huawei/hinic3/include/hinic3_cqm.h | 364 ++ .../huawei/hinic3/include/hinic3_cqm_define.h | 52 + .../huawei/hinic3/include/hinic3_lld.h | 223 + .../huawei/hinic3/include/hinic3_profile.h | 148 + .../huawei/hinic3/include/mpu/mag_mpu_cmd.h | 70 + .../hinic3/include/mpu/mpu_board_defs.h | 71 + .../hinic3/include/mpu/mpu_cmd_base_defs.h | 116 + .../hinic3/include/mpu/mpu_inband_cmd.h | 187 + .../hinic3/include/mpu/mpu_inband_cmd_defs.h | 1078 ++++ .../include/mpu/mpu_outband_ncsi_cmd_defs.h | 205 + .../huawei/hinic3/include/mpu/nic_cfg_comm.h | 55 + .../huawei/hinic3/include/ossl_types.h | 144 + .../include/public/npu_cmdq_base_defs.h | 232 + .../ethernet/huawei/hinic3/include/readme.txt | 1 + .../hinic3/include/vmsec/vmsec_mpu_common.h | 107 + .../huawei/hinic3/include/vram_common.h | 65 + drivers/net/ethernet/huawei/hinic3/mag_cmd.h | 272 +- drivers/net/ethernet/huawei/hinic3/ossl_knl.h | 4 + .../ethernet/huawei/hinic3/ossl_knl_linux.h | 70 +- 212 files changed, 62957 insertions(+), 1125 deletions(-) create mode 100644 drivers/infiniband/hw/hiroce3/Kconfig create mode 100644 drivers/infiniband/hw/hiroce3/Makefile create mode 100644 drivers/infiniband/hw/hiroce3/bond/roce_bond.h create mode 100644 drivers/infiniband/hw/hiroce3/bond/roce_bond_common.c create mode 100644 drivers/infiniband/hw/hiroce3/cq/roce_cq.h create mode 100644 drivers/infiniband/hw/hiroce3/cq/roce_cq_common.c create mode 100644 drivers/infiniband/hw/hiroce3/cq/roce_cq_cqe.c create mode 100644 drivers/infiniband/hw/hiroce3/cq/roce_cq_create.c create mode 100644 drivers/infiniband/hw/hiroce3/cq/roce_cq_ctrl.c create mode 100644 drivers/infiniband/hw/hiroce3/cq/roce_cq_destroy.c create mode 100644 drivers/infiniband/hw/hiroce3/dfx/roce_dfx.c create mode 100644 drivers/infiniband/hw/hiroce3/dfx/roce_dfx.h create mode 100644 drivers/infiniband/hw/hiroce3/dfx/roce_dfx_cap.c create mode 100644 drivers/infiniband/hw/hiroce3/dfx/roce_dfx_cap.h create mode 100644 drivers/infiniband/hw/hiroce3/dfx/roce_dfx_query.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_cdev_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_event_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_main_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_mr_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_netdev_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_qp_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_qp_post_send_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/extension/roce_srq_extension.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_buddy.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_buddy.h create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_comp.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_comp.h create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_comp_init.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_comp_mtt.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_comp_mw_mr.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_comp_res.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_em.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_em.h create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_mr.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_mr.h create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_umem.c create mode 100644 drivers/infiniband/hw/hiroce3/host/hmm/hmm_umem.h create mode 100644 drivers/infiniband/hw/hiroce3/include/hinic3_hmm.h create mode 100644 drivers/infiniband/hw/hiroce3/include/hinic3_rdma.h create mode 100644 drivers/infiniband/hw/hiroce3/include/nic/nic_mpu_cmd.h create mode 100644 drivers/infiniband/hw/hiroce3/include/nic/nic_npu_cmd.h create mode 100644 drivers/infiniband/hw/hiroce3/include/nic/nic_npu_cmd_defs.h create mode 100644 drivers/infiniband/hw/hiroce3/include/node_id.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/rdma_context_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/rdma_ext_ctx_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_ccf_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_compile_macro.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_ctx_api.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_dif_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_err_type.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_hmm_context.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_mpu_common.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_pub.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_pub_cmd.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_ulp.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_vbs_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_attr.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_attr_qpc_chip.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cmd.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_cq_attr.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_ext_attr.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_gid_attr.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_mr_attr.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_pub.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_srq_attr.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_verbs_ulp_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_wqe_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/rdma/roce_xqe_format.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_cdev_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_event_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_main_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_mr_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_netdev_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_qp_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_qp_post_send_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/include/roce_srq_extension.h create mode 100644 drivers/infiniband/hw/hiroce3/mr/roce_mr.c create mode 100644 drivers/infiniband/hw/hiroce3/mr/roce_mr.h create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_post.h create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp.h create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp_create.c create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp_destroy.c create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp_exp.h create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp_modify.c create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp_post_recv.c create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp_post_send.c create mode 100644 drivers/infiniband/hw/hiroce3/qp/roce_qp_query.c create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_bitmap.c create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_bitmap.h create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_comp.c create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_comp.h create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_comp_gid.c create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_comp_init.c create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_comp_mw_mr.c create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_comp_pd.c create mode 100644 drivers/infiniband/hw/hiroce3/rdma/rdma_comp_res.c create mode 100644 drivers/infiniband/hw/hiroce3/roce.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_cdev.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_cmd.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_cmd.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_compat.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_cqm_cmd.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_cqm_cmd.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_db.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_db.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_event.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_event.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_k_ioctl.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_main.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_mix.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_mix.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_netdev.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_netdev.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_netlink.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_netlink.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_pd.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_pd.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_sysfs.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_sysfs.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_user.h create mode 100644 drivers/infiniband/hw/hiroce3/roce_xrc.c create mode 100644 drivers/infiniband/hw/hiroce3/roce_xrc.h create mode 100644 drivers/infiniband/hw/hiroce3/srq/roce_srq.h create mode 100644 drivers/infiniband/hw/hiroce3/srq/roce_srq_comm.c create mode 100644 drivers/infiniband/hw/hiroce3/srq/roce_srq_create.c create mode 100644 drivers/infiniband/hw/hiroce3/srq/roce_srq_ctrl.c create mode 100644 drivers/net/ethernet/huawei/hinic3/bond/hinic3_bond.c create mode 100644 drivers/net/ethernet/huawei/hinic3/bond/hinic3_bond.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_bat_cla.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_bat_cla.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_bitmap_table.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_bitmap_table.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_bloomfilter.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_db.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_db.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_main.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_main.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_memsec.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_memsec.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_object.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_object.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.c create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/cqm_object_intern.h create mode 100644 drivers/net/ethernet/huawei/hinic3/cqm/readme.txt create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_multi_host_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/bond/bond_common_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/cfg_mgmt/cfg_mgmt_mpu_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/cfg_mgmt/cfg_mgmt_mpu_cmd_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/cqm/cqm_npu_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/cqm/cqm_npu_cmd_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/hinic3_common.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/hinic3_cqm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/hinic3_cqm_define.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/hinic3_lld.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/hinic3_profile.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/mpu/mag_mpu_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/mpu/mpu_board_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/mpu/mpu_cmd_base_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/mpu/mpu_inband_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/mpu/mpu_inband_cmd_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/mpu/mpu_outband_ncsi_cmd_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/mpu/nic_cfg_comm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/ossl_types.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/public/npu_cmdq_base_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/readme.txt create mode 100644 drivers/net/ethernet/huawei/hinic3/include/vmsec/vmsec_mpu_common.h create mode 100644 drivers/net/ethernet/huawei/hinic3/include/vram_common.h -- 2.33.0

2 3

[PATCH openEuler-1.0-LTS 0/1] fix race between rebuild scheduler domains and hotplug work
by Chen Ridong 26 Apr '24

26 Apr '24

*** BLURB HERE *** Chen Ridong (1): cpuset: fix race between rebuild scheduler domains and hotplug work kernel/cgroup/cpuset.c | 7 +++++++ 1 file changed, 7 insertions(+) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS v3] x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails
by Yu Liao 26 Apr '24

26 Apr '24

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v4.19.218 commit b20ec58f8a6f4fef32cc71480ddf824584e24743 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9FNFO CVE: CVE-2021-47217 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit daf972118c517b91f74ff1731417feb4270625a4 upstream. Check for a valid hv_vp_index array prior to derefencing hv_vp_index when setting Hyper-V's TSC change callback. If Hyper-V setup failed in hyperv_init(), the kernel will still report that it's running under Hyper-V, but will have silently disabled nearly all functionality. BUG: kernel NULL pointer dereference, address: 0000000000000010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP CPU: 4 PID: 1 Comm: swapper/0 Not tainted 5.15.0-rc2+ #75 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:set_hv_tscchange_cb+0x15/0xa0 Code: <8b> 04 82 8b 15 12 17 85 01 48 c1 e0 20 48 0d ee 00 01 00 f6 c6 08 ... Call Trace: kvm_arch_init+0x17c/0x280 kvm_init+0x31/0x330 vmx_init+0xba/0x13a do_one_initcall+0x41/0x1c0 kernel_init_freeable+0x1f2/0x23b kernel_init+0x16/0x120 ret_from_fork+0x22/0x30 Fixes: 93286261de1b ("x86/hyperv: Reenlightenment notifications support") Cc: stable(a)vger.kernel.org Cc: Vitaly Kuznetsov <vkuznets(a)redhat.com> Signed-off-by: Sean Christopherson <seanjc(a)google.com> Reviewed-by: Vitaly Kuznetsov <vkuznets(a)redhat.com> Link: https://lore.kernel.org/r/20211104182239.1302956-2-seanjc@google.com Signed-off-by: Wei Liu <wei.liu(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- arch/x86/hyperv/hv_init.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c index e4ba467a9fc6..fda61a4dc229 100644 --- a/arch/x86/hyperv/hv_init.c +++ b/arch/x86/hyperv/hv_init.c @@ -201,6 +201,9 @@ void set_hv_tscchange_cb(void (*cb)(void)) return; } + if (!hv_vp_index) + return; + hv_reenlightenment_cb = cb; /* Make sure callback is registered before we write to MSRs */ -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-26863
by Liu Jian 26 Apr '24

26 Apr '24

CVE-2024-26863 Murali Karicheri (1): net: hsr: fix placement of logical operator in a multi-line statement Shigeru Yoshida (1): hsr: Fix uninit-value access in hsr_get_node() net/hsr/hsr_forward.c | 8 ++++---- net/hsr/hsr_framereg.c | 8 ++++++-- 2 files changed, 10 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] hsr: Fix uninit-value access in hsr_get_node()
by Liu Jian 26 Apr '24

26 Apr '24

From: Shigeru Yoshida <syoshida(a)redhat.com> stable inclusion from stable-v5.10.214 commit 7fb2d4d6bb1c85f7a23aace0ed6c86a95dea792a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HJXK CVE: CVE-2024-26863 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit ddbec99f58571301679addbc022256970ca3eac6 ] KMSAN reported the following uninit-value access issue [1]: ===================================================== BUG: KMSAN: uninit-value in hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246 hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246 fill_frame_info net/hsr/hsr_forward.c:577 [inline] hsr_forward_skb+0xe12/0x30e0 net/hsr/hsr_forward.c:615 hsr_dev_xmit+0x1a1/0x270 net/hsr/hsr_device.c:223 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x8b1d/0x9f30 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560 __alloc_skb+0x318/0x740 net/core/skbuff.c:651 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2787 packet_alloc_skb net/packet/af_packet.c:2936 [inline] packet_snd net/packet/af_packet.c:3030 [inline] packet_sendmsg+0x70e8/0x9f30 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b CPU: 1 PID: 5033 Comm: syz-executor334 Not tainted 6.7.0-syzkaller-00562-g9f8413c4a66f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 ===================================================== If the packet type ID field in the Ethernet header is either ETH_P_PRP or ETH_P_HSR, but it is not followed by an HSR tag, hsr_get_skb_sequence_nr() reads an invalid value as a sequence number. This causes the above issue. This patch fixes the issue by returning NULL if the Ethernet header is not followed by an HSR tag. Fixes: f266a683a480 ("net/hsr: Better frame dispatch") Reported-and-tested-by: syzbot+2ef3a8ce8e91b5a50098(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2ef3a8ce8e91b5a50098 [1] Signed-off-by: Shigeru Yoshida <syoshida(a)redhat.com> Link: https://lore.kernel.org/r/20240312152719.724530-1-syoshida@redhat.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/hsr/hsr_framereg.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c index afc97d65cf2d..cb7feb9398b0 100644 --- a/net/hsr/hsr_framereg.c +++ b/net/hsr/hsr_framereg.c @@ -237,6 +237,10 @@ struct hsr_node *hsr_get_node(struct hsr_port *port, struct list_head *node_db, */ if (ethhdr->h_proto == htons(ETH_P_PRP) || ethhdr->h_proto == htons(ETH_P_HSR)) { + /* Check if skb contains hsr_ethhdr */ + if (skb->mac_len < sizeof(struct hsr_ethhdr)) + return NULL; + /* Use the existing sequence_nr from the tag as starting point * for filtering duplicate frames. */ -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] update oedefconfig for the minimum set
by Peng Zhang 26 Apr '24

26 Apr '24

From: ZhangPeng <zhangpeng362(a)huawei.com> Update oedefconfig for the minimum set. Changes as follows: For arm64: CONFIG_PVPANIC from not set to y CONFIG_NET_SCH_FQ_CODEL from m to y CONFIG_VIRTIO_MEM from y to m CONFIG_ARM_SPE_PMU from y to m CONFIG_ARM_SMMU_V3_PMU from y to m CONFIG_DRM from y to m CONFIG_RTC_SYSTOHC from not set to y CONFIG_NTB from not set to m For x86: CONFIG_VIRTIO_MMIO from not set to m CONFIG_PCIE_EDR from not set to y CONFIG_IO_STRICT_DEVMEM from not set to y The previous commit updated config without make update_oedefconfig, so now make update_oedefconfig will move some lines. ZhangPeng (2): arm64: openeuler_defconfig: update oedefconfig for the minimum set x86: openeuler_defconfig: update oedefconfig for the minimum set arch/arm64/configs/openeuler_defconfig | 114 ++++++++++++++----------- arch/x86/configs/openeuler_defconfig | 107 ++++++++++++----------- 2 files changed, 122 insertions(+), 99 deletions(-) -- 2.25.1

2 3

[openeuler:OLK-6.6] BUILD REGRESSION a5346226043730d40dbab0429ee159b8165d29f7
by kernel test robot 26 Apr '24

26 Apr '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: a5346226043730d40dbab0429ee159b8165d29f7 !6585 ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allnoconfig | `-- arch-arm64-kernel-cpufeature.c:error:enable_pseudo_nmi-undeclared-(first-use-in-this-function) |-- arm64-randconfig-002-20240426 | `-- include-linux-fortify-string.h:warning:__builtin_memcpy-reading-between-and-bytes-from-a-region-of-size |-- loongarch-allmodconfig | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:fatal-error:ne6x_trace.h:No-such-file-or-directory | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x.h:fatal-error:reg.h:No-such-file-or-directory | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf.h:fatal-error:reg.h:No-such-file-or-directory | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-netdev-not-described-in-rnp_netpoll | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-Polling-interrupt-().-Prototype-was-for-rnp_netpoll()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | `-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_alloc_rx_buffers `-- x86_64-randconfig-002-20240426 |-- drivers-net-ethernet-huawei-hinic-hinic_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_register_sw_cb().-Prototype-was-for-hinic_aeq_register_swe_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_unregister_sw_cb().-Prototype-was-for-hinic_aeq_unregister_swe_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_ceq_register_sw_cb().-Prototype-was-for-hinic_ceq_register_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_hwif.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_pf_mbox_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_ppf_to_pf_mbox_cb()-instead `-- drivers-net-ethernet-huawei-hinic-hinic_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst clang_recent_errors |-- arm64-allmodconfig | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_deinit_hwdev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_detach | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_shutdown | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_stop | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_init_hwdev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:variable-fault_level-set-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:variable-pcie_src-set-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_io_flush.c:warning:no-previous-prototype-for-function-sss_hwdev_flush_io | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_mgmt_info.c:warning:no-previous-prototype-for-function-sss_deinit_mgmt_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_mgmt_info.c:warning:no-previous-prototype-for-function-sss_init_mgmt_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read_ack | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write_nack | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_sync_send_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_complete_adm_event | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_destroy_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_hwif_deinit_adm | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_hwif_init_adm | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ceq.c:warning:no-previous-prototype-for-function-sss_ceq_intr_handle | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ceq.c:warning:no-previous-prototype-for-function-sss_init_ceqe_desc | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_ctrlq_flush_sync_cmd | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_deinit_ctrlq | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_deinit_ctrlq_channel | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_init_ctrlq_channel | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_reinit_ctrlq_ctx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_wait_ctrlq_stop | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_alloc_db_addr | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_chip_set_msix_auto_mask | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_chip_set_msix_state | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_free_db_addr | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_glb_pf_vf_offset | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_global_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_pcie_itf_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_pf_id_of_vf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_ppf_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_irq.c:warning:no-previous-prototype-for-function-sss_deinit_irq_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_irq.c:warning:no-previous-prototype-for-function-sss_init_irq_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_hwif_deinit_mbx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_hwif_init_mbx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_init_func_mbx_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_recv_mbx_aeq_handler | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_flush_mgmt_workq | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_force_complete_all | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_mgmt_msg_aeqe_handler | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_error.c:warning:no-previous-prototype-for-function-sss_detect_pci_error | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_attach_is_enable | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_get_uld_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_get_uld_names | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_init_uld_lock | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_lock_uld | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_unlock_uld | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_probe.c:warning:no-previous-prototype-for-function-sss_attach_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_probe.c:warning:no-previous-prototype-for-function-sss_pci_probe | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_adapter | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_function | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_pci_dev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_detach_all_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_detach_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_dettach_uld_dev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_pci_remove | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_unmap_pci_bar | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_shutdown.c:warning:no-previous-prototype-for-function-sss_pci_shutdown | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_rd32 | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_wr32 | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_send_clp_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_in_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_out_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_copy_to_user | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_in_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_out_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_hw_driver_stats | |-- drivers-net-ethernet-huawei-hinic-hinic_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_cfg.c:warning:arithmetic-between-different-enumeration-types-(-enum-hinic_node_id-and-enum-hinic_fault_err_level-) | |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_register_sw_cb().-Prototype-was-for-hinic_aeq_register_swe_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_unregister_sw_cb().-Prototype-was-for-hinic_aeq_unregister_swe_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_ceq_register_sw_cb().-Prototype-was-for-hinic_ceq_register_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_hwdev.c:warning:arithmetic-between-different-enumeration-types-(-enum-hinic_node_id-and-enum-hinic_fault_err_level-) | |-- drivers-net-ethernet-huawei-hinic-hinic_hwif.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_pf_mbox_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_ppf_to_pf_mbox_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic-hinic_nic_dbg.c:warning:arithmetic-between-different-enumeration-types-(-enum-hinic_node_id-and-enum-hinic_fault_err_level-) | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_api_cmd.c:warning:expecting-prototype-for-alloc_cmd_buf().-Prototype-was-for-alloc_resp_buf()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_devlink.c:warning:variable-pdev-set-but-not-used | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mbox.c:warning:expecting-prototype-for-hinic3_unregister_ppf_mbox_cb().-Prototype-was-for-hinic3_unregister_pf_mbox_cb()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mbox.c:warning:expecting-prototype-for-hinic3_unregister_ppf_mbox_cb().-Prototype-was-for-hinic3_unregister_ppf_to_pf_mbox_cb()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:expecting-prototype-for-hinic_pf_to_mgmt_free().-Prototype-was-for-hinic3_pf_to_mgmt_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:expecting-prototype-for-hinic_pf_to_mgmt_init().-Prototype-was-for-hinic3_pf_to_mgmt_init()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-netdev-not-described-in-rnp_netpoll | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-Polling-interrupt-().-Prototype-was-for-rnp_netpoll()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-scsi-hisi_raid-hiraid_main.c:warning:expecting-prototype-for-hiraid_create_cq().-Prototype-was-for-hiraid_create_complete_queue()-instead | `-- drivers-scsi-hisi_raid-hiraid_main.c:warning:expecting-prototype-for-hiraid_create_sq().-Prototype-was-for-hiraid_create_send_queue()-instead `-- arm64-randconfig-003-20240426 `-- ld.lld:error:undefined-symbol:__memcpy_mc elapsed time: 775m configs tested: 33 configs skipped: 141 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240426 gcc arm64 randconfig-002-20240426 gcc arm64 randconfig-003-20240426 clang arm64 randconfig-004-20240426 gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240426 gcc loongarch randconfig-002-20240426 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240426 clang x86_64 buildonly-randconfig-002-20240426 gcc x86_64 buildonly-randconfig-003-20240426 clang x86_64 buildonly-randconfig-004-20240426 clang x86_64 buildonly-randconfig-005-20240426 gcc x86_64 buildonly-randconfig-006-20240426 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240426 gcc x86_64 randconfig-002-20240426 gcc x86_64 randconfig-003-20240426 gcc x86_64 randconfig-004-20240426 clang x86_64 randconfig-005-20240426 clang x86_64 randconfig-006-20240426 clang x86_64 randconfig-011-20240426 clang x86_64 randconfig-012-20240426 gcc x86_64 randconfig-013-20240426 gcc x86_64 randconfig-014-20240426 gcc x86_64 randconfig-015-20240426 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS WITH WARNING 28b2caccd679faae83cc61e008d7cc8009933988
by kernel test robot 26 Apr '24

26 Apr '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 28b2caccd679faae83cc61e008d7cc8009933988 !6616 drm/amdgpu: Reset IH OVERFLOW_CLEAR bit Warning reports: https://lore.kernel.org/oe-kbuild-all/202404260704.Qvd9eJqD-lkp@intel.com Warning: (recently discovered and may have been fixed) drivers/perf/arm_smmuv3_pmu.c:459:9: warning: no previous prototype for 'smmu_pmu_event_show' [-Wmissing-prototypes] Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-randconfig-002-20240426 | `-- drivers-perf-arm_smmuv3_pmu.c:warning:no-previous-prototype-for-smmu_pmu_event_show |-- x86_64-buildonly-randconfig-006-20240426 | |-- fs-proc-array.c:warning:gtime-may-be-used-uninitialized-in-this-function | |-- fs-proc-array.c:warning:maj_flt-may-be-used-uninitialized-in-this-function | `-- fs-proc-array.c:warning:min_flt-may-be-used-uninitialized-in-this-function |-- x86_64-defconfig | |-- include-linux-list.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | |-- include-linux-plist.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | `-- mm-swapfile.c:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node |-- x86_64-randconfig-014-20240426 | |-- include-linux-compiler.h:warning:array-subscript-index-is-outside-array-bounds-of-u32-aka-unsigned-int | `-- include-linux-compiler.h:warning:array-subscript-unknown-is-outside-array-bounds-of-const-u32-aka-const-unsigned-int |-- x86_64-randconfig-015-20240426 | |-- include-linux-compiler.h:warning:array-subscript-index-is-outside-array-bounds-of-u32-aka-unsigned-int | |-- include-linux-compiler.h:warning:array-subscript-unknown-is-outside-array-bounds-of-const-u32-aka-const-unsigned-int | |-- include-linux-list.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | |-- include-linux-plist.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | `-- mm-swapfile.c:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node |-- x86_64-randconfig-075-20240426 | |-- include-linux-compiler.h:warning:array-subscript-index-is-outside-array-bounds-of-u32-aka-unsigned-int | |-- include-linux-compiler.h:warning:array-subscript-unknown-is-outside-array-bounds-of-const-u32-aka-const-unsigned-int | |-- include-linux-list.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | |-- include-linux-plist.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | `-- mm-swapfile.c:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node |-- x86_64-randconfig-076-20240426 | |-- include-linux-compiler.h:warning:array-subscript-index-is-outside-array-bounds-of-u32-aka-unsigned-int | `-- include-linux-compiler.h:warning:array-subscript-unknown-is-outside-array-bounds-of-const-u32-aka-const-unsigned-int `-- x86_64-randconfig-122-20240426 |-- drivers-pci-controller-hisi-pcie-customer-hisi_pcie_cae.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-to-got-void |-- drivers-pci-rom.c:sparse:sparse:incorrect-type-in-return-expression-(different-address-spaces)-expected-void-noderef-asn-got-void |-- kernel-cgroup-cgroup.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-cgroup_subsys_state-css-got-struct-cgroup_subsys_state-noderef-asn |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-got-int-noderef-pmu_disable_count |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-got-struct-perf_cpu_context-noderef-pmu_cpu_context |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-asn-got-int |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-asn-got-struct-perf_cpu_context `-- net-ipv4-arp.c:sparse:sparse:incompatible-types-in-comparison-expression-(different-type-sizes): clang_recent_errors |-- x86_64-allyesconfig | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-buildonly-randconfig-003-20240426 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-buildonly-randconfig-004-20240426 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-004-20240426 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-005-20240426 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-006-20240426 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-011-20240426 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-016-20240426 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-071-20240426 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-072-20240426 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-073-20240426 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-121-20240426 | |-- drivers-pci-controller-hisi-pcie-customer-hisi_pcie_cae.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-to-got-void | |-- drivers-pci-rom.c:sparse:sparse:incorrect-type-in-return-expression-(different-address-spaces)-expected-void-noderef-asn-got-void | |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-long-long-noderef-usertype-asn-off_in-got-long-long-usertype-assigned-poff_in | |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-long-long-noderef-usertype-asn-off_out-got-long-long-usertype-assigned-poff_out | |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-file-assigned-file-got-struct-file-noderef-asn | |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-return-expression-(different-address-spaces)-expected-void-noderef-asn-got-struct-io_buffer-assigned-kbuf | |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-got-int-noderef-pmu_disable_count | |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-got-struct-perf_cpu_context-noderef-pmu_cpu_context | |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-asn-got-int | |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-asn-got-struct-perf_cpu_context | |-- net-ipv4-arp.c:sparse:sparse:incompatible-types-in-comparison-expression-(different-type-sizes): | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-123-20240426 | |-- arch-x86-kernel-cpu-mce-therm_throt.c:sparse:sparse:cast-removes-address-space-asn-of-expression | |-- drivers-pci-controller-hisi-pcie-customer-hisi_pcie_cae.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-to-got-void | |-- drivers-pci-rom.c:sparse:sparse:incorrect-type-in-return-expression-(different-address-spaces)-expected-void-noderef-asn-got-void | |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-long-long-noderef-usertype-asn-off_in-got-long-long-usertype-assigned-poff_in | |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-long-long-noderef-usertype-asn-off_out-got-long-long-usertype-assigned-poff_out | |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-file-assigned-file-got-struct-file-noderef-asn | |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-return-expression-(different-address-spaces)-expected-void-noderef-asn-got-struct-io_buffer-assigned-kbuf | |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-got-int-noderef-pmu_disable_count | |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-got-struct-perf_cpu_context-noderef-pmu_cpu_context | |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-asn-got-int | |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-asn-got-struct-perf_cpu_context | |-- net-ipv4-arp.c:sparse:sparse:incompatible-types-in-comparison-expression-(different-type-sizes): | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-r133-20240426 | |-- drivers-gpu-drm-nouveau-nouveau_fence.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-nouveau_channel-chan-got-struct-nouveau_channel-noderef-asn-channel | |-- drivers-gpu-drm-radeon-radeon_bios.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-src-got-unsigned-char-noderef-usertype-asn-assigned-bios | |-- drivers-md-bcache-request.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-asn-from-got-struct-set_bcache_status | |-- drivers-md-bcache-request.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-to-got-struct-get_bcache_status | |-- drivers-pci-controller-hisi-pcie-customer-hisi_pcie_cae.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-to-got-void | |-- drivers-pci-rom.c:sparse:sparse:incorrect-type-in-return-expression-(different-address-spaces)-expected-void-noderef-asn-got-void | |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-long-long-noderef-usertype-asn-off_in-got-long-long-usertype-assigned-poff_in | |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-long-long-noderef-usertype-asn-off_out-got-long-long-usertype-assigned-poff_out | |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-file-assigned-file-got-struct-file-noderef-asn | |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-return-expression-(different-address-spaces)-expected-void-noderef-asn-got-struct-io_buffer-assigned-kbuf | |-- kernel-cgroup-cgroup.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-cgroup_subsys_state-css-got-struct-cgroup_subsys_state-noderef-asn | |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-got-int-noderef-pmu_disable_count | |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-got-struct-perf_cpu_context-noderef-pmu_cpu_context | |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-asn-got-int | |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-asn-got-struct-perf_cpu_context | |-- net-ipv4-arp.c:sparse:sparse:incompatible-types-in-comparison-expression-(different-type-sizes): | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) `-- x86_64-rhel-8.3-rust `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) elapsed time: 800m configs tested: 35 configs skipped: 146 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240426 gcc arm64 randconfig-002-20240426 gcc arm64 randconfig-003-20240426 gcc arm64 randconfig-004-20240426 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240426 clang x86_64 buildonly-randconfig-002-20240426 gcc x86_64 buildonly-randconfig-003-20240426 clang x86_64 buildonly-randconfig-004-20240426 clang x86_64 buildonly-randconfig-005-20240426 gcc x86_64 buildonly-randconfig-006-20240426 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240426 gcc x86_64 randconfig-002-20240426 gcc x86_64 randconfig-003-20240426 gcc x86_64 randconfig-004-20240426 clang x86_64 randconfig-005-20240426 clang x86_64 randconfig-006-20240426 clang x86_64 randconfig-011-20240426 clang x86_64 randconfig-012-20240426 gcc x86_64 randconfig-013-20240426 gcc x86_64 randconfig-014-20240426 gcc x86_64 randconfig-015-20240426 gcc x86_64 randconfig-016-20240426 clang x86_64 randconfig-071-20240426 clang x86_64 randconfig-072-20240426 clang x86_64 randconfig-073-20240426 clang x86_64 randconfig-074-20240426 gcc x86_64 randconfig-075-20240426 gcc x86_64 randconfig-076-20240426 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS v2] x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails
by Yu Liao 26 Apr '24

26 Apr '24

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v4.19.218 commit b20ec58f8a6f4fef32cc71480ddf824584e24743 bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9FNFO Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit daf972118c517b91f74ff1731417feb4270625a4 upstream. Check for a valid hv_vp_index array prior to derefencing hv_vp_index when setting Hyper-V's TSC change callback. If Hyper-V setup failed in hyperv_init(), the kernel will still report that it's running under Hyper-V, but will have silently disabled nearly all functionality. BUG: kernel NULL pointer dereference, address: 0000000000000010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP CPU: 4 PID: 1 Comm: swapper/0 Not tainted 5.15.0-rc2+ #75 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:set_hv_tscchange_cb+0x15/0xa0 Code: <8b> 04 82 8b 15 12 17 85 01 48 c1 e0 20 48 0d ee 00 01 00 f6 c6 08 ... Call Trace: kvm_arch_init+0x17c/0x280 kvm_init+0x31/0x330 vmx_init+0xba/0x13a do_one_initcall+0x41/0x1c0 kernel_init_freeable+0x1f2/0x23b kernel_init+0x16/0x120 ret_from_fork+0x22/0x30 Fixes: 93286261de1b ("x86/hyperv: Reenlightenment notifications support") Cc: stable(a)vger.kernel.org Cc: Vitaly Kuznetsov <vkuznets(a)redhat.com> Signed-off-by: Sean Christopherson <seanjc(a)google.com> Reviewed-by: Vitaly Kuznetsov <vkuznets(a)redhat.com> Link: https://lore.kernel.org/r/20211104182239.1302956-2-seanjc@google.com Signed-off-by: Wei Liu <wei.liu(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- arch/x86/hyperv/hv_init.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c index e4ba467a9fc6..fda61a4dc229 100644 --- a/arch/x86/hyperv/hv_init.c +++ b/arch/x86/hyperv/hv_init.c @@ -201,6 +201,9 @@ void set_hv_tscchange_cb(void (*cb)(void)) return; } + if (!hv_vp_index) + return; + hv_reenlightenment_cb = cb; /* Make sure callback is registered before we write to MSRs */ -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails
by Yu Liao 26 Apr '24

26 Apr '24

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v4.19.218 commit b20ec58f8a6f4fef32cc71480ddf824584e24743 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9FNFO CVE: CVE-2021-47217 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit daf972118c517b91f74ff1731417feb4270625a4 upstream. Check for a valid hv_vp_index array prior to derefencing hv_vp_index when setting Hyper-V's TSC change callback. If Hyper-V setup failed in hyperv_init(), the kernel will still report that it's running under Hyper-V, but will have silently disabled nearly all functionality. BUG: kernel NULL pointer dereference, address: 0000000000000010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP CPU: 4 PID: 1 Comm: swapper/0 Not tainted 5.15.0-rc2+ #75 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:set_hv_tscchange_cb+0x15/0xa0 Code: <8b> 04 82 8b 15 12 17 85 01 48 c1 e0 20 48 0d ee 00 01 00 f6 c6 08 ... Call Trace: kvm_arch_init+0x17c/0x280 kvm_init+0x31/0x330 vmx_init+0xba/0x13a do_one_initcall+0x41/0x1c0 kernel_init_freeable+0x1f2/0x23b kernel_init+0x16/0x120 ret_from_fork+0x22/0x30 Fixes: 93286261de1b ("x86/hyperv: Reenlightenment notifications support") Cc: stable(a)vger.kernel.org Cc: Vitaly Kuznetsov <vkuznets(a)redhat.com> Signed-off-by: Sean Christopherson <seanjc(a)google.com> Reviewed-by: Vitaly Kuznetsov <vkuznets(a)redhat.com> Link: https://lore.kernel.org/r/20211104182239.1302956-2-seanjc@google.com Signed-off-by: Wei Liu <wei.liu(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- arch/x86/hyperv/hv_init.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c index e4ba467a9fc6..fda61a4dc229 100644 --- a/arch/x86/hyperv/hv_init.c +++ b/arch/x86/hyperv/hv_init.c @@ -201,6 +201,9 @@ void set_hv_tscchange_cb(void (*cb)(void)) return; } + if (!hv_vp_index) + return; + hv_reenlightenment_cb = cb; /* Make sure callback is registered before we write to MSRs */ -- 2.25.1

2 1

[PATCH OLK-6.6 00/54] ext4: use iomap for regular file's buffered IO path and enable large foilo
by Zhang Yi 26 Apr '24

26 Apr '24

From: Zhang Yi <yi.zhang(a)huaweicloud.com> This series convert ext4 buffered IO path from buffered_head to iomap, and enable large folio by default. 01-14: ioamp map multiple blocks pre ->map_blocks by Christoph, backport from [1]. 15: A small debug improvement for the previous series in iomap map_blocks [2]. 16-24: fix a stale zero data issue in xfs and make iomap_zero_ranege don't increase i_size [3]. 25-29: the first part of prepartory changes have been merged to upstream [4]. 30-38: the second part of prepartory changes, fix an issue and support adding multi-delalloc blocks [5]. 39-54: comvert buffered_head to iomap, these are picked up from the my v3 series [6]. [1] https://lore.kernel.org/linux-fsdevel/20231207072710.176093-1-hch@lst.de/ [2] https://lore.kernel.org/linux-fsdevel/20240220115759.3445025-1-yi.zhang@hua… [3] https://lore.kernel.org/linux-xfs/20240320110548.2200662-1-yi.zhang@huaweic… [4] https://lore.kernel.org/linux-ext4/20240105033018.1665752-1-yi.zhang@huawei… [5] https://lore.kernel.org/linux-ext4/20240410034203.2188357-1-yi.zhang@huawei… [6] https://lore.kernel.org/linux-ext4/20240127015825.1608160-1-yi.zhang@huawei… Thanks, Yi. Christoph Hellwig (14): iomap: clear the per-folio dirty bits on all writeback failures iomap: treat inline data in iomap_writepage_map as an I/O error iomap: move the io_folios field out of struct iomap_ioend iomap: move the PF_MEMALLOC check to iomap_writepages iomap: factor out a iomap_writepage_handle_eof helper iomap: move all remaining per-folio logic into iomap_writepage_map iomap: clean up the iomap_alloc_ioend calling convention iomap: move the iomap_sector sector calculation out of iomap_add_to_ioend iomap: don't chain bios iomap: only call mapping_set_error once for each failed bio iomap: factor out a iomap_writepage_map_block helper iomap: submit ioends immediately iomap: map multiple blocks at a time iomap: pass the length of the dirty region to ->map_blocks Zhang Yi (40): iomap: add pos and dirty_len into trace_iomap_writepage_map xfs: match lock mode in xfs_buffered_write_iomap_begin() xfs: make the seq argument to xfs_bmapi_convert_delalloc() optional xfs: make xfs_bmapi_convert_delalloc() to allocate the target offset xfs: convert delayed extents to unwritten when zeroing post eof blocks iomap: drop the write failure handles when unsharing and zeroing iomap: don't increase i_size if it's not a write operation iomap: use a new variable to handle the written bytes in iomap_write_iter() iomap: make iomap_write_end() return a boolean iomap: do some small logical cleanup in buffered write ext4: refactor ext4_da_map_blocks() ext4: convert to exclusive lock while inserting delalloc extents ext4: add a hole extent entry in cache after punch ext4: make ext4_map_blocks() distinguish delalloc only extent ext4: make ext4_set_iomap() recognize IOMAP_DELALLOC map type ext4: factor out a common helper to query extent map ext4: check the extent status again before inserting delalloc block ext4: trim delalloc extent ext4: drop iblock parameter ext4: make ext4_es_insert_delayed_block() insert multi-blocks ext4: make ext4_da_reserve_space() reserve multi-clusters ext4: factor out check for whether a cluster is allocated ext4: make ext4_insert_delayed_block() insert multi-blocks ext4: make ext4_da_map_blocks() buffer_head unaware ext4: use reserved metadata blocks when splitting extent on endio ext4: factor out ext4_map_create_blocks() to allocate new blocks ext4: introduce seq counter for the extent status entry ext4: add a new iomap aops for regular file's buffered IO path ext4: implement buffered read iomap path ext4: implement buffered write iomap path ext4: implement writeback iomap path ext4: implement mmap iomap path ext4: implement zero_range iomap path ext4: writeback partial blocks before zeroing out range ext4: fall back to buffer_head path for defrag ext4: partial enable iomap for regular file's buffered IO path filemap: support disable large folios on active inode ext4: enable large folio for regular file with iomap buffered IO path ext4: don't mark IOMAP_F_DIRTY for buffer write ext4: add mount option for buffered IO iomap path block/fops.c | 2 +- fs/ext4/ext4.h | 15 +- fs/ext4/ext4_jbd2.c | 6 + fs/ext4/extents.c | 42 +- fs/ext4/extents_status.c | 76 ++- fs/ext4/extents_status.h | 5 +- fs/ext4/file.c | 19 +- fs/ext4/ialloc.c | 5 + fs/ext4/inode.c | 934 ++++++++++++++++++++++++++++-------- fs/ext4/move_extent.c | 35 ++ fs/ext4/page-io.c | 107 +++++ fs/ext4/super.c | 19 +- fs/gfs2/bmap.c | 2 +- fs/iomap/buffered-io.c | 683 +++++++++++++------------- fs/iomap/trace.h | 43 +- fs/xfs/libxfs/xfs_bmap.c | 40 +- fs/xfs/xfs_aops.c | 63 +-- fs/xfs/xfs_iomap.c | 39 +- fs/zonefs/file.c | 3 +- include/linux/iomap.h | 19 +- include/linux/pagemap.h | 14 + include/trace/events/ext4.h | 42 +- mm/readahead.c | 6 + 23 files changed, 1559 insertions(+), 660 deletions(-) -- 2.39.2

2 55

[PATCH OLK-5.10 v1 0/2] Backport x86 and spinlock patches from mainline
by Wei Li 26 Apr '24

26 Apr '24

Patch 1: Due to the asm code no longer disabling interrupts upon returning, the c function needs to call cond_local_irq_disable() for processing. Patch 2: Fix compilation warnings without any actual functional impact. Arnd Bergmann (1): qspinlock: use signed temporaries for cmpxchg Thomas Tai (1): x86/traps: Correct exc_general_protection() and math_error() return paths arch/x86/kernel/traps.c | 4 ++-- include/asm-generic/qrwlock.h | 8 ++++---- include/asm-generic/qspinlock.h | 4 ++-- 3 files changed, 8 insertions(+), 8 deletions(-) -- 2.25.1

2 3

[openeuler:openEuler-1.0-LTS 3158/22214] drivers/perf/arm_smmuv3_pmu.c:459:9: warning: no previous prototype for 'smmu_pmu_event_show'
by kernel test robot 26 Apr '24

26 Apr '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 28b2caccd679faae83cc61e008d7cc8009933988 commit: d80280f7df4f4be25d67a6460b63b3d2e0b5170d [3158/22214] perf: add arm64 smmuv3 pmu driver config: arm64-randconfig-002-20240426 (https://download.01.org/0day-ci/archive/20240426/202404260704.Qvd9eJqD-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240426/202404260704.Qvd9eJqD-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404260704.Qvd9eJqD-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/perf/arm_smmuv3_pmu.c:459:9: warning: no previous prototype for 'smmu_pmu_event_show' [-Wmissing-prototypes] 459 | ssize_t smmu_pmu_event_show(struct device *dev, | ^~~~~~~~~~~~~~~~~~~ vim +/smmu_pmu_event_show +459 drivers/perf/arm_smmuv3_pmu.c 458 > 459 ssize_t smmu_pmu_event_show(struct device *dev, 460 struct device_attribute *attr, char *page) 461 { 462 struct perf_pmu_events_attr *pmu_attr; 463 464 pmu_attr = container_of(attr, struct perf_pmu_events_attr, attr); 465 466 return sprintf(page, "event=0x%02llx\n", pmu_attr->id); 467 } 468 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/7] Backport page fault and fork optimization
by Peng Zhang 25 Apr '24

25 Apr '24

From: ZhangPeng <zhangpeng362(a)huawei.com> Backport page fault and fork optimization, including optimization for folio add and split, remove uffd_wp and anon/cow/shared fault optimization. We can get a 3% performance improvment for lmbench fork_proc and 1.5% for lmbench page_fault. Kairui Song (5): mm/filemap: return early if failed to allocate memory for split mm/filemap: clean up hugetlb exclusion code lib/xarray: introduce a new helper xas_get_order lib/xarray: introduce a new helper xas_get_order mm/filemap: optimize filemap folio adding Kefeng Wang (2): mm: memory: check userfaultfd_wp() in vmf_orig_pte_uffd_wp() mm: swapfile: check usable swap device in __folio_throttle_swaprate() include/linux/xarray.h | 6 +++ lib/test_xarray.c | 93 ++++++++++++++++++++++++++++++++++++++++++ lib/xarray.c | 49 ++++++++++++++-------- mm/filemap.c | 74 +++++++++++++++++++++------------ mm/memory.c | 10 ++--- mm/swapfile.c | 13 ++++-- 6 files changed, 194 insertions(+), 51 deletions(-) -- 2.25.1

2 8