- Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10 2668/2668] fs/cachefiles/rdwr.c:860:6: sparse: sparse: symbol 'cachefiles_readpages_work_func' was not declared. Should it be static?
by kernel test robot 10 Jan '25

10 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 1c1825ed0360fc09f928a4b2e1300f7b718df8dc commit: 33ba25cc4869bab81ad31784e7bbb25e5da2a2ad [2668/2668] anolis: fscache,cachefiles: add fscache_prepare_read() helper config: x86_64-randconfig-121-20250108 (https://download.01.org/0day-ci/archive/20250110/202501100858.H4pnEZpa-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250110/202501100858.H4pnEZpa-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501100858.H4pnEZpa-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> fs/cachefiles/rdwr.c:860:6: sparse: sparse: symbol 'cachefiles_readpages_work_func' was not declared. Should it be static? fs/cachefiles/rdwr.c:1106:25: sparse: sparse: self-comparison always evaluates to true vim +/cachefiles_readpages_work_func +860 fs/cachefiles/rdwr.c 859 > 860 void cachefiles_readpages_work_func(struct work_struct *work) 861 { 862 struct cachefiles_kiocb *ki = container_of(work, struct cachefiles_kiocb, work); 863 int ret; 864 865 ret = vfs_iocb_iter_read(ki->iocb.ki_filp, &ki->iocb, &ki->iter); 866 /* complete the request if there's any progress or error occurred */ 867 if (ret != -EIOCBQUEUED) { 868 struct fscache_retrieval *op = ki->op; 869 unsigned int nr_pages = atomic_read(&op->n_pages); 870 unsigned int done_pages = 0; 871 int i, error; 872 873 if (ret > 0) 874 done_pages = ret / PAGE_SIZE; 875 876 for (i = 0; i < nr_pages; i++) { 877 error = i < done_pages ? 0 : -EIO; 878 fscache_end_io(op, ki->bvs[i].bv_page, error); 879 } 880 881 fscache_retrieval_complete(op, nr_pages); 882 fscache_put_retrieval(op); 883 kfree(ki); 884 } 885 } 886 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 1c1825ed0360fc09f928a4b2e1300f7b718df8dc
by kernel test robot 10 Jan '25

10 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 1c1825ed0360fc09f928a4b2e1300f7b718df8dc !14801 CVE-2024-53237 Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202501092234.VRg7E3V6-lkp@intel.com block/bio-integrity.o: warning: objtool: bio_integrity_alloc()+0x109: unreachable instruction block/genhd.c:81:50: warning: '%d' directive output may be truncated writing between 1 and 11 bytes into a region of size between 0 and 31 [-Wformat-truncation=] block/genhd.c:83:51: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=] block/keyslot-manager.o: warning: objtool: blk_ksm_evict_key()+0xb5: unreachable instruction crypto/af_alg.c:742: warning: Function parameter or member 'min' not described in 'af_alg_wait_for_data' Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-001-20250109 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | |-- fs-fscache-main.c:warning:fscache_min_object_max_active-defined-but-not-used | `-- fs-fscache-main.c:warning:fscache_min_op_max_active-defined-but-not-used |-- arm64-randconfig-003-20250109 | |-- fs-fscache-main.c:warning:fscache_min_object_max_active-defined-but-not-used | `-- fs-fscache-main.c:warning:fscache_min_op_max_active-defined-but-not-used |-- arm64-randconfig-004-20250109 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- fs-fscache-main.c:warning:fscache_min_object_max_active-defined-but-not-used | `-- fs-fscache-main.c:warning:fscache_min_op_max_active-defined-but-not-used |-- x86_64-allnoconfig | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- samples-bpf-hbm.c:bpf-bpf.h-is-included-more-than-once. |-- x86_64-allyesconfig | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- drivers-gpu-drm-vmwgfx-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_rd32 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_wr32 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_send_clp_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_in_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_out_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_copy_to_user | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_in_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_out_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_hw_driver_stats | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read_ack | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write_nack | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_destroy_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_id | |-- drivers-net-ethernet-hisilicon-hns3-hns3_unic.c:warning:Function-parameter-or-member-skb-not-described-in-hns3_unic_set_l3_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3_unic.c:warning:Function-parameter-or-member-type_cs_vlan_tso-not-described-in-hns3_unic_set_l3_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_unic_guid.c:warning:no-previous-prototype-for-function-hclge_unic_del_mc_guid_common | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-has_mac-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-has_trans-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-headroom-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-tailroom-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_debugfs.c:warning:Excess-function-parameter-pf-description-in-rnp_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnp-rnp_debugfs.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-cmd-description-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-cmd-description-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-ec-description-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_module_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_ts_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_set_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_set_rxnfc | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-coal-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-data-not-described-in-rnp_reg_test | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_module_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_ts_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_set_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_set_rxnfc | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_get_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_set_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-ker-not-described-in-rnp_get_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-ker-not-described-in-rnp_set_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-inner_vlan_tag-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-l4_hdr_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-mss_seg_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-rxr_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-rxr_idx-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-tunnel_hdr_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-txr_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-txr_idx-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-type_tucmd-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-v_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-crc_pad-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-eth_queue_idx-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-ignore_vlan-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-inner_vlan_tunnel_len-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-mss_len_vf_num-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-r_count-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-r_idx-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-step-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:no-previous-prototype-for-function-rnp_acquire_msix_vectors | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:no-previous-prototype-for-function-rnp_print_ring_info | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-data-description-in-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-ent-description-in-rnp_probe | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-hw-description-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-link_speed-description-in-rnp_watchdog_update_link | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-maxrate-description-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-netdev-description-in-rnp_setup_tc | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-netdev-description-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-queue-description-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-skb-description-in-rnp_is_non_eop | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-subdev_id-description-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_setup_rx_resources | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_setup_tx_resources | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_setup_tc | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-id-not-described-in-rnp_probe | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-napi_budget-not-described-in-rnp_clean_tx_irq | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-rnp_msix_vector-not-described-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-rnp_queue-not-described-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-subdevice_id-not-described-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-t-not-described-in-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-txqueue-not-described-in-rnp_tx_timeout | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_assign_netdev_ops | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_can_rpu_start | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_clear_udp_tunnel_port | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_config_knode | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_delete_knode | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_do_reset | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_service_task | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_setup_tc_cls_u32 | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_unmap_and_free_tx_resource | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_vlan_stags_flag | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_write_eitr_rx | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_xmit_nop_frame_ring | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:variable-rxctrl-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:variable-xdp_xmit-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Excess-function-parameter-rnp_info-description-in-rnp_mbx_get_capability | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-adv-not-described-in-rnp_mbx_phy_link_set | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-info-not-described-in-rnp_mbx_get_capability | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-pfvfnum-not-described-in-rnp_fw_get_macaddr | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value-not-described-in-rnp_mbx_reg_writev | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value0-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value1-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value2-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value3-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_fw_reg_read | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:variable-value-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Excess-function-parameter-hw-description-in-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-hw-not-described-in-rnp_write_uc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-mac-not-described-in-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-sriov_flag-not-described-in-rnp_eth_update_rss_key_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-sriov_flag-not-described-in-rnp_write_uc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:equality-comparison-with-extraneous-parentheses | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp10_get_link_ksettings | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp10_set_link_ksettings | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_addr_list_itr | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_check_mac_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_clean_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_device_supports_autoneg_fc | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clear_rar_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clear_vmdq_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_all_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_all_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_mc_addr_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_vfta_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_rar_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_tcp_sync_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_vfta_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_vmdq_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_mc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_rss_key_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_rss_table_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_get_permtion_mac_addr_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_get_thermal_sensor_data_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_init_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_init_thermal_sensor_thresh_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_layer2_pritologic_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_mac_set_mac_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_nway_reset | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_phy_read_reg_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_phy_write_reg_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_reset_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_set_ethtool_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_set_vf_vlan_mode_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_setup_mac_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_start_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_tuple5_pritologic_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_tuple5_pritologic_tcam_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-autoneg_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-dma_ch-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-duplex_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-idx-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_ptp.c:warning:no-previous-prototype-for-function-rnp_ptp_setup_ptp | |-- drivers-net-ethernet-mucse-rnp-rnp_ptp.c:warning:variable-ts_event_en-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:no-previous-prototype-for-function-check_ari_mode | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:no-previous-prototype-for-function-rnp_msg_post_status_signle_link | |-- drivers-net-ethernet-mucse-rnp-rnp_sysfs.c:warning:no-previous-prototype-for-function-rnp_mbx_get_pn_sn | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr |-- x86_64-buildonly-randconfig-001-20250109 | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-003-20250109 | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-004-20241230 | |-- block-bio-integrity.o:warning:objtool:bio_integrity_alloc:unreachable-instruction | `-- block-keyslot-manager.o:warning:objtool:blk_ksm_evict_key:unreachable-instruction |-- x86_64-buildonly-randconfig-004-20250109 | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr | |-- fs-fscache-main.c:warning:unused-variable-fscache_min_object_max_active | `-- fs-fscache-main.c:warning:unused-variable-fscache_min_op_max_active |-- x86_64-buildonly-randconfig-005-20250109 | |-- drivers-gpu-drm-vmwgfx-ttm_object.c:error:Cannot-parse-struct-or-union | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- x86_64-randconfig-121-20250108 `-- fs-erofs-fscache.c:sparse:sparse:symbol-erofs_fscache_inode_object_def-was-not-declared.-Should-it-be-static elapsed time: 869m configs tested: 15 configs skipped: 95 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250109 gcc-14.2.0 arm64 randconfig-002-20250109 clang-20 arm64 randconfig-003-20250109 gcc-14.2.0 arm64 randconfig-004-20250109 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250109 clang-19 x86_64 buildonly-randconfig-002-20250109 gcc-12 x86_64 buildonly-randconfig-003-20250109 clang-19 x86_64 buildonly-randconfig-004-20250109 clang-19 x86_64 buildonly-randconfig-005-20250109 clang-19 x86_64 buildonly-randconfig-006-20250109 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1402/1402] block/blk-mq-sched.c:219:5: warning: no previous prototype for '__blk_mq_sched_dispatch_requests'
by kernel test robot 10 Jan '25

10 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 97f98c391a1fd153ae010a2faf73f9e03270da6e commit: c1ea82c0ddde70d5998c2f547520afbee10bea2a [1402/1402] block: Limit number of items taken from the I/O scheduler in one go config: x86_64-buildonly-randconfig-006-20250109 (https://download.01.org/0day-ci/archive/20250110/202501100428.rcoZkFtm-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250110/202501100428.rcoZkFtm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501100428.rcoZkFtm-lkp@intel.com/ All warnings (new ones prefixed by >>): >> block/blk-mq-sched.c:219:5: warning: no previous prototype for '__blk_mq_sched_dispatch_requests' [-Wmissing-prototypes] 219 | int __blk_mq_sched_dispatch_requests(struct blk_mq_hw_ctx *hctx) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/__blk_mq_sched_dispatch_requests +219 block/blk-mq-sched.c 218 > 219 int __blk_mq_sched_dispatch_requests(struct blk_mq_hw_ctx *hctx) 220 { 221 struct request_queue *q = hctx->queue; 222 struct elevator_queue *e = q->elevator; 223 const bool has_sched_dispatch = e && e->type->ops.mq.dispatch_request; 224 int ret = 0; 225 LIST_HEAD(rq_list); 226 227 /* 228 * If we have previous entries on our dispatch list, grab them first for 229 * more fair dispatch. 230 */ 231 if (!list_empty_careful(&hctx->dispatch)) { 232 spin_lock(&hctx->lock); 233 if (!list_empty(&hctx->dispatch)) 234 list_splice_init(&hctx->dispatch, &rq_list); 235 spin_unlock(&hctx->lock); 236 } 237 238 /* 239 * Only ask the scheduler for requests, if we didn't have residual 240 * requests from the dispatch list. This is to avoid the case where 241 * we only ever dispatch a fraction of the requests available because 242 * of low device queue depth. Once we pull requests out of the IO 243 * scheduler, we can no longer merge or sort them. So it's best to 244 * leave them there for as long as we can. Mark the hw queue as 245 * needing a restart in that case. 246 * 247 * We want to dispatch from the scheduler if there was nothing 248 * on the dispatch list or we were able to dispatch from the 249 * dispatch list. 250 */ 251 if (!list_empty(&rq_list)) { 252 blk_mq_sched_mark_restart_hctx(hctx); 253 if (blk_mq_dispatch_rq_list(q, &rq_list, false)) { 254 if (has_sched_dispatch) 255 ret = blk_mq_do_dispatch_sched(hctx); 256 else 257 ret = blk_mq_do_dispatch_ctx(hctx); 258 } 259 } else if (has_sched_dispatch) { 260 ret = blk_mq_do_dispatch_sched(hctx); 261 } else if (hctx->dispatch_busy) { 262 /* dequeue request one by one from sw queue if queue is busy */ 263 ret = blk_mq_do_dispatch_ctx(hctx); 264 } else { 265 blk_mq_flush_busy_ctxs(hctx, &rq_list); 266 blk_mq_dispatch_rq_list(q, &rq_list, false); 267 } 268 269 return ret; 270 } 271 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1402/1402] block/genhd.c:642:5: warning: no previous prototype for 'disk_scan_partitions'
by kernel test robot 10 Jan '25

10 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 97f98c391a1fd153ae010a2faf73f9e03270da6e commit: cdfb5c11ad89867cd28c903369fbfebe3f36ca26 [1402/1402] block: fix kabi broken in ioctl.c config: x86_64-buildonly-randconfig-006-20250109 (https://download.01.org/0day-ci/archive/20250110/202501100221.KRTzS1xl-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250110/202501100221.KRTzS1xl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501100221.KRTzS1xl-lkp@intel.com/ All warnings (new ones prefixed by >>): >> block/genhd.c:642:5: warning: no previous prototype for 'disk_scan_partitions' [-Wmissing-prototypes] 642 | int disk_scan_partitions(struct gendisk *disk, fmode_t mode) | ^~~~~~~~~~~~~~~~~~~~ block/genhd.c:533: warning: Function parameter or member 'devt' not described in 'blk_invalidate_devt' vim +/disk_scan_partitions +642 block/genhd.c d2bf1b6723ed0e Tejun Heo 2010-12-08 641 efc73feb2901d2 Christoph Hellwig 2023-04-07 @642 int disk_scan_partitions(struct gendisk *disk, fmode_t mode) b9484a857f600c Yu Kuai 2022-08-09 643 { b9484a857f600c Yu Kuai 2022-08-09 644 struct block_device *bdev; efc73feb2901d2 Christoph Hellwig 2023-04-07 645 int ret; b9484a857f600c Yu Kuai 2022-08-09 646 efc73feb2901d2 Christoph Hellwig 2023-04-07 647 if (!disk_part_scan_enabled(disk)) efc73feb2901d2 Christoph Hellwig 2023-04-07 648 return -EINVAL; b9484a857f600c Yu Kuai 2022-08-09 649 b9484a857f600c Yu Kuai 2022-08-09 650 bdev = bdget_disk(disk, 0); b9484a857f600c Yu Kuai 2022-08-09 651 if (!bdev) efc73feb2901d2 Christoph Hellwig 2023-04-07 652 return -ENOMEM; b9484a857f600c Yu Kuai 2022-08-09 653 b9484a857f600c Yu Kuai 2022-08-09 654 bdev->bd_invalidated = 1; efc73feb2901d2 Christoph Hellwig 2023-04-07 655 efc73feb2901d2 Christoph Hellwig 2023-04-07 656 ret = blkdev_get(bdev, mode, NULL); efc73feb2901d2 Christoph Hellwig 2023-04-07 657 if (!ret) efc73feb2901d2 Christoph Hellwig 2023-04-07 658 blkdev_put(bdev, mode); efc73feb2901d2 Christoph Hellwig 2023-04-07 659 efc73feb2901d2 Christoph Hellwig 2023-04-07 660 return ret; fbbec472351c99 Christoph Hellwig 2023-04-07 661 } fbbec472351c99 Christoph Hellwig 2023-04-07 662 :::::: The code at line 642 was first introduced by commit :::::: efc73feb2901d27dcd01fa859d1378aee42850aa block: merge disk_scan_partitions and blkdev_reread_part :::::: TO: Christoph Hellwig <hch(a)lst.de> :::::: CC: Yongqiang Liu <duanzi(a)zju.edu.cn> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1402/1402] block/bio-integrity.c:41:6: warning: no previous prototype for '__bio_integrity_free'
by kernel test robot 10 Jan '25

10 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 97f98c391a1fd153ae010a2faf73f9e03270da6e commit: f9c4e7b09f7d51f9256fe51b9c40657cd7302530 [1402/1402] block: release bip in a right way in error path config: x86_64-buildonly-randconfig-006-20250109 (https://download.01.org/0day-ci/archive/20250110/202501100043.2OiyDpsd-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250110/202501100043.2OiyDpsd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501100043.2OiyDpsd-lkp@intel.com/ All warnings (new ones prefixed by >>): >> block/bio-integrity.c:41:6: warning: no previous prototype for '__bio_integrity_free' [-Wmissing-prototypes] 41 | void __bio_integrity_free(struct bio_set *bs, struct bio_integrity_payload *bip) | ^~~~~~~~~~~~~~~~~~~~ vim +/__bio_integrity_free +41 block/bio-integrity.c 40 > 41 void __bio_integrity_free(struct bio_set *bs, struct bio_integrity_payload *bip) 42 { 43 if (bs && mempool_initialized(&bs->bio_integrity_pool)) { 44 if (bip->bip_vec) 45 bvec_free(&bs->bvec_integrity_pool, bip->bip_vec, 46 bip->bip_slab); 47 mempool_free(bip, &bs->bio_integrity_pool); 48 } else { 49 kfree(bip); 50 } 51 } 52 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2668/2668] fs/erofs/fscache.c:28:33: sparse: sparse: symbol 'erofs_fscache_inode_object_def' was not declared. Should it be static?
by kernel test robot 09 Jan '25

09 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 1c1825ed0360fc09f928a4b2e1300f7b718df8dc commit: d2f54ddb54950df46c7a841b90b57ff83b193d36 [2668/2668] erofs: add fscache context helper functions config: x86_64-randconfig-121-20250108 (https://download.01.org/0day-ci/archive/20250109/202501092234.VRg7E3V6-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250109/202501092234.VRg7E3V6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501092234.VRg7E3V6-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) fs/erofs/fscache.c:7:22: sparse: sparse: symbol 'erofs_fscache_netfs' was not declared. Should it be static? fs/erofs/fscache.c:22:33: sparse: sparse: symbol 'erofs_fscache_super_index_def' was not declared. Should it be static? >> fs/erofs/fscache.c:28:33: sparse: sparse: symbol 'erofs_fscache_inode_object_def' was not declared. Should it be static? vim +/erofs_fscache_inode_object_def +28 fs/erofs/fscache.c 27 > 28 const struct fscache_cookie_def erofs_fscache_inode_object_def = { 29 .name = "CIFS.uniqueid", 30 .type = FSCACHE_COOKIE_TYPE_DATAFILE, 31 }; 32 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] [Backport] btrfs: check folio mapping after unlock in relocate_one_folio()
by Yongjian Sun 09 Jan '25

09 Jan '25

mainline inclusion from mainline-v6.12-rc3 commit 3e74859ee35edc33a022c3f3971df066ea0ca6b9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBG2PL CVE: CVE-2024-56758 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When we call btrfs_read_folio() to bring a folio uptodate, we unlock the folio. The result of that is that a different thread can modify the mapping (like remove it with invalidate) before we call folio_lock(). This results in an invalid page and we need to try again. In particular, if we are relocating concurrently with aborting a transaction, this can result in a crash like the following: BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP CPU: 76 PID: 1411631 Comm: kworker/u322:5 Workqueue: events_unbound btrfs_reclaim_bgs_work RIP: 0010:set_page_extent_mapped+0x20/0xb0 RSP: 0018:ffffc900516a7be8 EFLAGS: 00010246 RAX: ffffea009e851d08 RBX: ffffea009e0b1880 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffc900516a7b90 RDI: ffffea009e0b1880 RBP: 0000000003573000 R08: 0000000000000001 R09: ffff88c07fd2f3f0 R10: 0000000000000000 R11: 0000194754b575be R12: 0000000003572000 R13: 0000000003572fff R14: 0000000000100cca R15: 0000000005582fff FS: 0000000000000000(0000) GS:ffff88c07fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000407d00f002 CR4: 00000000007706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __die+0x78/0xc0 ? page_fault_oops+0x2a8/0x3a0 ? __switch_to+0x133/0x530 ? wq_worker_running+0xa/0x40 ? exc_page_fault+0x63/0x130 ? asm_exc_page_fault+0x22/0x30 ? set_page_extent_mapped+0x20/0xb0 relocate_file_extent_cluster+0x1a7/0x940 relocate_data_extent+0xaf/0x120 relocate_block_group+0x20f/0x480 btrfs_relocate_block_group+0x152/0x320 btrfs_relocate_chunk+0x3d/0x120 btrfs_reclaim_bgs_work+0x2ae/0x4e0 process_scheduled_works+0x184/0x370 worker_thread+0xc6/0x3e0 ? blk_add_timer+0xb0/0xb0 kthread+0xae/0xe0 ? flush_tlb_kernel_range+0x90/0x90 ret_from_fork+0x2f/0x40 ? flush_tlb_kernel_range+0x90/0x90 ret_from_fork_asm+0x11/0x20 </TASK> This occurs because cleanup_one_transaction() calls destroy_delalloc_inodes() which calls invalidate_inode_pages2() which takes the folio_lock before setting mapping to NULL. We fail to check this, and subsequently call set_extent_mapping(), which assumes that mapping != NULL (in fact it asserts that in debug mode) Note that the "fixes" patch here is not the one that introduced the race (the very first iteration of this code from 2009) but a more recent change that made this particular crash happen in practice. Fixes: e7f1326cc24e ("btrfs: set page extent mapped after read_folio in relocate_one_page") CC: stable(a)vger.kernel.org # 6.1+ Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Boris Burkov <boris(a)bur.io> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/relocation.c [The Evolution from Page to Folio] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/btrfs/relocation.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c index a67dd544a52d..ea9e847c0e97 100644 --- a/fs/btrfs/relocation.c +++ b/fs/btrfs/relocation.c @@ -2732,7 +2732,7 @@ static int relocate_file_extent_cluster(struct inode *inode, PAGE_SIZE); if (ret) goto out; - +again: page = find_lock_page(inode->i_mapping, index); if (!page) { page_cache_sync_readahead(inode->i_mapping, @@ -2771,6 +2771,12 @@ static int relocate_file_extent_cluster(struct inode *inode, } } + if (page->mapping != inode->i_mapping) { + unlock_page(page); + put_page(page); + goto again; + } + page_start = page_offset(page); page_end = page_start + PAGE_SIZE - 1; -- 2.39.2

2 1

[PATCH OLK-6.6] [Backport] btrfs: check folio mapping after unlock in relocate_one_folio()
by Yongjian Sun 09 Jan '25

09 Jan '25

mainline inclusion from mainline-v6.12-rc3 commit 3e74859ee35edc33a022c3f3971df066ea0ca6b9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBG2PL CVE: CVE-2024-56758 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When we call btrfs_read_folio() to bring a folio uptodate, we unlock the folio. The result of that is that a different thread can modify the mapping (like remove it with invalidate) before we call folio_lock(). This results in an invalid page and we need to try again. In particular, if we are relocating concurrently with aborting a transaction, this can result in a crash like the following: BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP CPU: 76 PID: 1411631 Comm: kworker/u322:5 Workqueue: events_unbound btrfs_reclaim_bgs_work RIP: 0010:set_page_extent_mapped+0x20/0xb0 RSP: 0018:ffffc900516a7be8 EFLAGS: 00010246 RAX: ffffea009e851d08 RBX: ffffea009e0b1880 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffc900516a7b90 RDI: ffffea009e0b1880 RBP: 0000000003573000 R08: 0000000000000001 R09: ffff88c07fd2f3f0 R10: 0000000000000000 R11: 0000194754b575be R12: 0000000003572000 R13: 0000000003572fff R14: 0000000000100cca R15: 0000000005582fff FS: 0000000000000000(0000) GS:ffff88c07fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000407d00f002 CR4: 00000000007706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __die+0x78/0xc0 ? page_fault_oops+0x2a8/0x3a0 ? __switch_to+0x133/0x530 ? wq_worker_running+0xa/0x40 ? exc_page_fault+0x63/0x130 ? asm_exc_page_fault+0x22/0x30 ? set_page_extent_mapped+0x20/0xb0 relocate_file_extent_cluster+0x1a7/0x940 relocate_data_extent+0xaf/0x120 relocate_block_group+0x20f/0x480 btrfs_relocate_block_group+0x152/0x320 btrfs_relocate_chunk+0x3d/0x120 btrfs_reclaim_bgs_work+0x2ae/0x4e0 process_scheduled_works+0x184/0x370 worker_thread+0xc6/0x3e0 ? blk_add_timer+0xb0/0xb0 kthread+0xae/0xe0 ? flush_tlb_kernel_range+0x90/0x90 ret_from_fork+0x2f/0x40 ? flush_tlb_kernel_range+0x90/0x90 ret_from_fork_asm+0x11/0x20 </TASK> This occurs because cleanup_one_transaction() calls destroy_delalloc_inodes() which calls invalidate_inode_pages2() which takes the folio_lock before setting mapping to NULL. We fail to check this, and subsequently call set_extent_mapping(), which assumes that mapping != NULL (in fact it asserts that in debug mode) Note that the "fixes" patch here is not the one that introduced the race (the very first iteration of this code from 2009) but a more recent change that made this particular crash happen in practice. Fixes: e7f1326cc24e ("btrfs: set page extent mapped after read_folio in relocate_one_page") CC: stable(a)vger.kernel.org # 6.1+ Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Boris Burkov <boris(a)bur.io> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/relocation.c [The Evolution from Page to Folio] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/btrfs/relocation.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c index 299eac696eb4..f73920063572 100644 --- a/fs/btrfs/relocation.c +++ b/fs/btrfs/relocation.c @@ -2931,6 +2931,7 @@ static int relocate_one_page(struct inode *inode, struct file_ra_state *ra, int ret; ASSERT(page_index <= last_index); +again: page = find_lock_page(inode->i_mapping, page_index); if (!page) { page_cache_sync_readahead(inode->i_mapping, ra, NULL, @@ -2952,6 +2953,11 @@ static int relocate_one_page(struct inode *inode, struct file_ra_state *ra, ret = -EIO; goto release_page; } + if (page->mapping != inode->i_mapping) { + unlock_page(page); + put_page(page); + goto again; + } } /* -- 2.39.2

2 1

[openeuler:openEuler-1.0-LTS 1402/1402] block/blk-merge.c:688:16: warning: no previous prototype for 'blk_try_req_merge'
by kernel test robot 09 Jan '25

09 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 97f98c391a1fd153ae010a2faf73f9e03270da6e commit: 5f100bc6aabbe30e55cf20af8e163bb6dba3a3aa [1402/1402] block: fix the DISCARD request merge config: x86_64-buildonly-randconfig-006-20250109 (https://download.01.org/0day-ci/archive/20250109/202501092100.YDIEEEHw-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250109/202501092100.YDIEEEHw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501092100.YDIEEEHw-lkp@intel.com/ All warnings (new ones prefixed by >>): >> block/blk-merge.c:688:16: warning: no previous prototype for 'blk_try_req_merge' [-Wmissing-prototypes] 688 | enum elv_merge blk_try_req_merge(struct request *req, struct request *next) | ^~~~~~~~~~~~~~~~~ vim +/blk_try_req_merge +688 block/blk-merge.c 687 > 688 enum elv_merge blk_try_req_merge(struct request *req, struct request *next) 689 { 690 if (blk_discard_mergable(req)) 691 return ELEVATOR_DISCARD_MERGE; 692 else if (blk_rq_pos(req) + blk_rq_sectors(req) == blk_rq_pos(next)) 693 return ELEVATOR_BACK_MERGE; 694 695 return ELEVATOR_NO_MERGE; 696 } 697 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] [Backport] ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
by Yongjian Sun 09 Jan '25

09 Jan '25

mainline inclusion from mainline-v6.12-rc3 commit 313dab082289e460391c82d855430ec8a28ddf81 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAP7 CVE: CVE-2024-56626 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- An offset from client could be a negative value, It could allows to write data outside the bounds of the allocated buffer. Note that this issue is coming when setting 'vfs objects = streams_xattr parameter' in ksmbd.conf. Cc: stable(a)vger.kernel.org # v5.15+ Reported-by: Jordy Zomer <jordyzomer(a)google.com> Signed-off-by: Jordy Zomer <jordyzomer(a)google.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c fs/ksmbd/smb2pdu.c [Location and context differences.] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index b6194837028a..32aa702921ba 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -6535,6 +6535,11 @@ int smb2_write(struct ksmbd_work *work) return smb2_write_pipe(work); } + offset = le64_to_cpu(req->Offset); + if (offset < 0) + return -EINVAL; + length = le32_to_cpu(req->Length); + if (req->Channel == SMB2_CHANNEL_RDMA_V1 || req->Channel == SMB2_CHANNEL_RDMA_V1_INVALIDATE) { unsigned int ch_offset = le16_to_cpu(req->WriteChannelInfoOffset); @@ -6573,9 +6578,6 @@ int smb2_write(struct ksmbd_work *work) goto out; } - offset = le64_to_cpu(req->Offset); - length = le32_to_cpu(req->Length); - if (length > work->conn->vals->max_write_size) { ksmbd_debug(SMB, "limiting write size to max size(%u)\n", work->conn->vals->max_write_size); -- 2.39.2

2 1

[PATCH OLK-6.6] cgroup/cpuset: remove kernfs active break
by Chen Ridong 09 Jan '25

09 Jan '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBGLXT -------------------------------- A warning was found: WARNING: CPU: 10 PID: 3486953 at fs/kernfs/file.c:828 CPU: 10 PID: 3486953 Comm: rmdir Kdump: loaded Tainted: G RIP: 0010:kernfs_should_drain_open_files+0x1a1/0x1b0 RSP: 0018:ffff8881107ef9e0 EFLAGS: 00010202 RAX: 0000000080000002 RBX: ffff888154738c00 RCX: dffffc0000000000 RDX: 0000000000000007 RSI: 0000000000000004 RDI: ffff888154738c04 RBP: ffff888154738c04 R08: ffffffffaf27fa15 R09: ffffed102a8e7180 R10: ffff888154738c07 R11: 0000000000000000 R12: ffff888154738c08 R13: ffff888750f8c000 R14: ffff888750f8c0e8 R15: ffff888154738ca0 FS: 00007f84cd0be740(0000) GS:ffff8887ddc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kernfs_drain+0x15e/0x2f0 __kernfs_remove+0x165/0x300 kernfs_remove_by_name_ns+0x7b/0xc0 cgroup_rm_file+0x154/0x1c0 cgroup_addrm_files+0x1c2/0x1f0 css_clear_dir+0x77/0x110 kill_css+0x4c/0x1b0 cgroup_destroy_locked+0x194/0x380 cgroup_rmdir+0x2a/0x140 It can be explained by: rmdir echo 1 > cpuset.cpus kernfs_fop_write_iter // active=0 cgroup_rm_file kernfs_remove_by_name_ns kernfs_get_active // active=1 __kernfs_remove // active=0x80000002 kernfs_drain cpuset_write_resmask wait_event //waiting (active == 0x80000001) kernfs_break_active_protection // active = 0x80000001 // continue kernfs_unbreak_active_protection // active = 0x80000002 ... kernfs_should_drain_open_files // warning occurs kernfs_put_active This warning is caused by 'kernfs_break_active_protection' when it is writing to cpuset.cpus, and the cgroup is removed concurrently. The commit 3a5a6d0c2b03 ("cpuset: don't nest cgroup_mutex inside get_online_cpus()") made cpuset_hotplug_workfn asynchronous, This change involves calling flush_work(), which can create a multiple processes circular locking dependency that involve cgroup_mutex, potentially leading to a deadlock. To avoid deadlock. the commit 76bb5ab8f6e3 ("cpuset: break kernfs active protection in cpuset_write_resmask()") added 'kernfs_break_active_protection' in the cpuset_write_resmask. This could lead to this warning. After the commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplug processing synchronous"), the cpuset_write_resmask no longer needs to wait the hotplug to finish, which means that concurrent hotplug and cpuset operations are no longer possible. Therefore, the deadlock doesn't exist anymore and it does not have to 'break active protection' now. To fix this warning, just remove kernfs_break_active_protection operation in the 'cpuset_write_resmask'. Fixes: bdb2fd7fc56e ("kernfs: Skip kernfs_drain_open_files() more aggressively") Fixes: 76bb5ab8f6e3 ("cpuset: break kernfs active protection in cpuset_write_resmask()") Reported-by: Ji Fa <jifa(a)huawei.com> Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- kernel/cgroup/cpuset.c | 25 ------------------------- 1 file changed, 25 deletions(-) diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 7ea0a6d005192..53ba804a81603 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -3676,29 +3676,6 @@ static ssize_t cpuset_write_resmask(struct kernfs_open_file *of, int retval = -ENODEV; buf = strstrip(buf); - - /* - * CPU or memory hotunplug may leave @cs w/o any execution - * resources, in which case the hotplug code asynchronously updates - * configuration and transfers all tasks to the nearest ancestor - * which can execute. - * - * As writes to "cpus" or "mems" may restore @cs's execution - * resources, wait for the previously scheduled operations before - * proceeding, so that we don't end up keep removing tasks added - * after execution capability is restored. - * - * cpuset_handle_hotplug may call back into cgroup core asynchronously - * via cgroup_transfer_tasks() and waiting for it from a cgroupfs - * operation like this one can lead to a deadlock through kernfs - * active_ref protection. Let's break the protection. Losing the - * protection is okay as we check whether @cs is online after - * grabbing cpuset_mutex anyway. This only happens on the legacy - * hierarchies. - */ - css_get(&cs->css); - kernfs_break_active_protection(of->kn); - cpus_read_lock(); mutex_lock(&cpuset_mutex); if (!is_cpuset_online(cs)) @@ -3734,8 +3711,6 @@ static ssize_t cpuset_write_resmask(struct kernfs_open_file *of, out_unlock: mutex_unlock(&cpuset_mutex); cpus_read_unlock(); - kernfs_unbreak_active_protection(of->kn); - css_put(&cs->css); flush_workqueue(cpuset_migrate_mm_wq); return retval ?: nbytes; } -- 2.34.1

2 1

[PATCH OLK-6.6] smb: client: fix use-after-free of signing key
by Long Li 09 Jan '25

09 Jan '25

From: Paulo Alcantara <pc(a)manguebit.com> mainline inclusion from mainline-v6.10-rc2 commit 343d7fe6df9e247671440a932b6a73af4fa86d95 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEZ CVE: CVE-2024-53179 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Customers have reported use-after-free in @ses->auth_key.response with SMB2.1 + sign mounts which occurs due to following race: task A task B cifs_mount() dfs_mount_share() get_session() cifs_mount_get_session() cifs_send_recv() cifs_get_smb_ses() compound_send_recv() cifs_setup_session() smb2_setup_request() kfree_sensitive() smb2_calc_signature() crypto_shash_setkey() *UAF* Fix this by ensuring that we have a valid @ses->auth_key.response by checking whether @ses->ses_status is SES_GOOD or SES_EXITING with @ses->ses_lock held. After commit 24a9799aa8ef ("smb: client: fix UAF in smb2_reconnect_server()"), we made sure to call ->logoff() only when @ses was known to be good (e.g. valid ->auth_key.response), so it's safe to access signing key when @ses->ses_status == SES_EXITING. Cc: stable(a)vger.kernel.org Reported-by: Jay Shin <jaeshin(a)redhat.com> Signed-off-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/client/smb2transport.c [context in smb2_calc_signature() conflicts] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/smb/client/smb2proto.h | 2 -- fs/smb/client/smb2transport.c | 56 +++++++++++++++++++++++++---------- 2 files changed, 40 insertions(+), 18 deletions(-) diff --git a/fs/smb/client/smb2proto.h b/fs/smb/client/smb2proto.h index f6fafa997e99..0a49f653530f 100644 --- a/fs/smb/client/smb2proto.h +++ b/fs/smb/client/smb2proto.h @@ -37,8 +37,6 @@ extern struct mid_q_entry *smb2_setup_request(struct cifs_ses *ses, struct smb_rqst *rqst); extern struct mid_q_entry *smb2_setup_async_request( struct TCP_Server_Info *server, struct smb_rqst *rqst); -extern struct cifs_ses *smb2_find_smb_ses(struct TCP_Server_Info *server, - __u64 ses_id); extern struct cifs_tcon *smb2_find_smb_tcon(struct TCP_Server_Info *server, __u64 ses_id, __u32 tid); extern int smb2_calc_signature(struct smb_rqst *rqst, diff --git a/fs/smb/client/smb2transport.c b/fs/smb/client/smb2transport.c index 4ca04e62a993..4a43802375b3 100644 --- a/fs/smb/client/smb2transport.c +++ b/fs/smb/client/smb2transport.c @@ -74,7 +74,7 @@ smb311_crypto_shash_allocate(struct TCP_Server_Info *server) static -int smb2_get_sign_key(__u64 ses_id, struct TCP_Server_Info *server, u8 *key) +int smb3_get_sign_key(__u64 ses_id, struct TCP_Server_Info *server, u8 *key) { struct cifs_chan *chan; struct TCP_Server_Info *pserver; @@ -168,16 +168,41 @@ smb2_find_smb_ses_unlocked(struct TCP_Server_Info *server, __u64 ses_id) return NULL; } -struct cifs_ses * -smb2_find_smb_ses(struct TCP_Server_Info *server, __u64 ses_id) +static int smb2_get_sign_key(struct TCP_Server_Info *server, + __u64 ses_id, u8 *key) { struct cifs_ses *ses; + int rc = -ENOENT; + + if (SERVER_IS_CHAN(server)) + server = server->primary_server; spin_lock(&cifs_tcp_ses_lock); - ses = smb2_find_smb_ses_unlocked(server, ses_id); - spin_unlock(&cifs_tcp_ses_lock); + list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) { + if (ses->Suid != ses_id) + continue; - return ses; + rc = 0; + spin_lock(&ses->ses_lock); + switch (ses->ses_status) { + case SES_EXITING: /* SMB2_LOGOFF */ + case SES_GOOD: + if (likely(ses->auth_key.response)) { + memcpy(key, ses->auth_key.response, + SMB2_NTLMV2_SESSKEY_SIZE); + } else { + rc = -EIO; + } + break; + default: + rc = -EAGAIN; + break; + } + spin_unlock(&ses->ses_lock); + break; + } + spin_unlock(&cifs_tcp_ses_lock); + return rc; } static struct cifs_tcon * @@ -236,14 +261,16 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server, unsigned char *sigptr = smb2_signature; struct kvec *iov = rqst->rq_iov; struct smb2_hdr *shdr = (struct smb2_hdr *)iov[0].iov_base; - struct cifs_ses *ses; struct shash_desc *shash = NULL; struct smb_rqst drqst; + __u64 sid = le64_to_cpu(shdr->SessionId); + u8 key[SMB2_NTLMV2_SESSKEY_SIZE]; - ses = smb2_find_smb_ses(server, le64_to_cpu(shdr->SessionId)); - if (unlikely(!ses)) { - cifs_server_dbg(VFS, "%s: Could not find session\n", __func__); - return -ENOENT; + rc = smb2_get_sign_key(server, sid, key); + if (unlikely(rc)) { + cifs_server_dbg(FYI, "%s: [sesid=0x%llx] couldn't find signing key: %d\n", + __func__, sid, rc); + return rc; } memset(smb2_signature, 0x0, SMB2_HMACSHA256_SIZE); @@ -260,8 +287,7 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server, shash = server->secmech.hmacsha256; } - rc = crypto_shash_setkey(shash->tfm, ses->auth_key.response, - SMB2_NTLMV2_SESSKEY_SIZE); + rc = crypto_shash_setkey(shash->tfm, key, sizeof(key)); if (rc) { cifs_server_dbg(VFS, "%s: Could not update with response\n", @@ -303,8 +329,6 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server, out: if (allocate_crypto) cifs_free_hash(&shash); - if (ses) - cifs_put_smb_ses(ses); return rc; } @@ -570,7 +594,7 @@ smb3_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server, struct smb_rqst drqst; u8 key[SMB3_SIGN_KEY_SIZE]; - rc = smb2_get_sign_key(le64_to_cpu(shdr->SessionId), server, key); + rc = smb3_get_sign_key(le64_to_cpu(shdr->SessionId), server, key); if (unlikely(rc)) { cifs_server_dbg(FYI, "%s: Could not get signing key\n", __func__); return rc; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS v2] mm: hugetlb: independent PMD page table shared count
by Liu Shixin 09 Jan '25

09 Jan '25

mainline inclusion from mainline-v6.13-rc6 commit 59d9094df3d79443937add8700b2ef1a866b1081 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBBGL0 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The folio refcount may be increased unexpectly through try_get_folio() by caller such as split_huge_pages. In huge_pmd_unshare(), we use refcount to check whether a pmd page table is shared. The check is incorrect if the refcount is increased by the above caller, and this can cause the page table leaked: BUG: Bad page state in process sh pfn:109324 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x66 pfn:0x109324 flags: 0x17ffff800000000(node=0|zone=2|lastcpupid=0xfffff) page_type: f2(table) raw: 017ffff800000000 0000000000000000 0000000000000000 0000000000000000 raw: 0000000000000066 0000000000000000 00000000f2000000 0000000000000000 page dumped because: nonzero mapcount ... CPU: 31 UID: 0 PID: 7515 Comm: sh Kdump: loaded Tainted: G B 6.13.0-rc2master+ #7 Tainted: [B]=BAD_PAGE Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 Call trace: show_stack+0x20/0x38 (C) dump_stack_lvl+0x80/0xf8 dump_stack+0x18/0x28 bad_page+0x8c/0x130 free_page_is_bad_report+0xa4/0xb0 free_unref_page+0x3cc/0x620 __folio_put+0xf4/0x158 split_huge_pages_all+0x1e0/0x3e8 split_huge_pages_write+0x25c/0x2d8 full_proxy_write+0x64/0xd8 vfs_write+0xcc/0x280 ksys_write+0x70/0x110 __arm64_sys_write+0x24/0x38 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x34/0x128 el0t_64_sync_handler+0xc8/0xd0 el0t_64_sync+0x190/0x198 The issue may be triggered by damon, offline_page, page_idle, etc, which will increase the refcount of page table. 1. The page table itself will be discarded after reporting the "nonzero mapcount". 2. The HugeTLB page mapped by the page table miss freeing since we treat the page table as shared and a shared page table will not be unmapped. Fix it by introducing independent PMD page table shared count. As described by comment, pt_index/pt_mm/pt_frag_refcount are used for s390 gmap, x86 pgds and powerpc, pt_share_count is used for x86/arm64/riscv pmds, so we can reuse the field as pt_share_count. Link: https://lkml.kernel.org/r/20241216071147.3984217-1-liushixin2@huawei.com Fixes: 39dde65c9940 ("[PATCH] shared page table for hugetlb page") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Ken Chen <kenneth.w.chen(a)intel.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Cc: Jane Chu <jane.chu(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: include/linux/hugetlb.h include/linux/mm.h include/linux/mm_types.h mm/hugetlb.c mm/rmap.c [ Context conflict with commit ea919671517a and 38ca8a185389. Config conflict with commit 188cac58a8bc. Add missing vma in huge_pmd_unshare() from commit 34ae204f1851. ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- v1->v2: add __GENKSYMS__ to fix kabi broken. include/linux/hugetlb.h | 7 ++++--- include/linux/mm.h | 1 + include/linux/mm_types.h | 29 +++++++++++++++++++++++++++++ mm/hugetlb.c | 26 +++++++++++++------------- mm/rmap.c | 2 +- 5 files changed, 48 insertions(+), 17 deletions(-) diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index 86519e714986..303ae0d4ada1 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -138,7 +138,8 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr, unsigned long sz); pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr, unsigned long sz); -int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep); +int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long *addr, pte_t *ptep); void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, unsigned long *start, unsigned long *end); struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address, @@ -171,8 +172,8 @@ static inline unsigned long hugetlb_total_pages(void) return 0; } -static inline int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, - pte_t *ptep) +static inline int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long *addr, pte_t *ptep) { return 0; } diff --git a/include/linux/mm.h b/include/linux/mm.h index 72532a1d2d20..67e299374ac8 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -2104,6 +2104,7 @@ static inline bool pgtable_pmd_page_ctor(struct page *page) #ifdef CONFIG_TRANSPARENT_HUGEPAGE page->pmd_huge_pte = NULL; #endif + page_pmd_pts_init(page); return ptlock_init(page); } diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index f2142a5eab6e..0a46332b79d9 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -145,6 +145,9 @@ struct page { union { struct mm_struct *pt_mm; /* x86 pgds only */ atomic_t pt_frag_refcount; /* powerpc */ +#if defined(CONFIG_ARCH_WANT_HUGE_PMD_SHARE) && !defined(__GENKSYMS__) + atomic_t pt_share_count; +#endif }; #if ALLOC_SPLIT_PTLOCKS spinlock_t *ptl; @@ -209,6 +212,32 @@ struct page { #endif } _struct_page_alignment; +#ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE +static inline void page_pmd_pts_init(struct page *page) +{ + atomic_set(&page->pt_share_count, 0); +} + +static inline void page_pmd_pts_inc(struct page *page) +{ + atomic_inc(&page->pt_share_count); +} + +static inline void page_pmd_pts_dec(struct page *page) +{ + atomic_dec(&page->pt_share_count); +} + +static inline int page_pmd_pts_count(struct page *page) +{ + return atomic_read(&page->pt_share_count); +} +#else +static inline void page_pmd_pts_init(struct page *page) +{ +} +#endif + #define PAGE_FRAG_CACHE_MAX_SIZE __ALIGN_MASK(32768, ~PAGE_MASK) #define PAGE_FRAG_CACHE_MAX_ORDER get_order(PAGE_FRAG_CACHE_MAX_SIZE) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index bde2e7b632db..69dd1e096a48 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5054,7 +5054,7 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, continue; ptl = huge_pte_lock(h, mm, ptep); - if (huge_pmd_unshare(mm, &address, ptep)) { + if (huge_pmd_unshare(mm, vma, &address, ptep)) { spin_unlock(ptl); tlb_flush_pmd_range(tlb, address & PUD_MASK, PUD_SIZE); force_flush = true; @@ -6126,7 +6126,7 @@ unsigned long hugetlb_change_protection(struct vm_area_struct *vma, if (!ptep) continue; ptl = huge_pte_lock(h, mm, ptep); - if (huge_pmd_unshare(mm, &address, ptep)) { + if (huge_pmd_unshare(mm, vma, &address, ptep)) { pages++; spin_unlock(ptl); shared_pmd = true; @@ -6444,7 +6444,7 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) spte = huge_pte_offset(svma->vm_mm, saddr, vma_mmu_pagesize(svma)); if (spte) { - get_page(virt_to_page(spte)); + page_pmd_pts_inc(virt_to_page(spte)); break; } } @@ -6459,7 +6459,7 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) (pmd_t *)((unsigned long)spte & PAGE_MASK)); mm_inc_nr_pmds(mm); } else { - put_page(virt_to_page(spte)); + page_pmd_pts_dec(virt_to_page(spte)); } spin_unlock(ptl); out: @@ -6471,27 +6471,26 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) /* * unmap huge page backed by shared pte. * - * Hugetlb pte page is ref counted at the time of mapping. If pte is shared - * indicated by page_count > 1, unmap is achieved by clearing pud and - * decrementing the ref count. If count == 1, the pte page is not shared. - * * called with page table lock held. * * returns: 1 successfully unmapped a shared pte page * 0 the underlying pte page is not shared, or it is the last user */ -int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep) +int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long *addr, pte_t *ptep) { + unsigned long sz = huge_page_size(hstate_vma(vma)); pgd_t *pgd = pgd_offset(mm, *addr); p4d_t *p4d = p4d_offset(pgd, *addr); pud_t *pud = pud_offset(p4d, *addr); - BUG_ON(page_count(virt_to_page(ptep)) == 0); - if (page_count(virt_to_page(ptep)) == 1) + if (sz != PMD_SIZE) + return 0; + if (!page_pmd_pts_count(virt_to_page(ptep))) return 0; pud_clear(pud); - put_page(virt_to_page(ptep)); + page_pmd_pts_dec(virt_to_page(ptep)); mm_dec_nr_pmds(mm); *addr = ALIGN(*addr, HPAGE_SIZE * PTRS_PER_PTE) - HPAGE_SIZE; return 1; @@ -6503,7 +6502,8 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) return NULL; } -int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep) +int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long *addr, pte_t *ptep) { return 0; } diff --git a/mm/rmap.c b/mm/rmap.c index bf26f9c8edac..e6724fd0617c 100644 --- a/mm/rmap.c +++ b/mm/rmap.c @@ -1449,7 +1449,7 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma, address = pvmw.address; if (PageHuge(page)) { - if (huge_pmd_unshare(mm, &address, pvmw.pte)) { + if (huge_pmd_unshare(mm, vma, &address, pvmw.pte)) { /* * huge_pmd_unshare unmapped an entire PMD * page. There is no way of knowing exactly -- 2.34.1

2 1

[openeuler:OLK-6.6 1799/1799] drivers/net/ethernet/huawei/hibifur/bifur_main.c:175:5: warning: no previous prototype for function 'bifur_enable_disable_vf_all'
by kernel test robot 09 Jan '25

09 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 89cbe2e2a9d5402e079b95f36d33d4669614e0dc commit: a544f0ba62857476ae73fd4305dbe293b7ee7532 [1799/1799] Add Huawei Intelligent Network Card Driver:hibifur config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250109/202501091220.UhgFHZVc-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250109/202501091220.UhgFHZVc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501091220.UhgFHZVc-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/huawei/hibifur/bifur_main.c:175:5: warning: no previous prototype for function 'bifur_enable_disable_vf_all' [-Wmissing-prototypes] 175 | int bifur_enable_disable_vf_all(bool enable) | ^ drivers/net/ethernet/huawei/hibifur/bifur_main.c:175:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 175 | int bifur_enable_disable_vf_all(bool enable) | ^ | static 1 warning generated. -- >> drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:88:6: warning: no previous prototype for function 'bifur_vf_info_hold' [-Wmissing-prototypes] 88 | void bifur_vf_info_hold(struct bifur_vf_info *dev) | ^ drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:88:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 88 | void bifur_vf_info_hold(struct bifur_vf_info *dev) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:93:6: warning: no previous prototype for function 'bifur_vf_info_put' [-Wmissing-prototypes] 93 | void bifur_vf_info_put(struct bifur_vf_info *dev) | ^ drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:93:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 93 | void bifur_vf_info_put(struct bifur_vf_info *dev) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:99:6: warning: no previous prototype for function 'bifur_dev_file_add' [-Wmissing-prototypes] 99 | void bifur_dev_file_add(struct bifur_dev_file_t *dev_file) | ^ drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:99:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 99 | void bifur_dev_file_add(struct bifur_dev_file_t *dev_file) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:106:6: warning: no previous prototype for function 'bifur_dev_file_del' [-Wmissing-prototypes] 106 | void bifur_dev_file_del(struct bifur_dev_file_t *dev_file) | ^ drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:106:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 106 | void bifur_dev_file_del(struct bifur_dev_file_t *dev_file) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:113:5: warning: no previous prototype for function 'bifur_proc_open' [-Wmissing-prototypes] 113 | int bifur_proc_open(struct inode *inode, struct file *filp) | ^ drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:113:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 113 | int bifur_proc_open(struct inode *inode, struct file *filp) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:133:5: warning: no previous prototype for function 'bifur_proc_close' [-Wmissing-prototypes] 133 | int bifur_proc_close(struct inode *inode, struct file *filp) | ^ drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:133:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 133 | int bifur_proc_close(struct inode *inode, struct file *filp) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:171:5: warning: no previous prototype for function 'bifur_dev_proc_build' [-Wmissing-prototypes] 171 | int bifur_dev_proc_build(struct bifur_vf_info *dev) | ^ drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:171:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 171 | int bifur_dev_proc_build(struct bifur_vf_info *dev) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:204:5: warning: no previous prototype for function 'bifur_dev_proc_destroy' [-Wmissing-prototypes] 204 | int bifur_dev_proc_destroy(struct bifur_vf_info *dev) | ^ drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:204:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 204 | int bifur_dev_proc_destroy(struct bifur_vf_info *dev) | ^ | static 8 warnings generated. -- >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:43:6: warning: no previous prototype for function 'bifur_global_file_del' [-Wmissing-prototypes] 43 | void bifur_global_file_del(struct bifur_proc_file_t *proc_file) | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:43:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 43 | void bifur_global_file_del(struct bifur_proc_file_t *proc_file) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:50:5: warning: no previous prototype for function 'bifur_global_dev_close' [-Wmissing-prototypes] 50 | int bifur_global_dev_close(struct inode *inode, struct file *filp) | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:50:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 50 | int bifur_global_dev_close(struct inode *inode, struct file *filp) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:62:5: warning: no previous prototype for function 'bifur_global_file_add' [-Wmissing-prototypes] 62 | int bifur_global_file_add(struct bifur_proc_file_t *add_proc_file) | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:62:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 62 | int bifur_global_file_add(struct bifur_proc_file_t *add_proc_file) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:83:27: warning: no previous prototype for function 'bifur_alloc_proc_file' [-Wmissing-prototypes] 83 | struct bifur_proc_file_t *bifur_alloc_proc_file(void) | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:83:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 83 | struct bifur_proc_file_t *bifur_alloc_proc_file(void) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:95:5: warning: no previous prototype for function 'bifur_global_dev_open' [-Wmissing-prototypes] 95 | int bifur_global_dev_open(struct inode *inode, struct file *filp) | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:95:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 95 | int bifur_global_dev_open(struct inode *inode, struct file *filp) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:370:5: warning: no previous prototype for function 'bifur_cmd_exec' [-Wmissing-prototypes] 370 | int bifur_cmd_exec(struct file *file, struct bifur_msg *msg) | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:370:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 370 | int bifur_cmd_exec(struct file *file, struct bifur_msg *msg) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:383:5: warning: no previous prototype for function 'bifur_msg_copy_from_usr' [-Wmissing-prototypes] 383 | int bifur_msg_copy_from_usr(const char __user *ubuf, size_t size, struct bifur_msg *usr, | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:383:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 383 | int bifur_msg_copy_from_usr(const char __user *ubuf, size_t size, struct bifur_msg *usr, | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:431:6: warning: no previous prototype for function 'bifur_free_knl_msg_buf' [-Wmissing-prototypes] 431 | void bifur_free_knl_msg_buf(struct bifur_msg *msg) | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:431:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 431 | void bifur_free_knl_msg_buf(struct bifur_msg *msg) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:437:5: warning: no previous prototype for function 'bifur_msg_copy_to_usr' [-Wmissing-prototypes] 437 | int bifur_msg_copy_to_usr(struct bifur_msg *usr, struct bifur_msg *knl) | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:437:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 437 | int bifur_msg_copy_to_usr(struct bifur_msg *usr, struct bifur_msg *knl) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:457:9: warning: no previous prototype for function 'bifur_file_write' [-Wmissing-prototypes] 457 | ssize_t bifur_file_write(struct file *file, const char __user *ubuf, size_t size, loff_t *pos) | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:457:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 457 | ssize_t bifur_file_write(struct file *file, const char __user *ubuf, size_t size, loff_t *pos) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:488:9: warning: no previous prototype for function 'bifur_proc_write' [-Wmissing-prototypes] 488 | ssize_t bifur_proc_write(struct file *file, const char __user *ubuf, size_t size, loff_t *pos) | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:488:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 488 | ssize_t bifur_proc_write(struct file *file, const char __user *ubuf, size_t size, loff_t *pos) | ^ | static 11 warnings generated. -- >> drivers/net/ethernet/huawei/hibifur/bifur_event.c:257:6: warning: no previous prototype for function 'bifur_notify_vf_link_status' [-Wmissing-prototypes] 257 | void bifur_notify_vf_link_status(struct hinic3_lld_dev *lld_dev, u8 port_id, u16 vf_id, | ^ drivers/net/ethernet/huawei/hibifur/bifur_event.c:257:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 257 | void bifur_notify_vf_link_status(struct hinic3_lld_dev *lld_dev, u8 port_id, u16 vf_id, | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_event.c:282:6: warning: no previous prototype for function 'bifur_notify_all_vfs_link_changed' [-Wmissing-prototypes] 282 | void bifur_notify_all_vfs_link_changed(struct hinic3_lld_dev *lld_dev, u32 dbdf, u8 link_status) | ^ drivers/net/ethernet/huawei/hibifur/bifur_event.c:282:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 282 | void bifur_notify_all_vfs_link_changed(struct hinic3_lld_dev *lld_dev, u32 dbdf, u8 link_status) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_event.c:341:5: warning: no previous prototype for function 'bifur_net_event_callback' [-Wmissing-prototypes] 341 | int bifur_net_event_callback(struct notifier_block *nb, unsigned long event, void *ptr) | ^ drivers/net/ethernet/huawei/hibifur/bifur_event.c:341:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 341 | int bifur_net_event_callback(struct notifier_block *nb, unsigned long event, void *ptr) | ^ | static 3 warnings generated. vim +/bifur_enable_disable_vf_all +175 drivers/net/ethernet/huawei/hibifur/bifur_main.c 174 > 175 int bifur_enable_disable_vf_all(bool enable) 176 { 177 int err = 0; 178 int num_vfs = enable ? BIFUR_VF_NUM : 0; 179 struct bifur_lld_dev *bifur_dev = NULL; 180 struct bifur_lld_dev *tmp_dev = NULL; 181 struct bifur_adapter *adp = bifur_get_adp(); 182 struct list_head *head = &adp->lld_dev_head; 183 184 list_for_each_entry_safe(bifur_dev, tmp_dev, head, list) { 185 if (bifur_dev->pf_type != BIFUR_RESOURCE_PF) 186 continue; 187 188 bifur_dev_hold(bifur_dev); 189 err = bifur_enable_disable_vfs(bifur_dev, num_vfs); 190 bifur_dev_put(bifur_dev); 191 if (err) 192 return err; 193 } 194 195 return 0; 196 } 197 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] mm: hugetlb: independent PMD page table shared count
by Liu Shixin 09 Jan '25

09 Jan '25

mainline inclusion from mainline-v6.13-rc6 commit 59d9094df3d79443937add8700b2ef1a866b1081 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBBGL0 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The folio refcount may be increased unexpectly through try_get_folio() by caller such as split_huge_pages. In huge_pmd_unshare(), we use refcount to check whether a pmd page table is shared. The check is incorrect if the refcount is increased by the above caller, and this can cause the page table leaked: BUG: Bad page state in process sh pfn:109324 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x66 pfn:0x109324 flags: 0x17ffff800000000(node=0|zone=2|lastcpupid=0xfffff) page_type: f2(table) raw: 017ffff800000000 0000000000000000 0000000000000000 0000000000000000 raw: 0000000000000066 0000000000000000 00000000f2000000 0000000000000000 page dumped because: nonzero mapcount ... CPU: 31 UID: 0 PID: 7515 Comm: sh Kdump: loaded Tainted: G B 6.13.0-rc2master+ #7 Tainted: [B]=BAD_PAGE Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 Call trace: show_stack+0x20/0x38 (C) dump_stack_lvl+0x80/0xf8 dump_stack+0x18/0x28 bad_page+0x8c/0x130 free_page_is_bad_report+0xa4/0xb0 free_unref_page+0x3cc/0x620 __folio_put+0xf4/0x158 split_huge_pages_all+0x1e0/0x3e8 split_huge_pages_write+0x25c/0x2d8 full_proxy_write+0x64/0xd8 vfs_write+0xcc/0x280 ksys_write+0x70/0x110 __arm64_sys_write+0x24/0x38 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x34/0x128 el0t_64_sync_handler+0xc8/0xd0 el0t_64_sync+0x190/0x198 The issue may be triggered by damon, offline_page, page_idle, etc, which will increase the refcount of page table. 1. The page table itself will be discarded after reporting the "nonzero mapcount". 2. The HugeTLB page mapped by the page table miss freeing since we treat the page table as shared and a shared page table will not be unmapped. Fix it by introducing independent PMD page table shared count. As described by comment, pt_index/pt_mm/pt_frag_refcount are used for s390 gmap, x86 pgds and powerpc, pt_share_count is used for x86/arm64/riscv pmds, so we can reuse the field as pt_share_count. Link: https://lkml.kernel.org/r/20241216071147.3984217-1-liushixin2@huawei.com Fixes: 39dde65c9940 ("[PATCH] shared page table for hugetlb page") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Ken Chen <kenneth.w.chen(a)intel.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Cc: Jane Chu <jane.chu(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: include/linux/hugetlb.h include/linux/mm.h include/linux/mm_types.h mm/hugetlb.c mm/rmap.c [ Context conflict with commit ea919671517a and 38ca8a185389. Config conflict with commit 188cac58a8bc. Add missing vma in huge_pmd_unshare() from commit 34ae204f1851. ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- include/linux/hugetlb.h | 7 ++++--- include/linux/mm.h | 1 + include/linux/mm_types.h | 29 +++++++++++++++++++++++++++++ mm/hugetlb.c | 26 +++++++++++++------------- mm/rmap.c | 2 +- 5 files changed, 48 insertions(+), 17 deletions(-) diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index 86519e714986..303ae0d4ada1 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -138,7 +138,8 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr, unsigned long sz); pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr, unsigned long sz); -int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep); +int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long *addr, pte_t *ptep); void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, unsigned long *start, unsigned long *end); struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address, @@ -171,8 +172,8 @@ static inline unsigned long hugetlb_total_pages(void) return 0; } -static inline int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, - pte_t *ptep) +static inline int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long *addr, pte_t *ptep) { return 0; } diff --git a/include/linux/mm.h b/include/linux/mm.h index 72532a1d2d20..67e299374ac8 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -2104,6 +2104,7 @@ static inline bool pgtable_pmd_page_ctor(struct page *page) #ifdef CONFIG_TRANSPARENT_HUGEPAGE page->pmd_huge_pte = NULL; #endif + page_pmd_pts_init(page); return ptlock_init(page); } diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index f2142a5eab6e..2cf5d0aaeb97 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -145,6 +145,9 @@ struct page { union { struct mm_struct *pt_mm; /* x86 pgds only */ atomic_t pt_frag_refcount; /* powerpc */ +#ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE + atomic_t pt_share_count; +#endif }; #if ALLOC_SPLIT_PTLOCKS spinlock_t *ptl; @@ -209,6 +212,32 @@ struct page { #endif } _struct_page_alignment; +#ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE +static inline void page_pmd_pts_init(struct page *page) +{ + atomic_set(&page->pt_share_count, 0); +} + +static inline void page_pmd_pts_inc(struct page *page) +{ + atomic_inc(&page->pt_share_count); +} + +static inline void page_pmd_pts_dec(struct page *page) +{ + atomic_dec(&page->pt_share_count); +} + +static inline int page_pmd_pts_count(struct page *page) +{ + return atomic_read(&page->pt_share_count); +} +#else +static inline void page_pmd_pts_init(struct page *page) +{ +} +#endif + #define PAGE_FRAG_CACHE_MAX_SIZE __ALIGN_MASK(32768, ~PAGE_MASK) #define PAGE_FRAG_CACHE_MAX_ORDER get_order(PAGE_FRAG_CACHE_MAX_SIZE) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index bde2e7b632db..69dd1e096a48 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5054,7 +5054,7 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, continue; ptl = huge_pte_lock(h, mm, ptep); - if (huge_pmd_unshare(mm, &address, ptep)) { + if (huge_pmd_unshare(mm, vma, &address, ptep)) { spin_unlock(ptl); tlb_flush_pmd_range(tlb, address & PUD_MASK, PUD_SIZE); force_flush = true; @@ -6126,7 +6126,7 @@ unsigned long hugetlb_change_protection(struct vm_area_struct *vma, if (!ptep) continue; ptl = huge_pte_lock(h, mm, ptep); - if (huge_pmd_unshare(mm, &address, ptep)) { + if (huge_pmd_unshare(mm, vma, &address, ptep)) { pages++; spin_unlock(ptl); shared_pmd = true; @@ -6444,7 +6444,7 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) spte = huge_pte_offset(svma->vm_mm, saddr, vma_mmu_pagesize(svma)); if (spte) { - get_page(virt_to_page(spte)); + page_pmd_pts_inc(virt_to_page(spte)); break; } } @@ -6459,7 +6459,7 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) (pmd_t *)((unsigned long)spte & PAGE_MASK)); mm_inc_nr_pmds(mm); } else { - put_page(virt_to_page(spte)); + page_pmd_pts_dec(virt_to_page(spte)); } spin_unlock(ptl); out: @@ -6471,27 +6471,26 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) /* * unmap huge page backed by shared pte. * - * Hugetlb pte page is ref counted at the time of mapping. If pte is shared - * indicated by page_count > 1, unmap is achieved by clearing pud and - * decrementing the ref count. If count == 1, the pte page is not shared. - * * called with page table lock held. * * returns: 1 successfully unmapped a shared pte page * 0 the underlying pte page is not shared, or it is the last user */ -int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep) +int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long *addr, pte_t *ptep) { + unsigned long sz = huge_page_size(hstate_vma(vma)); pgd_t *pgd = pgd_offset(mm, *addr); p4d_t *p4d = p4d_offset(pgd, *addr); pud_t *pud = pud_offset(p4d, *addr); - BUG_ON(page_count(virt_to_page(ptep)) == 0); - if (page_count(virt_to_page(ptep)) == 1) + if (sz != PMD_SIZE) + return 0; + if (!page_pmd_pts_count(virt_to_page(ptep))) return 0; pud_clear(pud); - put_page(virt_to_page(ptep)); + page_pmd_pts_dec(virt_to_page(ptep)); mm_dec_nr_pmds(mm); *addr = ALIGN(*addr, HPAGE_SIZE * PTRS_PER_PTE) - HPAGE_SIZE; return 1; @@ -6503,7 +6502,8 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) return NULL; } -int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep) +int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long *addr, pte_t *ptep) { return 0; } diff --git a/mm/rmap.c b/mm/rmap.c index bf26f9c8edac..e6724fd0617c 100644 --- a/mm/rmap.c +++ b/mm/rmap.c @@ -1449,7 +1449,7 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma, address = pvmw.address; if (PageHuge(page)) { - if (huge_pmd_unshare(mm, &address, pvmw.pte)) { + if (huge_pmd_unshare(mm, vma, &address, pvmw.pte)) { /* * huge_pmd_unshare unmapped an entire PMD * page. There is no way of knowing exactly -- 2.34.1

2 1

[openeuler:OLK-5.10 2668/2668] fs/erofs/fscache.c:22:33: sparse: sparse: symbol 'erofs_fscache_super_index_def' was not declared. Should it be static?
by kernel test robot 09 Jan '25

09 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ed8467e701e8f5ed9f2b39cf55710a156fc2593f commit: 6de602b09314b731285d7807eb912ac04dbacfb8 [2668/2668] erofs: register fscache volume config: x86_64-randconfig-121-20250108 (https://download.01.org/0day-ci/archive/20250109/202501091137.E9nwi2KG-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250109/202501091137.E9nwi2KG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501091137.E9nwi2KG-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) fs/erofs/fscache.c:7:22: sparse: sparse: symbol 'erofs_fscache_netfs' was not declared. Should it be static? >> fs/erofs/fscache.c:22:33: sparse: sparse: symbol 'erofs_fscache_super_index_def' was not declared. Should it be static? vim +/erofs_fscache_super_index_def +22 fs/erofs/fscache.c 6 > 7 struct fscache_netfs erofs_fscache_netfs = { 8 .name = "erofs", 9 .version = 0, 10 }; 11 12 int erofs_fscache_register(void) 13 { 14 return fscache_register_netfs(&erofs_fscache_netfs); 15 } 16 17 void erofs_fscache_unregister(void) 18 { 19 fscache_unregister_netfs(&erofs_fscache_netfs); 20 } 21 > 22 const struct fscache_cookie_def erofs_fscache_super_index_def = { 23 .name = "EROFS.super", 24 .type = FSCACHE_COOKIE_TYPE_INDEX, 25 .check_aux = NULL, 26 }; 27 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] [Backport] ALSA: 6fire: Release resources at card release
by Lin Ruifeng 09 Jan '25

09 Jan '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.231 commit f2d06d4e129e2508e356136f99bb20a332ff1a00 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEC CVE: CVE-2024-53239 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a0810c3d6dd2d29a9b92604d682eacd2902ce947 ] The current 6fire code tries to release the resources right after the call of usb6fire_chip_abort(). But at this moment, the card object might be still in use (as we're calling snd_card_free_when_closed()). For avoid potential UAFs, move the release of resources to the card's private_free instead of the manual call of usb6fire_chip_destroy() at the USB disconnect callback. Fixes: c6d43ba816d1 ("ALSA: usb/6fire - Driver for TerraTec DMX 6Fire USB") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Link: https://patch.msgid.link/20241113111042.15058-6-tiwai@suse.de Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- sound/usb/6fire/chip.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/sound/usb/6fire/chip.c b/sound/usb/6fire/chip.c index 08c6e6a52eb9..ad6f89845a5c 100644 --- a/sound/usb/6fire/chip.c +++ b/sound/usb/6fire/chip.c @@ -62,8 +62,10 @@ static void usb6fire_chip_abort(struct sfire_chip *chip) } } -static void usb6fire_chip_destroy(struct sfire_chip *chip) +static void usb6fire_card_free(struct snd_card *card) { + struct sfire_chip *chip = card->private_data; + if (chip) { if (chip->pcm) usb6fire_pcm_destroy(chip); @@ -73,8 +75,6 @@ static void usb6fire_chip_destroy(struct sfire_chip *chip) usb6fire_comm_destroy(chip); if (chip->control) usb6fire_control_destroy(chip); - if (chip->card) - snd_card_free(chip->card); } } @@ -137,6 +137,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, chip->regidx = regidx; chip->intf_count = 1; chip->card = card; + card->private_free = usb6fire_card_free; ret = usb6fire_comm_init(chip); if (ret < 0) @@ -163,7 +164,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, return 0; destroy_chip: - usb6fire_chip_destroy(chip); + snd_card_free(card); return ret; } @@ -182,7 +183,6 @@ static void usb6fire_chip_disconnect(struct usb_interface *intf) chip->shutdown = true; usb6fire_chip_abort(chip); - usb6fire_chip_destroy(chip); } } } -- 2.22.0

2 1

[openeuler:OLK-5.10] BUILD REGRESSION ed8467e701e8f5ed9f2b39cf55710a156fc2593f
by kernel test robot 09 Jan '25

09 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: ed8467e701e8f5ed9f2b39cf55710a156fc2593f !14795 btrfs: fix use-after-free when COWing tree bock and tracing is enabled Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202501081846.dn5sbz8W-lkp@intel.com kernel/bpf/verifier.o: warning: objtool: do_check_common()+0x1649: unreachable instruction Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x0-in-asm | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x1-in-asm | `-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x2-in-asm |-- arm64-randconfig-001-20250108 | |-- fs-fscache-main.c:warning:fscache_min_object_max_active-defined-but-not-used | `-- fs-fscache-main.c:warning:fscache_min_op_max_active-defined-but-not-used |-- arm64-randconfig-002-20250108 | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x0-in-asm | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x1-in-asm | `-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x2-in-asm |-- x86_64-allnoconfig | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- samples-bpf-hbm.c:bpf-bpf.h-is-included-more-than-once. |-- x86_64-allyesconfig | |-- drivers-gpu-drm-vmwgfx-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_rd32 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_wr32 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_send_clp_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_in_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_out_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_copy_to_user | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_in_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_out_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_hw_driver_stats | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read_ack | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write_nack | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_destroy_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_id | |-- drivers-net-ethernet-hisilicon-hns3-hns3_unic.c:warning:Function-parameter-or-member-skb-not-described-in-hns3_unic_set_l3_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3_unic.c:warning:Function-parameter-or-member-type_cs_vlan_tso-not-described-in-hns3_unic_set_l3_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_unic_guid.c:warning:no-previous-prototype-for-function-hclge_unic_del_mc_guid_common | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-has_mac-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-has_trans-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-headroom-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-tailroom-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_debugfs.c:warning:Excess-function-parameter-pf-description-in-rnp_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnp-rnp_debugfs.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-cmd-description-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-cmd-description-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-ec-description-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_module_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_ts_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_set_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_set_rxnfc | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-coal-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-data-not-described-in-rnp_reg_test | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_module_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_ts_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_set_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_set_rxnfc | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_get_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_set_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-ker-not-described-in-rnp_get_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-ker-not-described-in-rnp_set_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-inner_vlan_tag-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-l4_hdr_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-mss_seg_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-rxr_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-rxr_idx-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-tunnel_hdr_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-txr_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-txr_idx-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-type_tucmd-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-v_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-crc_pad-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-eth_queue_idx-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-ignore_vlan-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-inner_vlan_tunnel_len-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-mss_len_vf_num-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-r_count-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-r_idx-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-step-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:no-previous-prototype-for-function-rnp_acquire_msix_vectors | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:no-previous-prototype-for-function-rnp_print_ring_info | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-data-description-in-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-ent-description-in-rnp_probe | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-hw-description-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-link_speed-description-in-rnp_watchdog_update_link | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-maxrate-description-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-netdev-description-in-rnp_setup_tc | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-netdev-description-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-queue-description-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-skb-description-in-rnp_is_non_eop | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-subdev_id-description-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_setup_rx_resources | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_setup_tx_resources | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_setup_tc | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-id-not-described-in-rnp_probe | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-napi_budget-not-described-in-rnp_clean_tx_irq | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-rnp_msix_vector-not-described-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-rnp_queue-not-described-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-subdevice_id-not-described-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-t-not-described-in-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-txqueue-not-described-in-rnp_tx_timeout | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_assign_netdev_ops | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_can_rpu_start | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_clear_udp_tunnel_port | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_config_knode | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_delete_knode | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_do_reset | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_service_task | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_setup_tc_cls_u32 | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_unmap_and_free_tx_resource | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_vlan_stags_flag | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_write_eitr_rx | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_xmit_nop_frame_ring | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:variable-rxctrl-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:variable-xdp_xmit-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Excess-function-parameter-rnp_info-description-in-rnp_mbx_get_capability | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-adv-not-described-in-rnp_mbx_phy_link_set | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-info-not-described-in-rnp_mbx_get_capability | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-pfvfnum-not-described-in-rnp_fw_get_macaddr | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value-not-described-in-rnp_mbx_reg_writev | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value0-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value1-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value2-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value3-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_fw_reg_read | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:variable-value-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Excess-function-parameter-hw-description-in-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-hw-not-described-in-rnp_write_uc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-mac-not-described-in-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-sriov_flag-not-described-in-rnp_eth_update_rss_key_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-sriov_flag-not-described-in-rnp_write_uc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:equality-comparison-with-extraneous-parentheses | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp10_get_link_ksettings | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp10_set_link_ksettings | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_addr_list_itr | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_check_mac_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_clean_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_device_supports_autoneg_fc | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clear_rar_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clear_vmdq_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_all_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_all_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_mc_addr_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_vfta_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_rar_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_tcp_sync_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_vfta_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_vmdq_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_mc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_rss_key_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_rss_table_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_get_permtion_mac_addr_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_get_thermal_sensor_data_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_init_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_init_thermal_sensor_thresh_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_layer2_pritologic_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_mac_set_mac_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_nway_reset | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_phy_read_reg_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_phy_write_reg_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_reset_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_set_ethtool_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_set_vf_vlan_mode_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_setup_mac_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_start_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_tuple5_pritologic_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_tuple5_pritologic_tcam_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-autoneg_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-dma_ch-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-duplex_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-idx-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_ptp.c:warning:no-previous-prototype-for-function-rnp_ptp_setup_ptp | |-- drivers-net-ethernet-mucse-rnp-rnp_ptp.c:warning:variable-ts_event_en-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:no-previous-prototype-for-function-check_ari_mode | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:no-previous-prototype-for-function-rnp_msg_post_status_signle_link | |-- drivers-net-ethernet-mucse-rnp-rnp_sysfs.c:warning:no-previous-prototype-for-function-rnp_mbx_get_pn_sn | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr |-- x86_64-buildonly-randconfig-001-20250108 | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-002-20250108 | `-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-003-20250108 | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-004-20241230 | `-- kernel-bpf-verifier.o:warning:objtool:do_check_common:unreachable-instruction |-- x86_64-buildonly-randconfig-005-20250108 | |-- fs-cachefiles-ondemand.c:warning:implicit-conversion-from-enum-cachefiles_obj_ref_trace-to-enum-fscache_obj_ref_trace | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-cachefiles_readpages_work_func | `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-cachefiles_check_old_object_xattr |-- x86_64-buildonly-randconfig-006-20250108 | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- x86_64-randconfig-121-20250108 |-- fs-cachefiles-daemon.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__rcu-slot-got-void-slot |-- fs-cachefiles-daemon.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-slot-got-void-noderef-__rcu |-- fs-cachefiles-ondemand.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__rcu-slot-got-void-slot `-- fs-cachefiles-ondemand.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-slot-got-void-noderef-__rcu elapsed time: 727m configs tested: 15 configs skipped: 118 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250108 gcc-14.2.0 arm64 randconfig-002-20250108 clang-20 arm64 randconfig-003-20250108 gcc-14.2.0 arm64 randconfig-004-20250108 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250108 clang-19 x86_64 buildonly-randconfig-002-20250108 gcc-11 x86_64 buildonly-randconfig-003-20250108 clang-19 x86_64 buildonly-randconfig-004-20250108 gcc-12 x86_64 buildonly-randconfig-005-20250108 gcc-12 x86_64 buildonly-randconfig-006-20250108 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1395/1395] net/tipc/.tmp_topsrv.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 09 Jan '25

09 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ba3cb2368ba01dbe03899a6eadacb91053e1f40e commit: e373fab80587f72c98463df1f4511d06011f915c [1395/1395] tipc: fix modprobe tipc failed after switch order of device registration config: x86_64-buildonly-randconfig-001-20250108 (https://download.01.org/0day-ci/archive/20250109/202501090232.iMcOsezA-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250109/202501090232.iMcOsezA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501090232.iMcOsezA-lkp@intel.com/ All warnings (new ones prefixed by >>): net/tipc/topsrv.c:82: warning: Function parameter or member 'awork' not described in 'tipc_topsrv' net/tipc/topsrv.c:82: warning: Function parameter or member 'listener' not described in 'tipc_topsrv' >> net/tipc/.tmp_topsrv.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2668/2668] fs/cachefiles/ondemand.c:211:9: sparse: sparse: incorrect type in assignment (different address spaces)
by kernel test robot 08 Jan '25

08 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ed8467e701e8f5ed9f2b39cf55710a156fc2593f commit: 2937cd5f8c58bd8e7895f6b2698057721442248e [2668/2668] cachefiles: notify the user daemon when looking up cookie config: x86_64-randconfig-121-20250108 (https://download.01.org/0day-ci/archive/20250108/202501081846.dn5sbz8W-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250108/202501081846.dn5sbz8W-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501081846.dn5sbz8W-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> fs/cachefiles/ondemand.c:211:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void **slot @@ got void [noderef] __rcu ** @@ fs/cachefiles/ondemand.c:211:9: sparse: expected void **slot fs/cachefiles/ondemand.c:211:9: sparse: got void [noderef] __rcu ** >> fs/cachefiles/ondemand.c:211:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void **slot @@ got void [noderef] __rcu ** @@ fs/cachefiles/ondemand.c:211:9: sparse: expected void **slot fs/cachefiles/ondemand.c:211:9: sparse: got void [noderef] __rcu ** >> fs/cachefiles/ondemand.c:213:55: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __rcu **slot @@ got void **slot @@ fs/cachefiles/ondemand.c:213:55: sparse: expected void [noderef] __rcu **slot fs/cachefiles/ondemand.c:213:55: sparse: got void **slot fs/cachefiles/ondemand.c:211:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __rcu **slot @@ got void **slot @@ fs/cachefiles/ondemand.c:211:9: sparse: expected void [noderef] __rcu **slot fs/cachefiles/ondemand.c:211:9: sparse: got void **slot >> fs/cachefiles/ondemand.c:211:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void **slot @@ got void [noderef] __rcu ** @@ fs/cachefiles/ondemand.c:211:9: sparse: expected void **slot fs/cachefiles/ondemand.c:211:9: sparse: got void [noderef] __rcu ** -- >> fs/cachefiles/daemon.c:155:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void **slot @@ got void [noderef] __rcu ** @@ fs/cachefiles/daemon.c:155:9: sparse: expected void **slot fs/cachefiles/daemon.c:155:9: sparse: got void [noderef] __rcu ** >> fs/cachefiles/daemon.c:155:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void **slot @@ got void [noderef] __rcu ** @@ fs/cachefiles/daemon.c:155:9: sparse: expected void **slot fs/cachefiles/daemon.c:155:9: sparse: got void [noderef] __rcu ** >> fs/cachefiles/daemon.c:156:55: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __rcu **slot @@ got void **slot @@ fs/cachefiles/daemon.c:156:55: sparse: expected void [noderef] __rcu **slot fs/cachefiles/daemon.c:156:55: sparse: got void **slot fs/cachefiles/daemon.c:155:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __rcu **slot @@ got void **slot @@ fs/cachefiles/daemon.c:155:9: sparse: expected void [noderef] __rcu **slot fs/cachefiles/daemon.c:155:9: sparse: got void **slot >> fs/cachefiles/daemon.c:155:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void **slot @@ got void [noderef] __rcu ** @@ fs/cachefiles/daemon.c:155:9: sparse: expected void **slot fs/cachefiles/daemon.c:155:9: sparse: got void [noderef] __rcu ** vim +211 fs/cachefiles/ondemand.c 194 195 ssize_t cachefiles_ondemand_daemon_read(struct cachefiles_cache *cache, 196 char __user *_buffer, size_t buflen, loff_t *pos) 197 { 198 struct cachefiles_req *req; 199 struct cachefiles_msg *msg; 200 unsigned long id = 0; 201 size_t n; 202 int ret = 0; 203 struct radix_tree_iter iter; 204 void **slot; 205 206 /* 207 * Search for a request that has not ever been processed, to prevent 208 * requests from being processed repeatedly. 209 */ 210 xa_lock(&cache->reqs); > 211 radix_tree_for_each_tagged(slot, &cache->reqs, &iter, 0, 212 CACHEFILES_REQ_NEW) { > 213 req = radix_tree_deref_slot_protected(slot, 214 &cache->reqs.xa_lock); 215 216 msg = &req->msg; 217 n = msg->len; 218 219 if (n > buflen) { 220 xa_unlock(&cache->reqs); 221 return -EMSGSIZE; 222 } 223 224 radix_tree_iter_tag_clear(&cache->reqs, &iter, 225 CACHEFILES_REQ_NEW); 226 xa_unlock(&cache->reqs); 227 228 id = iter.index; 229 msg->msg_id = id; 230 231 if (msg->opcode == CACHEFILES_OP_OPEN) { 232 ret = cachefiles_ondemand_get_fd(req); 233 if (ret) 234 goto error; 235 } 236 237 if (copy_to_user(_buffer, msg, n) != 0) { 238 ret = -EFAULT; 239 goto err_put_fd; 240 } 241 return n; 242 } 243 xa_unlock(&cache->reqs); 244 return 0; 245 246 err_put_fd: 247 if (msg->opcode == CACHEFILES_OP_OPEN) 248 __close_fd(current->files, 249 ((struct cachefiles_open *)msg->data)->fd); 250 error: 251 xa_lock(&cache->reqs); 252 radix_tree_delete(&cache->reqs, id); 253 xa_unlock(&cache->reqs); 254 req->error = ret; 255 complete(&req->done); 256 return ret; 257 } 258 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/1] olk-6.6
by Yuntao Liu 08 Jan '25

08 Jan '25

CVE-2024-53231 Jinjie Ruan (1): cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw() drivers/cpufreq/cppc_cpufreq.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] olk-6.6
by Yuntao Liu 08 Jan '25

08 Jan '25

CVE-2024-53190 Guilherme G. Piccoli (1): wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures drivers/net/wireless/realtek/rtlwifi/efuse.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] CVE-2024-53190
by Yuntao Liu 08 Jan '25

08 Jan '25

CVE-2024-53190 Guilherme G. Piccoli (1): wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures drivers/net/wireless/realtek/rtlwifi/efuse.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] OLK-5.10
by Yuntao Liu 08 Jan '25

08 Jan '25

CVE-2024-53190 Guilherme G. Piccoli (1): wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures drivers/net/wireless/realtek/rtlwifi/efuse.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] openEuler-22.03-LTS-SP1 olk-5.10
by Yuntao Liu 08 Jan '25

08 Jan '25

CVE-2024-53190 Guilherme G. Piccoli (1): wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures drivers/net/wireless/realtek/rtlwifi/efuse.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6] drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability
by Zhao Yipeng 08 Jan '25

08 Jan '25

From: Suraj Kandpal <suraj.kandpal(a)intel.com> mainline inclusion from mainline-v6.12-rc1 commit 31b42af516afa1e184d1a9f9dd4096c54044269a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KR6 CVE: CVE-2024-53051 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability Sometimes during hotplug scenario or suspend/resume scenario encoder is not always initialized when intel_hdcp_get_capability add a check to avoid kernel null pointer dereference. Signed-off-by: Suraj Kandpal <suraj.kandpal(a)intel.com> Reviewed-by: Dnyaneshwar Bhadane <dnyaneshwar.bhadane(a)intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240722064451.3610512-2-sura… Conflicts: drivers/gpu/drm/i915/display/intel_hdcp.c [The conflict is that the name of the function intel_hdcp_capable has been changed to intel_hdcp_get_capability in the mainline commit 8e754d9e9e8a068d18cba6618e099a1f24347c98. And in order to reduce the scope of modification, only the code changes in the function are merged.] Signed-off-by: Zhao Yipeng <zhaoyipeng5(a)huawei.com> --- drivers/gpu/drm/i915/display/intel_hdcp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/display/intel_hdcp.c b/drivers/gpu/drm/i915/display/intel_hdcp.c index cb99839afcd0..aa4c06b15190 100644 --- a/drivers/gpu/drm/i915/display/intel_hdcp.c +++ b/drivers/gpu/drm/i915/display/intel_hdcp.c @@ -142,11 +142,16 @@ int intel_hdcp_read_valid_bksv(struct intel_digital_port *dig_port, /* Is HDCP1.4 capable on Platform and Sink */ bool intel_hdcp_capable(struct intel_connector *connector) { - struct intel_digital_port *dig_port = intel_attached_dig_port(connector); + struct intel_digital_port *dig_port; const struct intel_hdcp_shim *shim = connector->hdcp.shim; bool capable = false; u8 bksv[5]; + if (!intel_attached_encoder(connector)) + return capable; + + dig_port = intel_attached_dig_port(connector); + if (!shim) return capable; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] net: af_can: do not leave a dangling sk pointer in can_create()
by Zhang Changzhong 08 Jan '25

08 Jan '25

From: Ignat Korchagin <ignat(a)cloudflare.com> mainline inclusion from mainline-v6.13-rc1 commit 811a7ca7320c062e15d0f5b171fe6ad8592d1434 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANB CVE: CVE-2024-56603 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On error can_create() frees the allocated sk object, but sock_init_data() has already attached it to the provided sock object. This will leave a dangling sk pointer in the sock object and may cause use-after-free later. Signed-off-by: Ignat Korchagin <ignat(a)cloudflare.com> Reviewed-by: Vincent Mailhol <mailhol.vincent(a)wanadoo.fr> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Link: https://patch.msgid.link/20241014153808.51894-5-ignat@cloudflare.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/can/af_can.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/can/af_can.c b/net/can/af_can.c index 7c80315..76b75de 100644 --- a/net/can/af_can.c +++ b/net/can/af_can.c @@ -189,6 +189,7 @@ static int can_create(struct net *net, struct socket *sock, int protocol, /* release sk on errors */ sock_orphan(sk); sock_put(sk); + sock->sk = NULL; } errout: -- 2.9.5

2 1

[openeuler:OLK-6.6 1788/1788] drivers/cpufreq/cppc_cpufreq.c:852:26: error: invalid use of undefined type 'struct fb_ctr_pair'
by kernel test robot 08 Jan '25

08 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 31b452f6f79028714fdf063d4e4f6b9d5cb87751 commit: 12f136b2134d4ded731c3ef23ac08c85b9c0b1fa [1788/1788] cpufreq: CPPC: Keep the target core awake when reading its cpufreq rate config: arm64-randconfig-001-20250108 (https://download.01.org/0day-ci/archive/20250108/202501081558.g5cb5wQS-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250108/202501081558.g5cb5wQS-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501081558.g5cb5wQS-lkp@intel.com/ All error/warnings (new ones prefixed by >>): drivers/cpufreq/cppc_cpufreq.c: In function 'cppc_get_perf_ctrs_pair': >> drivers/cpufreq/cppc_cpufreq.c:852:26: error: invalid use of undefined type 'struct fb_ctr_pair' 852 | int cpu = fb_ctrs->cpu; | ^~ drivers/cpufreq/cppc_cpufreq.c:855:47: error: invalid use of undefined type 'struct fb_ctr_pair' 855 | ret = cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t0); | ^~ drivers/cpufreq/cppc_cpufreq.c:861:48: error: invalid use of undefined type 'struct fb_ctr_pair' 861 | return cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t1); | ^~ drivers/cpufreq/cppc_cpufreq.c: In function 'cppc_cpufreq_get_rate': >> drivers/cpufreq/cppc_cpufreq.c:866:16: error: variable 'fb_ctrs' has initializer but incomplete type 866 | struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; | ^~~~~~~~~~~ >> drivers/cpufreq/cppc_cpufreq.c:866:41: error: 'struct fb_ctr_pair' has no member named 'cpu' 866 | struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; | ^~~ >> drivers/cpufreq/cppc_cpufreq.c:866:47: warning: excess elements in struct initializer 866 | struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; | ^~~ drivers/cpufreq/cppc_cpufreq.c:866:47: note: (near initialization for 'fb_ctrs') >> drivers/cpufreq/cppc_cpufreq.c:866:28: error: storage size of 'fb_ctrs' isn't known 866 | struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; | ^~~~~~~ >> drivers/cpufreq/cppc_cpufreq.c:866:28: warning: unused variable 'fb_ctrs' [-Wunused-variable] vim +852 drivers/cpufreq/cppc_cpufreq.c 848 849 static int cppc_get_perf_ctrs_pair(void *val) 850 { 851 struct fb_ctr_pair *fb_ctrs = val; > 852 int cpu = fb_ctrs->cpu; 853 int ret; 854 855 ret = cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t0); 856 if (ret) 857 return ret; 858 859 udelay(2); /* 2usec delay between sampling */ 860 861 return cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t1); 862 } 863 864 static unsigned int cppc_cpufreq_get_rate(unsigned int cpu) 865 { > 866 struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; 867 struct cpufreq_policy *policy = cpufreq_cpu_get(cpu); 868 struct cppc_cpudata *cpu_data = policy->driver_data; 869 u64 delivered_perf; 870 int ret; 871 872 cpufreq_cpu_put(policy); 873 874 if (cpu_has_amu_feat(cpu)) 875 ret = smp_call_on_cpu(cpu, cppc_get_perf_ctrs_pair, 876 &fb_ctrs, false); 877 else 878 ret = cppc_get_perf_ctrs_pair(&fb_ctrs); 879 880 if (ret) 881 return 0; 882 883 delivered_perf = cppc_perf_from_fbctrs(cpu_data, 884 &fb_ctrs.fb_ctrs_t0, 885 &fb_ctrs.fb_ctrs_t1); 886 887 return cppc_cpufreq_perf_to_khz(cpu_data, delivered_perf); 888 } 889 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] af_packet: avoid erroring out after sock_init_data() in packet_create()
by Zhang Changzhong 08 Jan '25

08 Jan '25

From: Ignat Korchagin <ignat(a)cloudflare.com> stable inclusion from stable-v5.10.231 commit 1dc1e1db927056cb323296e2294a855cd003dfe7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANY CVE: CVE-2024-56606 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 46f2a11cb82b657fd15bab1c47821b635e03838b ] After sock_init_data() the allocated sk object is attached to the provided sock object. On error, packet_create() frees the sk object leaving the dangling pointer in the sock object on return. Some other code may try to use this pointer and cause use-after-free. Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Ignat Korchagin <ignat(a)cloudflare.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241014153808.51894-2-ignat@cloudflare.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/packet/af_packet.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 6278535..62d1900 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -3315,18 +3315,18 @@ static int packet_create(struct net *net, struct socket *sock, int protocol, if (sock->type == SOCK_PACKET) sock->ops = &packet_ops_spkt; + po = pkt_sk(sk); + err = packet_alloc_pending(po); + if (err) + goto out_sk_free; + sock_init_data(sock, sk); - po = pkt_sk(sk); init_completion(&po->skb_completion); sk->sk_family = PF_PACKET; po->num = proto; po->xmit = dev_queue_xmit; - err = packet_alloc_pending(po); - if (err) - goto out2; - packet_cached_dev_reset(po); sk->sk_destruct = packet_sock_destruct; @@ -3361,7 +3361,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol, preempt_enable(); return 0; -out2: +out_sk_free: sk_free(sk); out: return err; -- 2.9.5

2 1

[PATCH OLK-5.10] af_packet: avoid erroring out after sock_init_data() in packet_create()
by Zhang Changzhong 08 Jan '25

08 Jan '25

From: Ignat Korchagin <ignat(a)cloudflare.com> stable inclusion from stable-v5.10.231 commit 1dc1e1db927056cb323296e2294a855cd003dfe7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANY CVE: CVE-2024-56606 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 46f2a11cb82b657fd15bab1c47821b635e03838b ] After sock_init_data() the allocated sk object is attached to the provided sock object. On error, packet_create() frees the sk object leaving the dangling pointer in the sock object on return. Some other code may try to use this pointer and cause use-after-free. Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Ignat Korchagin <ignat(a)cloudflare.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241014153808.51894-2-ignat@cloudflare.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/packet/af_packet.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 7740ab13..ae57d3e 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -3321,18 +3321,18 @@ static int packet_create(struct net *net, struct socket *sock, int protocol, if (sock->type == SOCK_PACKET) sock->ops = &packet_ops_spkt; + po = pkt_sk(sk); + err = packet_alloc_pending(po); + if (err) + goto out_sk_free; + sock_init_data(sock, sk); - po = pkt_sk(sk); init_completion(&po->skb_completion); sk->sk_family = PF_PACKET; po->num = proto; po->xmit = dev_queue_xmit; - err = packet_alloc_pending(po); - if (err) - goto out2; - packet_cached_dev_reset(po); sk->sk_destruct = packet_sock_destruct; @@ -3367,7 +3367,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol, preempt_enable(); return 0; -out2: +out_sk_free: sk_free(sk); out: return err; -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1] media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
by Qi Xi 08 Jan '25

08 Jan '25

From: Gaosheng Cui <cuigaosheng1(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit 0f514068fbc5d4d189c817adc7c4e32cffdc2e47 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMP CVE: CVE-2024-56572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The buffer in the loop should be released under the exception path, otherwise there may be a memory leak here. To mitigate this, free the buffer when allegro_alloc_buffer fails. Fixes: f20387dfd065 ("media: allegro: add Allegro DVT video IP core driver") Cc: <stable(a)vger.kernel.org> Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/staging/media/allegro-dvt/allegro-core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/staging/media/allegro-dvt/allegro-core.c b/drivers/staging/media/allegro-dvt/allegro-core.c index 28b6ba895ccd..84bd3d8649a8 100644 --- a/drivers/staging/media/allegro-dvt/allegro-core.c +++ b/drivers/staging/media/allegro-dvt/allegro-core.c @@ -1208,8 +1208,10 @@ static int allocate_buffers_internal(struct allegro_channel *channel, INIT_LIST_HEAD(&buffer->head); err = allegro_alloc_buffer(dev, buffer, size); - if (err) + if (err) { + kfree(buffer); goto err; + } list_add(&buffer->head, list); } -- 2.33.0

2 1

[PATCH OLK-6.6 0/9] CVE-2024-50102
by Qi Xi 08 Jan '25

08 Jan '25

*** BLURB HERE *** David Gow (1): x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit David Laight (1): x86: fix off-by-one in access_ok() Linus Torvalds (5): runtime constants: deal with old decrepit linkers runtime constants: add x86 architecture support x86: fix whitespace in runtime-const assembler output x86/uaccess: Improve the 8-byte getuser() case x86: fix user address masking non-canonical speculation issue Stephen Brennan (1): dcache: keep dentry_hashtable or d_hash_shift even when not used Thomas Gleixner (1): x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() arch/x86/include/asm/runtime-const.h | 61 +++++++++++++++++++++ arch/x86/include/asm/uaccess_64.h | 49 ++++++++++------- arch/x86/kernel/cpu/common.c | 10 ++++ arch/x86/kernel/vmlinux.lds.S | 4 ++ arch/x86/lib/getuser.S | 80 ++++++++++------------------ fs/dcache.c | 9 +++- include/asm-generic/vmlinux.lds.h | 7 +++ 7 files changed, 149 insertions(+), 71 deletions(-) create mode 100644 arch/x86/include/asm/runtime-const.h -- 2.33.0

2 10

[PATCH OLK-6.6] [Backport] btrfs: fix use-after-free in btrfs_encoded_read_endio()
by Yongjian Sun 08 Jan '25

08 Jan '25

From: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> mainline inclusion from mainline-v6.12-rc3 commit 05b36b04d74a517d6675bf2f90829ff1ac7e28dc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOP CVE: CVE-2024-56582 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Shinichiro reported the following use-after free that sometimes is happening in our CI system when running fstests' btrfs/284 on a TCMU runner device: BUG: KASAN: slab-use-after-free in lock_release+0x708/0x780 Read of size 8 at addr ffff888106a83f18 by task kworker/u80:6/219 CPU: 8 UID: 0 PID: 219 Comm: kworker/u80:6 Not tainted 6.12.0-rc6-kts+ #15 Hardware name: Supermicro Super Server/X11SPi-TF, BIOS 3.3 02/21/2020 Workqueue: btrfs-endio btrfs_end_bio_work [btrfs] Call Trace: <TASK> dump_stack_lvl+0x6e/0xa0 ? lock_release+0x708/0x780 print_report+0x174/0x505 ? lock_release+0x708/0x780 ? __virt_addr_valid+0x224/0x410 ? lock_release+0x708/0x780 kasan_report+0xda/0x1b0 ? lock_release+0x708/0x780 ? __wake_up+0x44/0x60 lock_release+0x708/0x780 ? __pfx_lock_release+0x10/0x10 ? __pfx_do_raw_spin_lock+0x10/0x10 ? lock_is_held_type+0x9a/0x110 _raw_spin_unlock_irqrestore+0x1f/0x60 __wake_up+0x44/0x60 btrfs_encoded_read_endio+0x14b/0x190 [btrfs] btrfs_check_read_bio+0x8d9/0x1360 [btrfs] ? lock_release+0x1b0/0x780 ? trace_lock_acquire+0x12f/0x1a0 ? __pfx_btrfs_check_read_bio+0x10/0x10 [btrfs] ? process_one_work+0x7e3/0x1460 ? lock_acquire+0x31/0xc0 ? process_one_work+0x7e3/0x1460 process_one_work+0x85c/0x1460 ? __pfx_process_one_work+0x10/0x10 ? assign_work+0x16c/0x240 worker_thread+0x5e6/0xfc0 ? __pfx_worker_thread+0x10/0x10 kthread+0x2c3/0x3a0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 3661: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 btrfs_encoded_read_regular_fill_pages+0x16c/0x6d0 [btrfs] send_extent_data+0xf0f/0x24a0 [btrfs] process_extent+0x48a/0x1830 [btrfs] changed_cb+0x178b/0x2ea0 [btrfs] btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs] _btrfs_ioctl_send+0x117/0x330 [btrfs] btrfs_ioctl+0x184a/0x60a0 [btrfs] __x64_sys_ioctl+0x12e/0x1a0 do_syscall_64+0x95/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 3661: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x70 __kasan_slab_free+0x4f/0x70 kfree+0x143/0x490 btrfs_encoded_read_regular_fill_pages+0x531/0x6d0 [btrfs] send_extent_data+0xf0f/0x24a0 [btrfs] process_extent+0x48a/0x1830 [btrfs] changed_cb+0x178b/0x2ea0 [btrfs] btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs] _btrfs_ioctl_send+0x117/0x330 [btrfs] btrfs_ioctl+0x184a/0x60a0 [btrfs] __x64_sys_ioctl+0x12e/0x1a0 do_syscall_64+0x95/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e The buggy address belongs to the object at ffff888106a83f00 which belongs to the cache kmalloc-rnd-07-96 of size 96 The buggy address is located 24 bytes inside of freed 96-byte region [ffff888106a83f00, ffff888106a83f60) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888106a83800 pfn:0x106a83 flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) page_type: f5(slab) raw: 0017ffffc0000000 ffff888100053680 ffffea0004917200 0000000000000004 raw: ffff888106a83800 0000000080200019 00000001f5000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888106a83e00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff888106a83e80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc >ffff888106a83f00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888106a83f80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff888106a84000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== Further analyzing the trace and the crash dump's vmcore file shows that the wake_up() call in btrfs_encoded_read_endio() is calling wake_up() on the wait_queue that is in the private data passed to the end_io handler. Commit 4ff47df40447 ("btrfs: move priv off stack in btrfs_encoded_read_regular_fill_pages()") moved 'struct btrfs_encoded_read_private' off the stack. Before that commit one can see a corruption of the private data when analyzing the vmcore after a crash: *(struct btrfs_encoded_read_private *)0xffff88815626eec8 = { .wait = (wait_queue_head_t){ .lock = (spinlock_t){ .rlock = (struct raw_spinlock){ .raw_lock = (arch_spinlock_t){ .val = (atomic_t){ .counter = (int)-2005885696, }, .locked = (u8)0, .pending = (u8)157, .locked_pending = (u16)40192, .tail = (u16)34928, }, .magic = (unsigned int)536325682, .owner_cpu = (unsigned int)29, .owner = (void *)__SCT__tp_func_btrfs_transaction_commit+0x0 = 0x0, .dep_map = (struct lockdep_map){ .key = (struct lock_class_key *)0xffff8881575a3b6c, .class_cache = (struct lock_class *[2]){ 0xffff8882a71985c0, 0xffffea00066f5d40 }, .name = (const char *)0xffff88815626f100 = "", .wait_type_outer = (u8)37, .wait_type_inner = (u8)178, .lock_type = (u8)154, }, }, .__padding = (u8 [24]){ 0, 157, 112, 136, 50, 174, 247, 31, 29 }, .dep_map = (struct lockdep_map){ .key = (struct lock_class_key *)0xffff8881575a3b6c, .class_cache = (struct lock_class *[2]){ 0xffff8882a71985c0, 0xffffea00066f5d40 }, .name = (const char *)0xffff88815626f100 = "", .wait_type_outer = (u8)37, .wait_type_inner = (u8)178, .lock_type = (u8)154, }, }, .head = (struct list_head){ .next = (struct list_head *)0x112cca, .prev = (struct list_head *)0x47, }, }, .pending = (atomic_t){ .counter = (int)-1491499288, }, .status = (blk_status_t)130, } Here we can see several indicators of in-memory data corruption, e.g. the large negative atomic values of ->pending or ->wait->lock->rlock->raw_lock->val, as well as the bogus spinlock magic 0x1ff7ae32 (decimal 536325682 above) instead of 0xdead4ead or the bogus pointer values for ->wait->head. To fix this, change atomic_dec_return() to atomic_dec_and_test() to fix the corruption, as atomic_dec_return() is defined as two instructions on x86_64, whereas atomic_dec_and_test() is defined as a single atomic operation. This can lead to a situation where counter value is already decremented but the if statement in btrfs_encoded_read_endio() is not completely processed, i.e. the 0 test has not completed. If another thread continues executing btrfs_encoded_read_regular_fill_pages() the atomic_dec_return() there can see an already updated ->pending counter and continues by freeing the private data. Continuing in the endio handler the test for 0 succeeds and the wait_queue is woken up, resulting in a use-after-free. Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> Suggested-by: Damien Le Moal <Damien.LeMoal(a)wdc.com> Fixes: 1881fba89bd5 ("btrfs: add BTRFS_IOC_ENCODED_READ ioctl") CC: stable(a)vger.kernel.org # 6.1+ Reviewed-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Sun Yongjian <sunyongjian1(a)huawei.com> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/btrfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index fae45b8d485e..fb262145f193 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -9974,7 +9974,7 @@ static void btrfs_encoded_read_endio(struct btrfs_bio *bbio) */ WRITE_ONCE(priv->status, bbio->bio.bi_status); } - if (!atomic_dec_return(&priv->pending)) + if (atomic_dec_and_test(&priv->pending)) wake_up(&priv->wait); bio_put(&bbio->bio); } -- 2.39.2

2 1

[PATCH OLK-6.6] bpf: fix recursive lock when verdict program return SK_PASS
by Liu Jian 08 Jan '25

08 Jan '25

From: Jiayuan Chen <mrpre(a)163.com> stable inclusion from stable-v6.6.64 commit da2bc8a0c8f3ac66fdf980fc59936f851a083561 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDOY CVE: CVE-2024-56694 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 8ca2a1eeadf09862190b2810697702d803ceef2d ] When the stream_verdict program returns SK_PASS, it places the received skb into its own receive queue, but a recursive lock eventually occurs, leading to an operating system deadlock. This issue has been present since v6.9. ''' sk_psock_strp_data_ready write_lock_bh(&sk->sk_callback_lock) strp_data_ready strp_read_sock read_sock -> tcp_read_sock strp_recv cb.rcv_msg -> sk_psock_strp_read # now stream_verdict return SK_PASS without peer sock assign __SK_PASS = sk_psock_map_verd(SK_PASS, NULL) sk_psock_verdict_apply sk_psock_skb_ingress_self sk_psock_skb_ingress_enqueue sk_psock_data_ready read_lock_bh(&sk->sk_callback_lock) <= dead lock ''' This topic has been discussed before, but it has not been fixed. Previous discussion: https://lore.kernel.org/all/6684a5864ec86_403d20898@john.notmuch Fixes: 6648e613226e ("bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue") Reported-by: Vincent Whitchurch <vincent.whitchurch(a)datadoghq.com> Signed-off-by: Jiayuan Chen <mrpre(a)163.com> Signed-off-by: John Fastabend <john.fastabend(a)gmail.com> Acked-by: Martin KaFai Lau <martin.lau(a)kernel.org> Link: https://patch.msgid.link/20241118030910.36230-2-mrpre@163.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/skmsg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/core/skmsg.c b/net/core/skmsg.c index 04a98327f81a4..5e77b9344d667 100644 --- a/net/core/skmsg.c +++ b/net/core/skmsg.c @@ -1125,9 +1125,9 @@ static void sk_psock_strp_data_ready(struct sock *sk) if (tls_sw_has_ctx_rx(sk)) { psock->saved_data_ready(sk); } else { - write_lock_bh(&sk->sk_callback_lock); + read_lock_bh(&sk->sk_callback_lock); strp_data_ready(&psock->strp); - write_unlock_bh(&sk->sk_callback_lock); + read_unlock_bh(&sk->sk_callback_lock); } } rcu_read_unlock(); -- 2.34.1

2 5

[PATCH OLK-5.10] net: hsr: avoid potential out-of-bound access in fill_frame_info()
by Liu Jian 08 Jan '25

08 Jan '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.231 commit aa632691c722a123e47ccd05a3afdd5f87a36061 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANV CVE: CVE-2024-56648 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit b9653d19e556c6afd035602927a93d100a0d7644 ] syzbot is able to feed a packet with 14 bytes, pretending it is a vlan one. Since fill_frame_info() is relying on skb->mac_len already, extend the check to cover this case. BUG: KMSAN: uninit-value in fill_frame_info net/hsr/hsr_forward.c:709 [inline] BUG: KMSAN: uninit-value in hsr_forward_skb+0x9ee/0x3b10 net/hsr/hsr_forward.c:724 fill_frame_info net/hsr/hsr_forward.c:709 [inline] hsr_forward_skb+0x9ee/0x3b10 net/hsr/hsr_forward.c:724 hsr_dev_xmit+0x2f0/0x350 net/hsr/hsr_device.c:235 __netdev_start_xmit include/linux/netdevice.h:5002 [inline] netdev_start_xmit include/linux/netdevice.h:5011 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3606 __dev_queue_xmit+0x366a/0x57d0 net/core/dev.c:4434 dev_queue_xmit include/linux/netdevice.h:3168 [inline] packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3146 [inline] packet_sendmsg+0x91ae/0xa6f0 net/packet/af_packet.c:3178 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:726 __sys_sendto+0x594/0x750 net/socket.c:2197 __do_sys_sendto net/socket.c:2204 [inline] __se_sys_sendto net/socket.c:2200 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2200 x64_sys_call+0x346a/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4091 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4186 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1323 [inline] alloc_skb_with_frags+0xc8/0xd00 net/core/skbuff.c:6612 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2881 packet_alloc_skb net/packet/af_packet.c:2995 [inline] packet_snd net/packet/af_packet.c:3089 [inline] packet_sendmsg+0x74c6/0xa6f0 net/packet/af_packet.c:3178 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:726 __sys_sendto+0x594/0x750 net/socket.c:2197 __do_sys_sendto net/socket.c:2204 [inline] __se_sys_sendto net/socket.c:2200 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2200 x64_sys_call+0x346a/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 48b491a5cc74 ("net: hsr: fix mac_len checks") Reported-by: syzbot+671e2853f9851d039551(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6745dc7f.050a0220.21d33d.0018.GAE@google.com… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: WingMan Kwok <w-kwok2(a)ti.com> Cc: Murali Karicheri <m-karicheri2(a)ti.com> Cc: MD Danish Anwar <danishanwar(a)ti.com> Cc: Jiri Pirko <jiri(a)nvidia.com> Cc: George McCollister <george.mccollister(a)gmail.com> Link: https://patch.msgid.link/20241126144344.4177332-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/hsr/hsr_forward.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c index 0c115d8ded03c..a58c0be64272b 100644 --- a/net/hsr/hsr_forward.c +++ b/net/hsr/hsr_forward.c @@ -525,6 +525,8 @@ static int fill_frame_info(struct hsr_frame_info *frame, frame->is_vlan = true; if (frame->is_vlan) { + if (skb->mac_len < offsetofend(struct hsr_vlan_ethhdr, vlanhdr)) + return -EINVAL; vlan_hdr = (struct hsr_vlan_ethhdr *)ethhdr; proto = vlan_hdr->vlanhdr.h_vlan_encapsulated_proto; /* FIXME: */ -- 2.34.1

2 1

[PATCH OLK-6.6 00/16] net:yt6801: Add Motorcomm yt6801 PCIe driver
by Frank Sae 08 Jan '25

08 Jan '25

This series includes adding Motorcomm YT6801 Gigabit ethernet driver and adding yt6801 ethernet driver entry in MAINTAINERS file. YT6801 integrates a YT8531S phy. Frank Sae (16): motorcomm:yt6801: Add support for a pci table in this module motorcomm:yt6801: Implement pci_driver shutdown motorcomm:yt6801: Implement the fxgmac_drv_probe function motorcomm:yt6801: Implement the .ndo_open function motorcomm:yt6801: Implement the fxgmac_start function motorcomm:yt6801: Implement the poll functions motorcomm:yt6801: Implement the fxgmac_init function motorcomm:yt6801: Implement the fxgmac_read_mac_addr function motorcomm:yt6801: Implement some hw_ops function motorcomm:yt6801: Implement .ndo_start_xmit function motorcomm:yt6801: Implement some net_device_ops function motorcomm:yt6801: Implement .ndo_tx_timeout and .ndo_change_mtu functions motorcomm:yt6801: Implement some ethtool_ops function motorcomm:yt6801: Implement the WOL function of ethtool_ops motorcomm:yt6801: Implement pci_driver suspend and resume motorcomm:yt6801: Update the Makefile, Kconfig and maintainer for yt6801 MAINTAINERS | 8 + arch/arm64/configs/openeuler_defconfig | 4 +- arch/powerpc/configs/openeuler_defconfig | 2 +- arch/riscv/configs/openeuler_defconfig | 4 +- arch/x86/configs/openeuler_defconfig | 4 +- drivers/net/ethernet/Kconfig | 1 + drivers/net/ethernet/Makefile | 1 + drivers/net/ethernet/motorcomm/Kconfig | 27 + drivers/net/ethernet/motorcomm/Makefile | 6 + .../net/ethernet/motorcomm/yt6801/Makefile | 9 + .../net/ethernet/motorcomm/yt6801/yt6801.h | 617 +++ .../ethernet/motorcomm/yt6801/yt6801_desc.c | 635 ++++ .../ethernet/motorcomm/yt6801/yt6801_desc.h | 39 + .../motorcomm/yt6801/yt6801_ethtool.c | 838 ++++ .../net/ethernet/motorcomm/yt6801/yt6801_hw.c | 3383 +++++++++++++++++ .../ethernet/motorcomm/yt6801/yt6801_net.c | 2907 ++++++++++++++ .../ethernet/motorcomm/yt6801/yt6801_net.h | 32 + .../ethernet/motorcomm/yt6801/yt6801_pci.c | 191 + .../ethernet/motorcomm/yt6801/yt6801_type.h | 1398 +++++++ 19 files changed, 10102 insertions(+), 4 deletions(-) create mode 100644 drivers/net/ethernet/motorcomm/Kconfig create mode 100644 drivers/net/ethernet/motorcomm/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801.h create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.h create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_ethtool.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_hw.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_net.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_net.h create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_pci.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_type.h -- 2.34.1

2 17

[PATCH OLK-5.10 0/2] CVE-2024-53237
by Guo Mengqi 08 Jan '25

08 Jan '25

CVE-2024-53237 Andy Shevchenko (1): driver core: Introduce device_find_any_child() helper Dmitry Antipov (1): Bluetooth: fix use-after-free in device_for_each_child() drivers/base/core.c | 20 ++++++++++++++++++++ include/linux/device.h | 2 ++ net/bluetooth/hci_sysfs.c | 15 ++++----------- 3 files changed, 26 insertions(+), 11 deletions(-) -- 2.22.0

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-53237
by Guo Mengqi 08 Jan '25

08 Jan '25

CVE-2024-53237 Aaron Lu (1): x86/sgx: Fix deadlock in SGX NUMA node search Weili Qian (1): crypto: hisilicon/qm - inject error before stopping queue -- 2.22.0

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-53237
by Guo Mengqi 08 Jan '25

08 Jan '25

CVE-2024-53237 Aaron Lu (1): x86/sgx: Fix deadlock in SGX NUMA node search Weili Qian (1): crypto: hisilicon/qm - inject error before stopping queue -- 2.22.0

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-56724
by Liao Chen 08 Jan '25

08 Jan '25

fix CVE-2024-56724 Andy Shevchenko (2): [Backport] mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device [Backport] mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device drivers/mfd/intel_soc_pmic_bxtwc.c | 82 +++++++++++++++++--------- drivers/platform/x86/intel_bxtwc_tmu.c | 22 ++----- drivers/usb/typec/tcpm/wcove.c | 4 -- 3 files changed, 60 insertions(+), 48 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] Bluetooth: fix use-after-free in device_for_each_child()
by Guo Mengqi 08 Jan '25

08 Jan '25

From: Dmitry Antipov <dmantipov(a)yandex.ru> stable inclusion from stable-v6.6.64 commit de5a44f351ca7efd9add9851b218f5353e2224b7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADX CVE: CVE-2024-53237 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 27aabf27fd014ae037cc179c61b0bee7cff55b3d ] Syzbot has reported the following KASAN splat: BUG: KASAN: slab-use-after-free in device_for_each_child+0x18f/0x1a0 Read of size 8 at addr ffff88801f605308 by task kbnepd bnep0/4980 CPU: 0 UID: 0 PID: 4980 Comm: kbnepd bnep0 Not tainted 6.12.0-rc4-00161-gae90f6a6170d #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x100/0x190 ? device_for_each_child+0x18f/0x1a0 print_report+0x13a/0x4cb ? __virt_addr_valid+0x5e/0x590 ? __phys_addr+0xc6/0x150 ? device_for_each_child+0x18f/0x1a0 kasan_report+0xda/0x110 ? device_for_each_child+0x18f/0x1a0 ? __pfx_dev_memalloc_noio+0x10/0x10 device_for_each_child+0x18f/0x1a0 ? __pfx_device_for_each_child+0x10/0x10 pm_runtime_set_memalloc_noio+0xf2/0x180 netdev_unregister_kobject+0x1ed/0x270 unregister_netdevice_many_notify+0x123c/0x1d80 ? __mutex_trylock_common+0xde/0x250 ? __pfx_unregister_netdevice_many_notify+0x10/0x10 ? trace_contention_end+0xe6/0x140 ? __mutex_lock+0x4e7/0x8f0 ? __pfx_lock_acquire.part.0+0x10/0x10 ? rcu_is_watching+0x12/0xc0 ? unregister_netdev+0x12/0x30 unregister_netdevice_queue+0x30d/0x3f0 ? __pfx_unregister_netdevice_queue+0x10/0x10 ? __pfx_down_write+0x10/0x10 unregister_netdev+0x1c/0x30 bnep_session+0x1fb3/0x2ab0 ? __pfx_bnep_session+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? __pfx_woken_wake_function+0x10/0x10 ? __kthread_parkme+0x132/0x200 ? __pfx_bnep_session+0x10/0x10 ? kthread+0x13a/0x370 ? __pfx_bnep_session+0x10/0x10 kthread+0x2b7/0x370 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x48/0x80 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 4974: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 __kmalloc_noprof+0x1d1/0x440 hci_alloc_dev_priv+0x1d/0x2820 __vhci_create_device+0xef/0x7d0 vhci_write+0x2c7/0x480 vfs_write+0x6a0/0xfc0 ksys_write+0x12f/0x260 do_syscall_64+0xc7/0x250 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 4979: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x4f/0x70 kfree+0x141/0x490 hci_release_dev+0x4d9/0x600 bt_host_release+0x6a/0xb0 device_release+0xa4/0x240 kobject_put+0x1ec/0x5a0 put_device+0x1f/0x30 vhci_release+0x81/0xf0 __fput+0x3f6/0xb30 task_work_run+0x151/0x250 do_exit+0xa79/0x2c30 do_group_exit+0xd5/0x2a0 get_signal+0x1fcd/0x2210 arch_do_signal_or_restart+0x93/0x780 syscall_exit_to_user_mode+0x140/0x290 do_syscall_64+0xd4/0x250 entry_SYSCALL_64_after_hwframe+0x77/0x7f In 'hci_conn_del_sysfs()', 'device_unregister()' may be called when an underlying (kobject) reference counter is greater than 1. This means that reparenting (happened when the device is actually freed) is delayed and, during that delay, parent controller device (hciX) may be deleted. Since the latter may create a dangling pointer to freed parent, avoid that scenario by reparenting to NULL explicitly. Reported-by: syzbot+6cf5652d3df49fae2e3f(a)syzkaller.appspotmail.com Tested-by: syzbot+6cf5652d3df49fae2e3f(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6cf5652d3df49fae2e3f Fixes: a85fb91e3d72 ("Bluetooth: Fix double free in hci_conn_cleanup") Signed-off-by: Dmitry Antipov <dmantipov(a)yandex.ru> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- net/bluetooth/hci_sysfs.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c index 367e32fe30eb..4b54dbbf0729 100644 --- a/net/bluetooth/hci_sysfs.c +++ b/net/bluetooth/hci_sysfs.c @@ -21,16 +21,6 @@ static const struct device_type bt_link = { .release = bt_link_release, }; -/* - * The rfcomm tty device will possibly retain even when conn - * is down, and sysfs doesn't support move zombie device, - * so we should move the device before conn device is destroyed. - */ -static int __match_tty(struct device *dev, void *data) -{ - return !strncmp(dev_name(dev), "rfcomm", 6); -} - void hci_conn_init_sysfs(struct hci_conn *conn) { struct hci_dev *hdev = conn->hdev; @@ -73,10 +63,13 @@ void hci_conn_del_sysfs(struct hci_conn *conn) return; } + /* If there are devices using the connection as parent reset it to NULL + * before unregistering the device. + */ while (1) { struct device *dev; - dev = device_find_child(&conn->dev, NULL, __match_tty); + dev = device_find_any_child(&conn->dev); if (!dev) break; device_move(dev, NULL, DPM_ORDER_DEV_LAST); -- 2.22.0

2 1

[PATCH OLK-5.10] Bluetooth: fix use-after-free in device_for_each_child()
by Guo Mengqi 08 Jan '25

08 Jan '25

From: Dmitry Antipov <dmantipov(a)yandex.ru> stable inclusion from stable-v5.10.231 commit fb91ce37dc9a37ea23cf32b6d7b667004e93d4c5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADX CVE: CVE-2024-53237 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 27aabf27fd014ae037cc179c61b0bee7cff55b3d ] Syzbot has reported the following KASAN splat: BUG: KASAN: slab-use-after-free in device_for_each_child+0x18f/0x1a0 Read of size 8 at addr ffff88801f605308 by task kbnepd bnep0/4980 CPU: 0 UID: 0 PID: 4980 Comm: kbnepd bnep0 Not tainted 6.12.0-rc4-00161-gae90f6a6170d #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x100/0x190 ? device_for_each_child+0x18f/0x1a0 print_report+0x13a/0x4cb ? __virt_addr_valid+0x5e/0x590 ? __phys_addr+0xc6/0x150 ? device_for_each_child+0x18f/0x1a0 kasan_report+0xda/0x110 ? device_for_each_child+0x18f/0x1a0 ? __pfx_dev_memalloc_noio+0x10/0x10 device_for_each_child+0x18f/0x1a0 ? __pfx_device_for_each_child+0x10/0x10 pm_runtime_set_memalloc_noio+0xf2/0x180 netdev_unregister_kobject+0x1ed/0x270 unregister_netdevice_many_notify+0x123c/0x1d80 ? __mutex_trylock_common+0xde/0x250 ? __pfx_unregister_netdevice_many_notify+0x10/0x10 ? trace_contention_end+0xe6/0x140 ? __mutex_lock+0x4e7/0x8f0 ? __pfx_lock_acquire.part.0+0x10/0x10 ? rcu_is_watching+0x12/0xc0 ? unregister_netdev+0x12/0x30 unregister_netdevice_queue+0x30d/0x3f0 ? __pfx_unregister_netdevice_queue+0x10/0x10 ? __pfx_down_write+0x10/0x10 unregister_netdev+0x1c/0x30 bnep_session+0x1fb3/0x2ab0 ? __pfx_bnep_session+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? __pfx_woken_wake_function+0x10/0x10 ? __kthread_parkme+0x132/0x200 ? __pfx_bnep_session+0x10/0x10 ? kthread+0x13a/0x370 ? __pfx_bnep_session+0x10/0x10 kthread+0x2b7/0x370 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x48/0x80 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 4974: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 __kmalloc_noprof+0x1d1/0x440 hci_alloc_dev_priv+0x1d/0x2820 __vhci_create_device+0xef/0x7d0 vhci_write+0x2c7/0x480 vfs_write+0x6a0/0xfc0 ksys_write+0x12f/0x260 do_syscall_64+0xc7/0x250 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 4979: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x4f/0x70 kfree+0x141/0x490 hci_release_dev+0x4d9/0x600 bt_host_release+0x6a/0xb0 device_release+0xa4/0x240 kobject_put+0x1ec/0x5a0 put_device+0x1f/0x30 vhci_release+0x81/0xf0 __fput+0x3f6/0xb30 task_work_run+0x151/0x250 do_exit+0xa79/0x2c30 do_group_exit+0xd5/0x2a0 get_signal+0x1fcd/0x2210 arch_do_signal_or_restart+0x93/0x780 syscall_exit_to_user_mode+0x140/0x290 do_syscall_64+0xd4/0x250 entry_SYSCALL_64_after_hwframe+0x77/0x7f In 'hci_conn_del_sysfs()', 'device_unregister()' may be called when an underlying (kobject) reference counter is greater than 1. This means that reparenting (happened when the device is actually freed) is delayed and, during that delay, parent controller device (hciX) may be deleted. Since the latter may create a dangling pointer to freed parent, avoid that scenario by reparenting to NULL explicitly. Reported-by: syzbot+6cf5652d3df49fae2e3f(a)syzkaller.appspotmail.com Tested-by: syzbot+6cf5652d3df49fae2e3f(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6cf5652d3df49fae2e3f Fixes: a85fb91e3d72 ("Bluetooth: Fix double free in hci_conn_cleanup") Signed-off-by: Dmitry Antipov <dmantipov(a)yandex.ru> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- net/bluetooth/hci_sysfs.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c index 266112c960ee..1b4d81ffb4b5 100644 --- a/net/bluetooth/hci_sysfs.c +++ b/net/bluetooth/hci_sysfs.c @@ -19,16 +19,6 @@ static const struct device_type bt_link = { .release = bt_link_release, }; -/* - * The rfcomm tty device will possibly retain even when conn - * is down, and sysfs doesn't support move zombie device, - * so we should move the device before conn device is destroyed. - */ -static int __match_tty(struct device *dev, void *data) -{ - return !strncmp(dev_name(dev), "rfcomm", 6); -} - void hci_conn_init_sysfs(struct hci_conn *conn) { struct hci_dev *hdev = conn->hdev; @@ -71,10 +61,13 @@ void hci_conn_del_sysfs(struct hci_conn *conn) return; } + /* If there are devices using the connection as parent reset it to NULL + * before unregistering the device. + */ while (1) { struct device *dev; - dev = device_find_child(&conn->dev, NULL, __match_tty); + dev = device_find_any_child(&conn->dev); if (!dev) break; device_move(dev, NULL, DPM_ORDER_DEV_LAST); -- 2.22.0

2 1

[PATCH openEuler-22.03-LTS-SP1] crypto: hisilicon/qm - inject error before stopping queue
by Guo Mengqi 08 Jan '25

08 Jan '25

From: Weili Qian <qianweili(a)huawei.com> stable inclusion from stable-v6.1.113 commit 98d3be34c9153eceadb56de50d9f9347e88d86e4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYQSI CVE: CVE-2024-47730 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b04f06fc0243600665b3b50253869533b7938468 ] The master ooo cannot be completely closed when the accelerator core reports memory error. Therefore, the driver needs to inject the qm error to close the master ooo. Currently, the qm error is injected after stopping queue, memory may be released immediately after stopping queue, causing the device to access the released memory. Therefore, error is injected to close master ooo before stopping queue to ensure that the device does not access the released memory. Fixes: 6c6dd5802c2d ("crypto: hisilicon/qm - add controller reset interface") Signed-off-by: Weili Qian <qianweili(a)huawei.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/crypto/hisilicon/qm.c [context conflict] Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/crypto/hisilicon/qm.c | 51 +++++++++++++++++------------------ 1 file changed, 24 insertions(+), 27 deletions(-) diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c index 382e54406510..179ec9710d8c 100644 --- a/drivers/crypto/hisilicon/qm.c +++ b/drivers/crypto/hisilicon/qm.c @@ -5058,6 +5058,28 @@ static int qm_set_vf_mse(struct hisi_qm *qm, bool set) return -ETIMEDOUT; } +static void qm_dev_ecc_mbit_handle(struct hisi_qm *qm) +{ + u32 nfe_enb = 0; + + /* Kunpeng930 hardware automatically close master ooo when NFE occurs */ + if (qm->ver >= QM_HW_V3) + return; + + if (!qm->err_status.is_dev_ecc_mbit && + qm->err_status.is_qm_ecc_mbit && + qm->err_ini->close_axi_master_ooo) { + qm->err_ini->close_axi_master_ooo(qm); + } else if (qm->err_status.is_dev_ecc_mbit && + !qm->err_status.is_qm_ecc_mbit && + !qm->err_ini->close_axi_master_ooo) { + nfe_enb = readl(qm->io_base + QM_RAS_NFE_ENABLE); + writel(nfe_enb & QM_RAS_NFE_MBIT_DISABLE, + qm->io_base + QM_RAS_NFE_ENABLE); + writel(QM_ECC_MBIT, qm->io_base + QM_ABNORMAL_INT_SET); + } +} + static int qm_vf_reset_prepare(struct hisi_qm *qm, enum qm_stop_reason stop_reason) { @@ -5122,6 +5144,8 @@ static int qm_controller_reset_prepare(struct hisi_qm *qm) return ret; } + qm_dev_ecc_mbit_handle(qm); + /* PF obtains the information of VF by querying the register. */ qm_cmd_uninit(qm); @@ -5146,31 +5170,6 @@ static int qm_controller_reset_prepare(struct hisi_qm *qm) return 0; } -static void qm_dev_ecc_mbit_handle(struct hisi_qm *qm) -{ - u32 nfe_enb = 0; - - /* Kunpeng930 hardware automatically close master ooo when NFE occurs */ - if (qm->ver >= QM_HW_V3) - return; - - if (!qm->err_status.is_dev_ecc_mbit && - qm->err_status.is_qm_ecc_mbit && - qm->err_ini->close_axi_master_ooo) { - - qm->err_ini->close_axi_master_ooo(qm); - - } else if (qm->err_status.is_dev_ecc_mbit && - !qm->err_status.is_qm_ecc_mbit && - !qm->err_ini->close_axi_master_ooo) { - - nfe_enb = readl(qm->io_base + QM_RAS_NFE_ENABLE); - writel(nfe_enb & QM_RAS_NFE_MBIT_DISABLE, - qm->io_base + QM_RAS_NFE_ENABLE); - writel(QM_ECC_MBIT, qm->io_base + QM_ABNORMAL_INT_SET); - } -} - static int qm_soft_reset(struct hisi_qm *qm) { struct pci_dev *pdev = qm->pdev; @@ -5196,8 +5195,6 @@ static int qm_soft_reset(struct hisi_qm *qm) return ret; } - qm_dev_ecc_mbit_handle(qm); - /* OOO register set and check */ writel(ACC_MASTER_GLOBAL_CTRL_SHUTDOWN, qm->io_base + ACC_MASTER_GLOBAL_CTRL); -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] jfs: fix shift-out-of-bounds in dbSplit
by Heyuan Wang 08 Jan '25

08 Jan '25

From: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> mainline inclusion from mainline-v6.13-rc1 commit a5f5e4698f8abbb25fe4959814093fb5bfa1aa9d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOT CVE: CVE-2024-56597 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When dmt_budmin is less than zero, it causes errors in the later stages. Added a check to return an error beforehand in dbAllocCtl itself. Reported-by: syzbot+b5ca8a249162c4b9a7d0(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b5ca8a249162c4b9a7d0 Signed-off-by: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index bd69bc08222f..f91bcd4192c5 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -1892,6 +1892,9 @@ dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno, s64 * results) return -EIO; dp = (struct dmap *) mp->data; + if (dp->tree.budmin < 0) + return -EIO; + /* try to allocate the blocks. */ rc = dbAllocDmapLev(bmp, dp, (int) nblocks, l2nb, results); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] jfs: fix shift-out-of-bounds in dbSplit
by Heyuan Wang 08 Jan '25

08 Jan '25

From: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> stable inclusion from stable-v5.10.231 commit df7c76636952670b31bd6c12b3aed3c502122273 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOT CVE: CVE-2024-56597 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a5f5e4698f8abbb25fe4959814093fb5bfa1aa9d ] When dmt_budmin is less than zero, it causes errors in the later stages. Added a check to return an error beforehand in dbAllocCtl itself. Reported-by: syzbot+b5ca8a249162c4b9a7d0(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b5ca8a249162c4b9a7d0 Signed-off-by: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 24bd3591c8e0..787eab88c16a 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -1881,6 +1881,9 @@ dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno, s64 * results) return -EIO; dp = (struct dmap *) mp->data; + if (dp->tree.budmin < 0) + return -EIO; + /* try to allocate the blocks. */ rc = dbAllocDmapLev(bmp, dp, (int) nblocks, l2nb, results); -- 2.25.1

2 1

[PATCH OLK-6.6] btrfs: fix use-after-free when COWing tree bock and tracing is enabled
by Yifan Qiao 08 Jan '25

08 Jan '25

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.13-rc5 commit 44f52bbe96dfdbe4aca3818a2534520082a07040 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBG2PK CVE: CVE-2024-56759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a COWing a tree block, at btrfs_cow_block(), and we have the tracepoint trace_btrfs_cow_block() enabled and preemption is also enabled (CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent buffer while inside the tracepoint code. This is because in some paths that call btrfs_cow_block(), such as btrfs_search_slot(), we are holding the last reference on the extent buffer @buf so btrfs_force_cow_block() drops the last reference on the @buf extent buffer when it calls free_extent_buffer_stale(buf), which schedules the release of the extent buffer with RCU. This means that if we are on a kernel with preemption, the current task may be preempted before calling trace_btrfs_cow_block() and the extent buffer already released by the time trace_btrfs_cow_block() is called, resulting in a use-after-free. Fix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to btrfs_force_cow_block() before the COWed extent buffer is freed. This also has a side effect of invoking the tracepoint in the tree defrag code, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is called there, but this is fine and it was actually missing there. Reported-by: syzbot+8517da8635307182c8a5(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/6759a9b9.050a0220.1ac542.000d.GAE@googl… CC: stable(a)vger.kernel.org # 5.4+ Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/ctree.c [__btrfs_cow_block did not rename to btrfs_force_cow_block yet.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/ctree.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c index 2eb4e03080ac..ddcc22384e36 100644 --- a/fs/btrfs/ctree.c +++ b/fs/btrfs/ctree.c @@ -648,6 +648,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans, btrfs_free_tree_block(trans, btrfs_root_id(root), buf, parent_start, last_ref); } + + trace_btrfs_cow_block(root, buf, cow); if (unlock_orig) btrfs_tree_unlock(buf); free_extent_buffer_stale(buf); @@ -699,7 +701,6 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans, { struct btrfs_fs_info *fs_info = root->fs_info; u64 search_start; - int ret; if (unlikely(test_bit(BTRFS_ROOT_DELETING, &root->state))) { btrfs_abort_transaction(trans, -EUCLEAN); @@ -740,12 +741,8 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans, * Also We don't care about the error, as it's handled internally. */ btrfs_qgroup_trace_subtree_after_cow(trans, root, buf); - ret = __btrfs_cow_block(trans, root, buf, parent, + return __btrfs_cow_block(trans, root, buf, parent, parent_slot, cow_ret, search_start, 0, nest); - - trace_btrfs_cow_block(root, buf, *cow_ret); - - return ret; } ALLOW_ERROR_INJECTION(btrfs_cow_block, ERRNO); -- 2.39.2

2 1

[PATCH OLK-5.10] btrfs: fix use-after-free when COWing tree bock and tracing is enabled
by Yifan Qiao 08 Jan '25

08 Jan '25

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.13-rc5 commit 44f52bbe96dfdbe4aca3818a2534520082a07040 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBG2PK CVE: CVE-2024-56759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a COWing a tree block, at btrfs_cow_block(), and we have the tracepoint trace_btrfs_cow_block() enabled and preemption is also enabled (CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent buffer while inside the tracepoint code. This is because in some paths that call btrfs_cow_block(), such as btrfs_search_slot(), we are holding the last reference on the extent buffer @buf so btrfs_force_cow_block() drops the last reference on the @buf extent buffer when it calls free_extent_buffer_stale(buf), which schedules the release of the extent buffer with RCU. This means that if we are on a kernel with preemption, the current task may be preempted before calling trace_btrfs_cow_block() and the extent buffer already released by the time trace_btrfs_cow_block() is called, resulting in a use-after-free. Fix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to btrfs_force_cow_block() before the COWed extent buffer is freed. This also has a side effect of invoking the tracepoint in the tree defrag code, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is called there, but this is fine and it was actually missing there. Reported-by: syzbot+8517da8635307182c8a5(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/6759a9b9.050a0220.1ac542.000d.GAE@googl… CC: stable(a)vger.kernel.org # 5.4+ Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/ctree.c [__btrfs_cow_block did not rename to btrfs_force_cow_block yet.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/ctree.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c index 55896280b2dd..21b5c0f12beb 100644 --- a/fs/btrfs/ctree.c +++ b/fs/btrfs/ctree.c @@ -1127,6 +1127,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans, btrfs_free_tree_block(trans, root, buf, parent_start, last_ref); } + + trace_btrfs_cow_block(root, buf, cow); if (unlock_orig) btrfs_tree_unlock(buf); free_extent_buffer_stale(buf); @@ -1493,7 +1495,6 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans, { struct btrfs_fs_info *fs_info = root->fs_info; u64 search_start; - int ret; if (test_bit(BTRFS_ROOT_DELETING, &root->state)) btrfs_err(fs_info, @@ -1527,12 +1528,8 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans, * Also We don't care about the error, as it's handled internally. */ btrfs_qgroup_trace_subtree_after_cow(trans, root, buf); - ret = __btrfs_cow_block(trans, root, buf, parent, + return __btrfs_cow_block(trans, root, buf, parent, parent_slot, cow_ret, search_start, 0, nest); - - trace_btrfs_cow_block(root, buf, *cow_ret); - - return ret; } /* -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] btrfs: fix use-after-free when COWing tree bock and tracing is enabled
by Yifan Qiao 08 Jan '25

08 Jan '25

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.13-rc5 commit 44f52bbe96dfdbe4aca3818a2534520082a07040 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBG2PK CVE: CVE-2024-56759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a COWing a tree block, at btrfs_cow_block(), and we have the tracepoint trace_btrfs_cow_block() enabled and preemption is also enabled (CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent buffer while inside the tracepoint code. This is because in some paths that call btrfs_cow_block(), such as btrfs_search_slot(), we are holding the last reference on the extent buffer @buf so btrfs_force_cow_block() drops the last reference on the @buf extent buffer when it calls free_extent_buffer_stale(buf), which schedules the release of the extent buffer with RCU. This means that if we are on a kernel with preemption, the current task may be preempted before calling trace_btrfs_cow_block() and the extent buffer already released by the time trace_btrfs_cow_block() is called, resulting in a use-after-free. Fix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to btrfs_force_cow_block() before the COWed extent buffer is freed. This also has a side effect of invoking the tracepoint in the tree defrag code, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is called there, but this is fine and it was actually missing there. Reported-by: syzbot+8517da8635307182c8a5(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/6759a9b9.050a0220.1ac542.000d.GAE@googl… CC: stable(a)vger.kernel.org # 5.4+ Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/ctree.c [__btrfs_cow_block did not rename to btrfs_force_cow_block yet.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/ctree.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c index f88c443cffea..ebc4fff273a6 100644 --- a/fs/btrfs/ctree.c +++ b/fs/btrfs/ctree.c @@ -1127,6 +1127,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans, btrfs_free_tree_block(trans, root, buf, parent_start, last_ref); } + + trace_btrfs_cow_block(root, buf, cow); if (unlock_orig) btrfs_tree_unlock(buf); free_extent_buffer_stale(buf); @@ -1493,7 +1495,6 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans, { struct btrfs_fs_info *fs_info = root->fs_info; u64 search_start; - int ret; if (test_bit(BTRFS_ROOT_DELETING, &root->state)) btrfs_err(fs_info, @@ -1527,12 +1528,8 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans, * Also We don't care about the error, as it's handled internally. */ btrfs_qgroup_trace_subtree_after_cow(trans, root, buf); - ret = __btrfs_cow_block(trans, root, buf, parent, + return __btrfs_cow_block(trans, root, buf, parent, parent_slot, cow_ret, search_start, 0, nest); - - trace_btrfs_cow_block(root, buf, *cow_ret); - - return ret; } /* -- 2.39.2

2 1

[PATCH OLK-5.10] jfs: fix shift-out-of-bounds in dbSplit
by Heyuan Wang 08 Jan '25

08 Jan '25

From: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> stable inclusion from stable-v5.10.231 commit df7c76636952670b31bd6c12b3aed3c502122273 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOT CVE: CVE-2024-56597 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a5f5e4698f8abbb25fe4959814093fb5bfa1aa9d ] When dmt_budmin is less than zero, it causes errors in the later stages. Added a check to return an error beforehand in dbAllocCtl itself. Reported-by: syzbot+b5ca8a249162c4b9a7d0(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b5ca8a249162c4b9a7d0 Signed-off-by: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index bf1f3d4d23f2..54298823d8ad 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -1888,6 +1888,9 @@ dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno, s64 * results) return -EIO; dp = (struct dmap *) mp->data; + if (dp->tree.budmin < 0) + return -EIO; + /* try to allocate the blocks. */ rc = dbAllocDmapLev(bmp, dp, (int) nblocks, l2nb, results); -- 2.25.1

2 1

[PATCH OLK-6.6] jfs: fix shift-out-of-bounds in dbSplit
by Heyuan Wang 08 Jan '25

08 Jan '25

From: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> stable inclusion from stable-v6.6.66 commit c56245baf3fd1f79145dd7408e3ead034b74255c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOT CVE: CVE-2024-56597 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a5f5e4698f8abbb25fe4959814093fb5bfa1aa9d ] When dmt_budmin is less than zero, it causes errors in the later stages. Added a check to return an error beforehand in dbAllocCtl itself. Reported-by: syzbot+b5ca8a249162c4b9a7d0(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b5ca8a249162c4b9a7d0 Signed-off-by: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 3ab410059dc2..39957361a7ee 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -1820,6 +1820,9 @@ dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno, s64 * results) return -EIO; dp = (struct dmap *) mp->data; + if (dp->tree.budmin < 0) + return -EIO; + /* try to allocate the blocks. */ rc = dbAllocDmapLev(bmp, dp, (int) nblocks, l2nb, results); -- 2.25.1

2 1

[PATCH OLK-6.6] scsi: ufs: core: sysfs: Prevent div by zero
by Heyuan Wang 08 Jan '25

08 Jan '25

From: Gwendal Grignou <gwendal(a)chromium.org> stable inclusion from stable-v6.6.66 commit 0069928727c2e95ca26c738fbe6e4b241aeaaf08 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOG CVE: CVE-2024-56622 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit eb48e9fc0028bed94a40a9352d065909f19e333c upstream. Prevent a division by 0 when monitoring is not enabled. Fixes: 1d8613a23f3c ("scsi: ufs: core: Introduce HBA performance monitor sysfs nodes") Cc: stable(a)vger.kernel.org Signed-off-by: Gwendal Grignou <gwendal(a)chromium.org> Link: https://lore.kernel.org/r/20241120062522.917157-1-gwendal@chromium.org Reviewed-by: Can Guo <quic_cang(a)quicinc.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- drivers/ufs/core/ufs-sysfs.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/ufs/core/ufs-sysfs.c b/drivers/ufs/core/ufs-sysfs.c index c95906443d5f..3692b39b35e7 100644 --- a/drivers/ufs/core/ufs-sysfs.c +++ b/drivers/ufs/core/ufs-sysfs.c @@ -485,6 +485,9 @@ static ssize_t read_req_latency_avg_show(struct device *dev, struct ufs_hba *hba = dev_get_drvdata(dev); struct ufs_hba_monitor *m = &hba->monitor; + if (!m->nr_req[READ]) + return sysfs_emit(buf, "0\n"); + return sysfs_emit(buf, "%llu\n", div_u64(ktime_to_us(m->lat_sum[READ]), m->nr_req[READ])); } @@ -552,6 +555,9 @@ static ssize_t write_req_latency_avg_show(struct device *dev, struct ufs_hba *hba = dev_get_drvdata(dev); struct ufs_hba_monitor *m = &hba->monitor; + if (!m->nr_req[WRITE]) + return sysfs_emit(buf, "0\n"); + return sysfs_emit(buf, "%llu\n", div_u64(ktime_to_us(m->lat_sum[WRITE]), m->nr_req[WRITE])); } -- 2.25.1

2 1

[PATCH OLK-5.10] acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
by Heyuan Wang 08 Jan '25

08 Jan '25

From: Suraj Sonawane <surajsonawane0215(a)gmail.com> stable inclusion from stable-v5.10.232 commit 616aa5f3c86e0479bcbb81e41c08c43ff32af637 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMX CVE: CVE-2024-56662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 265e98f72bac6c41a4492d3e30a8e5fd22fe0779 ] Fix an issue detected by syzbot with KASAN: BUG: KASAN: vmalloc-out-of-bounds in cmd_to_func drivers/acpi/nfit/ core.c:416 [inline] BUG: KASAN: vmalloc-out-of-bounds in acpi_nfit_ctl+0x20e8/0x24a0 drivers/acpi/nfit/core.c:459 The issue occurs in cmd_to_func when the call_pkg->nd_reserved2 array is accessed without verifying that call_pkg points to a buffer that is appropriately sized as a struct nd_cmd_pkg. This can lead to out-of-bounds access and undefined behavior if the buffer does not have sufficient space. To address this, a check was added in acpi_nfit_ctl() to ensure that buf is not NULL and that buf_len is less than sizeof(*call_pkg) before accessing it. This ensures safe access to the members of call_pkg, including the nd_reserved2 array. Reported-by: syzbot+7534f060ebda6b8b51b3(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7534f060ebda6b8b51b3 Tested-by: syzbot+7534f060ebda6b8b51b3(a)syzkaller.appspotmail.com Fixes: ebe9f6f19d80 ("acpi/nfit: Fix bus command validation") Signed-off-by: Suraj Sonawane <surajsonawane0215(a)gmail.com> Reviewed-by: Alison Schofield <alison.schofield(a)intel.com> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Link: https://patch.msgid.link/20241118162609.29063-1-surajsonawane0215@gmail.com Signed-off-by: Ira Weiny <ira.weiny(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- drivers/acpi/nfit/core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c index 2306abb09f7f..16857612103e 100644 --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -453,8 +453,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, if (cmd_rc) *cmd_rc = -EINVAL; - if (cmd == ND_CMD_CALL) + if (cmd == ND_CMD_CALL) { + if (!buf || buf_len < sizeof(*call_pkg)) + return -EINVAL; + call_pkg = buf; + } + func = cmd_to_func(nfit_mem, cmd, call_pkg, &family); if (func < 0) return func; -- 2.25.1

2 1

[PATCH OLK-6.6] erofs: handle NONHEAD !delta[1] lclusters gracefully
by Zizhi Wo 08 Jan '25

08 Jan '25

From: Gao Xiang <hsiangkao(a)linux.alibaba.com> stable inclusion from stable-v6.6.64 commit f466641debcbea8bdf78d1b63a6270aadf9301bf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAED CVE: CVE-2024-53234 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 0bc8061ffc733a0a246b8689b2d32a3e9204f43c ] syzbot reported a WARNING in iomap_iter_done: iomap_fiemap+0x73b/0x9b0 fs/iomap/fiemap.c:80 ioctl_fiemap fs/ioctl.c:220 [inline] Generally, NONHEAD lclusters won't have delta[1]==0, except for crafted images and filesystems created by pre-1.0 mkfs versions. Previously, it would immediately bail out if delta[1]==0, which led to inadequate decompressed lengths (thus FIEMAP is impacted). Treat it as delta[1]=1 to work around these legacy mkfs versions. `lclusterbits > 14` is illegal for compact indexes, error out too. Reported-by: syzbot+6c0b301317aa0156f9eb(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/67373c0c.050a0220.2a2fcc.0079.GAE@google.com Tested-by: syzbot+6c0b301317aa0156f9eb(a)syzkaller.appspotmail.com Fixes: d95ae5e25326 ("erofs: add support for the full decompressed length") Fixes: 001b8ccd0650 ("erofs: fix compact 4B support for 16k block size") Signed-off-by: Gao Xiang <hsiangkao(a)linux.alibaba.com> Link: https://lore.kernel.org/r/20241115173651.3339514-1-hsiangkao@linux.alibaba.… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/erofs/zmap.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index 6bd435a565f6..76566c2cbf63 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -234,7 +234,7 @@ static int z_erofs_load_compact_lcluster(struct z_erofs_maprecorder *m, unsigned int amortizedshift; erofs_off_t pos; - if (lcn >= totalidx) + if (lcn >= totalidx || vi->z_logical_clusterbits > 14) return -EINVAL; m->lcn = lcn; @@ -409,7 +409,7 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m) u64 lcn = m->lcn, headlcn = map->m_la >> lclusterbits; int err; - do { + while (1) { /* handle the last EOF pcluster (no next HEAD lcluster) */ if ((lcn << lclusterbits) >= inode->i_size) { map->m_llen = inode->i_size - map->m_la; @@ -421,14 +421,16 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m) return err; if (m->type == Z_EROFS_LCLUSTER_TYPE_NONHEAD) { - DBG_BUGON(!m->delta[1] && - m->clusterofs != 1 << lclusterbits); + /* work around invalid d1 generated by pre-1.0 mkfs */ + if (unlikely(!m->delta[1])) { + m->delta[1] = 1; + DBG_BUGON(1); + } } else if (m->type == Z_EROFS_LCLUSTER_TYPE_PLAIN || m->type == Z_EROFS_LCLUSTER_TYPE_HEAD1 || m->type == Z_EROFS_LCLUSTER_TYPE_HEAD2) { - /* go on until the next HEAD lcluster */ if (lcn != headlcn) - break; + break; /* ends at the next HEAD lcluster */ m->delta[1] = 1; } else { erofs_err(inode->i_sb, "unknown type %u @ lcn %llu of nid %llu", @@ -437,8 +439,7 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m) return -EOPNOTSUPP; } lcn += m->delta[1]; - } while (m->delta[1]); - + } map->m_llen = (lcn << lclusterbits) + m->clusterofs - map->m_la; return 0; } -- 2.46.1

2 1

[PATCH openEuler-22.03-LTS-SP1] acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
by Heyuan Wang 08 Jan '25

08 Jan '25

From: Suraj Sonawane <surajsonawane0215(a)gmail.com> stable inclusion from stable-v5.10.232 commit 616aa5f3c86e0479bcbb81e41c08c43ff32af637 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMX CVE: CVE-2024-56662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 265e98f72bac6c41a4492d3e30a8e5fd22fe0779 ] Fix an issue detected by syzbot with KASAN: BUG: KASAN: vmalloc-out-of-bounds in cmd_to_func drivers/acpi/nfit/ core.c:416 [inline] BUG: KASAN: vmalloc-out-of-bounds in acpi_nfit_ctl+0x20e8/0x24a0 drivers/acpi/nfit/core.c:459 The issue occurs in cmd_to_func when the call_pkg->nd_reserved2 array is accessed without verifying that call_pkg points to a buffer that is appropriately sized as a struct nd_cmd_pkg. This can lead to out-of-bounds access and undefined behavior if the buffer does not have sufficient space. To address this, a check was added in acpi_nfit_ctl() to ensure that buf is not NULL and that buf_len is less than sizeof(*call_pkg) before accessing it. This ensures safe access to the members of call_pkg, including the nd_reserved2 array. Reported-by: syzbot+7534f060ebda6b8b51b3(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7534f060ebda6b8b51b3 Tested-by: syzbot+7534f060ebda6b8b51b3(a)syzkaller.appspotmail.com Fixes: ebe9f6f19d80 ("acpi/nfit: Fix bus command validation") Signed-off-by: Suraj Sonawane <surajsonawane0215(a)gmail.com> Reviewed-by: Alison Schofield <alison.schofield(a)intel.com> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Link: https://patch.msgid.link/20241118162609.29063-1-surajsonawane0215@gmail.com Signed-off-by: Ira Weiny <ira.weiny(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- drivers/acpi/nfit/core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c index 99e23a5df026..53a60e9e4c6f 100644 --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -453,8 +453,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, if (cmd_rc) *cmd_rc = -EINVAL; - if (cmd == ND_CMD_CALL) + if (cmd == ND_CMD_CALL) { + if (!buf || buf_len < sizeof(*call_pkg)) + return -EINVAL; + call_pkg = buf; + } + func = cmd_to_func(nfit_mem, cmd, call_pkg, &family); if (func < 0) return func; -- 2.25.1

2 1

[PATCH OLK-6.6] acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
by Heyuan Wang 08 Jan '25

08 Jan '25

From: Suraj Sonawane <surajsonawane0215(a)gmail.com> stable inclusion from stable-v6.6.67 commit e08dc2dc3c3f7938df0e4476fe3e6fdec5583c1d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMX CVE: CVE-2024-56662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 265e98f72bac6c41a4492d3e30a8e5fd22fe0779 ] Fix an issue detected by syzbot with KASAN: BUG: KASAN: vmalloc-out-of-bounds in cmd_to_func drivers/acpi/nfit/ core.c:416 [inline] BUG: KASAN: vmalloc-out-of-bounds in acpi_nfit_ctl+0x20e8/0x24a0 drivers/acpi/nfit/core.c:459 The issue occurs in cmd_to_func when the call_pkg->nd_reserved2 array is accessed without verifying that call_pkg points to a buffer that is appropriately sized as a struct nd_cmd_pkg. This can lead to out-of-bounds access and undefined behavior if the buffer does not have sufficient space. To address this, a check was added in acpi_nfit_ctl() to ensure that buf is not NULL and that buf_len is less than sizeof(*call_pkg) before accessing it. This ensures safe access to the members of call_pkg, including the nd_reserved2 array. Reported-by: syzbot+7534f060ebda6b8b51b3(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7534f060ebda6b8b51b3 Tested-by: syzbot+7534f060ebda6b8b51b3(a)syzkaller.appspotmail.com Fixes: ebe9f6f19d80 ("acpi/nfit: Fix bus command validation") Signed-off-by: Suraj Sonawane <surajsonawane0215(a)gmail.com> Reviewed-by: Alison Schofield <alison.schofield(a)intel.com> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Link: https://patch.msgid.link/20241118162609.29063-1-surajsonawane0215@gmail.com Signed-off-by: Ira Weiny <ira.weiny(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- drivers/acpi/nfit/core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c index 7d88db451cfb..7918923e3b74 100644 --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -454,8 +454,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, if (cmd_rc) *cmd_rc = -EINVAL; - if (cmd == ND_CMD_CALL) + if (cmd == ND_CMD_CALL) { + if (!buf || buf_len < sizeof(*call_pkg)) + return -EINVAL; + call_pkg = buf; + } + func = cmd_to_func(nfit_mem, cmd, call_pkg, &family); if (func < 0) return func; -- 2.25.1

2 1

[PATCH OLK-6.6] x86/xen: don't do PV iret hypercall through hypercall page
by Heyuan Wang 08 Jan '25

08 Jan '25

From: Juergen Gross <jgross(a)suse.com> stable inclusion from stable-v6.6.67 commit 82c211ead1ec440dbf81727e17b03b5e3c44b93d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBCAZE CVE: CVE-2024-53241 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a2796dff62d6c6bfc5fbebdf2bee0d5ac0438906 upstream. Instead of jumping to the Xen hypercall page for doing the iret hypercall, directly code the required sequence in xen-asm.S. This is done in preparation of no longer using hypercall page at all, as it has shown to cause problems with speculation mitigations. This is part of XSA-466 / CVE-2024-53241. Reported-by: Andrew Cooper <andrew.cooper3(a)citrix.com> Signed-off-by: Juergen Gross <jgross(a)suse.com> Reviewed-by: Jan Beulich <jbeulich(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- arch/x86/xen/xen-asm.S | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm.S index 1a9cd18dfbd3..72f61a69f72e 100644 --- a/arch/x86/xen/xen-asm.S +++ b/arch/x86/xen/xen-asm.S @@ -176,7 +176,6 @@ SYM_CODE_START(xen_early_idt_handler_array) SYM_CODE_END(xen_early_idt_handler_array) __FINIT -hypercall_iret = hypercall_page + __HYPERVISOR_iret * 32 /* * Xen64 iret frame: * @@ -186,17 +185,28 @@ hypercall_iret = hypercall_page + __HYPERVISOR_iret * 32 * cs * rip <-- standard iret frame * - * flags + * flags <-- xen_iret must push from here on * - * rcx } - * r11 }<-- pushed by hypercall page - * rsp->rax } + * rcx + * r11 + * rsp->rax */ +.macro xen_hypercall_iret + pushq $0 /* Flags */ + push %rcx + push %r11 + push %rax + mov $__HYPERVISOR_iret, %eax + syscall /* Do the IRET. */ +#ifdef CONFIG_MITIGATION_SLS + int3 +#endif +.endm + SYM_CODE_START(xen_iret) UNWIND_HINT_UNDEFINED ANNOTATE_NOENDBR - pushq $0 - jmp hypercall_iret + xen_hypercall_iret SYM_CODE_END(xen_iret) /* @@ -301,8 +311,7 @@ SYM_CODE_START(xen_entry_SYSENTER_compat) ENDBR lea 16(%rsp), %rsp /* strip %rcx, %r11 */ mov $-ENOSYS, %rax - pushq $0 - jmp hypercall_iret + xen_hypercall_iret SYM_CODE_END(xen_entry_SYSENTER_compat) SYM_CODE_END(xen_entry_SYSCALL_compat) -- 2.25.1

2 1

[PATCH OLK-6.6] drm/i915: Fix NULL pointer dereference in capture_engine
by Heyuan Wang 08 Jan '25

08 Jan '25

From: Eugene Kobyak <eugene.kobyak(a)intel.com> stable inclusion from stable-v6.6.67 commit e07f9c92bd127f8835ac669d83b5e7ff59bbb40f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANL CVE: CVE-2024-56667 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit da0b986256ae9a78b0215214ff44f271bfe237c1 upstream. When the intel_context structure contains NULL, it raises a NULL pointer dereference error in drm_info(). Fixes: e8a3319c31a1 ("drm/i915: Allow error capture without a request") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/12309 Reviewed-by: Andi Shyti <andi.shyti(a)linux.intel.com> Cc: John Harrison <John.C.Harrison(a)Intel.com> Cc: <stable(a)vger.kernel.org> # v6.3+ Signed-off-by: Eugene Kobyak <eugene.kobyak(a)intel.com> Signed-off-by: Andi Shyti <andi.shyti(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/xmsgfynkhycw3cf56akp4he2ffg44… (cherry picked from commit 754302a5bc1bd8fd3b7d85c168b0a1af6d4bba4d) Signed-off-by: Tvrtko Ursulin <tursulin(a)ursulin.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- drivers/gpu/drm/i915/i915_gpu_error.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c index 4008bb09fdb5..074ff6016383 100644 --- a/drivers/gpu/drm/i915/i915_gpu_error.c +++ b/drivers/gpu/drm/i915/i915_gpu_error.c @@ -1638,9 +1638,21 @@ capture_engine(struct intel_engine_cs *engine, return NULL; intel_engine_get_hung_entity(engine, &ce, &rq); - if (rq && !i915_request_started(rq)) - drm_info(&engine->gt->i915->drm, "Got hung context on %s with active request %lld:%lld [0x%04X] not yet started\n", - engine->name, rq->fence.context, rq->fence.seqno, ce->guc_id.id); + if (rq && !i915_request_started(rq)) { + /* + * We want to know also what is the guc_id of the context, + * but if we don't have the context reference, then skip + * printing it. + */ + if (ce) + drm_info(&engine->gt->i915->drm, + "Got hung context on %s with active request %lld:%lld [0x%04X] not yet started\n", + engine->name, rq->fence.context, rq->fence.seqno, ce->guc_id.id); + else + drm_info(&engine->gt->i915->drm, + "Got hung context on %s with active request %lld:%lld not yet started\n", + engine->name, rq->fence.context, rq->fence.seqno); + } if (rq) { capture = intel_engine_coredump_add_request(ee, rq, ATOMIC_MAYFAIL); -- 2.25.1

2 1

[PATCH OLK-6.6] wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one
by Heyuan Wang 08 Jan '25

08 Jan '25

From: Lin Ma <linma(a)zju.edu.cn> stable inclusion from stable-v6.6.67 commit f3412522f78826fef1dfae40ef378a863df2591c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMY CVE: CVE-2024-56663 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2e3dbf938656986cce73ac4083500d0bcfbffe24 ] Since the netlink attribute range validation provides inclusive checking, the *max* of attribute NL80211_ATTR_MLO_LINK_ID should be IEEE80211_MLD_MAX_NUM_LINKS - 1 otherwise causing an off-by-one. One crash stack for demonstration: ================================================================== BUG: KASAN: wild-memory-access in ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939 Read of size 6 at addr 001102080000000c by task fuzzer.386/9508 CPU: 1 PID: 9508 Comm: syz.1.386 Not tainted 6.1.70 #2 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x177/0x231 lib/dump_stack.c:106 print_report+0xe0/0x750 mm/kasan/report.c:398 kasan_report+0x139/0x170 mm/kasan/report.c:495 kasan_check_range+0x287/0x290 mm/kasan/generic.c:189 memcpy+0x25/0x60 mm/kasan/shadow.c:65 ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939 rdev_tx_control_port net/wireless/rdev-ops.h:761 [inline] nl80211_tx_control_port+0x7b3/0xc40 net/wireless/nl80211.c:15453 genl_family_rcv_msg_doit+0x22e/0x320 net/netlink/genetlink.c:756 genl_family_rcv_msg net/netlink/genetlink.c:833 [inline] genl_rcv_msg+0x539/0x740 net/netlink/genetlink.c:850 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2508 genl_rcv+0x24/0x40 net/netlink/genetlink.c:861 netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline] netlink_unicast+0x74b/0x8c0 net/netlink/af_netlink.c:1352 netlink_sendmsg+0x882/0xb90 net/netlink/af_netlink.c:1874 sock_sendmsg_nosec net/socket.c:716 [inline] __sock_sendmsg net/socket.c:728 [inline] ____sys_sendmsg+0x5cc/0x8f0 net/socket.c:2499 ___sys_sendmsg+0x21c/0x290 net/socket.c:2553 __sys_sendmsg net/socket.c:2582 [inline] __do_sys_sendmsg net/socket.c:2591 [inline] __se_sys_sendmsg+0x19e/0x270 net/socket.c:2589 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x45/0x90 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd Update the policy to ensure correct validation. Fixes: 7b0a0e3c3a88 ("wifi: cfg80211: do some rework towards MLO link APIs") Signed-off-by: Lin Ma <linma(a)zju.edu.cn> Suggested-by: Cengiz Can <cengiz.can(a)canonical.com> Link: https://patch.msgid.link/20241130170526.96698-1-linma@zju.edu.cn Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- net/wireless/nl80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 797907303669..5b9f39d93b04 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -811,7 +811,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { [NL80211_ATTR_MLO_LINKS] = NLA_POLICY_NESTED_ARRAY(nl80211_policy), [NL80211_ATTR_MLO_LINK_ID] = - NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS), + NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS - 1), [NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN), [NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG }, [NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT }, -- 2.25.1

2 1

[PATCH OLK-6.6] erofs: handle NONHEAD !delta[1] lclusters gracefully
by Zizhi Wo 08 Jan '25

08 Jan '25

From: Gao Xiang <hsiangkao(a)linux.alibaba.com> stable inclusion from stable-v6.6.64 commit f466641debcbea8bdf78d1b63a6270aadf9301bf category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBA6RL CVE: CVE-2024-53234 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 0bc8061ffc733a0a246b8689b2d32a3e9204f43c ] syzbot reported a WARNING in iomap_iter_done: iomap_fiemap+0x73b/0x9b0 fs/iomap/fiemap.c:80 ioctl_fiemap fs/ioctl.c:220 [inline] Generally, NONHEAD lclusters won't have delta[1]==0, except for crafted images and filesystems created by pre-1.0 mkfs versions. Previously, it would immediately bail out if delta[1]==0, which led to inadequate decompressed lengths (thus FIEMAP is impacted). Treat it as delta[1]=1 to work around these legacy mkfs versions. `lclusterbits > 14` is illegal for compact indexes, error out too. Reported-by: syzbot+6c0b301317aa0156f9eb(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/67373c0c.050a0220.2a2fcc.0079.GAE@google.com Tested-by: syzbot+6c0b301317aa0156f9eb(a)syzkaller.appspotmail.com Fixes: d95ae5e25326 ("erofs: add support for the full decompressed length") Fixes: 001b8ccd0650 ("erofs: fix compact 4B support for 16k block size") Signed-off-by: Gao Xiang <hsiangkao(a)linux.alibaba.com> Link: https://lore.kernel.org/r/20241115173651.3339514-1-hsiangkao@linux.alibaba.… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/erofs/zmap.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index 6bd435a565f6..76566c2cbf63 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -234,7 +234,7 @@ static int z_erofs_load_compact_lcluster(struct z_erofs_maprecorder *m, unsigned int amortizedshift; erofs_off_t pos; - if (lcn >= totalidx) + if (lcn >= totalidx || vi->z_logical_clusterbits > 14) return -EINVAL; m->lcn = lcn; @@ -409,7 +409,7 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m) u64 lcn = m->lcn, headlcn = map->m_la >> lclusterbits; int err; - do { + while (1) { /* handle the last EOF pcluster (no next HEAD lcluster) */ if ((lcn << lclusterbits) >= inode->i_size) { map->m_llen = inode->i_size - map->m_la; @@ -421,14 +421,16 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m) return err; if (m->type == Z_EROFS_LCLUSTER_TYPE_NONHEAD) { - DBG_BUGON(!m->delta[1] && - m->clusterofs != 1 << lclusterbits); + /* work around invalid d1 generated by pre-1.0 mkfs */ + if (unlikely(!m->delta[1])) { + m->delta[1] = 1; + DBG_BUGON(1); + } } else if (m->type == Z_EROFS_LCLUSTER_TYPE_PLAIN || m->type == Z_EROFS_LCLUSTER_TYPE_HEAD1 || m->type == Z_EROFS_LCLUSTER_TYPE_HEAD2) { - /* go on until the next HEAD lcluster */ if (lcn != headlcn) - break; + break; /* ends at the next HEAD lcluster */ m->delta[1] = 1; } else { erofs_err(inode->i_sb, "unknown type %u @ lcn %llu of nid %llu", @@ -437,8 +439,7 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m) return -EOPNOTSUPP; } lcn += m->delta[1]; - } while (m->delta[1]); - + } map->m_llen = (lcn << lclusterbits) + m->clusterofs - map->m_la; return 0; } -- 2.46.1

2 1

[openeuler:OLK-6.6] BUILD REGRESSION 323fdd0bb1c04cc9d146fbb356de334a6230d4f2
by kernel test robot 08 Jan '25

08 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 323fdd0bb1c04cc9d146fbb356de334a6230d4f2 !14746 nvme-pci: fix freeing of the HMB descriptor table Error/Warning ids grouped by kconfigs: recent_errors |-- loongarch-allmodconfig | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:Function-parameter-or-member-ivrs-not-described-in-get_highest_supported_ivhd_type | |-- drivers-iommu-loongarch_iommu.c:warning:la_iommu_setup-defined-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-check_device_compat | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-create_rlookup_entry | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_attach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_deattach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-find_iommu_by_dev | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-get_iommu_info_from_dom | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-iommu_init_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-la_iommu_probe_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-lookup_rlooptable | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-loongarch_get_iommu_by_devid | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | `-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc |-- loongarch-allnoconfig | |-- arch-loongarch-kernel-efi.c:error:incompatible-types-when-assigning-to-type-pmd_t-from-type-int | `-- include-linux-suspend.h:error:expected-)-before-numeric-constant |-- loongarch-allyesconfig | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:Function-parameter-or-member-ivrs-not-described-in-get_highest_supported_ivhd_type | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-check_device_compat | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-create_rlookup_entry | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_attach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_deattach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-find_iommu_by_dev | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-get_iommu_info_from_dom | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-iommu_init_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-la_iommu_probe_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-lookup_rlooptable | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-loongarch_get_iommu_by_devid | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | `-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc |-- loongarch-randconfig-002-20250107 | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | |-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc | `-- include-linux-suspend.h:error:expected-)-before-numeric-constant |-- x86_64-allnoconfig | `-- samples-trace_events-trace_custom_sched.c:linux-version.h-not-needed. |-- x86_64-allyesconfig | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-sm3_generic_block_fn | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_finup | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_update | |-- arch-x86-crypto-sm4-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-gmi_sm4_set_key | |-- arch-x86-kernel-cpu-hygon.c:warning:no-previous-prototype-for-function-get_nt_block_copy_mini_len | |-- arch-x86-kernel-cpu-hygon.c:warning:no-previous-prototype-for-function-set_c86_features_para_invalid | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpustate_free_space | |-- arch-x86-kvm-svm-csv.c:warning:no-previous-prototype-for-function-csv_vm_attestation | |-- arch-x86-kvm-svm-sev.c:warning:no-previous-prototype-for-function-sev_install_hooks | |-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device | |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-dml-calcs-dcn_calc_auto.c:warning:stack-frame-size-()-exceeds-limit-()-in-mode_support_and_system_configuration | |-- net-ipv4-tcp_comp.c:warning:no-previous-prototype-for-function-comp_setup_strp | `-- net-ipv4-tcp_comp.c:warning:no-previous-prototype-for-function-comp_stream_read |-- x86_64-buildonly-randconfig-001-20250107 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus |-- x86_64-buildonly-randconfig-003-20250107 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus `-- x86_64-buildonly-randconfig-004-20250107 `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) elapsed time: 730m configs tested: 19 configs skipped: 104 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250107 clang-15 arm64 randconfig-002-20250107 clang-20 arm64 randconfig-003-20250107 gcc-14.2.0 arm64 randconfig-004-20250107 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250107 gcc-14.2.0 loongarch randconfig-002-20250107 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250107 clang-19 x86_64 buildonly-randconfig-002-20250107 gcc-12 x86_64 buildonly-randconfig-003-20250107 clang-19 x86_64 buildonly-randconfig-004-20250107 gcc-12 x86_64 buildonly-randconfig-005-20250107 clang-19 x86_64 buildonly-randconfig-006-20250107 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 43c2a19ed680b57698ab6b44cbb76bb5e66dc4dd
by kernel test robot 08 Jan '25

08 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 43c2a19ed680b57698ab6b44cbb76bb5e66dc4dd !14726 etmem: fix use-after-free of mm in the scan release process Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-001-20250107 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-002-20250107 | |-- include-linux-rcupdate.h:warning:array-subscript-unknown-is-outside-array-bounds-of-struct-net_device | |-- include-linux-spinlock.h:warning:array-subscript-unknown-is-outside-array-bounds-of-struct-smt_entry | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-003-20250107 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-004-20250107 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-allnoconfig | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-001-20250107 | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20250107 | |-- drivers-staging-media-zoran-zoran_procfs.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-003-20250107 | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20250107 | |-- drivers-bcma-.tmp_core.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-.tmp_drm_bridge.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-.tmp_drm_color_mgmt.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-.tmp_drm_dp_dual_mode_helper.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-.tmp_drm_encoder.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-.tmp_drm_irq.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-.tmp_drm_lease.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-.tmp_drm_mode_config.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-.tmp_drm_modeset_helper.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-.tmp_drm_rect.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-amd-amdgpu-.tmp_amdgpu_gart.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-amd-amdgpu-.tmp_amdgpu_sched.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-hwmon-.tmp_mlxreg-fan.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-input-serio-.tmp_libps2.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-mfd-.tmp_madera-core.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-of-.tmp_base.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-opp-.tmp_cpu.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-opp-.tmp_of.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-pci-controller-.tmp_pcie-cadence.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-power-supply-.tmp_adp5061.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-video-.tmp_hdmi.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-autofs-.tmp_expire.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-notify-.tmp_fdinfo.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-sysfs-.tmp_dir.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-sysfs-.tmp_group.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-sysfs-.tmp_symlink.o:warning:objtool:missing-symbol-for-section-.text | |-- kernel-.tmp_stacktrace.o:warning:objtool:missing-symbol-for-section-.text | |-- kernel-hung_task.c:error:sysctl_hung_task_all_cpu_backtrace-undeclared-(first-use-in-this-function) | |-- kernel-trace-.tmp_trace_events_trigger.o:warning:objtool:missing-symbol-for-section-.init.text | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-005-20250107 | |-- arch-x86-kernel-unwind_orc.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-hwtracing-intel_th-debug.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-media-usb-as102-as102_fw.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-media-usb-as102-as1_cmd.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-media-usb-as102-as1_cmd_cfg.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-media-usb-as102-as1_cmd_stream.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-usb-dwc2-hcd_ddma.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-xfs-xfs_bmap_util.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-xfs-xfs_symlink.o:warning:objtool:missing-symbol-for-section-.text | |-- kernel-gcov-base.o:warning:objtool:missing-symbol-for-section-.text | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration `-- x86_64-buildonly-randconfig-006-20250107 |-- arch-x86-kernel-unwind_orc.o:warning:objtool:missing-symbol-for-section-.text |-- block-bfq-wf2q.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-dispnv50-base.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-dispnv50-core.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-dispnv50-core507d.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-dispnv50-curs.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-dispnv50-oimm.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-dispnv50-oimm507b.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-dispnv50-ovly.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-dispnv50-wimm.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-nvif-disp.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-nvif-fifo.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-nvif-user.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-nvkm-engine-disp-hdmigv100.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-nvkm-engine-gr-ctxgf117.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-pci-pcie-dpc.o:warning:objtool:missing-symbol-for-section-.init.text |-- drivers-usb-dwc2-hcd_ddma.o:warning:objtool:missing-symbol-for-section-.text |-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- fs-xfs-xfs_rtalloc.o:warning:objtool:missing-symbol-for-section-.text |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration elapsed time: 740m configs tested: 15 configs skipped: 108 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250107 gcc-14.2.0 arm64 randconfig-002-20250107 gcc-14.2.0 arm64 randconfig-003-20250107 gcc-14.2.0 arm64 randconfig-004-20250107 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250107 clang-19 x86_64 buildonly-randconfig-002-20250107 gcc-12 x86_64 buildonly-randconfig-003-20250107 clang-19 x86_64 buildonly-randconfig-004-20250107 gcc-12 x86_64 buildonly-randconfig-005-20250107 clang-19 x86_64 buildonly-randconfig-006-20250107 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION b21ca7240f2269ad91a1842acef33c267c8b201e
by kernel test robot 08 Jan '25

08 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: b21ca7240f2269ad91a1842acef33c267c8b201e !14604 scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() Error/Warning (recently discovered and may have been fixed): net/core/datagram.o: warning: objtool: __skb_datagram_iter()+0x1b4: unreachable instruction net/mptcp/protocol.o: warning: objtool: mptcp_reset_timer()+0x27: unreachable instruction Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x0-in-asm | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x1-in-asm | `-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x2-in-asm |-- arm64-randconfig-001-20250107 | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x0-in-asm | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x1-in-asm | `-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x2-in-asm |-- arm64-randconfig-002-20250107 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r0-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r1-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- x86_64-allnoconfig | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- samples-bpf-hbm.c:bpf-bpf.h-is-included-more-than-once. |-- x86_64-allyesconfig | |-- drivers-gpu-drm-vmwgfx-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_rd32 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_wr32 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_send_clp_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_in_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_out_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_copy_to_user | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_in_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_out_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_hw_driver_stats | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read_ack | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write_nack | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_destroy_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_id | |-- drivers-net-ethernet-hisilicon-hns3-hns3_unic.c:warning:Function-parameter-or-member-skb-not-described-in-hns3_unic_set_l3_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3_unic.c:warning:Function-parameter-or-member-type_cs_vlan_tso-not-described-in-hns3_unic_set_l3_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_unic_guid.c:warning:no-previous-prototype-for-function-hclge_unic_del_mc_guid_common | |-- drivers-net-ethernet-huawei-hinic-hinic_hwdev.c:warning:address-of-array-chip_node-rt_cmd-will-always-evaluate-to-true | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-has_mac-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-has_trans-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-headroom-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-tailroom-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_debugfs.c:warning:Excess-function-parameter-pf-description-in-rnp_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnp-rnp_debugfs.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-cmd-description-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-cmd-description-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-ec-description-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_module_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_ts_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_set_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_set_rxnfc | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-coal-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-data-not-described-in-rnp_reg_test | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_module_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_ts_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_set_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_set_rxnfc | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_get_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_set_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-ker-not-described-in-rnp_get_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-ker-not-described-in-rnp_set_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-inner_vlan_tag-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-l4_hdr_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-mss_seg_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-rxr_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-rxr_idx-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-tunnel_hdr_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-txr_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-txr_idx-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-type_tucmd-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-v_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-crc_pad-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-eth_queue_idx-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-ignore_vlan-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-inner_vlan_tunnel_len-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-mss_len_vf_num-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-r_count-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-r_idx-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-step-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:no-previous-prototype-for-function-rnp_acquire_msix_vectors | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:no-previous-prototype-for-function-rnp_print_ring_info | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-data-description-in-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-ent-description-in-rnp_probe | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-hw-description-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-link_speed-description-in-rnp_watchdog_update_link | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-maxrate-description-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-netdev-description-in-rnp_setup_tc | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-netdev-description-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-queue-description-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-skb-description-in-rnp_is_non_eop | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-subdev_id-description-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_setup_rx_resources | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_setup_tx_resources | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_setup_tc | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-id-not-described-in-rnp_probe | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-napi_budget-not-described-in-rnp_clean_tx_irq | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-rnp_msix_vector-not-described-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-rnp_queue-not-described-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-subdevice_id-not-described-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-t-not-described-in-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-txqueue-not-described-in-rnp_tx_timeout | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_assign_netdev_ops | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_can_rpu_start | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_clear_udp_tunnel_port | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_config_knode | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_delete_knode | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_do_reset | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_service_task | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_setup_tc_cls_u32 | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_unmap_and_free_tx_resource | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_vlan_stags_flag | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_write_eitr_rx | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_xmit_nop_frame_ring | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:variable-rxctrl-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:variable-xdp_xmit-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Excess-function-parameter-rnp_info-description-in-rnp_mbx_get_capability | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-adv-not-described-in-rnp_mbx_phy_link_set | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-info-not-described-in-rnp_mbx_get_capability | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-pfvfnum-not-described-in-rnp_fw_get_macaddr | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value-not-described-in-rnp_mbx_reg_writev | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value0-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value1-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value2-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value3-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_fw_reg_read | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:variable-value-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Excess-function-parameter-hw-description-in-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-hw-not-described-in-rnp_write_uc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-mac-not-described-in-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-sriov_flag-not-described-in-rnp_eth_update_rss_key_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-sriov_flag-not-described-in-rnp_write_uc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:equality-comparison-with-extraneous-parentheses | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp10_get_link_ksettings | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp10_set_link_ksettings | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_addr_list_itr | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_check_mac_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_clean_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_device_supports_autoneg_fc | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clear_rar_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clear_vmdq_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_all_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_all_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_mc_addr_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_vfta_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_rar_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_tcp_sync_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_vfta_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_vmdq_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_mc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_rss_key_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_rss_table_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_get_permtion_mac_addr_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_get_thermal_sensor_data_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_init_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_init_thermal_sensor_thresh_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_layer2_pritologic_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_mac_set_mac_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_nway_reset | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_phy_read_reg_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_phy_write_reg_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_reset_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_set_ethtool_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_set_vf_vlan_mode_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_setup_mac_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_start_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_tuple5_pritologic_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_tuple5_pritologic_tcam_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-autoneg_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-dma_ch-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-duplex_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-idx-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_ptp.c:warning:no-previous-prototype-for-function-rnp_ptp_setup_ptp | |-- drivers-net-ethernet-mucse-rnp-rnp_ptp.c:warning:variable-ts_event_en-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:no-previous-prototype-for-function-check_ari_mode | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:no-previous-prototype-for-function-rnp_msg_post_status_signle_link | |-- drivers-net-ethernet-mucse-rnp-rnp_sysfs.c:warning:no-previous-prototype-for-function-rnp_mbx_get_pn_sn | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr | |-- fs-eulerfs-euler_def.h:warning:redefinition-of-typedef-hashlen_t-is-a-C11-feature | |-- fs-eulerfs-euler_def.h:warning:redefinition-of-typedef-page_info_t-is-a-C11-feature | `-- fs-eulerfs-namei.c:warning:variable-de-is-uninitialized-when-used-here |-- x86_64-buildonly-randconfig-001-20250107 | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr |-- x86_64-buildonly-randconfig-002-20250107 | `-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-003-20250107 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-004-20241230 | |-- net-core-datagram.o:warning:objtool:__skb_datagram_iter:unreachable-instruction | `-- net-mptcp-protocol.o:warning:objtool:mptcp_reset_timer:unreachable-instruction |-- x86_64-buildonly-randconfig-004-20250107 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | `-- drivers-gpu-drm-vmwgfx-ttm_object.c:error:Cannot-parse-struct-or-union |-- x86_64-buildonly-randconfig-005-20250107 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- x86_64-buildonly-randconfig-006-20250107 |-- kernel-rcu-update.o:warning:objtool:synchronize_rcu_tasks_trace:unreachable-instruction |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory elapsed time: 736m configs tested: 15 configs skipped: 100 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250107 clang-15 arm64 randconfig-002-20250107 clang-20 arm64 randconfig-003-20250107 gcc-14.2.0 arm64 randconfig-004-20250107 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250107 clang-19 x86_64 buildonly-randconfig-002-20250107 gcc-12 x86_64 buildonly-randconfig-003-20250107 clang-19 x86_64 buildonly-randconfig-004-20250107 gcc-12 x86_64 buildonly-randconfig-005-20250107 clang-19 x86_64 buildonly-randconfig-006-20250107 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-25.03] PM / devfreq: Rectify the uncore frequency alarm
by Xiangwei Li 07 Jan '25

07 Jan '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBC4SJ -------------------------------- In the x86 architecture, the return value of topology_cluster_cpumask must be a const modification variable. The compilation alarm caused by the constant is rectified. Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- drivers/devfreq/hisi_uncore_freq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/devfreq/hisi_uncore_freq.c b/drivers/devfreq/hisi_uncore_freq.c index 89af7aa9a095..d815133b647e 100644 --- a/drivers/devfreq/hisi_uncore_freq.c +++ b/drivers/devfreq/hisi_uncore_freq.c @@ -367,7 +367,7 @@ static int hisi_uncore_devfreq_register(struct hisi_uncore_freq *uncore) static int hisi_uncore_mark_related_cpus(struct hisi_uncore_freq *uncore, char *property, int (get_topo_id)(int cpu), - struct cpumask *(get_cpumask)(int cpu)) + const struct cpumask *(get_cpumask)(int cpu)) { unsigned int i, cpu; size_t len; @@ -419,7 +419,7 @@ static int get_cluster_id(int cpu) return topology_cluster_id(cpu); } -static struct cpumask *get_cluster_cpumask(int cpu) +static const struct cpumask *get_cluster_cpumask(int cpu) { return topology_cluster_cpumask(cpu); } -- 2.25.1

1 0

[PATCH openEuler-25.03] PM / devfreq: Only ARM64 support HiSilicon uncore frequency scaling driver
by Xiangwei Li 07 Jan '25

07 Jan '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBC4SJ -------------------------------- The HiSilicon uncore frequency scaling driver runs on Kunpeng SoCs, which are ARM64 chips. Therefore, architecture restrictions are added. Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- drivers/devfreq/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/devfreq/Kconfig b/drivers/devfreq/Kconfig index 1bcdce9a89d3..a8dcebd17275 100644 --- a/drivers/devfreq/Kconfig +++ b/drivers/devfreq/Kconfig @@ -158,7 +158,7 @@ config ARM_SUN8I_A33_MBUS_DEVFREQ config ARM_HISI_UNCORE_DEVFREQ tristate "HiSilicon uncore DEVFREQ Driver" - depends on (PCC && ACPI && ACPI_PPTT) || COMPILE_TEST + depends on ARM64 && ((PCC && ACPI && ACPI_PPTT) || COMPILE_TEST) help HiSilicon uncore DEVFREQ Driver -- 2.25.1

1 0

[PATCH OLK-6.6 0/2] CVE-2024-56677
by Liao Chen 07 Jan '25

07 Jan '25

fix CVE-2024-56677 Ritesh Harjani (IBM) (2): powerpc/fadump: Refactor and prepare fadump_cma_init for late init powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init() arch/powerpc/include/asm/fadump.h | 7 +++++++ arch/powerpc/kernel/fadump.c | 23 +++++++---------------- arch/powerpc/kernel/setup-common.c | 6 ++++-- 3 files changed, 18 insertions(+), 18 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] CVE-2024-56724
by Liao Chen 07 Jan '25

07 Jan '25

fix CVE-2024-56724 Andy Shevchenko (2): mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device drivers/mfd/intel_soc_pmic_bxtwc.c | 82 +++++++++++++++++--------- drivers/platform/x86/intel/bxtwc_tmu.c | 22 ++----- drivers/usb/typec/tcpm/wcove.c | 4 -- 3 files changed, 60 insertions(+), 48 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1] tracing: Prevent bad count for tracing_cpumask_write
by Luo Gengkun 07 Jan '25

07 Jan '25

From: Lizhi Xu <lizhi.xu(a)windriver.com> mainline inclusion from mainline-v6.13-rc5 commit 98feccbf32cfdde8c722bc4587aaa60ee5ac33f0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBG2PO CVE: CVE-2024-56763 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If a large count is provided, it will trigger a warning in bitmap_parse_user. Also check zero for it. Cc: stable(a)vger.kernel.org Fixes: 9e01c1b74c953 ("cpumask: convert kernel trace functions") Link: https://lore.kernel.org/20241216073238.2573704-1-lizhi.xu@windriver.com Reported-by: syzbot+0aecfd34fb878546f3fd(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0aecfd34fb878546f3fd Tested-by: syzbot+0aecfd34fb878546f3fd(a)syzkaller.appspotmail.com Signed-off-by: Lizhi Xu <lizhi.xu(a)windriver.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/trace/trace.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index e9a737451a76..fa138d1bba56 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -4878,6 +4878,9 @@ tracing_cpumask_write(struct file *filp, const char __user *ubuf, cpumask_var_t tracing_cpumask_new; int err; + if (count == 0 || count > KMALLOC_MAX_SIZE) + return -EINVAL; + if (!zalloc_cpumask_var(&tracing_cpumask_new, GFP_KERNEL)) return -ENOMEM; -- 2.34.1

2 1

[PATCH OLK-5.10] tracing: Prevent bad count for tracing_cpumask_write
by Luo Gengkun 07 Jan '25

07 Jan '25

From: Lizhi Xu <lizhi.xu(a)windriver.com> mainline inclusion from mainline-v6.13-rc5 commit 98feccbf32cfdde8c722bc4587aaa60ee5ac33f0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBG2PO CVE: CVE-2024-56763 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If a large count is provided, it will trigger a warning in bitmap_parse_user. Also check zero for it. Cc: stable(a)vger.kernel.org Fixes: 9e01c1b74c953 ("cpumask: convert kernel trace functions") Link: https://lore.kernel.org/20241216073238.2573704-1-lizhi.xu@windriver.com Reported-by: syzbot+0aecfd34fb878546f3fd(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0aecfd34fb878546f3fd Tested-by: syzbot+0aecfd34fb878546f3fd(a)syzkaller.appspotmail.com Signed-off-by: Lizhi Xu <lizhi.xu(a)windriver.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/trace/trace.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index a470950b8ed6..462d2a70a835 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -4869,6 +4869,9 @@ tracing_cpumask_write(struct file *filp, const char __user *ubuf, cpumask_var_t tracing_cpumask_new; int err; + if (count == 0 || count > KMALLOC_MAX_SIZE) + return -EINVAL; + if (!zalloc_cpumask_var(&tracing_cpumask_new, GFP_KERNEL)) return -ENOMEM; -- 2.34.1

2 1

[PATCH OLK-6.6] tracing: Prevent bad count for tracing_cpumask_write
by Luo Gengkun 07 Jan '25

07 Jan '25

From: Lizhi Xu <lizhi.xu(a)windriver.com> stable inclusion from stable-v6.6.69 commit 03041e474a6a8f1bfd4b96b164bb3165c48fa1a3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBG2PO CVE: CVE-2024-56763 Reference: https://git.kernel.org/stable/c/03041e474a6a8f1bfd4b96b164bb3165c48fa1a3 -------------------------------- commit 98feccbf32cfdde8c722bc4587aaa60ee5ac33f0 upstream. If a large count is provided, it will trigger a warning in bitmap_parse_user. Also check zero for it. Cc: stable(a)vger.kernel.org Fixes: 9e01c1b74c953 ("cpumask: convert kernel trace functions") Link: https://lore.kernel.org/20241216073238.2573704-1-lizhi.xu@windriver.com Reported-by: syzbot+0aecfd34fb878546f3fd(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0aecfd34fb878546f3fd Tested-by: syzbot+0aecfd34fb878546f3fd(a)syzkaller.appspotmail.com Signed-off-by: Lizhi Xu <lizhi.xu(a)windriver.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/trace/trace.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 02bc8e03ffa1..24c995d1dab2 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -5331,6 +5331,9 @@ tracing_cpumask_write(struct file *filp, const char __user *ubuf, cpumask_var_t tracing_cpumask_new; int err; + if (count == 0 || count > KMALLOC_MAX_SIZE) + return -EINVAL; + if (!zalloc_cpumask_var(&tracing_cpumask_new, GFP_KERNEL)) return -ENOMEM; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-56567
by Liao Chen 07 Jan '25

07 Jan '25

fix CVE-2024-56567 Zicheng Qu (1): ad7780: fix division by zero in ad7780_write_raw() drivers/iio/adc/ad7780.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[openeuler:OLK-5.10 2656/2656] kernel/rcu/update.o: warning: objtool: synchronize_rcu_tasks_trace()+0xde: unreachable instruction
by kernel test robot 07 Jan '25

07 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 9be6ae394c896999214be0f875765d2c58d15b13 commit: 2509f2079e7247ed0d695bdb69c3d019a700a4b8 [2656/2656] rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug config: x86_64-buildonly-randconfig-006-20250107 (https://download.01.org/0day-ci/archive/20250107/202501071757.EREnWTHH-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250107/202501071757.EREnWTHH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501071757.EREnWTHH-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/rcu/update.o: warning: objtool: synchronize_rcu_tasks_trace()+0xde: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/3] CVE-2024-56642
by Liu Jian 07 Jan '25

07 Jan '25

CVE-2024-56642 Eric Dumazet (1): tipc: fix NULL deref in cleanup_bearer() Kuniyuki Iwashima (1): tipc: Fix use-after-free of kernel socket in cleanup_bearer(). Xin Long (1): tipc: remove ub->ubsock checks net/tipc/udp_media.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6] bpf, sockmap: Several fixes to bpf_msg_pop_data
by Liu Jian 07 Jan '25

07 Jan '25

From: Zijian Zhang <zijianzhang(a)bytedance.com> stable inclusion from stable-v6.6.64 commit 98c7ea7d11f2588e8197db042e0291e4ac8f8346 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGFC CVE: CVE-2024-56720 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 5d609ba262475db450ba69b8e8a557bd768ac07a ] Several fixes to bpf_msg_pop_data, 1. In sk_msg_shift_left, we should put_page 2. if (len == 0), return early is better 3. pop the entire sk_msg (last == msg->sg.size) should be supported 4. Fix for the value of variable "a" 5. In sk_msg_shift_left, after shifting, i has already pointed to the next element. Addtional sk_msg_iter_var_next may result in BUG. Fixes: 7246d8ed4dcc ("bpf: helper to pop data from messages") Signed-off-by: Zijian Zhang <zijianzhang(a)bytedance.com> Reviewed-by: John Fastabend <john.fastabend(a)gmail.com> Link: https://lore.kernel.org/r/20241106222520.527076-8-zijianzhang@bytedance.com Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/filter.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index 48dd2896ee1d9..131a21b5463cc 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2889,8 +2889,10 @@ static const struct bpf_func_proto bpf_msg_push_data_proto = { static void sk_msg_shift_left(struct sk_msg *msg, int i) { + struct scatterlist *sge = sk_msg_elem(msg, i); int prev; + put_page(sg_page(sge)); do { prev = i; sk_msg_iter_var_next(i); @@ -2927,6 +2929,9 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, if (unlikely(flags)) return -EINVAL; + if (unlikely(len == 0)) + return 0; + /* First find the starting scatterlist element */ i = msg->sg.start; do { @@ -2939,7 +2944,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, } while (i != msg->sg.end); /* Bounds checks: start and pop must be inside message */ - if (start >= offset + l || last >= msg->sg.size) + if (start >= offset + l || last > msg->sg.size) return -EINVAL; space = MAX_MSG_FRAGS - sk_msg_elem_used(msg); @@ -2968,12 +2973,12 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, */ if (start != offset) { struct scatterlist *nsge, *sge = sk_msg_elem(msg, i); - int a = start; + int a = start - offset; int b = sge->length - pop - a; sk_msg_iter_var_next(i); - if (pop < sge->length - a) { + if (b > 0) { if (space) { sge->length = a; sk_msg_shift_right(msg, i); @@ -2992,7 +2997,6 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, if (unlikely(!page)) return -ENOMEM; - sge->length = a; orig = sg_page(sge); from = sg_virt(sge); to = page_address(page); @@ -3002,7 +3006,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, put_page(orig); } pop = 0; - } else if (pop >= sge->length - a) { + } else { pop -= (sge->length - a); sge->length = a; } @@ -3036,7 +3040,6 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, pop -= sge->length; sk_msg_shift_left(msg, i); } - sk_msg_iter_var_next(i); } sk_mem_uncharge(msg->sk, len - pop); -- 2.34.1

2 5

[PATCH OLK-5.10] tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
by Liu Jian 07 Jan '25

07 Jan '25

From: Zijian Zhang <zijianzhang(a)bytedance.com> stable inclusion from stable-v5.10.231 commit dbedc7e142df5ea238a46fdd7462c1c42cd36a10 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANQ CVE: CVE-2024-56633 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit ca70b8baf2bd125b2a4d96e76db79375c07d7ff2 ] The current sk memory accounting logic in __SK_REDIRECT is pre-uncharging tosend bytes, which is either msg->sg.size or a smaller value apply_bytes. Potential problems with this strategy are as follows: - If the actual sent bytes are smaller than tosend, we need to charge some bytes back, as in line 487, which is okay but seems not clean. - When tosend is set to apply_bytes, as in line 417, and (ret < 0), we may miss uncharging (msg->sg.size - apply_bytes) bytes. [...] 415 tosend = msg->sg.size; 416 if (psock->apply_bytes && psock->apply_bytes < tosend) 417 tosend = psock->apply_bytes; [...] 443 sk_msg_return(sk, msg, tosend); 444 release_sock(sk); 446 origsize = msg->sg.size; 447 ret = tcp_bpf_sendmsg_redir(sk_redir, redir_ingress, 448 msg, tosend, flags); 449 sent = origsize - msg->sg.size; [...] 454 lock_sock(sk); 455 if (unlikely(ret < 0)) { 456 int free = sk_msg_free_nocharge(sk, msg); 458 if (!cork) 459 *copied -= free; 460 } [...] 487 if (eval == __SK_REDIRECT) 488 sk_mem_charge(sk, tosend - sent); [...] When running the selftest test_txmsg_redir_wait_sndmem with txmsg_apply, the following warning will be reported: ------------[ cut here ]------------ WARNING: CPU: 6 PID: 57 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x190/0x1a0 Modules linked in: CPU: 6 UID: 0 PID: 57 Comm: kworker/6:0 Not tainted 6.12.0-rc1.bm.1-amd64+ #43 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Workqueue: events sk_psock_destroy RIP: 0010:inet_sock_destruct+0x190/0x1a0 RSP: 0018:ffffad0a8021fe08 EFLAGS: 00010206 RAX: 0000000000000011 RBX: ffff9aab4475b900 RCX: ffff9aab481a0800 RDX: 0000000000000303 RSI: 0000000000000011 RDI: ffff9aab4475b900 RBP: ffff9aab4475b990 R08: 0000000000000000 R09: ffff9aab40050ec0 R10: 0000000000000000 R11: ffff9aae6fdb1d01 R12: ffff9aab49c60400 R13: ffff9aab49c60598 R14: ffff9aab49c60598 R15: dead000000000100 FS: 0000000000000000(0000) GS:ffff9aae6fd80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffec7e47bd8 CR3: 00000001a1a1c004 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x89/0x130 ? inet_sock_destruct+0x190/0x1a0 ? report_bug+0xfc/0x1e0 ? handle_bug+0x5c/0xa0 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? inet_sock_destruct+0x190/0x1a0 __sk_destruct+0x25/0x220 sk_psock_destroy+0x2b2/0x310 process_scheduled_works+0xa3/0x3e0 worker_thread+0x117/0x240 ? __pfx_worker_thread+0x10/0x10 kthread+0xcf/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x40 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> ---[ end trace 0000000000000000 ]--- In __SK_REDIRECT, a more concise way is delaying the uncharging after sent bytes are finalized, and uncharge this value. When (ret < 0), we shall invoke sk_msg_free. Same thing happens in case __SK_DROP, when tosend is set to apply_bytes, we may miss uncharging (msg->sg.size - apply_bytes) bytes. The same warning will be reported in selftest. [...] 468 case __SK_DROP: 469 default: 470 sk_msg_free_partial(sk, msg, tosend); 471 sk_msg_apply_bytes(psock, tosend); 472 *copied -= (tosend + delta); 473 return -EACCES; [...] So instead of sk_msg_free_partial we can do sk_msg_free here. Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Fixes: 8ec95b94716a ("bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues") Signed-off-by: Zijian Zhang <zijianzhang(a)bytedance.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: John Fastabend <john.fastabend(a)gmail.com> Link: https://lore.kernel.org/bpf/20241016234838.3167769-3-zijianzhang@bytedance.… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/ipv4/tcp_bpf.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index 8645017da9df9..384121426ea28 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -447,7 +447,6 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock, cork = true; psock->cork = NULL; } - sk_msg_return(sk, msg, tosend); release_sock(sk); origsize = msg->sg.size; @@ -459,8 +458,9 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock, sock_put(sk_redir); lock_sock(sk); + sk_mem_uncharge(sk, sent); if (unlikely(ret < 0)) { - int free = sk_msg_free_nocharge(sk, msg); + int free = sk_msg_free(sk, msg); if (!cork) *copied -= free; @@ -474,7 +474,7 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock, break; case __SK_DROP: default: - sk_msg_free_partial(sk, msg, tosend); + sk_msg_free(sk, msg); sk_msg_apply_bytes(psock, tosend); *copied -= (tosend + delta); return -EACCES; @@ -490,11 +490,8 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock, } if (msg && msg->sg.data[msg->sg.start].page_link && - msg->sg.data[msg->sg.start].length) { - if (eval == __SK_REDIRECT) - sk_mem_charge(sk, tosend - sent); + msg->sg.data[msg->sg.start].length) goto more_data; - } } return ret; } -- 2.34.1

2 1

[PATCH OLK-6.6] drm/i915/hdcp: Add encoder check in hdcp2_get_capability
by He Yujie 07 Jan '25

07 Jan '25

From: Suraj Kandpal <suraj.kandpal(a)intel.com> mainline inclusion from mainline-v6.12-rc1 commit d34f4f058edf1235c103ca9c921dc54820d14d40 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQZ CVE: CVE-2024-53050 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Add encoder check in intel_hdcp2_get_capability to avoid null pointer error. Signed-off-by: Suraj Kandpal <suraj.kandpal(a)intel.com> Reviewed-by: Dnyaneshwar Bhadane <dnyaneshwar.bhadane(a)intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240722064451.3610512-3-sura… Conflicts: drivers/gpu/drm/i915/display/intel_hdcp.c drivers/gpu/drm/i915/display/intel_dp_hdcp.c [ Context conflict: 130849f8ec14("drm/i915/hdcp: Use intel_connector as argument for hdcp_2_2_capable") a35239a89259("drm/i915/hdcp: Use correct aux for capability check scenario") 287c0de8b294("drm/i915/hdcp: Move to direct reads for HDCP") 55d9b2b8e440("drm/i915/hdcp: Refactor intel_dp_hdcp2_capable") 8e754d9e9e8a("drm/i915/hdcp: Rename hdcp capable functions") the above patches are not merge. ] Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/gpu/drm/i915/display/intel_hdcp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/display/intel_hdcp.c b/drivers/gpu/drm/i915/display/intel_hdcp.c index cb99839afcd0..762170e6cbbb 100644 --- a/drivers/gpu/drm/i915/display/intel_hdcp.c +++ b/drivers/gpu/drm/i915/display/intel_hdcp.c @@ -163,7 +163,7 @@ bool intel_hdcp_capable(struct intel_connector *connector) /* Is HDCP2.2 capable on Platform and Sink */ bool intel_hdcp2_capable(struct intel_connector *connector) { - struct intel_digital_port *dig_port = intel_attached_dig_port(connector); + struct intel_digital_port *dig_port; struct drm_i915_private *i915 = to_i915(connector->base.dev); struct intel_hdcp *hdcp = &connector->hdcp; bool capable = false; @@ -192,6 +192,11 @@ bool intel_hdcp2_capable(struct intel_connector *connector) } mutex_unlock(&i915->display.hdcp.hdcp_mutex); + if (!intel_attached_encoder(connector)) + return false; + + dig_port = intel_attached_dig_port(connector); + /* Sink's capability for HDCP2.2 */ hdcp->shim->hdcp_2_2_capable(dig_port, &capable); -- 2.34.1

2 1

[PATCH OLK-6.6] nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
by He Yujie 07 Jan '25

07 Jan '25

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v6.6.63 commit 59b49ca67cca7b007a5afd3de0283c8008157665 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBA6RL CVE: CVE-2024-53131 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit cd45e963e44b0f10d90b9e6c0e8b4f47f3c92471 upstream. Patch series "nilfs2: fix null-ptr-deref bugs on block tracepoints". This series fixes null pointer dereference bugs that occur when using nilfs2 and two block-related tracepoints. This patch (of 2): It has been reported that when using "block:block_touch_buffer" tracepoint, touch_buffer() called from __nilfs_get_folio_block() causes a NULL pointer dereference, or a general protection fault when KASAN is enabled. This happens because since the tracepoint was added in touch_buffer(), it references the dev_t member bh->b_bdev->bd_dev regardless of whether the buffer head has a pointer to a block_device structure. In the current implementation, the block_device structure is set after the function returns to the caller. Here, touch_buffer() is used to mark the folio/page that owns the buffer head as accessed, but the common search helper for folio/page used by the caller function was optimized to mark the folio/page as accessed when it was reimplemented a long time ago, eliminating the need to call touch_buffer() here in the first place. So this solves the issue by eliminating the touch_buffer() call itself. Link: https://lkml.kernel.org/r/20241106160811.3316-1-konishi.ryusuke@gmail.com Link: https://lkml.kernel.org/r/20241106160811.3316-2-konishi.ryusuke@gmail.com Fixes: 5305cb830834 ("block: add block_{touch|dirty}_buffer tracepoint") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: Ubisectech Sirius <bugreport(a)valiantsec.com> Closes: https://lkml.kernel.org/r/86bd3013-887e-4e38-960f-ca45c657f032.bugreport@va… Reported-by: syzbot+9982fb8d18eba905abe2(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9982fb8d18eba905abe2 Tested-by: syzbot+9982fb8d18eba905abe2(a)syzkaller.appspotmail.com Cc: Tejun Heo <tj(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- fs/nilfs2/page.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c index 9bced0a5c253..144e200c4909 100644 --- a/fs/nilfs2/page.c +++ b/fs/nilfs2/page.c @@ -39,7 +39,6 @@ __nilfs_get_page_block(struct page *page, unsigned long block, pgoff_t index, first_block = (unsigned long)index << (PAGE_SHIFT - blkbits); bh = nilfs_page_get_nth_block(page, block - first_block); - touch_buffer(bh); wait_on_buffer(bh); return bh; } -- 2.34.1

2 1

[PATCH OLK-6.6] octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
by He Yujie 07 Jan '25

07 Jan '25

From: Dipendra Khadka <kdipendra88(a)gmail.com> stable inclusion from stable-v6.6.64 commit c0f64fd73b60aee85f88c270c9d714ead27a7b7a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBA6RL CVE: CVE-2024-56728 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e26f8eac6bb20b20fdb8f7dc695711ebce4c7c5c ] Add error pointer check after calling otx2_mbox_get_rsp(). Fixes: 75f36270990c ("octeontx2-pf: Support to enable/disable pause frames via ethtool") Fixes: d0cf9503e908 ("octeontx2-pf: ethtool fec mode support") Signed-off-by: Dipendra Khadka <kdipendra88(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: Andrew Lunn <andrew(a)lunn.ch> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- .../net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c index 8b7fc0af91ce..532e84bc38c7 100644 --- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c +++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c @@ -343,6 +343,11 @@ static void otx2_get_pauseparam(struct net_device *netdev, if (!otx2_sync_mbox_msg(&pfvf->mbox)) { rsp = (struct cgx_pause_frm_cfg *) otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr); + if (IS_ERR(rsp)) { + mutex_unlock(&pfvf->mbox.lock); + return; + } + pause->rx_pause = rsp->rx_pause; pause->tx_pause = rsp->tx_pause; } @@ -1082,6 +1087,11 @@ static int otx2_set_fecparam(struct net_device *netdev, rsp = (struct fec_mode *)otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr); + if (IS_ERR(rsp)) { + err = PTR_ERR(rsp); + goto end; + } + if (rsp->fec >= 0) pfvf->linfo.fec = rsp->fec; else -- 2.34.1

2 1

[PATCH OLK-6.6] usb: musb: Fix hardware lockup on first Rx endpoint request
by He Yujie 07 Jan '25

07 Jan '25

From: Hubert Wiśniewski <hubert.wisniewski.25632(a)gmail.com> stable inclusion from stable-v6.6.64 commit 5906ee3693674d734177df13a519a21bb03f730d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBA6RL CVE: CVE-2024-56687 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3fc137386c4620305bbc2a216868c53f9245670a upstream. There is a possibility that a request's callback could be invoked from usb_ep_queue() (call trace below, supplemented with missing calls): req->complete from usb_gadget_giveback_request (drivers/usb/gadget/udc/core.c:999) usb_gadget_giveback_request from musb_g_giveback (drivers/usb/musb/musb_gadget.c:147) musb_g_giveback from rxstate (drivers/usb/musb/musb_gadget.c:784) rxstate from musb_ep_restart (drivers/usb/musb/musb_gadget.c:1169) musb_ep_restart from musb_ep_restart_resume_work (drivers/usb/musb/musb_gadget.c:1176) musb_ep_restart_resume_work from musb_queue_resume_work (drivers/usb/musb/musb_core.c:2279) musb_queue_resume_work from musb_gadget_queue (drivers/usb/musb/musb_gadget.c:1241) musb_gadget_queue from usb_ep_queue (drivers/usb/gadget/udc/core.c:300) According to the docstring of usb_ep_queue(), this should not happen: "Note that @req's ->complete() callback must never be called from within usb_ep_queue() as that can create deadlock situations." In fact, a hardware lockup might occur in the following sequence: 1. The gadget is initialized using musb_gadget_enable(). 2. Meanwhile, a packet arrives, and the RXPKTRDY flag is set, raising an interrupt. 3. If IRQs are enabled, the interrupt is handled, but musb_g_rx() finds an empty queue (next_request() returns NULL). The interrupt flag has already been cleared by the glue layer handler, but the RXPKTRDY flag remains set. 4. The first request is enqueued using usb_ep_queue(), leading to the call of req->complete(), as shown in the call trace above. 5. If the callback enables IRQs and another packet is waiting, step (3) repeats. The request queue is empty because usb_g_giveback() removes the request before invoking the callback. 6. The endpoint remains locked up, as the interrupt triggered by hardware setting the RXPKTRDY flag has been handled, but the flag itself remains set. For this scenario to occur, it is only necessary for IRQs to be enabled at some point during the complete callback. This happens with the USB Ethernet gadget, whose rx_complete() callback calls netif_rx(). If called in the task context, netif_rx() disables the bottom halves (BHs). When the BHs are re-enabled, IRQs are also enabled to allow soft IRQs to be processed. The gadget itself is initialized at module load (or at boot if built-in), but the first request is enqueued when the network interface is brought up, triggering rx_complete() in the task context via ioctl(). If a packet arrives while the interface is down, it can prevent the interface from receiving any further packets from the USB host. The situation is quite complicated with many parties involved. This particular issue can be resolved in several possible ways: 1. Ensure that callbacks never enable IRQs. This would be difficult to enforce, as discovering how netif_rx() interacts with interrupts was already quite challenging and u_ether is not the only function driver. Similar "bugs" could be hidden in other drivers as well. 2. Disable MUSB interrupts in musb_g_giveback() before calling the callback and re-enable them afterwars (by calling musb_{dis,en}able_interrupts(), for example). This would ensure that MUSB interrupts are not handled during the callback, even if IRQs are enabled. In fact, it would allow IRQs to be enabled when releasing the lock. However, this feels like an inelegant hack. 3. Modify the interrupt handler to clear the RXPKTRDY flag if the request queue is empty. While this approach also feels like a hack, it wastes CPU time by attempting to handle incoming packets when the software is not ready to process them. 4. Flush the Rx FIFO instead of calling rxstate() in musb_ep_restart(). This ensures that the hardware can receive packets when there is at least one request in the queue. Once IRQs are enabled, the interrupt handler will be able to correctly process the next incoming packet (eventually calling rxstate()). This approach may cause one or two packets to be dropped (two if double buffering is enabled), but this seems to be a minor issue, as packet loss can occur when the software is not yet ready to process them. Additionally, this solution makes the gadget driver compliant with the rule mentioned in the docstring of usb_ep_queue(). There may be additional solutions, but from these four, the last one has been chosen as it seems to be the most appropriate, as it addresses the "bad" behavior of the driver. Fixes: baebdf48c360 ("net: dev: Makes sure netif_rx() can be invoked in any context.") Cc: stable(a)vger.kernel.org Signed-off-by: Hubert Wiśniewski <hubert.wisniewski.25632(a)gmail.com> Link: https://lore.kernel.org/r/4ee1ead4525f78fb5909a8cbf99513ad0082ad21.camel@gm… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/usb/musb/musb_gadget.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c index 051c6da7cf6d..f175cb2c3e7b 100644 --- a/drivers/usb/musb/musb_gadget.c +++ b/drivers/usb/musb/musb_gadget.c @@ -1170,12 +1170,19 @@ struct free_record { */ void musb_ep_restart(struct musb *musb, struct musb_request *req) { + u16 csr; + void __iomem *epio = req->ep->hw_ep->regs; + trace_musb_req_start(req); musb_ep_select(musb->mregs, req->epnum); - if (req->tx) + if (req->tx) { txstate(musb, req); - else - rxstate(musb, req); + } else { + csr = musb_readw(epio, MUSB_RXCSR); + csr |= MUSB_RXCSR_FLUSHFIFO | MUSB_RXCSR_P_WZC_BITS; + musb_writew(epio, MUSB_RXCSR, csr); + musb_writew(epio, MUSB_RXCSR, csr); + } } static int musb_ep_restart_resume_work(struct musb *musb, void *data) -- 2.34.1

2 1

[PATCH OLK-6.6] sched/numa: fix memory leak due to the overwritten vma->numab_state
by He Yujie 07 Jan '25

07 Jan '25

From: Adrian Huang <ahuang12(a)lenovo.com> mainline inclusion from mainline-v6.13-rc2 commit 5f1b64e9a9b7ee9cfd32c6b2fab796e29bfed075 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPC CVE: CVE-2024-56613 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [Problem Description] When running the hackbench program of LTP, the following memory leak is reported by kmemleak. # /opt/ltp/testcases/bin/hackbench 20 thread 1000 Running with 20*40 (== 800) tasks. # dmesg | grep kmemleak ... kmemleak: 480 new suspected memory leaks (see /sys/kernel/debug/kmemleak) kmemleak: 665 new suspected memory leaks (see /sys/kernel/debug/kmemleak) # cat /sys/kernel/debug/kmemleak unreferenced object 0xffff888cd8ca2c40 (size 64): comm "hackbench", pid 17142, jiffies 4299780315 hex dump (first 32 bytes): ac 74 49 00 01 00 00 00 4c 84 49 00 01 00 00 00 .tI.....L.I..... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc bff18fd4): [<ffffffff81419a89>] __kmalloc_cache_noprof+0x2f9/0x3f0 [<ffffffff8113f715>] task_numa_work+0x725/0xa00 [<ffffffff8110f878>] task_work_run+0x58/0x90 [<ffffffff81ddd9f8>] syscall_exit_to_user_mode+0x1c8/0x1e0 [<ffffffff81dd78d5>] do_syscall_64+0x85/0x150 [<ffffffff81e0012b>] entry_SYSCALL_64_after_hwframe+0x76/0x7e ... This issue can be consistently reproduced on three different servers: * a 448-core server * a 256-core server * a 192-core server [Root Cause] Since multiple threads are created by the hackbench program (along with the command argument 'thread'), a shared vma might be accessed by two or more cores simultaneously. When two or more cores observe that vma->numab_state is NULL at the same time, vma->numab_state will be overwritten. Although current code ensures that only one thread scans the VMAs in a single 'numa_scan_period', there might be a chance for another thread to enter in the next 'numa_scan_period' while we have not gotten till numab_state allocation [1]. Note that the command `/opt/ltp/testcases/bin/hackbench 50 process 1000` cannot the reproduce the issue. It is verified with 200+ test runs. [Solution] Use the cmpxchg atomic operation to ensure that only one thread executes the vma->numab_state assignment. [1] https://lore.kernel.org/lkml/1794be3c-358c-4cdc-a43d-a1f841d91ef7@amd.com/ Link: https://lkml.kernel.org/r/20241113102146.2384-1-ahuang12@lenovo.com Fixes: ef6a22b70f6d ("sched/numa: apply the scan delay to every new vma") Signed-off-by: Adrian Huang <ahuang12(a)lenovo.com> Reported-by: Jiwei Sun <sunjw10(a)lenovo.com> Reviewed-by: Raghavendra K T <raghavendra.kt(a)amd.com> Reviewed-by: Vlastimil Babka <vbabka(a)suse.cz> Cc: Ben Segall <bsegall(a)google.com> Cc: Dietmar Eggemann <dietmar.eggemann(a)arm.com> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Juri Lelli <juri.lelli(a)redhat.com> Cc: Mel Gorman <mgorman(a)suse.de> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Steven Rostedt <rostedt(a)goodmis.org> Cc: Valentin Schneider <vschneid(a)redhat.com> Cc: Vincent Guittot <vincent.guittot(a)linaro.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: kernel/sched/fair.c [ Context conflict due to not merge 84db47ca7146 ("sched/numa: Fix mm numa_scan_seq based unconditional scan") ] Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- kernel/sched/fair.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index be1d35549144..7df2b07629c0 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -3452,10 +3452,16 @@ static void task_numa_work(struct callback_head *work) /* Initialise new per-VMA NUMAB state. */ if (!vma->numab_state) { - vma->numab_state = kzalloc(sizeof(struct vma_numab_state), - GFP_KERNEL); - if (!vma->numab_state) + struct vma_numab_state *ptr; + + ptr = kzalloc(sizeof(*ptr), GFP_KERNEL); + if (!ptr) + continue; + + if (cmpxchg(&vma->numab_state, NULL, ptr)) { + kfree(ptr); continue; + } vma->numab_state->next_scan = now + msecs_to_jiffies(sysctl_numa_balancing_scan_delay); -- 2.34.1

2 1

[PATCH OLK-6.6] Add Huawei Intelligent Network Card Driver:hibifur
by Zhang Zhenghao 07 Jan '25

07 Jan '25

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBCO6Q CVE: NA --------------------------------- The BIFUR drive supports the following features: Supports Huawei's self-developed SP670 series network cards; Supports users to allocate specific PF to derive VF for single function stream bifurcation; Signed-off-by: Zhang Zhenghao <zhangzhenghao9(a)huawei.com> --- MAINTAINERS | 7 + arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/net/ethernet/huawei/Kconfig | 1 + drivers/net/ethernet/huawei/Makefile | 1 + drivers/net/ethernet/huawei/hibifur/Kconfig | 13 + drivers/net/ethernet/huawei/hibifur/Makefile | 26 + .../ethernet/huawei/hibifur/bifur_common.h | 57 ++ .../net/ethernet/huawei/hibifur/bifur_event.c | 381 +++++++++ .../net/ethernet/huawei/hibifur/bifur_event.h | 26 + .../net/ethernet/huawei/hibifur/bifur_main.c | 791 ++++++++++++++++++ .../net/ethernet/huawei/hibifur/bifur_main.h | 57 ++ .../net/ethernet/huawei/hibifur/bifur_pfile.c | 545 ++++++++++++ .../net/ethernet/huawei/hibifur/bifur_pfile.h | 75 ++ .../ethernet/huawei/hibifur/bifur_vf_mgr.c | 263 ++++++ .../ethernet/huawei/hibifur/bifur_vf_mgr.h | 58 ++ .../huawei/hibifur/include/nic/nic_mpu_cmd.h | 183 ++++ .../huawei/hibifur/include/nic/nic_npu_cmd.h | 29 + .../hibifur/include/nic/nic_npu_cmd_defs.h | 133 +++ .../net/ethernet/huawei/hinic3/hinic3_crm.h | 14 + .../net/ethernet/huawei/hinic3/hinic3_main.c | 18 +- .../huawei/hinic3/hinic3_mgmt_interface.h | 9 + .../net/ethernet/huawei/hinic3/hinic3_mt.h | 7 +- .../huawei/hinic3/hw/hinic3_dev_mgmt.c | 3 + .../huawei/hinic3/hw/hinic3_dev_mgmt.h | 2 + .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c | 14 + .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h | 2 + .../ethernet/huawei/hinic3/hw/hinic3_lld.c | 2 +- .../huawei/hinic3/hw/hinic3_nictool.c | 22 +- .../include/cfg_mgmt/cfg_mgmt_mpu_cmd_defs.h | 2 + 30 files changed, 2724 insertions(+), 19 deletions(-) create mode 100644 drivers/net/ethernet/huawei/hibifur/Kconfig create mode 100644 drivers/net/ethernet/huawei/hibifur/Makefile create mode 100644 drivers/net/ethernet/huawei/hibifur/bifur_common.h create mode 100644 drivers/net/ethernet/huawei/hibifur/bifur_event.c create mode 100644 drivers/net/ethernet/huawei/hibifur/bifur_event.h create mode 100644 drivers/net/ethernet/huawei/hibifur/bifur_main.c create mode 100644 drivers/net/ethernet/huawei/hibifur/bifur_main.h create mode 100644 drivers/net/ethernet/huawei/hibifur/bifur_pfile.c create mode 100644 drivers/net/ethernet/huawei/hibifur/bifur_pfile.h create mode 100644 drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c create mode 100644 drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.h create mode 100644 drivers/net/ethernet/huawei/hibifur/include/nic/nic_mpu_cmd.h create mode 100644 drivers/net/ethernet/huawei/hibifur/include/nic/nic_npu_cmd.h create mode 100644 drivers/net/ethernet/huawei/hibifur/include/nic/nic_npu_cmd_defs.h diff --git a/MAINTAINERS b/MAINTAINERS index 219b3d11e..b22778025 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -9690,6 +9690,13 @@ F: drivers/net/ethernet/huawei/hinic3/cqm/ F: drivers/net/ethernet/huawei/hinic3/hw/ F: drivers/net/ethernet/huawei/hinic3/include/ +HUAWEI BIFUR DRIVER +M: Xiaoping zheng <zhengxiaoping5(a)huawei.com> +L: netdev(a)vger.kernel.org +S: Supported +F: drivers/net/ethernet/huawei/hibifur/ +F: drivers/net/ethernet/huawei/hibifur/include/ + HUAWEI PVRDMA DRIVER M: Chengbo Gu <guchengbo(a)huawei.com> R: Xiaoping zheng <zhengxiaoping5(a)huawei.com> diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index fc6053a50..d4a573c8d 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -2940,6 +2940,7 @@ CONFIG_NET_VENDOR_HUAWEI=y CONFIG_HINIC=m CONFIG_HINIC3=m CONFIG_BMA=m +CONFIG_HIBIFUR=m # CONFIG_NET_VENDOR_I825XX is not set CONFIG_NET_VENDOR_INTEL=y # CONFIG_E100 is not set diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index adfaef0cb..bcb212458 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -2933,6 +2933,7 @@ CONFIG_NET_VENDOR_HUAWEI=y CONFIG_HINIC=m CONFIG_HINIC3=m CONFIG_BMA=m +CONFIG_HIBIFUR=m # CONFIG_NET_VENDOR_I825XX is not set CONFIG_NET_VENDOR_INTEL=y # CONFIG_E100 is not set diff --git a/drivers/net/ethernet/huawei/Kconfig b/drivers/net/ethernet/huawei/Kconfig index 0df9544dc..fc22693e4 100644 --- a/drivers/net/ethernet/huawei/Kconfig +++ b/drivers/net/ethernet/huawei/Kconfig @@ -18,5 +18,6 @@ if NET_VENDOR_HUAWEI source "drivers/net/ethernet/huawei/hinic/Kconfig" source "drivers/net/ethernet/huawei/hinic3/Kconfig" source "drivers/net/ethernet/huawei/bma/Kconfig" +source "drivers/net/ethernet/huawei/hibifur/Kconfig" endif # NET_VENDOR_HUAWEI diff --git a/drivers/net/ethernet/huawei/Makefile b/drivers/net/ethernet/huawei/Makefile index d88e8fd77..97ee28af8 100644 --- a/drivers/net/ethernet/huawei/Makefile +++ b/drivers/net/ethernet/huawei/Makefile @@ -6,3 +6,4 @@ obj-$(CONFIG_HINIC) += hinic/ obj-$(CONFIG_HINIC3) += hinic3/ obj-$(CONFIG_BMA) += bma/ +obj-$(CONFIG_HIBIFUR) += hibifur/ diff --git a/drivers/net/ethernet/huawei/hibifur/Kconfig b/drivers/net/ethernet/huawei/hibifur/Kconfig new file mode 100644 index 000000000..99d7ecec5 --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/Kconfig @@ -0,0 +1,13 @@ +# SPDX-License-Identifier: GPL-2.0-only +# +# Huawei driver configuration +# + +config HIBIFUR + tristate "Huawei Intelligent Network Interface Card Bifur Driver" + depends on HINIC3 && PCI_MSI && NUMA && PCI_IOV && DCB && (X86 || ARM64) + help + This driver supports HIBIFUR PCIE Ethernet cards. + To compile this driver as part of the kernel, choose Y here. + If unsure, choose N. + The default is N. diff --git a/drivers/net/ethernet/huawei/hibifur/Makefile b/drivers/net/ethernet/huawei/hibifur/Makefile new file mode 100644 index 000000000..a4fd682e1 --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/Makefile @@ -0,0 +1,26 @@ +EXPORT_SYMBOL := true + +KBUILD_EXTRA_SYMBOLS += $(srctree)/drivers/net/ethernet/huawei/hinic3/Module.symvers + +SYS_TIME=$(shell date +%Y-%m-%d_%H:%M:%S) +ccflags-y += -D __TIME_STR__=\"$(SYS_TIME)\" + +ccflags-y += -I$(srctree)/include/linux +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hinic3/include/public +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hinic3/include/cfg_mgmt +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hinic3/include/cqm +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hinic3/include/bond +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hinic3/include/mpu +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hinic3/hw +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hinic3/bond +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hibifur/include +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hibifur/include/nic +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hinic3 +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hinic3/include + +obj-$(CONFIG_HIBIFUR) += hibifur3.o + +hibifur3-objs := bifur_main.o \ + bifur_vf_mgr.o \ + bifur_pfile.o \ + bifur_event.o diff --git a/drivers/net/ethernet/huawei/hibifur/bifur_common.h b/drivers/net/ethernet/huawei/hibifur/bifur_common.h new file mode 100644 index 000000000..145db9cd3 --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/bifur_common.h @@ -0,0 +1,57 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2024-2024. All rights reserved. + */ + +#ifndef BIFUR_COMMON_H__ +#define BIFUR_COMMON_H__ + +#include <linux/module.h> +#include <linux/init.h> +#include <linux/etherdevice.h> +#include <linux/proc_fs.h> +#include <linux/uaccess.h> +#include <linux/types.h> +#include <linux/cdev.h> +#include <linux/fs.h> +#include <linux/mm_types.h> +#include <linux/kdev_t.h> +#include <linux/netdevice.h> +#include <linux/notifier.h> +#include <net/net_namespace.h> +#include "asm-generic/int-ll64.h" +#include "linux/pci.h" + +#include "ossl_knl_linux.h" +#include "hinic3_nic_dev.h" +#include "ossl_knl.h" +#include "hinic3_nic_cfg.h" +#include "hinic3_srv_nic.h" + +#define BIFUR_VF_NUM 40 +#define BIFUR_FILE_PATH_SIZE 50 +#define BIFUR_RESOURCE_PF_SSID 0x5a1 + +#define BIFUR_ENABLED 1 +#define BIFUR_DISABLED 0 + +#define PCI_DBDF(dom, bus, dev, func) \ + ((((u32)(dom) << 16) | ((u32)(bus) << 8) | ((u32)(dev) << 3) | ((u32)(func) & 0x7))) +#define PCI_DBDF_DOM(dbdf) (((dbdf) >> 16) & 0xFFFF) +#define PCI_DBDF_BUS(dbdf) (((dbdf) >> 8) & 0xFF) +#define PCI_DBDF_DEVID(dbdf) (((dbdf) >> 3) & 0x1F) +#define PCI_DBDF_FUNCTION(dbdf) ((dbdf) & 0x7) +#define PCI_DBDF_DEVFN(dbdf) ((dbdf) & 0xFF) + +struct bifur_cdev { + struct cdev cdev; + dev_t cdev_id; + struct proc_dir_entry *proc_dir; +}; + +#define BIFUR_DEV_INFO(lld_dev, fmt, arg...) dev_info(&((lld_dev)->pdev->dev), "[BIFUR]" fmt, ##arg) + +#define BIFUR_DEV_WARN(lld_dev, fmt, arg...) dev_warn(&((lld_dev)->pdev->dev), "[BIFUR]" fmt, ##arg) + +#define BIFUR_DEV_ERR(lld_dev, fmt, arg...) dev_err(&((lld_dev)->pdev->dev), "[BIFUR]" fmt, ##arg) +#endif diff --git a/drivers/net/ethernet/huawei/hibifur/bifur_event.c b/drivers/net/ethernet/huawei/hibifur/bifur_event.c new file mode 100644 index 000000000..397ee107f --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/bifur_event.c @@ -0,0 +1,381 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2024-2024. All rights reserved. + */ +#include <net/bonding.h> +#include "hinic3_srv_nic.h" +#include "hinic3_lld.h" +#include "hinic3_bond.h" +#include "hinic3_mt.h" +#include "nic_mpu_cmd.h" +#include "hinic3_hw.h" +#include "hinic3_mgmt_interface.h" + +#include "bifur_common.h" +#include "bifur_vf_mgr.h" +#include "bifur_main.h" +#include "bifur_event.h" + +static int bifur_set_vf_bond_enable(struct bifur_lld_dev *bifur_dev, u16 vf_id, u8 bond_bifur_en) +{ + int err; + struct hinic3_bond_mask_cmd bond_info = { 0 }; + u16 out_size = sizeof(struct hinic3_bond_mask_cmd); + + bond_info.msg_head.status = 1; + bond_info.func_id = vf_id; + bond_info.bond_en = bond_bifur_en; + + err = hinic3_msg_to_mgmt_sync(bifur_dev->lld_dev->hwdev, HINIC3_MOD_L2NIC, + HINIC3_NIC_CMD_SET_BOND_MASK, &bond_info, + sizeof(bond_info), &bond_info, + &out_size, 0, HINIC3_CHANNEL_DEFAULT); + if (bond_info.msg_head.status != 0 || err != 0 || out_size == 0) { + BIFUR_DEV_ERR(bifur_dev->lld_dev, + "Failed to set VF forward id config. err(%d), sts(%u), out_size(%u)\n", + err, bond_info.msg_head.status, out_size); + return -EIO; + } + return 0; +} + +void bifur_set_bond_enable(u8 bond_bifur_en) +{ + int i, err; + struct bifur_vf_info *vf_info = NULL; + struct bifur_vf_mgr *vf_mgr = NULL; + struct bifur_lld_dev *bifur_src_dev = bifur_get_resource_dev(); + + if (!bifur_src_dev) { + pr_err("Bifur source pf didn't inited.\n"); + return; + } + vf_mgr = bifur_src_dev->vf_mgr; + + mutex_lock(&vf_mgr->vf_mgr_mutex); + for (i = 0; i < vf_mgr->vf_sum; ++i) { + vf_info = &vf_mgr->vf_info[i]; + err = bifur_set_vf_bond_enable(bifur_src_dev, vf_info->glb_func_id, bond_bifur_en); + if (err != 0) { + BIFUR_DEV_WARN(bifur_src_dev->lld_dev, + "Failed to set VF(0x%x) bond enable(%u).\n", + vf_info->glb_func_id, bond_bifur_en); + } + } + + mutex_unlock(&vf_mgr->vf_mgr_mutex); + bifur_dev_put(bifur_src_dev); +} + +static void bifur_attach_bond_work(struct work_struct *_work) +{ + int ret; + u16 bond_id; + struct bifur_bond_work *work = container_of(_work, struct bifur_bond_work, work); + struct bifur_adapter *adp = bifur_get_adp(); + + if (!adp) { + pr_err("Bifur driver init failed.\n"); + kfree(work); + return; + } + + ret = hinic3_bond_attach(work->name, HINIC3_BOND_USER_OVS, &bond_id); + if (ret) { + pr_info("%s: hinic3 bond attach failed, ret(%d).\n", __func__, ret); + kfree(work); + return; + } + + bifur_dev_list_lock(); + adp->bond_id = bond_id; + adp->bond_bifur_enabled = BIFUR_ENABLED; + bifur_dev_list_unlock(); + + pr_info("bifur_attach: %s: bond_name(%s), bond_id(%u)\n", __func__, work->name, bond_id); + bifur_set_bond_enable(BIFUR_ENABLED); + + kfree(work); +} + +static void bifur_queue_bond_work(struct bifur_adapter *adp, struct net_device *upper_netdev) +{ + struct bifur_bond_work *work; + struct bonding *bond = netdev_priv(upper_netdev); + + if (!bond) { + pr_info("%s: (name:%s) has no bond dev.\n", __func__, upper_netdev->name); + return; + } + + work = kzalloc(sizeof(*work), GFP_KERNEL); + if (!work) + return; + + (void)strscpy(work->name, upper_netdev->name, strlen(upper_netdev->name)); + INIT_WORK(&work->work, bifur_attach_bond_work); + (void)queue_work(adp->event_workq, &work->work); +} + +static void bifur_detach_nic_bond_work(struct work_struct *work) +{ + struct bifur_bond_work *detach_work = container_of(work, struct bifur_bond_work, work); + struct bifur_adapter *adp = bifur_get_adp(); + u16 bond_id; + + if (!adp) { + pr_err("Bifur driver init failed.\n"); + kfree(detach_work); + return; + } + + bifur_dev_list_lock(); + bond_id = adp->bond_id; + adp->bond_bifur_enabled = BIFUR_DISABLED; + bifur_dev_list_unlock(); + + hinic3_bond_detach(bond_id, HINIC3_BOND_USER_OVS); + bifur_set_bond_enable(BIFUR_DISABLED); + kfree(detach_work); +} + +static void bifur_queue_detach_bond_work(struct bifur_adapter *adp) +{ + struct bifur_bond_work *work; + + work = kzalloc(sizeof(*work), GFP_KERNEL); + if (!work) + return; + + INIT_WORK(&work->work, bifur_detach_nic_bond_work); + + (void)queue_work(adp->event_workq, &work->work); +} + +static bool bifur_can_do_bond(struct bonding *bond) +{ + bool ret = false; + int slave_cnt = 0; + struct slave *slave = NULL; + struct list_head *iter = NULL; + struct hinic3_lld_dev *lld_dev = NULL; + struct hinic3_lld_dev *ppf_dev = NULL; + + if (!bond) + return ret; + + rcu_read_lock(); + bond_for_each_slave_rcu(bond, slave, iter) { + lld_dev = hinic3_get_lld_dev_by_netdev(slave->dev); + if (!lld_dev) + goto out; + + if (!hinic3_support_bifur(lld_dev->hwdev, NULL)) + goto out; + + if (!ppf_dev) { + ppf_dev = hinic3_get_ppf_lld_dev(lld_dev); + if (!ppf_dev) + goto out; + } + + slave_cnt++; + pr_info("%s:can do bond? slave_cnt(%d), slave_name(%s)", __func__, + slave_cnt, slave->dev->name); + } + + ret = (slave_cnt == BIFUR_BOND_2_FUNC_NUM); +out: + rcu_read_unlock(); + return ret; +} + +static int bifur_bond_netdev_event(struct bifur_adapter *adp, + struct netdev_notifier_changeupper_info *info, + struct net_device *net_dev) +{ + struct bonding *bond = NULL; + struct net_device *upper_netdev = info->upper_dev; + + if (net_eq(dev_net(net_dev), &init_net) == 0) + return NOTIFY_DONE; + + if (!upper_netdev) + return NOTIFY_DONE; + + if (!netif_is_lag_master(upper_netdev)) + return NOTIFY_DONE; + + bond = netdev_priv(upper_netdev); + if (!bifur_can_do_bond(bond)) { + bifur_queue_detach_bond_work(adp); + pr_info("%s: (name:%s) has no bond dev.\n", __func__, upper_netdev->name); + return NOTIFY_DONE; + } + + bifur_queue_bond_work(adp, upper_netdev); + + return NOTIFY_DONE; +} + +int bifur_bond_init(void) +{ + int ret = 0; + struct net_device *upper_netdev; + struct bifur_adapter *adp = bifur_get_adp(); + + if (!adp) { + pr_err("Bifur driver init failed.\n"); + return -EINVAL; + } + + rtnl_lock(); + for_each_netdev(&init_net, upper_netdev) { + if (netif_is_bond_master(upper_netdev) && + bifur_can_do_bond(netdev_priv(upper_netdev))) { + bifur_queue_bond_work(adp, upper_netdev); + break; + } + } + rtnl_unlock(); + + pr_info("%s: bond init exit.\n", __func__); + return ret; +} + +void bifur_bond_exit(void) +{ + struct bifur_adapter *adp = bifur_get_adp(); + + if (!adp) { + pr_err("Bifur driver init failed.\n"); + return; + } + bifur_queue_detach_bond_work(adp); +} + +void bifur_notify_vf_link_status(struct hinic3_lld_dev *lld_dev, u8 port_id, u16 vf_id, + u8 link_status) +{ + struct mag_cmd_get_link_status link; + u16 out_size = sizeof(link); + int err; + + (void)memset(&link, 0, sizeof(link)); + link.status = link_status; + link.port_id = port_id; + + err = hinic3_mbox_to_vf_no_ack(lld_dev->hwdev, vf_id, HINIC3_MOD_HILINK, + MAG_CMD_GET_LINK_STATUS, &link, sizeof(link), + &link, &out_size, HINIC3_CHANNEL_NIC); + if (err == MBOX_ERRCODE_UNKNOWN_DES_FUNC) { + pr_err("Vf%d not initialized, disconnect it\n", HW_VF_ID_TO_OS(vf_id)); + return; + } + + if (err || !out_size || link.head.status) { + pr_err("Send link change event to VF %d failed, err: %d, status: 0x%x, out_size: 0x%x\n", + HW_VF_ID_TO_OS(vf_id), err, link.head.status, out_size); + } +} + +void bifur_notify_all_vfs_link_changed(struct hinic3_lld_dev *lld_dev, u32 dbdf, u8 link_status) +{ + struct bifur_lld_dev *bifur_src_dev = NULL; + struct bifur_vf_mgr *vf_mgr = NULL; + struct bifur_vf_info *vf_info = NULL; + u16 i; + u8 port_id; + + bifur_src_dev = bifur_get_resource_dev(); + if (!bifur_src_dev) + return; + + vf_mgr = bifur_src_dev->vf_mgr; + port_id = hinic3_physical_port_id(lld_dev->hwdev); + + mutex_lock(&vf_mgr->vf_mgr_mutex); + for (i = 0; i < vf_mgr->vf_sum; ++i) { + vf_info = &vf_mgr->vf_info[i]; + if (vf_info->pf_dbdf == dbdf && vf_info->in_use) + bifur_notify_vf_link_status(bifur_src_dev->lld_dev, port_id, + OS_VF_ID_TO_HW(i), link_status); + } + mutex_unlock(&vf_mgr->vf_mgr_mutex); + + bifur_dev_put(bifur_src_dev); +} + +void bifur_netdev_event(struct work_struct *work) +{ + struct bifur_lld_dev *bifur_dev = container_of(work, struct bifur_lld_dev, netdev_link); + + bifur_notify_all_vfs_link_changed(bifur_dev->lld_dev, bifur_dev->dbdf, + bifur_dev->link_status); + + bifur_dev_put(bifur_dev); +} + +static int bifur_net_link_event(struct bifur_adapter *adp, unsigned long event, + struct net_device *dev) +{ + u32 dbdf; + struct pci_dev *pcidev = NULL; + struct bifur_lld_dev *bifur_dev = NULL; + struct hinic3_nic_dev *nic_dev = NULL; + + nic_dev = netdev_priv(dev); + pcidev = nic_dev->pdev; + dbdf = PCI_DBDF(pci_domain_nr(pcidev->bus), pcidev->bus->number, + PCI_DBDF_DEVID(pcidev->devfn), PCI_DBDF_FUNCTION(pcidev->devfn)); + + bifur_dev = bifur_get_shared_dev_by_dbdf(dbdf); + if (!bifur_dev) + return NOTIFY_DONE; + + bifur_dev->link_status = (event == NETDEV_UP ? 1 : 0); + (void)queue_work(adp->event_workq, &bifur_dev->netdev_link); + return NOTIFY_OK; +} + +int bifur_net_event_callback(struct notifier_block *nb, unsigned long event, void *ptr) +{ + struct net_device *dev = netdev_notifier_info_to_dev(ptr); + struct bifur_adapter *adp = bifur_get_adp(); + + if (unlikely(!dev)) { + pr_err("bifur notify dev null\n"); + return NOTIFY_DONE; + } + + /* only self-developed NICs can be processed */ + if (!hinic3_get_lld_dev_by_netdev(dev)) + return NOTIFY_DONE; + + switch (event) { + case NETDEV_UP: + case NETDEV_DOWN: + return bifur_net_link_event(adp, event, dev); + case NETDEV_CHANGEUPPER: + return bifur_bond_netdev_event(adp, (struct netdev_notifier_changeupper_info *)ptr, + dev); + default: + break; + } + + return NOTIFY_OK; +} + +static struct notifier_block g_bifur_event_nb = { + .notifier_call = bifur_net_event_callback +}; + +int bifur_register_net_event(void) +{ + return register_netdevice_notifier(&g_bifur_event_nb); +} + +void bifur_unregister_net_event(void) +{ + (void)unregister_netdevice_notifier(&g_bifur_event_nb); +} diff --git a/drivers/net/ethernet/huawei/hibifur/bifur_event.h b/drivers/net/ethernet/huawei/hibifur/bifur_event.h new file mode 100644 index 000000000..b9068a10f --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/bifur_event.h @@ -0,0 +1,26 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2024-2024. All rights reserved. + */ + +#ifndef BIFUR_EVENT_H__ +#define BIFUR_EVENT_H__ +#include <linux/workqueue.h> +#include <linux/notifier.h> +#include <linux/if.h> + +#define BIFUR_BOND_2_FUNC_NUM 2 + +struct bifur_bond_work { + char name[IFNAMSIZ]; + struct work_struct work; +}; + +void bifur_set_bond_enable(u8 bond_bifur_en); +int bifur_bond_init(void); +void bifur_bond_exit(void); +int bifur_register_net_event(void); +void bifur_unregister_net_event(void); +void bifur_netdev_event(struct work_struct *work); + +#endif diff --git a/drivers/net/ethernet/huawei/hibifur/bifur_main.c b/drivers/net/ethernet/huawei/hibifur/bifur_main.c new file mode 100644 index 000000000..287ef2268 --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/bifur_main.c @@ -0,0 +1,791 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2024-2024. All rights reserved. + */ + +/* sdk include */ +#include "hinic3_crm.h" +#include "hinic3_hw.h" +#include "hinic3_cqm.h" +#include "hinic3_lld.h" +#include "hinic3_mt.h" + +#include "bifur_common.h" +#include "bifur_vf_mgr.h" +#include "bifur_pfile.h" +#include "bifur_event.h" +#include "bifur_main.h" +#define BIFUR_DRV_DESC "BIFUR Offload Driver" +#define BIFUR_DRV_VERSION "" + +#define BIFUR_WAIT_TIMES 1000 +#define BIFUR_REMOVE_TIMESTEP 10 +#define BIFUR_KWRITE_BUF_SIZE 20 +#define BIFUR_DPDK_KDRIVER_TYPE 3 + +#define BIFUR_SET_ENABLE 0xc0 +#define BIFUR_GET_ENABLE 0xc1 + +static char *g_bifur_dpdk_kdriver = "vfio-pci"; +module_param(g_bifur_dpdk_kdriver, charp, 0644); +MODULE_PARM_DESC(g_bifur_dpdk_kdriver, + "for dpdk kernel driver module (default:\"igb_uio\", options:\"vfio-pci\", \"uio_pci_generic\")"); +static const char *g_bifur_dpdk_kdriver_all[BIFUR_DPDK_KDRIVER_TYPE] = { + "igb_uio", + "vfio-pci", + "uio_pci_generic" +}; + +/* bifur global manager struct */ +static struct bifur_adapter *g_bifur_adapter; + +static void bifur_destroy_dev(struct bifur_lld_dev *bifur_dev); +static void wait_bifur_dev_unused(struct bifur_lld_dev *bifur_dev); + +struct bifur_adapter *bifur_get_adp(void) +{ + return g_bifur_adapter; +} + +void bifur_dev_hold(struct bifur_lld_dev *bifur_dev) +{ + atomic_inc(&bifur_dev->bifur_dev.bifur_dev_ref); +} + +void bifur_dev_put(struct bifur_lld_dev *bifur_dev) +{ + atomic_dec(&bifur_dev->bifur_dev.bifur_dev_ref); +} + +void bifur_dev_list_lock(void) +{ + mutex_lock(&g_bifur_adapter->bifur_dev_mutex); +} + +void bifur_dev_list_unlock(void) +{ + mutex_unlock(&g_bifur_adapter->bifur_dev_mutex); +} + +static int bifur_alloc_adapter(void) +{ + /* alloc driver global adapter struct */ + if (!g_bifur_adapter) { + g_bifur_adapter = kzalloc(sizeof(*g_bifur_adapter), GFP_KERNEL); + if (!g_bifur_adapter) + return -ENOMEM; + } + + /* init global adapter */ + INIT_LIST_HEAD(&g_bifur_adapter->lld_dev_head); + mutex_init(&g_bifur_adapter->bifur_dev_mutex); + + g_bifur_adapter->event_workq = create_singlethread_workqueue("bifur_eventq"); + if (!g_bifur_adapter->event_workq) { + kfree(g_bifur_adapter); + g_bifur_adapter = NULL; + pr_err("Create bifur event_workq fail"); + return -ENOMEM; + } + + pr_info("Alloc bifur adapter success\n"); + return 0; +} + +static void bifur_free_adapter(void) +{ + destroy_workqueue(g_bifur_adapter->event_workq); + + kfree(g_bifur_adapter); + g_bifur_adapter = NULL; + pr_info("Free adapter success\n"); +} + +static bool bifur_check_dpdk_kdriver(void) +{ + bool is_valid_driver = false; + int i; + + for (i = 0; i < BIFUR_DPDK_KDRIVER_TYPE; ++i) { + if (!strcmp(g_bifur_dpdk_kdriver, g_bifur_dpdk_kdriver_all[i])) + is_valid_driver = true; + } + + return is_valid_driver; +} + +static int bifur_open_and_write_file(const char *file_path, const char *buf, int open_flags, + umode_t open_mode) +{ + struct file *fp = NULL; + loff_t f_pos = 0; + int err = 0; + + fp = filp_open(file_path, open_flags, open_mode); + if (IS_ERR(fp)) { + pr_err("Open %s failed, err %ld\n", file_path, PTR_ERR(fp)); + return -ENOENT; + } + + err = kernel_write(fp, buf, strlen(buf), &f_pos); + if (err < 0) { + pr_err("Write %s to file %s failed, err %d\n", buf, file_path, err); + (void)filp_close(fp, NULL); + return err; + } + + (void)filp_close(fp, NULL); + + return 0; +} + +static int bifur_enable_disable_vfs(struct bifur_lld_dev *bifur_dev, u16 num_vfs) +{ + int err = 0; + char file_path[BIFUR_FILE_PATH_SIZE] = {}; + char buf[BIFUR_KWRITE_BUF_SIZE] = {}; + struct pci_dev *pdev = bifur_dev->lld_dev->pdev; + + /* write vf num to /sys/bus/pci/devices/%s/sriov_numvfs */ + err = snprintf(file_path, BIFUR_FILE_PATH_SIZE, + "/sys/bus/pci/devices/%s/sriov_numvfs", pci_name(pdev)); + if (err == -1) { + pr_err("Snprintf bifur pci dev sriov_numvfs file path, err %d!\n", err); + return err; + } + + err = snprintf(buf, BIFUR_KWRITE_BUF_SIZE, "%u", num_vfs); + if (err == -1) { + pr_err("Snprintf bifur numvfs str, err %d!\n", err); + return err; + } + + err = bifur_open_and_write_file(file_path, buf, O_WRONLY | O_TRUNC, 0); + if (err != 0) { + pr_info("Enable vf of pf failed, dbdf:0x%s, sriov_nums:%u\n", + pci_name(pdev), num_vfs); + return err; + } + + pr_info("Enable vf of pf success, dbdf:0x%s, sriov_nums:%u\n", pci_name(pdev), num_vfs); + + return 0; +} + +int bifur_enable_disable_vf_all(bool enable) +{ + int err = 0; + int num_vfs = enable ? BIFUR_VF_NUM : 0; + struct bifur_lld_dev *bifur_dev = NULL; + struct bifur_lld_dev *tmp_dev = NULL; + struct bifur_adapter *adp = bifur_get_adp(); + struct list_head *head = &adp->lld_dev_head; + + list_for_each_entry_safe(bifur_dev, tmp_dev, head, list) { + if (bifur_dev->pf_type != BIFUR_RESOURCE_PF) + continue; + + bifur_dev_hold(bifur_dev); + err = bifur_enable_disable_vfs(bifur_dev, num_vfs); + bifur_dev_put(bifur_dev); + if (err) + return err; + } + + return 0; +} + +static int bifur_one_unbind_driver(u32 dbdf, const char *driver) +{ + int err = 0; + char file_path[BIFUR_FILE_PATH_SIZE] = {}; + char buf[BIFUR_KWRITE_BUF_SIZE] = {}; + + /* write pci dbdf to /sys/bus/pci/drivers/%s/unbind */ + err = snprintf(file_path, BIFUR_FILE_PATH_SIZE, + "/sys/bus/pci/drivers/%s/unbind", driver); + if (err == -1) { + pr_err("Snprintf bifur driver unbind file path, err %d!\n", err); + return err; + } + + err = snprintf(buf, BIFUR_KWRITE_BUF_SIZE, "%.4x:%.2x:%.2x.%x", + PCI_DBDF_DOM(dbdf), PCI_DBDF_BUS(dbdf), + PCI_DBDF_DEVID(dbdf), PCI_DBDF_FUNCTION(dbdf)); + if (err == -1) { + pr_err("Snprintf bifur pci dev dbdf str, err %d!\n", err); + return err; + } + + err = bifur_open_and_write_file(file_path, buf, O_WRONLY | O_APPEND, 0); + if (err != 0) { + pr_info("Unbind vf from driver %s failed\n", driver); + return err; + } + + pr_info("Unbind vf from driver %s success\n", driver); + + return 0; +} + +static int bifur_one_bind_dpdk(u32 dbdf) +{ + int err = 0; + char file_path[BIFUR_FILE_PATH_SIZE] = {}; + char buf[BIFUR_KWRITE_BUF_SIZE] = {}; + const char *kernel_driver = "hisdk3"; + + bifur_one_unbind_driver(dbdf, kernel_driver); + + err = snprintf(file_path, BIFUR_FILE_PATH_SIZE, + "/sys/bus/pci/devices/%.4x:%.2x:%.2x.%x/driver_override", + PCI_DBDF_DOM(dbdf), PCI_DBDF_BUS(dbdf), + PCI_DBDF_DEVID(dbdf), PCI_DBDF_FUNCTION(dbdf)); + if (err == -1) { + pr_err("Snprintf bifur pci dev driver_override file path, err %d!\n", err); + return err; + } + + (void)strscpy(buf, g_bifur_dpdk_kdriver, sizeof(buf)); + + err = bifur_open_and_write_file(file_path, buf, O_WRONLY | O_TRUNC, 0); + if (err != 0) + return err; + + err = snprintf(file_path, BIFUR_FILE_PATH_SIZE, + "/sys/bus/pci/drivers/%s/bind", g_bifur_dpdk_kdriver); + if (err == -1) { + pr_err("Snprintf bifur dpdk driver bind file path, err %d!\n", err); + return err; + } + + err = snprintf(buf, BIFUR_KWRITE_BUF_SIZE, "%.4x:%.2x:%.2x.%x", + PCI_DBDF_DOM(dbdf), PCI_DBDF_BUS(dbdf), + PCI_DBDF_DEVID(dbdf), PCI_DBDF_FUNCTION(dbdf)); + if (err == -1) { + pr_err("Snprintf bifur pci dev dbdf str, err %d!\n", err); + return err; + } + + err = bifur_open_and_write_file(file_path, buf, O_WRONLY | O_APPEND, 0); + if (err != 0) + return err; + + return 0; +} + +static int bifur_bind_unbind_dpdk(struct bifur_lld_dev *bifur_dev, bool enable) +{ + int err = 0; + u32 dbdf = 0; + int i; + + for (i = 0; i < bifur_dev->vf_mgr->vf_sum; ++i) { + dbdf = bifur_dev->vf_mgr->vf_info[i].vf_dbdf; + if (enable) + err = bifur_one_bind_dpdk(dbdf); + else + err = bifur_one_unbind_driver(dbdf, g_bifur_dpdk_kdriver); + if (err) { + pr_err("Bind/Unbind failed for vf %08x\n", dbdf); + return err; + } + } + + return 0; +} + +static int bifur_bind_unbind_dpdk_all(bool enable) +{ + int err = 0; + struct bifur_lld_dev *bifur_dev = NULL; + struct bifur_lld_dev *tmp_dev = NULL; + struct bifur_adapter *adp = bifur_get_adp(); + struct list_head *head = &adp->lld_dev_head; + + list_for_each_entry_safe(bifur_dev, tmp_dev, head, list) { + if (bifur_dev->pf_type != BIFUR_RESOURCE_PF) + continue; + + bifur_dev_hold(bifur_dev); + err = bifur_bind_unbind_dpdk(bifur_dev, enable); + bifur_dev_put(bifur_dev); + if (err) + return err; + } + + return 0; +} + +static int bifur_probe_vf(struct hinic3_lld_dev *lld_dev) +{ + struct bifur_lld_dev *bifur_dev = NULL; + struct bifur_vf_mgr *vf_mgr = NULL; + struct bifur_vf_info *vf_info = NULL; + u32 vf_dbdf; + int ret; + + bifur_dev = bifur_get_resource_dev(); + if (!bifur_dev) + return -ENODEV; + + vf_mgr = bifur_dev->vf_mgr; + vf_dbdf = PCI_DBDF(pci_domain_nr(lld_dev->pdev->bus), lld_dev->pdev->bus->number, + PCI_DBDF_DEVID(lld_dev->pdev->devfn), + PCI_DBDF_FUNCTION(lld_dev->pdev->devfn)); + if (vf_mgr->vf_sum >= BIFUR_VF_NUM) { + bifur_dev_put(bifur_dev); + BIFUR_DEV_ERR(lld_dev, "current_vf_sum(%u) >= BIFUR_VF_NUM(%u)\n", + vf_mgr->vf_sum, BIFUR_VF_NUM); + return -ENOMEM; + } + + mutex_lock(&bifur_dev->vf_mgr->vf_mgr_mutex); + vf_info = &vf_mgr->vf_info[vf_mgr->vf_sum]; + vf_mgr->vf_sum++; + vf_info->vf_dbdf = vf_dbdf; + vf_info->glb_func_id = hinic3_global_func_id(lld_dev->hwdev); + vf_info->in_use = 0; + vf_info->vf_mgr = vf_mgr; + ret = snprintf(vf_info->name, (size_t)BIFURNAMSIZ, "bifur%04x", vf_dbdf); + if (ret < 0) { + mutex_unlock(&bifur_dev->vf_mgr->vf_mgr_mutex); + BIFUR_DEV_ERR(lld_dev, "set name failed, ret(%d)\n", ret); + bifur_dev_put(bifur_dev); + return ret; + } + bifur_vf_cdev_init(vf_info); + mutex_unlock(&bifur_dev->vf_mgr->vf_mgr_mutex); + + bifur_dev_put(bifur_dev); + + return 0; +} + +static int bifur_remove_vf(struct bifur_lld_dev *bifur_dev) +{ + struct bifur_vf_info *vf_info = NULL; + struct bifur_vf_mgr *vf_mgr = NULL; + int i; + + if (!bifur_dev) + return -ENODEV; + vf_mgr = bifur_dev->vf_mgr; + + mutex_lock(&vf_mgr->vf_mgr_mutex); + for (i = 0; i < vf_mgr->vf_sum; ++i) { + vf_info = &vf_mgr->vf_info[i]; + bifur_vf_cdev_uninit(vf_info); + } + mutex_unlock(&vf_mgr->vf_mgr_mutex); + return 0; +} + +static int bifur_probe(struct hinic3_lld_dev *lld_dev, void **uld_dev, char *uld_dev_name) +{ + struct bifur_lld_dev *bifur_dev = NULL; + struct bifur_adapter *adp = bifur_get_adp(); + int err = 0; + + if (!uld_dev || !lld_dev || !lld_dev->pdev || !lld_dev->hwdev) { + pr_err("Bifur probe failed for invalid param, lld_dev or uld_dev\n"); + return -EINVAL; + } + + if (hinic3_func_type(lld_dev->hwdev) == TYPE_VF) { + *uld_dev = NULL; + if (hinic3_support_bifur(lld_dev->hwdev, NULL)) { + err = bifur_probe_vf(lld_dev); + return err; + } + return 0; + } + + bifur_dev = kzalloc(sizeof(*bifur_dev), GFP_KERNEL); + if (!bifur_dev) { + BIFUR_DEV_ERR(lld_dev, "Alloc bifur lld dev failed\n"); + return -ENOMEM; + } + + /* init bifur dev */ + bifur_dev->lld_dev = lld_dev; + + if (hinic3_support_bifur(lld_dev->hwdev, NULL)) { + if (lld_dev->pdev->subsystem_device == BIFUR_RESOURCE_PF_SSID) { + bifur_dev->pf_type = BIFUR_RESOURCE_PF; + err = bifur_alloc_vf_mgr(bifur_dev); + if (err) { + kfree(bifur_dev); + bifur_dev = NULL; + return err; + } + } else { + bifur_dev->pf_type = BIFUR_SHARED_PF; + } + } else { + bifur_dev->pf_type = BIFUR_EXCLUSIVE_PF; + } + pr_info("bifur_dev->pf_type: %d\n", bifur_dev->pf_type); + + INIT_WORK(&bifur_dev->netdev_link, bifur_netdev_event); + bifur_dev->dbdf = PCI_DBDF(pci_domain_nr(lld_dev->pdev->bus), lld_dev->pdev->bus->number, + PCI_DBDF_DEVID(lld_dev->pdev->devfn), + PCI_DBDF_FUNCTION(lld_dev->pdev->devfn)); + + atomic_set(&bifur_dev->bifur_dev.bifur_dev_ref, 0); + bifur_dev->bifur_dev.has_created = true; + + bifur_dev_list_lock(); + list_add_tail(&bifur_dev->list, &adp->lld_dev_head); + bifur_dev_list_unlock(); + + *uld_dev = bifur_dev; + + BIFUR_DEV_INFO(lld_dev, "bifur driver probe\n"); + + return 0; +} + +static void bifur_remove(struct hinic3_lld_dev *lld_dev, void *uld_dev) +{ + struct bifur_lld_dev *bifur_dev = (struct bifur_lld_dev *)uld_dev; + + if (!bifur_dev) + return; + + if (bifur_dev->pf_type == BIFUR_RESOURCE_PF) { + (void)bifur_remove_vf(bifur_dev); + bifur_free_vf_mgr(bifur_dev); + } + + /* delete bifur device */ + bifur_dev_list_lock(); + list_del(&bifur_dev->list); + bifur_dev_list_unlock(); + + (void)cancel_work_sync(&bifur_dev->netdev_link); + wait_bifur_dev_unused(bifur_dev); + + bifur_destroy_dev(bifur_dev); + + kfree(bifur_dev); + bifur_dev = NULL; + + BIFUR_DEV_INFO(lld_dev, "bifur driver remove\n"); +} + +static int get_bifur_drv_version(struct drv_version_info *ver_info, u32 *out_size) +{ + int err; + + if (*out_size != sizeof(*ver_info)) { + pr_err("Unexpected out buf size from user :%u, expect: %lu\n", + *out_size, sizeof(*ver_info)); + return -EINVAL; + } + + err = snprintf(ver_info->ver, sizeof(ver_info->ver), "%s %s", + BIFUR_DRV_VERSION, __TIME_STR__); + if (err == -1) { + pr_err("Snprintf bifur version err\n"); + return -EFAULT; + } + + return 0; +} + +static int bifur_enable_vfs(u8 bond_bifur_en) +{ + int err; + + err = bifur_enable_disable_vf_all(true); + if (err) { + pr_err("Enable bifur vf failed. err(%d)\n", err); + return err; + } + + err = bifur_bind_unbind_dpdk_all(true); + if (err) { + (void)bifur_enable_disable_vf_all(false); + pr_err("Bind bifur vf to dpdk failed. err(%d)\n", err); + return err; + } + + bifur_set_bond_enable(bond_bifur_en); + return 0; +} + +static int bifur_disable_vfs(void) +{ + int err; + + bifur_set_bond_enable(BIFUR_DISABLED); + + err = bifur_enable_disable_vf_all(false); + if (err) { + pr_err("Disable bifur vf failed. err(%d)\n", err); + return err; + } + return 0; +} + +static int bifur_set_vfs_enable_state(struct bifur_adapter *adp, int set_enable, + int *out_enable, u32 *out_size) +{ + int err; + u8 bond_bifur_en; + + if (set_enable != BIFUR_ENABLED && set_enable != BIFUR_DISABLED) { + pr_err("Input params invalid. set_enable(%d)\n", set_enable); + return -EINVAL; + } + + if (*out_size != sizeof(*out_enable)) { + pr_err("Unexpected out buf size from user :%u, expect: %lu\n", + *out_size, sizeof(*out_enable)); + return -EINVAL; + } + + bifur_dev_list_lock(); + if ((u8)set_enable == adp->bifur_enabled) { + *out_enable = adp->bifur_enabled; + bifur_dev_list_unlock(); + pr_info("Bifur enabled status has been set. set_enable(%d)\n", set_enable); + return 0; + } + bond_bifur_en = adp->bond_bifur_enabled; + adp->bifur_enabled = set_enable; + bifur_dev_list_unlock(); + + if (set_enable == BIFUR_ENABLED) + err = bifur_enable_vfs(bond_bifur_en); + else + err = bifur_disable_vfs(); + + bifur_dev_list_lock(); + if (err != 0) + adp->bifur_enabled = !set_enable; + *out_enable = adp->bifur_enabled; + bifur_dev_list_unlock(); + + return err; +} + +static int bifur_get_bifur_enabled(struct bifur_adapter *adp, int *enabled_status, u32 *out_size) +{ + if (*out_size != sizeof(*enabled_status)) { + pr_err("Unexpected out buf size from user :%u, expect: %lu\n", + *out_size, sizeof(*enabled_status)); + return -EINVAL; + } + + bifur_dev_list_lock(); + *enabled_status = adp->bifur_enabled; + bifur_dev_list_unlock(); + return 0; +} + +static int bifur_ioctl(void *uld_dev, u32 cmd, const void *buf_in, u32 in_size, + void *buf_out, u32 *out_size) +{ + struct bifur_adapter *adp = bifur_get_adp(); + struct bifur_lld_dev *bifur_dev = (struct bifur_lld_dev *)uld_dev; + + if (!uld_dev || !out_size || !buf_out) { + pr_err("[BIFUR] %s: Input params is null. out_size(%d), buf_out(%d)\n", + __func__, (int)(!out_size), (int)(!buf_out)); + return -EINVAL; + } + + if (!hinic3_support_bifur(bifur_dev->lld_dev->hwdev, NULL)) { + pr_err("[BIFUR] %s: %s Not support bifurcation\n", __func__, + pci_name(bifur_dev->lld_dev->pdev)); + return -EINVAL; + } + + if (cmd == GET_DRV_VERSION) + return get_bifur_drv_version((struct drv_version_info *)buf_out, out_size); + + if (cmd == BIFUR_SET_ENABLE) + return bifur_set_vfs_enable_state(adp, *(int *)buf_in, (int *)buf_out, out_size); + else if (cmd == BIFUR_GET_ENABLE) + return bifur_get_bifur_enabled(adp, (int *)buf_out, out_size); + + pr_err("Not support cmd %u for bifur\n", cmd); + return 0; +} + +static struct hinic3_uld_info bifur_uld_info = { + .probe = bifur_probe, + .remove = bifur_remove, + .suspend = NULL, + .resume = NULL, + .ioctl = bifur_ioctl, +}; + +static __init int hibifur_init(void) +{ + int err = 0; + + pr_info("%s - version %s, compile time:%s\n", BIFUR_DRV_DESC, + BIFUR_DRV_VERSION, __TIME_STR__); + + if (!bifur_check_dpdk_kdriver()) { + pr_err("Invalid dpdk kernel driver type: %s\n", g_bifur_dpdk_kdriver); + return -EINVAL; + } + + err = bifur_alloc_adapter(); + if (err != 0) + return -ENOMEM; + + err = hinic3_register_uld(SERVICE_T_BIFUR, &bifur_uld_info); + if (err != 0) { + pr_err("Register bifur uld failed\n"); + goto register_uld_err; + } + + err = bifur_global_dev_init(); + if (err) { + pr_err("Register bifur global cdev failed\n"); + goto global_dev_init_err; + } + + err = bifur_register_net_event(); + if (err) { + pr_err("Register bifur global cdev failed\n"); + goto register_event_err; + } + + err = bifur_bond_init(); + if (err != 0) { + pr_err("Bifur bond status init failed\n"); + goto bond_init_err; + } + + return 0; + +bond_init_err: + bifur_unregister_net_event(); +register_event_err: + bifur_global_dev_uninit(); +global_dev_init_err: + hinic3_unregister_uld(SERVICE_T_BIFUR); +register_uld_err: + bifur_free_adapter(); + return err; +} + +static __exit void hibifur_exit(void) +{ + struct bifur_adapter *adp = bifur_get_adp(); + u8 bifur_enabled = BIFUR_DISABLED; + + bifur_bond_exit(); + bifur_unregister_net_event(); + bifur_global_dev_uninit(); + + bifur_dev_list_lock(); + if (adp->bifur_enabled) { + bifur_enabled = adp->bifur_enabled; + adp->bifur_enabled = BIFUR_DISABLED; + } + bifur_dev_list_unlock(); + + if (bifur_enabled) { + (void)bifur_bind_unbind_dpdk_all(false); + (void)bifur_enable_disable_vf_all(false); + } + + hinic3_unregister_uld(SERVICE_T_BIFUR); + bifur_free_adapter(); + + pr_info("%s exit\n", BIFUR_DRV_DESC); +} + +struct bifur_lld_dev *bifur_get_resource_dev(void) +{ + struct bifur_lld_dev *bifur_dev = NULL; + struct bifur_lld_dev *tmp_dev = NULL; + struct bifur_adapter *adp = bifur_get_adp(); + struct list_head *head = &adp->lld_dev_head; + + bifur_dev_list_lock(); + + /* found the bifur_lld_dev of resource pf */ + list_for_each_entry_safe(bifur_dev, tmp_dev, head, list) { + if (bifur_dev->pf_type == BIFUR_RESOURCE_PF) { + bifur_dev_hold(bifur_dev); + bifur_dev_list_unlock(); + pr_info("Find resource pf DBDF 0x%08x\n", bifur_dev->dbdf); + return bifur_dev; + } + } + + bifur_dev_list_unlock(); + + pr_err("Can't find resource pf\n"); + return NULL; +} + +struct bifur_lld_dev *bifur_get_shared_dev_by_dbdf(u32 dbdf) +{ + struct bifur_lld_dev *bifur_dev = NULL; + struct bifur_lld_dev *tmp_dev = NULL; + struct bifur_adapter *adp = bifur_get_adp(); + struct list_head *head = &adp->lld_dev_head; + + bifur_dev_list_lock(); + + /* found the bifur_lld_dev of shared pf */ + list_for_each_entry_safe(bifur_dev, tmp_dev, head, list) { + if (bifur_dev->pf_type == BIFUR_SHARED_PF && dbdf == bifur_dev->dbdf) { + bifur_dev_hold(bifur_dev); + bifur_dev_list_unlock(); + pr_info("Find shared pf DBDF 0x%08x\n", bifur_dev->dbdf); + return bifur_dev; + } + } + + bifur_dev_list_unlock(); + + pr_err("Can't find shared pf 0x%x\n", dbdf); + return NULL; +} + +static void wait_bifur_dev_unused(struct bifur_lld_dev *bifur_dev) +{ + int i; + + for (i = 0; i < BIFUR_WAIT_TIMES; i++) { + if (!atomic_read(&bifur_dev->bifur_dev.bifur_dev_ref)) + break; + + msleep(BIFUR_REMOVE_TIMESTEP); + } + + if (i == BIFUR_WAIT_TIMES) { + BIFUR_DEV_WARN(bifur_dev->lld_dev, + "destroy BIFUR device failed, bifur_dev_ref(%d) can not be 0 after %d ms\n", + atomic_read(&bifur_dev->bifur_dev.bifur_dev_ref), + (BIFUR_WAIT_TIMES * BIFUR_REMOVE_TIMESTEP)); + } +} + +static void bifur_destroy_dev(struct bifur_lld_dev *bifur_dev) +{ + if (!bifur_dev->bifur_dev.has_created) + return; + + bifur_dev->bifur_dev.has_created = false; + + BIFUR_DEV_INFO(bifur_dev->lld_dev, "Destroy BIFUR device success\n"); +} + +module_init(hibifur_init); +module_exit(hibifur_exit); + +MODULE_AUTHOR("Huawei Technologies CO., Ltd"); +MODULE_DESCRIPTION(BIFUR_DRV_DESC); +MODULE_VERSION(BIFUR_DRV_VERSION); +MODULE_LICENSE("GPL"); diff --git a/drivers/net/ethernet/huawei/hibifur/bifur_main.h b/drivers/net/ethernet/huawei/hibifur/bifur_main.h new file mode 100644 index 000000000..9daac17dd --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/bifur_main.h @@ -0,0 +1,57 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2024-2024. All rights reserved. + */ + +#ifndef BIFUR_MAIN_H__ +#define BIFUR_MAIN_H__ + +#include "hinic3_lld.h" +#include "asm-generic/int-ll64.h" + +#include <linux/mutex.h> +#include <linux/types.h> +#include <linux/timer.h> + +enum bifur_func_type { + BIFUR_EXCLUSIVE_PF = 1, + BIFUR_SHARED_PF, + BIFUR_RESOURCE_PF, + BIFUR_RESOURCE_VF, + BIFUR_FUNC_TYPE_MAX +}; + +struct bifur_flow_dev { + atomic_t bifur_dev_ref; + bool has_created; /* bifur dev created or not */ +}; + +struct bifur_adapter { + struct list_head lld_dev_head; /* pcie device list head */ + struct mutex bifur_dev_mutex; /* lock for bifur dev list */ + struct workqueue_struct *event_workq; /* global work queue */ + u8 bifur_enabled; /* used for mark whether to enable traffic bifurcation */ + u8 bond_bifur_enabled; /* used for mark whether to enable bond status of bifurcation vfs */ + u16 bond_id; +}; + +struct bifur_vf_mgr; +struct bifur_lld_dev { + struct list_head list; + struct hinic3_lld_dev *lld_dev; + struct bifur_vf_mgr *vf_mgr; + struct bifur_flow_dev bifur_dev; /* bifur device */ + enum bifur_func_type pf_type; + struct work_struct netdev_link; + u8 link_status; + u32 dbdf; +}; + +void bifur_dev_hold(struct bifur_lld_dev *bifur_dev); +void bifur_dev_put(struct bifur_lld_dev *bifur_dev); +void bifur_dev_list_lock(void); +void bifur_dev_list_unlock(void); +struct bifur_lld_dev *bifur_get_resource_dev(void); +struct bifur_adapter *bifur_get_adp(void); +struct bifur_lld_dev *bifur_get_shared_dev_by_dbdf(u32 dbdf); +#endif diff --git a/drivers/net/ethernet/huawei/hibifur/bifur_pfile.c b/drivers/net/ethernet/huawei/hibifur/bifur_pfile.c new file mode 100644 index 000000000..3621bb10d --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/bifur_pfile.c @@ -0,0 +1,545 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2024-2024. All rights reserved. + */ + +#include <linux/kernel.h> +#include "nic_mpu_cmd.h" +#include "hinic3_hw.h" +#include "hinic3_mgmt_interface.h" +#include "hinic3_common.h" + +#include "bifur_common.h" +#include "bifur_vf_mgr.h" +#include "bifur_main.h" +#include "bifur_pfile.h" + +#define BIFUR_GLOBAL_CDEV_NAME "bifur_gdev" +struct bifur_cdev g_bifur_global_dev; +struct bifur_global_file_list_t g_bifur_global_file_list; + +struct class *g_bifur_class; + +void bifur_global_dev_uninit(void) +{ + struct bifur_proc_file_t *tmp = NULL; + struct bifur_proc_file_t *proc_file = NULL; + struct bifur_cdev *bdev = &g_bifur_global_dev; + + mutex_lock(&g_bifur_global_file_list.lock); + list_for_each_entry_safe(proc_file, tmp, &g_bifur_global_file_list.list, node) { + list_del(&proc_file->node); + } + mutex_unlock(&g_bifur_global_file_list.lock); + + device_destroy(g_bifur_class, bdev->cdev_id); + class_destroy(g_bifur_class); + g_bifur_class = NULL; + cdev_del(&bdev->cdev); + unregister_chrdev_region(bdev->cdev_id, 1); + pr_info("Bifur destroy global cdev(%s) succeed.", BIFUR_GLOBAL_CDEV_NAME); +} + +void bifur_global_file_del(struct bifur_proc_file_t *proc_file) +{ + mutex_lock(&g_bifur_global_file_list.lock); + list_del(&proc_file->node); + mutex_unlock(&g_bifur_global_file_list.lock); +} + +int bifur_global_dev_close(struct inode *inode, struct file *filp) +{ + struct bifur_proc_file_t *proc_file = filp->private_data; + + pr_info("Close global proc_file(%p), filp(%p).", proc_file, filp); + bifur_global_file_del(proc_file); // Direct chain removal without traversing + kfree(proc_file); + + return 0; +} + +/* One dpdk process has only one process_file. A unique file is added to the global list. */ +int bifur_global_file_add(struct bifur_proc_file_t *add_proc_file) +{ + struct bifur_proc_file_t *tmp = NULL; + struct bifur_proc_file_t *proc_file = NULL; + + mutex_lock(&g_bifur_global_file_list.lock); + + list_for_each_entry_safe(proc_file, tmp, &g_bifur_global_file_list.list, node) { + if (proc_file->pid == add_proc_file->pid) { + mutex_unlock(&g_bifur_global_file_list.lock); + pr_err("Process(%u) file is exist.", proc_file->pid); + return -EPERM; + } + } + + list_add_tail(&add_proc_file->node, &g_bifur_global_file_list.list); + mutex_unlock(&g_bifur_global_file_list.lock); + + return 0; +} + +struct bifur_proc_file_t *bifur_alloc_proc_file(void) +{ + struct bifur_proc_file_t *proc_file = kzalloc(sizeof(struct bifur_proc_file_t), GFP_KERNEL); + + if (!proc_file) + return NULL; + + proc_file->pid = current->pid; + + return proc_file; +} + +int bifur_global_dev_open(struct inode *inode, struct file *filp) +{ + int ret; + struct bifur_proc_file_t *proc_file = bifur_alloc_proc_file(); + + if (!proc_file) + return -ENOMEM; + + ret = bifur_global_file_add(proc_file); + if (ret != 0) { + pr_err("Duplicate processes(%u) open global char dev.", current->pid); + kfree(proc_file); + return -EEXIST; + } + filp->private_data = proc_file; + + pr_info("Open proc global proc file success, proc_file(%p), filp(%p) pid(%u).", + proc_file, filp, proc_file->pid); + + return nonseekable_open(inode, filp); +} + +static int bifur_drv_cmd_func_attr_get(struct file *filp, struct bifur_msg *cmd) +{ + struct bifur_lld_dev *bifur_dev = NULL; + struct bifur_lld_dev *tmp_dev = NULL; + struct bifur_adapter *adp = bifur_get_adp(); + struct list_head *head = &adp->lld_dev_head; + int i; + + struct bifur_func_attr_get_cmd_msg *query_cmd; + struct bifur_func_attr_get_cmd_rsp *query_resp; + + query_cmd = (struct bifur_func_attr_get_cmd_msg *)(cmd->in_buf); + query_resp = (struct bifur_func_attr_get_cmd_rsp *)(cmd->out_buf); + if ((!query_cmd) || (!query_resp) || + cmd->in_buf_len < sizeof(struct bifur_func_attr_get_cmd_msg) || + cmd->out_buf_len < sizeof(struct bifur_func_attr_get_cmd_rsp)) { + pr_err("Input param fail, in_buf_len(%u), out_buf_len(%u).", + cmd->in_buf_len, cmd->out_buf_len); + return -EPERM; + } + + query_resp->func_type = 0; + cmd->out_data_len = sizeof(struct bifur_func_attr_get_cmd_rsp); + + bifur_dev_list_lock(); + if (adp->bifur_enabled == BIFUR_DISABLED) { + bifur_dev_list_unlock(); + query_resp->func_type = BIFUR_EXCLUSIVE_PF; + pr_info("Didn't enable traffic bifurcation, functions are exclusive.\n"); + return 0; + } + bifur_dev_list_unlock(); + + list_for_each_entry_safe(bifur_dev, tmp_dev, head, list) { + if (bifur_dev->dbdf == query_cmd->dbdf) { + query_resp->func_type = bifur_dev->pf_type; + break; + } + + if (bifur_dev->pf_type == BIFUR_RESOURCE_PF) { + for (i = 0; i < bifur_dev->vf_mgr->vf_sum; ++i) { + if (bifur_dev->vf_mgr->vf_info[i].vf_dbdf == query_cmd->dbdf) { + query_resp->func_type = BIFUR_RESOURCE_VF; + break; + } + } + } + } + + pr_info("Do get func attr cmd success\n"); + return 0; +} + +static inline void bifur_release_vf(struct bifur_vf_mgr *vf_mgr, struct bifur_vf_info *vf_info) +{ + mutex_lock(&vf_mgr->vf_mgr_mutex); + vf_info->in_use = 0; + vf_mgr->vf_in_use--; + mutex_unlock(&vf_mgr->vf_mgr_mutex); +} + +static int get_global_func_id_by_dbdf(u32 dbdf, u16 *glb_func_id) +{ + struct bifur_lld_dev *bifur_dev = NULL; + struct bifur_lld_dev *tmp_dev = NULL; + struct bifur_adapter *adp = bifur_get_adp(); + struct list_head *head = &adp->lld_dev_head; + int i; + + list_for_each_entry_safe(bifur_dev, tmp_dev, head, list) { + if (bifur_dev->dbdf == dbdf) { + *glb_func_id = hinic3_global_func_id(bifur_dev->lld_dev->hwdev); + return 0; + } + + if (bifur_dev->pf_type == BIFUR_RESOURCE_PF) { + for (i = 0; i < bifur_dev->vf_mgr->vf_sum; ++i) { + if (bifur_dev->vf_mgr->vf_info[i].vf_dbdf == dbdf) { + *glb_func_id = bifur_dev->vf_mgr->vf_info[i].glb_func_id; + return 0; + } + } + } + } + return -ENODEV; +} + +static int bifur_set_vf_tx_port(struct bifur_lld_dev *bifur_dev, u32 src_dbdf, u32 dst_dbdf) +{ + int err; + struct hinic3_func_er_value_cmd vf_fwd_id_cfg = {0}; + u16 out_size = sizeof(struct hinic3_func_er_value_cmd); + + err = get_global_func_id_by_dbdf(src_dbdf, &vf_fwd_id_cfg.vf_id); + if (err != 0) { + BIFUR_DEV_ERR(bifur_dev->lld_dev, "Do not exit this vf, vf(%u)\n", src_dbdf); + return err; + } + BIFUR_DEV_INFO(bifur_dev->lld_dev, "src_vf(0x%x), vf_id(%u)\n", + src_dbdf, vf_fwd_id_cfg.vf_id); + + err = get_global_func_id_by_dbdf(dst_dbdf, &vf_fwd_id_cfg.er_fwd_id); + if (err != 0) { + BIFUR_DEV_ERR(bifur_dev->lld_dev, "Do not exit this port, port dbdf(%u)\n", + dst_dbdf); + return err; + } + BIFUR_DEV_INFO(bifur_dev->lld_dev, "dst_dbdf(0x%x), er_fwd_id(%u)\n", + dst_dbdf, vf_fwd_id_cfg.er_fwd_id); + + err = hinic3_msg_to_mgmt_sync(bifur_dev->lld_dev->hwdev, HINIC3_MOD_L2NIC, + HINIC3_NIC_CMD_SET_FUNC_ER_FWD_ID, &vf_fwd_id_cfg, + sizeof(vf_fwd_id_cfg), &vf_fwd_id_cfg, &out_size, 0, + HINIC3_CHANNEL_DEFAULT); + if (vf_fwd_id_cfg.msg_head.status != 0 || err != 0 || out_size == 0) { + BIFUR_DEV_ERR(bifur_dev->lld_dev, + "Failed to set VF forward id config. err(%d), sts(%u), out_size(%u)\n", + err, vf_fwd_id_cfg.msg_head.status, out_size); + return -EIO; + } + return 0; +} + +static int bifur_drv_cmd_vf_alloc(struct file *filp, struct bifur_msg *cmd) +{ + int err; + struct bifur_lld_dev *bifur_dev = NULL; + struct bifur_vf_info *vf_info = NULL; + struct bifur_vf_alloc_cmd_msg *query_cmd = (struct bifur_vf_alloc_cmd_msg *)(cmd->in_buf); + struct bifur_vf_alloc_cmd_rsp *query_resp = (struct bifur_vf_alloc_cmd_rsp *)(cmd->out_buf); + struct bifur_adapter *adp = bifur_get_adp(); + + if (!query_cmd || !query_resp || + cmd->in_buf_len < sizeof(struct bifur_vf_alloc_cmd_msg) || + cmd->out_buf_len < sizeof(struct bifur_vf_alloc_cmd_rsp)) { + pr_err("Input param fail, in_buf_len(%u), out_buf_len(%u).", + cmd->in_buf_len, cmd->out_buf_len); + return -EINVAL; + } + + bifur_dev_list_lock(); + if (adp->bifur_enabled == BIFUR_DISABLED) { + bifur_dev_list_unlock(); + pr_err("Didn't enable traffic bifurcation.\n"); + return -EPERM; + } + bifur_dev_list_unlock(); + + /* found the bifur device */ + bifur_dev = bifur_get_resource_dev(); + if (!bifur_dev) + return -EINVAL; + + vf_info = bifur_find_vf(bifur_dev->vf_mgr, query_cmd->dbdf); + if (!vf_info) { + bifur_dev_put(bifur_dev); + BIFUR_DEV_ERR(bifur_dev->lld_dev, "Alloc vf failed, %u vf in use\n", + bifur_dev->vf_mgr->vf_in_use); + return -EFAULT; + } + + err = bifur_set_vf_tx_port(bifur_dev, vf_info->vf_dbdf, query_cmd->dbdf); + if (err) { + bifur_release_vf(bifur_dev->vf_mgr, vf_info); + bifur_dev_put(bifur_dev); + BIFUR_DEV_ERR(bifur_dev->lld_dev, "Set vf forward id failed, vf(%u), dst_pf(%u)\n", + vf_info->vf_dbdf, query_cmd->dbdf); + return err; + } + query_resp->vf_dbdf = vf_info->vf_dbdf; + + BIFUR_DEV_INFO(bifur_dev->lld_dev, "pf_dbdf: 0x%x\n", query_cmd->dbdf); + BIFUR_DEV_INFO(bifur_dev->lld_dev, "alloc_vf_dbdf: 0x%x\n", query_resp->vf_dbdf); + + cmd->out_data_len = sizeof(struct bifur_vf_alloc_cmd_rsp); + bifur_dev_put(bifur_dev); + pr_info("Do vf alloc cmd success\n"); + return 0; +} + +static int bifur_drv_cmd_mac_get(struct file *filp, struct bifur_msg *cmd) +{ + int ret; + u32 pf_dbdf; + struct bifur_lld_dev *bifur_dev = NULL; + struct bifur_lld_dev *shared_bifur_dev = NULL; + struct net_device *net_dev = NULL; + struct bifur_adapter *adp = bifur_get_adp(); + + struct bifur_mac_get_cmd_msg *query_cmd = (struct bifur_mac_get_cmd_msg *)(cmd->in_buf); + struct bifur_mac_get_cmd_rsp *query_resp = (struct bifur_mac_get_cmd_rsp *)(cmd->out_buf); + + if (!query_cmd || !query_resp || + cmd->in_buf_len < sizeof(struct bifur_mac_get_cmd_msg) || + cmd->out_buf_len < sizeof(struct bifur_mac_get_cmd_rsp)) { + pr_err("Input param fail, in_buf_len(%u), out_buf_len(%u).", + cmd->in_buf_len, cmd->out_buf_len); + return -EINVAL; + } + + bifur_dev_list_lock(); + if (adp->bifur_enabled == BIFUR_DISABLED) { + bifur_dev_list_unlock(); + pr_err("Didn't enable traffic bifurcation.\n"); + return -EPERM; + } + bifur_dev_list_unlock(); + + bifur_dev = bifur_get_resource_dev(); + if (!bifur_dev) + return -EINVAL; + + ret = bifur_find_pf_by_vf(bifur_dev->vf_mgr, query_cmd->dbdf, &pf_dbdf); + if (ret != 0) { + bifur_dev_put(bifur_dev); + pr_err("Find pf dbdf failed, vf dbdf(0x%x)\n", query_cmd->dbdf); + return -EFAULT; + } + + /* found shared dev by pf dbdf */ + shared_bifur_dev = bifur_get_shared_dev_by_dbdf(pf_dbdf); + if (!shared_bifur_dev) { + bifur_dev_put(bifur_dev); + return -EINVAL; + } + + /* found net device by shared dev lld dev */ + net_dev = hinic3_get_netdev_by_lld(shared_bifur_dev->lld_dev); + if (!net_dev) { + bifur_dev_put(bifur_dev); + bifur_dev_put(shared_bifur_dev); + pr_err("Get net device by lld dev failed, pf_dbdf(0x%x)\n", pf_dbdf); + return -EINVAL; + } + + ether_addr_copy(query_resp->mac, net_dev->dev_addr); + bifur_dev_put(bifur_dev); + bifur_dev_put(shared_bifur_dev); + + cmd->out_data_len = sizeof(struct bifur_mac_get_cmd_rsp); + pr_info("DO Get mac cmd of vf success\n"); + return 0; +} + +struct { + enum bifur_cmd_m drv_cmd; + int (*cmd_handle)(struct file *filp, struct bifur_msg *msg); +} g_bifur_cmd_table[] = { + {BIFUR_DRV_CMD_FUNC_ATTR_GET, bifur_drv_cmd_func_attr_get}, + {BIFUR_DRV_CMD_VF_ALLOC, bifur_drv_cmd_vf_alloc}, + {BIFUR_DRV_CMD_MAC_GET, bifur_drv_cmd_mac_get}, +}; + +int bifur_cmd_exec(struct file *file, struct bifur_msg *msg) +{ + int i; + + for (i = 0; i < ARRAY_SIZE(g_bifur_cmd_table); i++) { + if (g_bifur_cmd_table[i].drv_cmd == msg->drv_cmd) + return g_bifur_cmd_table[i].cmd_handle(file, msg); + } + + pr_err("Cmd(%u) is not supported.", msg->drv_cmd); + return -EOPNOTSUPP; +} + +int bifur_msg_copy_from_usr(const char __user *ubuf, size_t size, struct bifur_msg *usr, + struct bifur_msg *knl) +{ + u64 ret = 0; + + ret = copy_from_user(usr, ubuf, size); + if (ret != 0) { + pr_err("Copy msg from user failed, ret(0x%llx).", ret); + return -EFAULT; + } + + if (usr->in_buf && (usr->in_buf_len == 0 || usr->in_buf_len > BIFUR_MAX_CMD_LEN)) { + pr_err("Invalid in buf param, cmd(%u) in_buf_len(%u).", + usr->drv_cmd, usr->in_buf_len); + return -EINVAL; + } + if (usr->out_buf && (usr->out_buf_len == 0 || usr->out_buf_len > BIFUR_MAX_CMD_LEN)) { + pr_err("Invalid out buf param, cmd(%u) out_buf_len(%u).", + usr->drv_cmd, usr->out_buf_len); + return -EINVAL; + } + knl->drv_cmd = usr->drv_cmd; + knl->in_buf_len = usr->in_buf_len; + knl->out_buf_len = usr->out_buf_len; + + if (usr->in_buf) { + knl->in_buf = kzalloc((size_t)usr->in_buf_len, GFP_KERNEL); + if (!knl->in_buf) + return -ENOMEM; + ret = copy_from_user(knl->in_buf, usr->in_buf, (size_t)usr->in_buf_len); + if (ret != 0) { + pr_err("Cmd(%u) copy in_buf from user failed, ret(0x%llx).", + usr->drv_cmd, ret); + BUFUR_CHECK_KFREE(knl->in_buf); + return -EFAULT; + } + } + + if (usr->out_buf) { + knl->out_buf = kzalloc((size_t)usr->out_buf_len, GFP_KERNEL); + if (!knl->out_buf) { + BUFUR_CHECK_KFREE(knl->in_buf); + return -ENOMEM; + } + } + return 0; +} + +void bifur_free_knl_msg_buf(struct bifur_msg *msg) +{ + BUFUR_CHECK_KFREE(msg->in_buf); + BUFUR_CHECK_KFREE(msg->out_buf); +} + +int bifur_msg_copy_to_usr(struct bifur_msg *usr, struct bifur_msg *knl) +{ + u64 ret; + u32 copy_len; + + if (!usr->out_buf || knl->out_data_len == 0) { + usr->out_data_len = 0; + return 0; + } + + copy_len = (usr->out_buf_len > knl->out_data_len) ? knl->out_data_len : usr->out_buf_len; + ret = copy_to_user(usr->out_buf, knl->out_buf, (ulong)copy_len); + if (ret != 0) { + pr_err("Cmd(%u) copy out_buf to user failed, ret(0x%llx).", usr->drv_cmd, ret); + return -EFAULT; + } + + return 0; +} + +ssize_t bifur_file_write(struct file *file, const char __user *ubuf, size_t size, loff_t *pos) +{ + int ret = 0; + struct bifur_msg usr_msg = { 0 }; + struct bifur_msg knl_msg = { 0 }; + + if (!ubuf || size < sizeof(struct bifur_msg) || size > BIFUR_MAX_CMD_LEN) { + pr_err("Invalid param, size(%lu).", size); + return -EINVAL; + } + + ret = bifur_msg_copy_from_usr(ubuf, size, &usr_msg, &knl_msg); + if (ret != 0) + return ret; + + ret = bifur_cmd_exec(file, &knl_msg); + if (ret != 0) { + bifur_free_knl_msg_buf(&knl_msg); + return (ret < 0) ? ret : -EFAULT; + } + + ret = bifur_msg_copy_to_usr(&usr_msg, &knl_msg); + if (ret != 0) { + bifur_free_knl_msg_buf(&knl_msg); + return ret; + } + bifur_free_knl_msg_buf(&knl_msg); + + return 0; +} + +ssize_t bifur_proc_write(struct file *file, const char __user *ubuf, size_t size, loff_t *pos) +{ + return bifur_file_write(file, ubuf, size, pos); +} + +static const struct file_operations g_bifur_global_cdev_fops = { + .owner = THIS_MODULE, + .open = bifur_global_dev_open, + .release = bifur_global_dev_close, + .write = bifur_proc_write, +}; + +/* When the module is initialized, prepare the global character device. */ +int bifur_global_dev_init(void) +{ + char *name = BIFUR_GLOBAL_CDEV_NAME; + struct device *device; + struct bifur_cdev *bdev = &g_bifur_global_dev; + + int ret = alloc_chrdev_region(&bdev->cdev_id, 0, 1, name); + + if (ret < 0) { + pr_err("Bifur cdev(%s) alloc card chrdev region fail, ret(%d).", name, ret); + return -EFAULT; + } + + cdev_init(&bdev->cdev, &g_bifur_global_cdev_fops); + + ret = cdev_add(&bdev->cdev, bdev->cdev_id, 1); + if (ret < 0) { + unregister_chrdev_region(bdev->cdev_id, 1); + pr_err("Bifur cdev(%s) add cdev fail, ret(%d).", name, ret); + return -EFAULT; + } + + g_bifur_class = class_create(BIFUR_MOD_NAME); + if (IS_ERR(g_bifur_class)) { + unregister_chrdev_region(bdev->cdev_id, 1); + cdev_del(&bdev->cdev); + pr_err("Bifur create class fail."); + return -EEXIST; + } + + device = device_create(g_bifur_class, NULL, bdev->cdev_id, NULL, "%s", name); + if (IS_ERR(device)) { + class_destroy(g_bifur_class); + unregister_chrdev_region(bdev->cdev_id, 1); + cdev_del(&bdev->cdev); + pr_err("Bifur cdev(%s) create device fail.", name); + return -EFAULT; + } + + mutex_init(&g_bifur_global_file_list.lock); + INIT_LIST_HEAD(&g_bifur_global_file_list.list); + pr_info("Bifur create global cdev(%s) succeed.", name); + + return 0; +} diff --git a/drivers/net/ethernet/huawei/hibifur/bifur_pfile.h b/drivers/net/ethernet/huawei/hibifur/bifur_pfile.h new file mode 100644 index 000000000..396d76311 --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/bifur_pfile.h @@ -0,0 +1,75 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2024-2024. All rights reserved. + */ +#ifndef BIFUR_PFILE_H +#define BIFUR_PFILE_H + +#define BIFUR_MAX_CMD_LEN (1024 * 1024) + +#define BIFUR_MOD_NAME "bifur" +#define BIFUR_PROC_DIR_MOD 0550 + +#define BUFUR_CHECK_KFREE(m) \ +do { \ + kfree(m); \ + m = NULL; \ +} while (0) + +#define BIFUR_UNREF_PARAM(x) ((x)) + +struct bifur_msg { + u32 drv_cmd; + u32 in_buf_len; + u32 out_buf_len; + u32 out_data_len; + void *in_buf; + void *out_buf; + u8 rsvd[24]; +}; + +enum bifur_cmd_m { + BIFUR_DRV_CMD_FUNC_ATTR_GET = 1, + BIFUR_DRV_CMD_VF_ALLOC, + BIFUR_DRV_CMD_MAC_GET, + BIFUR_CMD_BUTT +}; + +struct bifur_vf_alloc_cmd_msg { + unsigned int dbdf; +}; + +struct bifur_vf_alloc_cmd_rsp { + u32 vf_dbdf; +}; + +struct bifur_func_attr_get_cmd_msg { + unsigned int dbdf; +}; + +struct bifur_func_attr_get_cmd_rsp { + u32 func_type; +}; + +struct bifur_mac_get_cmd_msg { + unsigned int dbdf; +}; + +struct bifur_mac_get_cmd_rsp { + u8 mac[6]; +}; + +struct bifur_global_file_list_t { + struct mutex lock; + struct list_head list; +}; + +struct bifur_proc_file_t { + struct list_head node; + pid_t pid; +}; + +int bifur_global_dev_init(void); +void bifur_global_dev_uninit(void); + +#endif // BIFUR_PFILE_H diff --git a/drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c b/drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c new file mode 100644 index 000000000..71974c85d --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c @@ -0,0 +1,263 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2024-2024. All rights reserved. + */ +#include "bifur_common.h" +#include "bifur_pfile.h" +#include "bifur_main.h" +#include "bifur_vf_mgr.h" + +#define PDE_DATA(inode) pde_data(inode) + +int bifur_alloc_vf_mgr(struct bifur_lld_dev *bifur_dev) +{ + struct bifur_vf_mgr *vf_mgr = NULL; + struct bifur_vf_info *vf_info = NULL; + + vf_mgr = kzalloc(sizeof(*vf_mgr), GFP_KERNEL); + if (!vf_mgr) { + BIFUR_DEV_ERR(bifur_dev->lld_dev, "Alloc vf mgr failed\n"); + return -ENOMEM; + } + + bifur_dev->vf_mgr = vf_mgr; + vf_info = kzalloc(sizeof(*vf_info) * BIFUR_VF_NUM, GFP_KERNEL); + if (!vf_info) { + kfree(vf_mgr); + BIFUR_DEV_ERR(bifur_dev->lld_dev, "Alloc vf info failed\n"); + return -ENOMEM; + } + + vf_mgr->vf_sum = 0; + vf_mgr->vf_in_use = 0; + vf_mgr->vf_info = vf_info; + mutex_init(&vf_mgr->vf_mgr_mutex); + if (!vf_mgr->bifur_proc_root) { + vf_mgr->bifur_proc_root = proc_mkdir_mode(BIFUR_MOD_NAME, BIFUR_PROC_DIR_MOD, + init_net.proc_net); + if (!vf_mgr->bifur_proc_root) { + kfree(vf_mgr); + kfree(vf_info); + bifur_dev->vf_mgr = NULL; + BIFUR_DEV_ERR(bifur_dev->lld_dev, "Bifur create dir failed."); + return -ENOMEM; + } + } + + BIFUR_DEV_INFO(bifur_dev->lld_dev, "Alloc vf mgr success\n"); + return 0; +} + +void bifur_free_vf_mgr(struct bifur_lld_dev *bifur_dev) +{ + if (bifur_dev->vf_mgr && bifur_dev->vf_mgr->vf_info) { + kfree(bifur_dev->vf_mgr->vf_info); + bifur_dev->vf_mgr->vf_info = NULL; + } + + if (bifur_dev->vf_mgr != NULL) { + kfree(bifur_dev->vf_mgr); + bifur_dev->vf_mgr = NULL; + } + + remove_proc_entry(BIFUR_MOD_NAME, init_net.proc_net); + BIFUR_DEV_INFO(bifur_dev->lld_dev, "Free vf mgr success\n"); +} + +struct bifur_vf_info *bifur_find_vf(struct bifur_vf_mgr *vf_mgr, u32 pf_dbdf) +{ + u32 i; + struct bifur_vf_info *vf_info = NULL; + + mutex_lock(&vf_mgr->vf_mgr_mutex); + for (i = 0; i < vf_mgr->vf_sum; ++i) { + vf_info = &vf_mgr->vf_info[i]; + if (!vf_info->in_use) { + vf_info->in_use = 1; + vf_info->pf_dbdf = pf_dbdf; + vf_mgr->vf_in_use++; + mutex_unlock(&vf_mgr->vf_mgr_mutex); + return vf_info; + } + } + mutex_unlock(&vf_mgr->vf_mgr_mutex); + + return NULL; +} + +void bifur_vf_info_hold(struct bifur_vf_info *dev) +{ + atomic_inc(&dev->refcount); +} + +void bifur_vf_info_put(struct bifur_vf_info *dev) +{ + if (atomic_dec_and_test(&dev->refcount)) + pr_info("Dev(%s) pci_bdf(0x%x) comp complete.", dev->name, dev->vf_dbdf); +} + +void bifur_dev_file_add(struct bifur_dev_file_t *dev_file) +{ + mutex_lock(&dev_file->dev->dev_file_mgt.lock); + list_add_tail(&dev_file->node, &dev_file->dev->dev_file_mgt.list); + mutex_unlock(&dev_file->dev->dev_file_mgt.lock); +} + +void bifur_dev_file_del(struct bifur_dev_file_t *dev_file) +{ + mutex_lock(&dev_file->dev->dev_file_mgt.lock); + list_del(&dev_file->node); + mutex_unlock(&dev_file->dev->dev_file_mgt.lock); +} + +int bifur_proc_open(struct inode *inode, struct file *filp) +{ + struct bifur_vf_info *dev = (struct bifur_vf_info *)PDE_DATA(file_inode(filp)); + struct bifur_dev_file_t *dev_file = kzalloc(sizeof(*dev_file), GFP_KERNEL); + + if (!dev_file) + return -ENOMEM; + + atomic_set(&dev_file->refcount, 1); + dev_file->dev = dev; + bifur_vf_info_hold(dev_file->dev); + + bifur_dev_file_add(dev_file); + filp->private_data = dev_file; + + pr_info("Open proc dev(%s) success, filp(%p).", dev->name, filp); + + return nonseekable_open(inode, filp); +} + +int bifur_proc_close(struct inode *inode, struct file *filp) +{ + struct bifur_dev_file_t *dev_file = filp->private_data; + struct bifur_vf_info *dev = dev_file->dev; + struct bifur_vf_mgr *vf_mgr = dev->vf_mgr; + + pr_info("Close proc dev(%s), pci_bdf(0x%x), filp(%p).", dev_file->dev->name, + dev_file->dev->vf_dbdf, filp); + + bifur_dev_file_del(dev_file); + mutex_lock(&vf_mgr->vf_mgr_mutex); + dev->in_use = 0; + dev->pf_dbdf = 0; + vf_mgr->vf_in_use--; + bifur_vf_info_put(dev_file->dev); + mutex_unlock(&vf_mgr->vf_mgr_mutex); + + memset(dev_file, 0, sizeof(*dev_file)); + kfree(dev_file); + filp->private_data = NULL; + + return 0; +} + +#ifdef HAVE_PROC_OPS +const struct proc_ops g_bifur_proc_fops = { + .proc_open = bifur_proc_open, + .proc_release = bifur_proc_close, +}; +#else +const struct file_operations g_bifur_proc_fops = { + .owner = THIS_MODULE, + .open = bifur_proc_open, + .llseek = NULL, + .release = bifur_proc_close, +}; +#endif + +int bifur_dev_proc_build(struct bifur_vf_info *dev) +{ + struct proc_dir_entry *dir = NULL; + char pci_dev_name[BIFURNAMSIZ] = { 0 }; + struct bifur_vf_mgr *vf_mgr = dev->vf_mgr; + + int ret = sprintf(pci_dev_name, "0x%x", dev->vf_dbdf); + + if (ret < 0) { + pr_err("Bifur dev(%s) proc dir create fail, bdf(0x%x).", dev->name, dev->vf_dbdf); + return -ENOEXEC; + } + + dev->cdev.proc_dir = proc_mkdir_mode(pci_dev_name, BIFUR_PROC_DIR_MOD, + vf_mgr->bifur_proc_root); + if (!dev->cdev.proc_dir) { + pr_err("Bifur dev(%s) proc dir create fail.", dev->name); + return -EINVAL; + } + + dir = proc_create_data(BIFUR_CDEV_PROC_NAME, BIFUR_PROC_FILE_MOD, + dev->cdev.proc_dir, &g_bifur_proc_fops, dev); + if (!dir) { + remove_proc_entry(pci_dev_name, vf_mgr->bifur_proc_root); + dev->cdev.proc_dir = NULL; + pr_err("Bifur dev(%s) create card file failed.", dev->name); + return -EPERM; + } + + pr_info("Bifur dev(%p) name(%s,%s) proc build success.", dev, dev->name, pci_dev_name); + return 0; +} + +int bifur_dev_proc_destroy(struct bifur_vf_info *dev) +{ + char pci_dev_name[BIFURNAMSIZ] = { 0 }; + struct bifur_vf_mgr *vf_mgr = dev->vf_mgr; + + int ret = sprintf(pci_dev_name, "0x%x", dev->vf_dbdf); + + if (ret < 0) { + pr_err("Bifur dev(%s) proc dir create fail, bdf(0x%x).", dev->name, dev->vf_dbdf); + return -ENOEXEC; + } + + remove_proc_entry(BIFUR_CDEV_PROC_NAME, dev->cdev.proc_dir); + remove_proc_entry(pci_dev_name, vf_mgr->bifur_proc_root); + dev->cdev.proc_dir = NULL; + + pr_info("Bifur dev(%s) proc destroy success, pci_dev_name(%s).", dev->name, pci_dev_name); + + return 0; +} + +int bifur_find_pf_by_vf(struct bifur_vf_mgr *vf_mgr, u32 vf_dbdf, u32 *pf_dbdf) +{ + u32 i; + struct bifur_vf_info *vf_info = NULL; + + mutex_lock(&vf_mgr->vf_mgr_mutex); + for (i = 0; i < vf_mgr->vf_sum; ++i) { + vf_info = vf_mgr->vf_info + i; + if (vf_info->vf_dbdf == vf_dbdf && vf_info->in_use) { + *pf_dbdf = vf_info->pf_dbdf; + mutex_unlock(&vf_mgr->vf_mgr_mutex); + return 0; + } + } + mutex_unlock(&vf_mgr->vf_mgr_mutex); + + return -EINVAL; +} + +int bifur_vf_cdev_init(struct bifur_vf_info *dev) +{ + int ret; + + mutex_init(&dev->dev_file_mgt.lock); + INIT_LIST_HEAD(&dev->dev_file_mgt.list); + + ret = bifur_dev_proc_build(dev); + if (ret != 0) { + pr_err("Init dev build failed, ret(%d).", ret); + return ret; + } + + return 0; +} + +void bifur_vf_cdev_uninit(struct bifur_vf_info *dev) +{ + (void)bifur_dev_proc_destroy(dev); +} diff --git a/drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.h b/drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.h new file mode 100644 index 000000000..7c4124495 --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.h @@ -0,0 +1,58 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2024-2024. All rights reserved. + */ + +#ifndef BIFUR_VF_MGR_H__ +#define BIFUR_VF_MGR_H__ + +#define BIFURNAMSIZ 20 +#define BIFUR_PROC_FILE_MOD 0640 +#define BIFUR_CDEV_PROC_NAME "bifur_vdev" + +struct bifur_dev_file_mgt_t { + struct mutex lock; + struct list_head list; +}; +struct bifur_lld_dev; +struct bifur_vf_mgr; + +struct bifur_vf_info { + char name[BIFURNAMSIZ]; + u32 vf_dbdf; + u32 pf_dbdf; + u16 glb_func_id; + bool in_use; + struct bifur_cdev cdev; + struct bifur_dev_file_mgt_t dev_file_mgt; + struct bifur_vf_mgr *vf_mgr; + atomic_t refcount; +}; + +struct bifur_vf_mgr { + u32 vf_sum; + u32 vf_in_use; + struct bifur_vf_info *vf_info; + struct mutex vf_mgr_mutex; + struct proc_dir_entry *bifur_proc_root; +}; + +struct bifur_dev_file_t { + struct list_head node; + struct bifur_vf_info *dev; + + atomic_t refcount; +}; + +int bifur_alloc_vf_mgr(struct bifur_lld_dev *bifur_dev); + +void bifur_free_vf_mgr(struct bifur_lld_dev *bifur_dev); + +struct bifur_vf_info *bifur_find_vf(struct bifur_vf_mgr *vf_mgr, u32 dbdf); + +int bifur_find_pf_by_vf(struct bifur_vf_mgr *vf_mgr, u32 vf_dbdf, u32 *pf_dbdf); + +int bifur_vf_cdev_init(struct bifur_vf_info *dev); +void bifur_vf_cdev_uninit(struct bifur_vf_info *dev); + +#endif diff --git a/drivers/net/ethernet/huawei/hibifur/include/nic/nic_mpu_cmd.h b/drivers/net/ethernet/huawei/hibifur/include/nic/nic_mpu_cmd.h new file mode 100644 index 000000000..1a3c26d00 --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/include/nic/nic_mpu_cmd.h @@ -0,0 +1,183 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* Copyright(c) 2024 Huawei Technologies Co., Ltd */ + +#ifndef NIC_MPU_CMD_H +#define NIC_MPU_CMD_H + +/** Commands between NIC to MPU + */ +enum hinic3_nic_cmd { + HINIC3_NIC_CMD_VF_REGISTER = 0, /**< Only for PFD and VFD @see > hinic3_cmd_register_vf */ + + /** FUNC CFG */ + HINIC3_NIC_CMD_SET_FUNC_TBL = 5, /**< Set function table @see > hinic3_cmd_set_func_tbl */ + HINIC3_NIC_CMD_SET_VPORT_ENABLE, /**< Enable a vport @see > hinic3_vport_state */ + HINIC3_NIC_CMD_SET_RX_MODE, /**< Set nic rx mode. @see > hinic3_rx_mode_config */ + HINIC3_NIC_CMD_SQ_CI_ATTR_SET, /**< Set SQ CI attr @see > hinic3_cmd_cons_idx_attr */ + /**< Get vport stat @see > hinic3_port_stats_info, < hinic3_cmd_vport_stats */ + HINIC3_NIC_CMD_GET_VPORT_STAT, + /**< Clean vport stat @see > hinic3_cmd_clear_vport_stats */ + HINIC3_NIC_CMD_CLEAN_VPORT_STAT, + /**< Clean queue pair resource @see > hinic3_cmd_clear_qp_resource */ + HINIC3_NIC_CMD_CLEAR_QP_RESOURCE, + HINIC3_NIC_CMD_CFG_FLEX_QUEUE, /**< Set flex queue @see > hinic3_cmd_cfg_qps */ + /** LRO CFG */ + HINIC3_NIC_CMD_CFG_RX_LRO, /**< Set rx LRO @see > hinic3_cmd_lro_config */ + HINIC3_NIC_CMD_CFG_LRO_TIMER, /**< Set LRO timer @see > hinic3_cmd_lro_timer */ + /**< negotiate features @see > hinic3_cmd_feature_nego */ + HINIC3_NIC_CMD_FEATURE_NEGO, + /**< Configure local LRO state @see > hinic3_cmd_local_lro_state */ + HINIC3_NIC_CMD_CFG_LOCAL_LRO_STATE, + + /**< Cache out queue pair resource @see > hinic3_cmd_cache_out_qp_resource */ + HINIC3_NIC_CMD_CACHE_OUT_QP_RES, + /**< Set nic er fwd id. @see > mpu_nic_cmd_set_func_er_fwd_id */ + HINIC3_NIC_CMD_SET_FUNC_ER_FWD_ID, + + /** MAC & VLAN CFG */ + HINIC3_NIC_CMD_GET_MAC = 20, /**< Get mac address @see > hinic3_port_mac_set */ + HINIC3_NIC_CMD_SET_MAC, /**< Set mac address @see > hinic3_port_mac_set */ + HINIC3_NIC_CMD_DEL_MAC, /**< Delete mac address @see > hinic3_port_mac_set */ + /**< Update mac address @see > hinic3_port_mac_update */ + HINIC3_NIC_CMD_UPDATE_MAC, + /**< Get all default mac address @see > cmd_mac_info_get_s */ + HINIC3_NIC_CMD_GET_ALL_DEFAULT_MAC, + + /**< Configure function vlan @see > hinic3_cmd_vlan_config */ + HINIC3_NIC_CMD_CFG_FUNC_VLAN, + /**< Enable vlan filter @see > hinic3_cmd_set_vlan_filter */ + HINIC3_NIC_CMD_SET_VLAN_FILTER_EN, + /**< Set rx vlan offload @see > hinic3_cmd_vlan_offload */ + HINIC3_NIC_CMD_SET_RX_VLAN_OFFLOAD, + HINIC3_NIC_CMD_SMAC_CHECK_STATE, + + /** SR-IOV */ + /**< Configure vf vlan @see > hinic3_cmd_vf_vlan_config */ + HINIC3_NIC_CMD_CFG_VF_VLAN = 40, + /**< Set snoopchk state @see > hinic3_cmd_spoofchk_set */ + HINIC3_NIC_CMD_SET_SPOOPCHK_STATE, + /* RATE LIMIT */ + /**< Set rate limit @see > HINIC3_NIC_CMD_SET_MAX_MIN_RATE */ + HINIC3_NIC_CMD_SET_MAX_MIN_RATE, + + /** RSS CFG */ + HINIC3_NIC_CMD_RSS_CFG = 60, /**< Set rss config @see > hinic3_cmd_rss_config */ + HINIC3_NIC_CMD_RSS_TEMP_MGR, /**< TODO: delete after implement nego cmd */ + HINIC3_NIC_CMD_GET_RSS_CTX_TBL, /**< TODO: delete: move to ucode cmd */ + /**< Set rss hash key @see > hinic3_cmd_rss_hash_key */ + HINIC3_NIC_CMD_CFG_RSS_HASH_KEY, + /**< Set rss hash engine type @see > hinic3_cmd_rss_engine_type */ + HINIC3_NIC_CMD_CFG_RSS_HASH_ENGINE, + /**< Set rss context table info @see > hinic3_rss_context_table */ + HINIC3_NIC_CMD_SET_RSS_CTX_TBL_INTO_FUNC, + /** IP checksum error packets, enable rss quadruple hash */ + /**< Set rss config @see > hinic3_ipcs_err_rss_enable_operation_s */ + HINIC3_NIC_CMD_IPCS_ERR_RSS_ENABLE_OP = 66, + + /** PPA/FDIR */ + HINIC3_NIC_CMD_ADD_TC_FLOW = 80, /**< Add tc flow @see > nic_cmd_fdir_add_rule */ + HINIC3_NIC_CMD_DEL_TC_FLOW, /**< Delete tc flow @see > nic_cmd_fdir_del_rules */ + HINIC3_NIC_CMD_GET_TC_FLOW, /**< Get tc flow @see > nic_cmd_fdir_get_rule */ + HINIC3_NIC_CMD_FLUSH_TCAM, /**< Flush TCAM @see > nic_cmd_flush_tcam_rules */ + /**< Configure TCAM block @see > nic_cmd_ctrl_tcam_block_out */ + HINIC3_NIC_CMD_CFG_TCAM_BLOCK, + /**< Enable TCAM @see > nic_cmd_set_tcam_enable */ + HINIC3_NIC_CMD_ENABLE_TCAM, + /**< Get TCAM block @see > nic_cmd_dfx_fdir_tcam_block_table */ + HINIC3_NIC_CMD_GET_TCAM_BLOCK, + /**< Configure PPA table id @see > hinic3_ppa_cfg_table_id_cmd */ + HINIC3_NIC_CMD_CFG_PPA_TABLE_ID, + /**< Set PPA enable @see > hinic3_ppa_cfg_ppa_en_cmd */ + HINIC3_NIC_CMD_SET_PPA_EN = 88, + /**< Configure PPA mode @see > hinic3_ppa_cfg_mode_cmd */ + HINIC3_NIC_CMD_CFG_PPA_MODE, + /**< Configure PPA flush @see > hinic3_ppa_cfg_flush_cmd */ + HINIC3_NIC_CMD_CFG_PPA_FLUSH, + /**< Set FDIR status @see > hinic3_set_fdir_ethertype_rule */ + HINIC3_NIC_CMD_SET_FDIR_STATUS, + /**< Get PPA counter @see > hinic3_ppa_fdir_query_cmd */ + HINIC3_NIC_CMD_GET_PPA_COUNTER, + /**< Set flow bifur status @see > cmd_flow_bifur_func_handle */ + HINIC3_NIC_CMD_SET_FUNC_FLOW_BIFUR_ENABLE, + /**< Set flow bifur bond @see > cmd_flow_bifur_bond_handle */ + HINIC3_NIC_CMD_SET_BOND_MASK, + /**< Get func tcam table @see > get_fdir_func_tcam_table */ + HINIC3_NIC_CMD_GET_BLOCK_TC_FLOWS, + /**< Get flow bifur bond @see > cmd_flow_bifur_bond_handle */ + HINIC3_NIC_CMD_GET_BOND_MASK, + + /** PORT CFG */ + HINIC3_NIC_CMD_SET_PORT_ENABLE = 100, /**< set port enable @see > hinic3_port_state */ + HINIC3_NIC_CMD_CFG_PAUSE_INFO, /**< Configure pause info @see > hinic3_cmd_pause_config */ + + HINIC3_NIC_CMD_SET_PORT_CAR, /**< Set port Car @see > hinic3_cmd_set_port_car */ + HINIC3_NIC_CMD_SET_ER_DROP_PKT, /**< Unused */ + + HINIC3_NIC_CMD_VF_COS, /**< Get vf CoS @see > hinic3_cmd_vf_dcb_state */ + HINIC3_NIC_CMD_SETUP_COS_MAPPING, /**< Unused */ + HINIC3_NIC_CMD_SET_ETS, /**< Unused */ + HINIC3_NIC_CMD_SET_PFC, /**< Unused */ + HINIC3_NIC_CMD_QOS_ETS, /**< Set QoS ETS @see > hinic3_cmd_ets_cfg */ + HINIC3_NIC_CMD_QOS_PFC, /**< Set QoS PFC @see > hinic3_cmd_set_pfc */ + HINIC3_NIC_CMD_QOS_DCB_STATE, /**< Get QoS DCB state @see > hinic3_cmd_set_dcb_state */ + HINIC3_NIC_CMD_QOS_PORT_CFG, /**< Get QoS port cfg @see > hinic3_cmd_qos_port_cfg */ + HINIC3_NIC_CMD_QOS_MAP_CFG, /**< Get QoS map cfg @see > hinic3_cmd_qos_map_cfg */ + HINIC3_NIC_CMD_FORCE_PKT_DROP, /**< Force pkt drop @see > hinic3_force_pkt_drop */ + /**< Configure nic tx promisc skip @see > hinic3_tx_promisc_cfg */ + HINIC3_NIC_CMD_CFG_TX_PROMISC_SKIP = 114, + /**< Set flow bifur port switch @see > cmd_flow_bifur_port_handle */ + HINIC3_NIC_CMD_SET_PORT_FLOW_BIFUR_ENABLE = 117, + /**< Set tx pause exc notice @see > nic_cmd_tx_pause_notice */ + HINIC3_NIC_CMD_TX_PAUSE_EXCP_NOTICE = 118, + /**< Inquirt pause cfg @see > nic_cmd_pause_inquiry_cfg_s */ + HINIC3_NIC_CMD_INQUIRT_PAUSE_CFG = 119, + + /** MISC */ + HINIC3_NIC_CMD_BIOS_CFG = 120, /**< Set QoS ETS @see > nic_cmd_bios_cfg */ + HINIC3_NIC_CMD_SET_FIRMWARE_CUSTOM_PACKETS_MSG, /**< Set QoS ETS @see > fault_msg_st */ + + /** BOND */ + /**< Create bond device @see > hinic3_cmd_create_bond */ + HINIC3_NIC_CMD_BOND_DEV_CREATE = 134, + HINIC3_NIC_CMD_BOND_DEV_DELETE, /**< Delete bond device @see > hinic3_cmd_delete_bond */ + /**<Open/close bond dev @see > hinic3_cmd_open_close_bond */ + HINIC3_NIC_CMD_BOND_DEV_OPEN_CLOSE, + HINIC3_NIC_CMD_BOND_INFO_GET, /**< Set QoS ETS @see > hinic3_bond_status_info */ + /**< Get bond active info @see > hinic3_bond_active_report_info */ + HINIC3_NIC_CMD_BOND_ACTIVE_INFO_GET, + /**< Bond active notice report @see > nic_cmd_bond_active_report_info */ + HINIC3_NIC_CMD_BOND_ACTIVE_NOTICE, + + /** DFX */ + HINIC3_NIC_CMD_GET_SM_TABLE = 140, /**< Get sm table @see > nic_cmd_dfx_sm_table */ + /**< Set RD line table @see > nic_mpu_lt_opera, < nic_mpu_lt_opera */ + HINIC3_NIC_CMD_RD_LINE_TBL, + + HINIC3_NIC_CMD_SET_UCAPTURE_OPT = 160, /**< TODO: move to roce */ + HINIC3_NIC_CMD_SET_VHD_CFG, /**< Set VHD configuration @see > hinic3_set_vhd_mode */ + + /** TODO: move to HILINK */ + /**< Get port stat @see > hinic3_port_stats_info, < hinic3_port_stats */ + HINIC3_NIC_CMD_GET_PORT_STAT = 200, + HINIC3_NIC_CMD_CLEAN_PORT_STAT, /**< Unused */ + HINIC3_NIC_CMD_CFG_LOOPBACK_MODE, /**< Unused */ + HINIC3_NIC_CMD_GET_SFP_QSFP_INFO, /**< Unused */ + HINIC3_NIC_CMD_SET_SFP_STATUS, /**< Unused */ + HINIC3_NIC_CMD_GET_LIGHT_MODULE_ABS, /**< Unused */ + HINIC3_NIC_CMD_GET_LINK_INFO, /**< Unused */ + HINIC3_NIC_CMD_CFG_AN_TYPE, /**< Unused */ + HINIC3_NIC_CMD_GET_PORT_INFO, /**< Get port info @see > hinic3_cmd_port_info */ + HINIC3_NIC_CMD_SET_LINK_SETTINGS, /**< Unused */ + HINIC3_NIC_CMD_ACTIVATE_BIOS_LINK_CFG, /**< Unused */ + HINIC3_NIC_CMD_RESTORE_LINK_CFG, /**< Unused */ + HINIC3_NIC_CMD_SET_LINK_FOLLOW, /**< Unused */ + HINIC3_NIC_CMD_GET_LINK_STATE, /**< Unused */ + HINIC3_NIC_CMD_LINK_STATUS_REPORT, /**< Unused */ + HINIC3_NIC_CMD_CABLE_PLUG_EVENT, /**< Unused */ + HINIC3_NIC_CMD_LINK_ERR_EVENT, /**< Unused */ + HINIC3_NIC_CMD_SET_LED_STATUS, /**< Unused */ + + HINIC3_NIC_CMD_MAX = 256, +}; + +#endif /* NIC_MPU_CMD_H */ diff --git a/drivers/net/ethernet/huawei/hibifur/include/nic/nic_npu_cmd.h b/drivers/net/ethernet/huawei/hibifur/include/nic/nic_npu_cmd.h new file mode 100644 index 000000000..65b243a0e --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/include/nic/nic_npu_cmd.h @@ -0,0 +1,29 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* Copyright(c) 2024 Huawei Technologies Co., Ltd */ + +#ifndef NIC_NPU_CMD_H +#define NIC_NPU_CMD_H + +/* NIC CMDQ MODE */ +enum hinic3_ucode_cmd { + /**< Modify queue context. @see > hinic3_sq_ctxt_block */ + HINIC3_UCODE_CMD_MODIFY_QUEUE_CTX = 0, + /**< Clean queue context. @see > hinic3_clean_queue_ctxt */ + HINIC3_UCODE_CMD_CLEAN_QUEUE_CONTEXT, + HINIC3_UCODE_CMD_ARM_SQ, /**< Unused */ + HINIC3_UCODE_CMD_ARM_RQ, /**< Unused */ + /**< Set RSS indir table. @see > nic_rss_indirect_tbl */ + HINIC3_UCODE_CMD_SET_RSS_INDIR_TABLE, + /**< Set RSS indir table. @see > nic_rss_context_tbl */ + HINIC3_UCODE_CMD_SET_RSS_CONTEXT_TABLE, + HINIC3_UCODE_CMD_GET_RSS_INDIR_TABLE, + HINIC3_UCODE_CMD_GET_RSS_CONTEXT_TABLE, /**< Unused */ + HINIC3_UCODE_CMD_SET_IQ_ENABLE, /**< Unused */ + HINIC3_UCODE_CMD_SET_RQ_FLUSH = 10, /**< Set RQ flush. @see > hinic3_cmd_set_rq_flush */ + HINIC3_UCODE_CMD_MODIFY_VLAN_CTX, /**< Get rxq info. @see > nic_vlan_ctx */ + HINIC3_UCODE_CMD_PPA_HASH_TABLE, + /**< Get rxq info. @see > hinic3_rxq_hw, < rxq_check_info */ + HINIC3_UCODE_CMD_RXQ_INFO_GET = 13, +}; + +#endif /* NIC_NPU_CMD_H */ diff --git a/drivers/net/ethernet/huawei/hibifur/include/nic/nic_npu_cmd_defs.h b/drivers/net/ethernet/huawei/hibifur/include/nic/nic_npu_cmd_defs.h new file mode 100644 index 000000000..b5461ad85 --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/include/nic/nic_npu_cmd_defs.h @@ -0,0 +1,133 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* Copyright(c) 2024 Huawei Technologies Co., Ltd */ + + +#ifndef NIC_NPU_CMD_DEFS_H +#define NIC_NPU_CMD_DEFS_H + +#include "typedef.h" +#include "nic_cfg_comm.h" + +/* NIC Command Queue Header + * This header is used to indicate the start of a NIC command queue. + * All contexts that follow this header should be consecutive. + */ +struct nic_cmdq_header { + union { + struct { +#if (BYTE_ORDER == BIG_ENDIAN) + /* 0x0:SQ, 0x1:RQ */ + u16 queue_type; + /* queue number in buffer follow this header */ + u16 queue_num; +#else + u16 queue_num; + u16 queue_type; +#endif + } cmdq_ctx_dw0; + + u32 ctx_dw0; + }; + +#if (BYTE_ORDER == BIG_ENDIAN) + u16 rsvd; + u16 start_qid; +#else + u16 start_qid; + u16 rsvd; +#endif +}; + +struct nic_cmdq_context_modify_s { + struct nic_cmdq_header hdr; + u8 data[2016]; +}; + +struct nic_cmdq_clean_q_space { + /* queue_type = 0, TSO (TCP Segmentation Offload) + * queue_type = 1, LRO (Large Receive Offload) + */ + union { + struct { +#if (BYTE_ORDER == BIG_ENDIAN) + u16 queue_type; + u16 queue_num; +#else + u16 queue_num; + u16 queue_type; +#endif + } cmdq_space_dw0; + + u32 space_dw0; + }; + +#if (BYTE_ORDER == BIG_ENDIAN) + u16 rsvd; + u16 start_qid; +#else + u16 start_qid; + u16 rsvd; +#endif + + u32 rsvd1; +}; + +struct nic_cmdq_flush_rq_task { + union { + struct { +#if (BYTE_ORDER == BIG_ENDIAN) + u16 q_id; + u16 glb_rq_id; +#else + u16 glb_rq_id; + u16 q_id; +#endif + } bs; + + u32 value; + } dw0; +}; + +/* arm sq/rq */ +union nic_cmdq_arm { + struct cmdq_arm_dw0_s { +#if (BYTE_ORDER == BIG_ENDIAN) + u16 qpn; + u16 pi; +#else + u16 pi; + u16 qpn; +#endif + } dw0; + + u32 arm_dw0; +}; + +/* rss */ +struct nic_rss_indirect_tbl { + u32 rsvd[4]; // Make sure that 16B beyond entry[] + u16 entry[NIC_RSS_INDIR_SIZE]; +}; + +struct nic_rss_glb_qid_indirect_tbl { + u32 group_index; + u32 offset; + u32 size; + u32 rsvd; /* Make sure that 16B beyond entry[] */ + u16 entry[NIC_RSS_INDIR_SIZE]; +}; + +struct nic_rss_context_tbl { + u32 rsvd[4]; + u32 ctx; +}; + +struct nic_vlan_ctx { + u32 func_id; + u32 qid; /* if qid = 0xFFFF, config current function all queue */ + u32 vlan_id; + u32 vlan_mode; + u32 vlan_sel; +}; + +#endif /* NIC_NPU_CMD_DEFS_H */ diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_crm.h b/drivers/net/ethernet/huawei/hinic3/hinic3_crm.h index 14d409b02..64139c49a 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_crm.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_crm.h @@ -45,6 +45,7 @@ enum hinic3_service_type { SERVICE_T_CUSTOM, SERVICE_T_VROCE, SERVICE_T_CRYPT, + SERVICE_T_BIFUR, SERVICE_T_MAX, /* Only used for interruption resource management, @@ -76,6 +77,10 @@ struct ppa_service_cap { u16 rsvd1; }; +struct bifur_service_cap { + u8 rsvd; +}; + struct vbs_service_cap { u16 vbs_max_volq; u8 vbs_main_pf_enable; @@ -785,6 +790,15 @@ bool hinic3_support_toe(void *hwdev, struct toe_service_cap *cap); */ bool hinic3_support_ppa(void *hwdev, struct ppa_service_cap *cap); +/* * + * @brief hinic3_support_bifur - function support bifur + * @param hwdev: device pointer to hwdev + * @param cap: bifur service capbility + * @retval zero: success + * @retval non-zero: failure + */ +bool hinic3_support_bifur(void *hwdev, struct bifur_service_cap *cap); + /* * * @brief hinic3_support_migr - function support migrate * @param hwdev: device pointer to hwdev diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_main.c b/drivers/net/ethernet/huawei/hinic3/hinic3_main.c index d07a1ba04..6f90c868a 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_main.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_main.c @@ -89,6 +89,8 @@ enum hinic3_rx_buff_len { #define CONVERT_UNIT 1024 +#define BIFUR_RESOURCE_PF_SSID 0x5a1 + #ifdef HAVE_MULTI_VLAN_OFFLOAD_EN static int hinic3_netdev_event(struct notifier_block *notifier, unsigned long event, void *ptr); @@ -876,11 +878,13 @@ static int nic_probe(struct hinic3_lld_dev *lld_dev, void **uld_dev, hinic3_register_notifier(nic_dev); #endif - err = register_netdev(netdev); - if (err) { - nic_err(&pdev->dev, "Failed to register netdev\n"); - err = -ENOMEM; - goto netdev_err; + if (pdev->subsystem_device != BIFUR_RESOURCE_PF_SSID) { + err = register_netdev(netdev); + if (err) { + nic_err(&pdev->dev, "Failed to register netdev\n"); + err = -ENOMEM; + goto netdev_err; + } } queue_delayed_work(nic_dev->workq, &nic_dev->periodic_work, HZ); @@ -928,7 +932,9 @@ static void nic_remove(struct hinic3_lld_dev *lld_dev, void *adapter) netdev = nic_dev->netdev; - unregister_netdev(netdev); + if (lld_dev->pdev->subsystem_device != BIFUR_RESOURCE_PF_SSID) + unregister_netdev(netdev); + #ifdef HAVE_MULTI_VLAN_OFFLOAD_EN hinic3_unregister_notifier(nic_dev); #endif diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_mgmt_interface.h b/drivers/net/ethernet/huawei/hinic3/hinic3_mgmt_interface.h index 952133f10..18a85f489 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_mgmt_interface.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_mgmt_interface.h @@ -1091,9 +1091,18 @@ struct hinic3_bond_mask_cmd { u8 rsvd[3]; }; +struct hinic3_func_er_value_cmd { + struct hinic3_mgmt_msg_head msg_head; + u16 vf_id; + u16 er_fwd_id; +}; + #define HINIC3_TX_SET_PROMISC_SKIP 0 #define HINIC3_TX_GET_PROMISC_SKIP 1 +#define HINIC3_GET_TRAFFIC_BIFUR_STATE 0 +#define HINIC3_SET_TRAFFIC_BIFUR_STATE 1 + struct hinic3_tx_promisc_cfg { struct hinic3_mgmt_msg_head msg_head; u8 port_id; diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_mt.h b/drivers/net/ethernet/huawei/hinic3/hinic3_mt.h index b5bcd8ae8..94e606e96 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_mt.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_mt.h @@ -132,7 +132,8 @@ enum module_name { SEND_TO_MIGRATE_DRIVER, SEND_TO_PPA_DRIVER, SEND_TO_CUSTOM_DRIVER = SEND_TO_SRV_DRV_BASE + 11, - SEND_TO_DRIVER_MAX = SEND_TO_SRV_DRV_BASE + 15, /* reserved */ + SEND_TO_BIFUR_DRIVER = SEND_TO_SRV_DRV_BASE + 15, + SEND_TO_DRIVER_MAX = SEND_TO_SRV_DRV_BASE + 16, /* reserved */ }; enum driver_cmd_type { @@ -208,12 +209,16 @@ enum driver_cmd_type { GET_XSFP_PRESENT = 0x51, GET_XSFP_INFO = 0x52, DEV_NAME_TEST = 0x53, + GET_XSFP_INFO_COMP_CMIS = 0x54, GET_WIN_STAT = 0x60, WIN_CSR_READ = 0x61, WIN_CSR_WRITE = 0x62, WIN_API_CMD_RD = 0x63, + BIFUR_SET_ENABLE = 0xc0, + BIFUR_GET_ENABLE = 0xc1, + VM_COMPAT_TEST = 0xFF }; diff --git a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.c b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.c index 9154a1d27..5e0139aa9 100644 --- a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.c +++ b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.c @@ -622,6 +622,9 @@ void hinic3_get_card_info(const void *hwdev, void *bufin) if (hinic3_func_for_mgmt(fun_hwdev)) strscpy(info->pf[i].name, "FOR_MGMT", IFNAMSIZ); + if (dev->lld_dev.pdev->subsystem_device == BIFUR_RESOURCE_PF_SSID) + strscpy(info->pf[i].name, "bifur", IFNAMSIZ); + strscpy(info->pf[i].bus_info, pci_name(dev->pcidev), sizeof(info->pf[i].bus_info)); info->pf_num++; diff --git a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.h b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.h index bb7f5bb67..5c7c7cdd8 100644 --- a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.h +++ b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.h @@ -20,6 +20,8 @@ #define ULD_LOCK_MIN_USLEEP_TIME 900 #define ULD_LOCK_MAX_USLEEP_TIME 1000 +#define BIFUR_RESOURCE_PF_SSID 0x05a1 + #define HINIC3_IS_VF_DEV(pdev) ((pdev)->device == HINIC3_DEV_ID_VF) #define HINIC3_IS_SPU_DEV(pdev) ((pdev)->device == HINIC3_DEV_ID_SPU) diff --git a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c index 819c56f42..030ef6df7 100644 --- a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c +++ b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c @@ -1172,6 +1172,20 @@ bool hinic3_support_ppa(void *hwdev, struct ppa_service_cap *cap) } EXPORT_SYMBOL(hinic3_support_ppa); +bool hinic3_support_bifur(void *hwdev, struct bifur_service_cap *cap) +{ + struct hinic3_hwdev *dev = (struct hinic3_hwdev *)hwdev; + + if (!hwdev) + return false; + + if (!IS_BIFUR_TYPE(dev)) + return false; + + return true; +} +EXPORT_SYMBOL(hinic3_support_bifur); + bool hinic3_support_migr(void *hwdev, struct migr_service_cap *cap) { struct hinic3_hwdev *dev = hwdev; diff --git a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h index db6e3cab6..671eed69c 100644 --- a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h +++ b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h @@ -322,6 +322,8 @@ struct cfg_mgmt_info { (((u32)(dev)->cfg_mgmt->svc_cap.chip_svc_type) & CFG_SERVICE_MASK_PPA) #define IS_MIGR_TYPE(dev) \ (((u32)(dev)->cfg_mgmt->svc_cap.chip_svc_type) & CFG_SERVICE_MASK_MIGRATE) +#define IS_BIFUR_TYPE(dev) \ + (((u32)(dev)->cfg_mgmt->svc_cap.chip_svc_type) & CFG_SERVICE_MASK_BIFUR) int init_cfg_mgmt(struct hinic3_hwdev *dev); diff --git a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c index 0b1c995bd..6ab1b92e7 100644 --- a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c +++ b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c @@ -73,7 +73,7 @@ void hinic3_uld_lock_init(void) static const char *s_uld_name[SERVICE_T_MAX] = { "nic", "ovs", "roce", "toe", "ioe", - "fc", "vbs", "ipsec", "virtio", "migrate", "ppa", "custom"}; + "fc", "vbs", "ipsec", "virtio", "migrate", "ppa", "bifur", "custom"}; const char **hinic3_get_uld_names(void) { diff --git a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_nictool.c b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_nictool.c index 4cdc6f6ea..5e4804a96 100644 --- a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_nictool.c +++ b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_nictool.c @@ -550,8 +550,17 @@ static struct hinic3_lld_dev *get_lld_dev_by_nt_msg(struct msg_module *nt_msg) { struct hinic3_lld_dev *lld_dev = NULL; - if (nt_msg->module >= SEND_TO_SRV_DRV_BASE && nt_msg->module < SEND_TO_DRIVER_MAX && - nt_msg->module != SEND_TO_HW_DRIVER && nt_msg->msg_formate != GET_DRV_VERSION) { + if (nt_msg->module == SEND_TO_NIC_DRIVER && (nt_msg->msg_formate == GET_XSFP_INFO || + nt_msg->msg_formate == GET_XSFP_PRESENT || + nt_msg->msg_formate == GET_XSFP_INFO_COMP_CMIS)) { + lld_dev = hinic3_get_lld_dev_by_chip_and_port(nt_msg->device_name, nt_msg->port_id); + } else if (nt_msg->module == SEND_TO_CUSTOM_DRIVER && + nt_msg->msg_formate == CMD_CUSTOM_BOND_GET_CHIP_NAME) { + lld_dev = hinic3_get_lld_dev_by_dev_name(nt_msg->device_name, SERVICE_T_MAX); + } else if (nt_msg->module == SEND_TO_VBS_DRIVER || nt_msg->module == SEND_TO_BIFUR_DRIVER) { + lld_dev = hinic3_get_lld_dev_by_chip_name(nt_msg->device_name); + } else if (nt_msg->module >= SEND_TO_SRV_DRV_BASE && nt_msg->module < SEND_TO_DRIVER_MAX && + nt_msg->msg_formate != GET_DRV_VERSION) { lld_dev = hinic3_get_lld_dev_by_dev_name(nt_msg->device_name, nt_msg->module - SEND_TO_SRV_DRV_BASE); } else { @@ -561,15 +570,6 @@ static struct hinic3_lld_dev *get_lld_dev_by_nt_msg(struct msg_module *nt_msg) SERVICE_T_MAX); } - if (nt_msg->module == SEND_TO_NIC_DRIVER && (nt_msg->msg_formate == GET_XSFP_INFO || - nt_msg->msg_formate == GET_XSFP_PRESENT)) - lld_dev = hinic3_get_lld_dev_by_chip_and_port(nt_msg->device_name, - nt_msg->port_id); - - if (nt_msg->module == SEND_TO_CUSTOM_DRIVER && - nt_msg->msg_formate == CMD_CUSTOM_BOND_GET_CHIP_NAME) - lld_dev = hinic3_get_lld_dev_by_dev_name(nt_msg->device_name, SERVICE_T_MAX); - return lld_dev; } diff --git a/drivers/net/ethernet/huawei/hinic3/include/cfg_mgmt/cfg_mgmt_mpu_cmd_defs.h b/drivers/net/ethernet/huawei/hinic3/include/cfg_mgmt/cfg_mgmt_mpu_cmd_defs.h index f56df083a..e7e16fca4 100644 --- a/drivers/net/ethernet/huawei/hinic3/include/cfg_mgmt/cfg_mgmt_mpu_cmd_defs.h +++ b/drivers/net/ethernet/huawei/hinic3/include/cfg_mgmt/cfg_mgmt_mpu_cmd_defs.h @@ -21,6 +21,7 @@ enum servic_bit_define { SERVICE_BIT_PPA = 11, SERVICE_BIT_MIGRATE = 12, SERVICE_BIT_VROCE = 13, + SERVICE_BIT_BIFUR = 14, SERVICE_BIT_MAX }; @@ -38,6 +39,7 @@ enum servic_bit_define { #define CFG_SERVICE_MASK_PPA (0x1 << SERVICE_BIT_PPA) #define CFG_SERVICE_MASK_MIGRATE (0x1 << SERVICE_BIT_MIGRATE) #define CFG_SERVICE_MASK_VROCE (0x1 << SERVICE_BIT_VROCE) +#define CFG_SERVICE_MASK_BIFUR (0x1 << SERVICE_BIT_BIFUR) /* Definition of the scenario ID in the cfg_data, which is used for SML memory allocation. */ enum scenes_id_define { -- 2.45.1.windows.1

2 1

[PATCH OLK-6.6 00/16] net:yt6801: Add Motorcomm yt6801 PCIe driver
by Frank Sae 07 Jan '25

07 Jan '25

This series includes adding Motorcomm YT6801 Gigabit ethernet driver and adding yt6801 ethernet driver entry in MAINTAINERS file. YT6801 integrates a YT8531S phy. Frank Sae (16): motorcomm:yt6801: Add support for a pci table in this module motorcomm:yt6801: Implement pci_driver shutdown motorcomm:yt6801: Implement the fxgmac_drv_probe function motorcomm:yt6801: Implement the .ndo_open function motorcomm:yt6801: Implement the fxgmac_start function motorcomm:yt6801: Implement the poll functions motorcomm:yt6801: Implement the fxgmac_init function motorcomm:yt6801: Implement the fxgmac_read_mac_addr function motorcomm:yt6801: Implement some hw_ops function motorcomm:yt6801: Implement .ndo_start_xmit function motorcomm:yt6801: Implement some net_device_ops function motorcomm:yt6801: Implement .ndo_tx_timeout and .ndo_change_mtu functions motorcomm:yt6801: Implement some ethtool_ops function motorcomm:yt6801: Implement the WOL function of ethtool_ops motorcomm:yt6801: Implement pci_driver suspend and resume motorcomm:yt6801: Update the Makefile, Kconfig and maintainer for yt6801 MAINTAINERS | 8 + arch/arm64/configs/openeuler_defconfig | 2 + arch/riscv/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 2 + drivers/net/ethernet/Kconfig | 1 + drivers/net/ethernet/Makefile | 1 + drivers/net/ethernet/motorcomm/Kconfig | 27 + drivers/net/ethernet/motorcomm/Makefile | 6 + .../net/ethernet/motorcomm/yt6801/Makefile | 9 + .../net/ethernet/motorcomm/yt6801/yt6801.h | 617 +++ .../ethernet/motorcomm/yt6801/yt6801_desc.c | 638 ++++ .../ethernet/motorcomm/yt6801/yt6801_desc.h | 39 + .../motorcomm/yt6801/yt6801_ethtool.c | 838 ++++ .../net/ethernet/motorcomm/yt6801/yt6801_hw.c | 3383 +++++++++++++++++ .../ethernet/motorcomm/yt6801/yt6801_net.c | 2907 ++++++++++++++ .../ethernet/motorcomm/yt6801/yt6801_net.h | 32 + .../ethernet/motorcomm/yt6801/yt6801_pci.c | 191 + .../ethernet/motorcomm/yt6801/yt6801_type.h | 1398 +++++++ 18 files changed, 10101 insertions(+) create mode 100644 drivers/net/ethernet/motorcomm/Kconfig create mode 100644 drivers/net/ethernet/motorcomm/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801.h create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.h create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_ethtool.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_hw.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_net.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_net.h create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_pci.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_type.h -- 2.34.1

2 17

[PATCH OLK-6.6] wifi: ath12k: Skip Rx TID cleanup for self peer
by Qi Xi 07 Jan '25

07 Jan '25

From: Ramya Gnanasekar <quic_rgnanase(a)quicinc.com> mainline inclusion from mainline-v6.13-rc1 commit 1a0c640ce1cdcde3eb131a0c1e70ca1ed7cf27cb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADH CVE: CVE-2024-56543 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- During peer create, dp setup for the peer is done where Rx TID is updated for all the TIDs. Peer object for self peer will not go through dp setup. When core halts, dp cleanup is done for all the peers. While cleanup, rx_tid::ab is accessed which causes below stack trace for self peer. WARNING: CPU: 6 PID: 12297 at drivers/net/wireless/ath/ath12k/dp_rx.c:851 Call Trace: __warn+0x7b/0x1a0 ath12k_dp_rx_frags_cleanup+0xd2/0xe0 [ath12k] report_bug+0x10b/0x200 handle_bug+0x3f/0x70 exc_invalid_op+0x13/0x60 asm_exc_invalid_op+0x16/0x20 ath12k_dp_rx_frags_cleanup+0xd2/0xe0 [ath12k] ath12k_dp_rx_frags_cleanup+0xca/0xe0 [ath12k] ath12k_dp_rx_peer_tid_cleanup+0x39/0xa0 [ath12k] ath12k_mac_peer_cleanup_all+0x61/0x100 [ath12k] ath12k_core_halt+0x3b/0x100 [ath12k] ath12k_core_reset+0x494/0x4c0 [ath12k] sta object in peer will be updated when remote peer is created. Hence use peer::sta to detect the self peer and skip the cleanup. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Signed-off-by: Ramya Gnanasekar <quic_rgnanase(a)quicinc.com> Acked-by: Jeff Johnson <quic_jjohnson(a)quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://patch.msgid.link/20240905042851.2282306-1-quic_rgnanase@quicinc.com Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/net/wireless/ath/ath12k/mac.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c index 4bb30e403728..f90191a290c2 100644 --- a/drivers/net/wireless/ath/ath12k/mac.c +++ b/drivers/net/wireless/ath/ath12k/mac.c @@ -775,7 +775,10 @@ void ath12k_mac_peer_cleanup_all(struct ath12k *ar) spin_lock_bh(&ab->base_lock); list_for_each_entry_safe(peer, tmp, &ab->peers, list) { - ath12k_dp_rx_peer_tid_cleanup(ar, peer); + /* Skip Rx TID cleanup for self peer */ + if (peer->sta) + ath12k_dp_rx_peer_tid_cleanup(ar, peer); + list_del(&peer->list); kfree(peer); } -- 2.33.0

2 1

[PATCH OLK-5.10] media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
by Qi Xi 07 Jan '25

07 Jan '25

From: Gaosheng Cui <cuigaosheng1(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit 0f514068fbc5d4d189c817adc7c4e32cffdc2e47 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMP CVE: CVE-2024-56572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The buffer in the loop should be released under the exception path, otherwise there may be a memory leak here. To mitigate this, free the buffer when allegro_alloc_buffer fails. Fixes: f20387dfd065 ("media: allegro: add Allegro DVT video IP core driver") Cc: <stable(a)vger.kernel.org> Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Conflicts: drivers/media/platform/allegro-dvt/allegro-core.c drivers/staging/media/allegro-dvt/allegro-core.c [Context conflicts] Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/staging/media/allegro-dvt/allegro-core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/staging/media/allegro-dvt/allegro-core.c b/drivers/staging/media/allegro-dvt/allegro-core.c index 28b6ba895ccd..84bd3d8649a8 100644 --- a/drivers/staging/media/allegro-dvt/allegro-core.c +++ b/drivers/staging/media/allegro-dvt/allegro-core.c @@ -1208,8 +1208,10 @@ static int allocate_buffers_internal(struct allegro_channel *channel, INIT_LIST_HEAD(&buffer->head); err = allegro_alloc_buffer(dev, buffer, size); - if (err) + if (err) { + kfree(buffer); goto err; + } list_add(&buffer->head, list); } -- 2.33.0

2 1

[PATCH OLK-6.6] media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
by Qi Xi 07 Jan '25

07 Jan '25

From: Gaosheng Cui <cuigaosheng1(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit 0f514068fbc5d4d189c817adc7c4e32cffdc2e47 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMP CVE: CVE-2024-56572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The buffer in the loop should be released under the exception path, otherwise there may be a memory leak here. To mitigate this, free the buffer when allegro_alloc_buffer fails. Fixes: f20387dfd065 ("media: allegro: add Allegro DVT video IP core driver") Cc: <stable(a)vger.kernel.org> Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/media/platform/allegro-dvt/allegro-core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/allegro-dvt/allegro-core.c b/drivers/media/platform/allegro-dvt/allegro-core.c index da61f9beb6b4..7dffea2ad88a 100644 --- a/drivers/media/platform/allegro-dvt/allegro-core.c +++ b/drivers/media/platform/allegro-dvt/allegro-core.c @@ -1509,8 +1509,10 @@ static int allocate_buffers_internal(struct allegro_channel *channel, INIT_LIST_HEAD(&buffer->head); err = allegro_alloc_buffer(dev, buffer, size); - if (err) + if (err) { + kfree(buffer); goto err; + } list_add(&buffer->head, list); } -- 2.33.0

2 1

[PATCH openEuler-22.03-LTS-SP1] i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
by Qi Xi 07 Jan '25

07 Jan '25

From: Frank Li <Frank.Li(a)nxp.com> mainline inclusion from mainline-v6.13-rc1 commit 3082990592f7c6d7510a9133afa46e31bbe26533 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAM5 CVE: CVE-2024-56562 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- if (dev->boardinfo && dev->boardinfo->init_dyn_addr) ^^^ here check "init_dyn_addr" i3c_bus_set_addr_slot_status(&master->bus, dev->info.dyn_addr, ...) ^^^^ free "dyn_addr" Fix copy/paste error "dyn_addr" by replacing it with "init_dyn_addr". Cc: stable(a)kernel.org Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") Reviewed-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Signed-off-by: Frank Li <Frank.Li(a)nxp.com> Link: https://lore.kernel.org/r/20241001162608.224039-1-Frank.Li@nxp.com Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/i3c/master.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c index 1c6b78ad5ade..c3f1345c08de 100644 --- a/drivers/i3c/master.c +++ b/drivers/i3c/master.c @@ -1285,7 +1285,7 @@ static void i3c_master_put_i3c_addrs(struct i3c_dev_desc *dev) I3C_ADDR_SLOT_FREE); if (dev->boardinfo && dev->boardinfo->init_dyn_addr) - i3c_bus_set_addr_slot_status(&master->bus, dev->info.dyn_addr, + i3c_bus_set_addr_slot_status(&master->bus, dev->boardinfo->init_dyn_addr, I3C_ADDR_SLOT_FREE); } -- 2.33.0

2 1

[PATCH OLK-5.10] i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
by Qi Xi 07 Jan '25

07 Jan '25

From: Frank Li <Frank.Li(a)nxp.com> mainline inclusion from mainline-v6.13-rc1 commit 3082990592f7c6d7510a9133afa46e31bbe26533 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAM5 CVE: CVE-2024-56562 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- if (dev->boardinfo && dev->boardinfo->init_dyn_addr) ^^^ here check "init_dyn_addr" i3c_bus_set_addr_slot_status(&master->bus, dev->info.dyn_addr, ...) ^^^^ free "dyn_addr" Fix copy/paste error "dyn_addr" by replacing it with "init_dyn_addr". Cc: stable(a)kernel.org Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") Reviewed-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Signed-off-by: Frank Li <Frank.Li(a)nxp.com> Link: https://lore.kernel.org/r/20241001162608.224039-1-Frank.Li@nxp.com Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/i3c/master.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c index 828fb236a63a..2527965a6f24 100644 --- a/drivers/i3c/master.c +++ b/drivers/i3c/master.c @@ -1285,7 +1285,7 @@ static void i3c_master_put_i3c_addrs(struct i3c_dev_desc *dev) I3C_ADDR_SLOT_FREE); if (dev->boardinfo && dev->boardinfo->init_dyn_addr) - i3c_bus_set_addr_slot_status(&master->bus, dev->info.dyn_addr, + i3c_bus_set_addr_slot_status(&master->bus, dev->boardinfo->init_dyn_addr, I3C_ADDR_SLOT_FREE); } -- 2.33.0

2 1

[PATCH OLK-6.6] i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
by Qi Xi 07 Jan '25

07 Jan '25

From: Frank Li <Frank.Li(a)nxp.com> mainline inclusion from mainline-v6.13-rc1 commit 3082990592f7c6d7510a9133afa46e31bbe26533 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAM5 CVE: CVE-2024-56562 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- if (dev->boardinfo && dev->boardinfo->init_dyn_addr) ^^^ here check "init_dyn_addr" i3c_bus_set_addr_slot_status(&master->bus, dev->info.dyn_addr, ...) ^^^^ free "dyn_addr" Fix copy/paste error "dyn_addr" by replacing it with "init_dyn_addr". Cc: stable(a)kernel.org Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") Reviewed-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Signed-off-by: Frank Li <Frank.Li(a)nxp.com> Link: https://lore.kernel.org/r/20241001162608.224039-1-Frank.Li@nxp.com Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/i3c/master.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c index 0e9ff5500a77..70d120dfb090 100644 --- a/drivers/i3c/master.c +++ b/drivers/i3c/master.c @@ -1293,7 +1293,7 @@ static void i3c_master_put_i3c_addrs(struct i3c_dev_desc *dev) I3C_ADDR_SLOT_FREE); if (dev->boardinfo && dev->boardinfo->init_dyn_addr) - i3c_bus_set_addr_slot_status(&master->bus, dev->info.dyn_addr, + i3c_bus_set_addr_slot_status(&master->bus, dev->boardinfo->init_dyn_addr, I3C_ADDR_SLOT_FREE); } -- 2.33.0

2 1

[PATCH openEuler-22.03-LTS-SP1] mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
by Zeng Heng 07 Jan '25

07 Jan '25

From: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> stable inclusion from stable-v5.10.231 commit 0b648968bfa4f5c9c4983bca9f2de17626ed6fb6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDOS CVE: CVE-2024-56691 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 686fb77712a4bc94b76a0c5ae74c60118b7a0d79 ] While design wise the idea of converting the driver to use the hierarchy of the IRQ chips is correct, the implementation has (inherited) flaws. This was unveiled when platform_get_irq() had started WARN() on IRQ 0 that is supposed to be a Linux IRQ number (also known as vIRQ). Rework the driver to respect IRQ domain when creating each MFD device separately, as the domain is not the same for all of them. Fixes: 9c6235c86332 ("mfd: intel_soc_pmic_bxtwc: Add bxt_wcove_usbc device") Fixes: d2061f9cc32d ("usb: typec: add driver for Intel Whiskey Cove PMIC USB Type-C PHY") Fixes: 57129044f504 ("mfd: intel_soc_pmic_bxtwc: Use chained IRQs for second level IRQ chips") Reported-by: Zhang Ning <zhangn1985(a)outlook.com> Closes: https://lore.kernel.org/r/TY2PR01MB3322FEDCDC048B7D3794F922CDBA2@TY2PR01MB3… Tested-by: Zhang Ning <zhangn1985(a)outlook.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Acked-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Link: https://lore.kernel.org/r/20241005193029.1929139-2-andriy.shevchenko@linux.… Signed-off-by: Lee Jones <lee(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/mfd/intel_soc_pmic_bxtwc.c | 61 ++++++++++++++++++++---------- drivers/usb/typec/tcpm/wcove.c | 4 -- 2 files changed, 40 insertions(+), 25 deletions(-) diff --git a/drivers/mfd/intel_soc_pmic_bxtwc.c b/drivers/mfd/intel_soc_pmic_bxtwc.c index eba89780dbe7..e1570191795d 100644 --- a/drivers/mfd/intel_soc_pmic_bxtwc.c +++ b/drivers/mfd/intel_soc_pmic_bxtwc.c @@ -240,16 +240,6 @@ static struct mfd_cell bxt_wc_dev[] = { .num_resources = ARRAY_SIZE(thermal_resources), .resources = thermal_resources, }, - { - .name = "bxt_wcove_usbc", - .num_resources = ARRAY_SIZE(usbc_resources), - .resources = usbc_resources, - }, - { - .name = "bxt_wcove_ext_charger", - .num_resources = ARRAY_SIZE(charger_resources), - .resources = charger_resources, - }, { .name = "bxt_wcove_bcu", .num_resources = ARRAY_SIZE(bcu_resources), @@ -271,6 +261,19 @@ static struct mfd_cell bxt_wc_dev[] = { }, }; +static struct mfd_cell bxt_wc_chgr_dev[] = { + { + .name = "bxt_wcove_usbc", + .num_resources = ARRAY_SIZE(usbc_resources), + .resources = usbc_resources, + }, + { + .name = "bxt_wcove_ext_charger", + .num_resources = ARRAY_SIZE(charger_resources), + .resources = charger_resources, + }, +}; + static int regmap_ipc_byte_reg_read(void *context, unsigned int reg, unsigned int *val) { @@ -421,6 +424,26 @@ static int bxtwc_add_chained_irq_chip(struct intel_soc_pmic *pmic, 0, chip, data); } +static int bxtwc_add_chained_devices(struct intel_soc_pmic *pmic, + const struct mfd_cell *cells, int n_devs, + struct regmap_irq_chip_data *pdata, + int pirq, int irq_flags, + const struct regmap_irq_chip *chip, + struct regmap_irq_chip_data **data) +{ + struct device *dev = pmic->dev; + struct irq_domain *domain; + int ret; + + ret = bxtwc_add_chained_irq_chip(pmic, pdata, pirq, irq_flags, chip, data); + if (ret) + return dev_err_probe(dev, ret, "Failed to add %s IRQ chip\n", chip->name); + + domain = regmap_irq_get_domain(*data); + + return devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE, cells, n_devs, NULL, 0, domain); +} + static int bxtwc_probe(struct platform_device *pdev) { int ret; @@ -520,18 +543,14 @@ static int bxtwc_probe(struct platform_device *pdev) return ret; } - /* Add chained IRQ handler for CHGR IRQs */ - ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, - BXTWC_CHGR_LVL1_IRQ, - IRQF_ONESHOT, - &bxtwc_regmap_irq_chip_chgr, - &pmic->irq_chip_data_chgr); - - - if (ret) { - dev_err(&pdev->dev, "Failed to add CHGR IRQ chip\n"); + ret = bxtwc_add_chained_devices(pmic, bxt_wc_chgr_dev, ARRAY_SIZE(bxt_wc_chgr_dev), + pmic->irq_chip_data, + BXTWC_CHGR_LVL1_IRQ, + IRQF_ONESHOT, + &bxtwc_regmap_irq_chip_chgr, + &pmic->irq_chip_data_chgr); + if (ret) return ret; - } /* Add chained IRQ handler for CRIT IRQs */ ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, diff --git a/drivers/usb/typec/tcpm/wcove.c b/drivers/usb/typec/tcpm/wcove.c index 7e9c279bf49d..22fe8d60fe36 100644 --- a/drivers/usb/typec/tcpm/wcove.c +++ b/drivers/usb/typec/tcpm/wcove.c @@ -620,10 +620,6 @@ static int wcove_typec_probe(struct platform_device *pdev) if (irq < 0) return irq; - irq = regmap_irq_get_virq(pmic->irq_chip_data_chgr, irq); - if (irq < 0) - return irq; - ret = guid_parse(WCOVE_DSM_UUID, &wcove->guid); if (ret) return ret; -- 2.25.1

2 1

[PATCH OLK-5.10] mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
by Zeng Heng 07 Jan '25

07 Jan '25

From: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> stable inclusion from stable-v5.10.231 commit 0b648968bfa4f5c9c4983bca9f2de17626ed6fb6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDOS CVE: CVE-2024-56691 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 686fb77712a4bc94b76a0c5ae74c60118b7a0d79 ] While design wise the idea of converting the driver to use the hierarchy of the IRQ chips is correct, the implementation has (inherited) flaws. This was unveiled when platform_get_irq() had started WARN() on IRQ 0 that is supposed to be a Linux IRQ number (also known as vIRQ). Rework the driver to respect IRQ domain when creating each MFD device separately, as the domain is not the same for all of them. Fixes: 9c6235c86332 ("mfd: intel_soc_pmic_bxtwc: Add bxt_wcove_usbc device") Fixes: d2061f9cc32d ("usb: typec: add driver for Intel Whiskey Cove PMIC USB Type-C PHY") Fixes: 57129044f504 ("mfd: intel_soc_pmic_bxtwc: Use chained IRQs for second level IRQ chips") Reported-by: Zhang Ning <zhangn1985(a)outlook.com> Closes: https://lore.kernel.org/r/TY2PR01MB3322FEDCDC048B7D3794F922CDBA2@TY2PR01MB3… Tested-by: Zhang Ning <zhangn1985(a)outlook.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Acked-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Link: https://lore.kernel.org/r/20241005193029.1929139-2-andriy.shevchenko@linux.… Signed-off-by: Lee Jones <lee(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/mfd/intel_soc_pmic_bxtwc.c | 61 ++++++++++++++++++++---------- drivers/usb/typec/tcpm/wcove.c | 4 -- 2 files changed, 40 insertions(+), 25 deletions(-) diff --git a/drivers/mfd/intel_soc_pmic_bxtwc.c b/drivers/mfd/intel_soc_pmic_bxtwc.c index eba89780dbe7..e1570191795d 100644 --- a/drivers/mfd/intel_soc_pmic_bxtwc.c +++ b/drivers/mfd/intel_soc_pmic_bxtwc.c @@ -240,16 +240,6 @@ static struct mfd_cell bxt_wc_dev[] = { .num_resources = ARRAY_SIZE(thermal_resources), .resources = thermal_resources, }, - { - .name = "bxt_wcove_usbc", - .num_resources = ARRAY_SIZE(usbc_resources), - .resources = usbc_resources, - }, - { - .name = "bxt_wcove_ext_charger", - .num_resources = ARRAY_SIZE(charger_resources), - .resources = charger_resources, - }, { .name = "bxt_wcove_bcu", .num_resources = ARRAY_SIZE(bcu_resources), @@ -271,6 +261,19 @@ static struct mfd_cell bxt_wc_dev[] = { }, }; +static struct mfd_cell bxt_wc_chgr_dev[] = { + { + .name = "bxt_wcove_usbc", + .num_resources = ARRAY_SIZE(usbc_resources), + .resources = usbc_resources, + }, + { + .name = "bxt_wcove_ext_charger", + .num_resources = ARRAY_SIZE(charger_resources), + .resources = charger_resources, + }, +}; + static int regmap_ipc_byte_reg_read(void *context, unsigned int reg, unsigned int *val) { @@ -421,6 +424,26 @@ static int bxtwc_add_chained_irq_chip(struct intel_soc_pmic *pmic, 0, chip, data); } +static int bxtwc_add_chained_devices(struct intel_soc_pmic *pmic, + const struct mfd_cell *cells, int n_devs, + struct regmap_irq_chip_data *pdata, + int pirq, int irq_flags, + const struct regmap_irq_chip *chip, + struct regmap_irq_chip_data **data) +{ + struct device *dev = pmic->dev; + struct irq_domain *domain; + int ret; + + ret = bxtwc_add_chained_irq_chip(pmic, pdata, pirq, irq_flags, chip, data); + if (ret) + return dev_err_probe(dev, ret, "Failed to add %s IRQ chip\n", chip->name); + + domain = regmap_irq_get_domain(*data); + + return devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE, cells, n_devs, NULL, 0, domain); +} + static int bxtwc_probe(struct platform_device *pdev) { int ret; @@ -520,18 +543,14 @@ static int bxtwc_probe(struct platform_device *pdev) return ret; } - /* Add chained IRQ handler for CHGR IRQs */ - ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, - BXTWC_CHGR_LVL1_IRQ, - IRQF_ONESHOT, - &bxtwc_regmap_irq_chip_chgr, - &pmic->irq_chip_data_chgr); - - - if (ret) { - dev_err(&pdev->dev, "Failed to add CHGR IRQ chip\n"); + ret = bxtwc_add_chained_devices(pmic, bxt_wc_chgr_dev, ARRAY_SIZE(bxt_wc_chgr_dev), + pmic->irq_chip_data, + BXTWC_CHGR_LVL1_IRQ, + IRQF_ONESHOT, + &bxtwc_regmap_irq_chip_chgr, + &pmic->irq_chip_data_chgr); + if (ret) return ret; - } /* Add chained IRQ handler for CRIT IRQs */ ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, diff --git a/drivers/usb/typec/tcpm/wcove.c b/drivers/usb/typec/tcpm/wcove.c index 7e9c279bf49d..22fe8d60fe36 100644 --- a/drivers/usb/typec/tcpm/wcove.c +++ b/drivers/usb/typec/tcpm/wcove.c @@ -620,10 +620,6 @@ static int wcove_typec_probe(struct platform_device *pdev) if (irq < 0) return irq; - irq = regmap_irq_get_virq(pmic->irq_chip_data_chgr, irq); - if (irq < 0) - return irq; - ret = guid_parse(WCOVE_DSM_UUID, &wcove->guid); if (ret) return ret; -- 2.25.1

2 1

[PATCH OLK-6.6] usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer
by Liu Mingrui 07 Jan '25

07 Jan '25

From: Lianqin Hu <hulianqin(a)vivo.com> stable inclusion from stable-v6.6.67 commit 8ca07a3d18f39b1669927ef536e485787e856df6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAO8 CVE: CVE-2024-56670 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4cfbca86f6a8b801f3254e0e3c8f2b1d2d64be2b upstream. Considering that in some extreme cases, when u_serial driver is accessed by multiple threads, Thread A is executing the open operation and calling the gs_open, Thread B is executing the disconnect operation and calling the gserial_disconnect function,The port->port_usb pointer will be set to NULL. E.g. Thread A Thread B gs_open() gadget_unbind_driver() gs_start_io() composite_disconnect() gs_start_rx() gserial_disconnect() ... ... spin_unlock(&port->port_lock) status = usb_ep_queue() spin_lock(&port->port_lock) spin_lock(&port->port_lock) port->port_usb = NULL gs_free_requests(port->port_usb->in) spin_unlock(&port->port_lock) Crash This causes thread A to access a null pointer (port->port_usb is null) when calling the gs_free_requests function, causing a crash. If port_usb is NULL, the release request will be skipped as it will be done by gserial_disconnect. So add a null pointer check to gs_start_io before attempting to access the value of the pointer port->port_usb. Call trace: gs_start_io+0x164/0x25c gs_open+0x108/0x13c tty_open+0x314/0x638 chrdev_open+0x1b8/0x258 do_dentry_open+0x2c4/0x700 vfs_open+0x2c/0x3c path_openat+0xa64/0xc60 do_filp_open+0xb8/0x164 do_sys_openat2+0x84/0xf0 __arm64_sys_openat+0x70/0x9c invoke_syscall+0x58/0x114 el0_svc_common+0x80/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x38/0x68 Fixes: c1dca562be8a ("usb gadget: split out serial core") Cc: stable(a)vger.kernel.org Suggested-by: Prashanth K <quic_prashk(a)quicinc.com> Signed-off-by: Lianqin Hu <hulianqin(a)vivo.com> Acked-by: Prashanth K <quic_prashk(a)quicinc.com> Link: https://lore.kernel.org/r/TYUPR06MB62178DC3473F9E1A537DCD02D2362@TYUPR06MB6… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/usb/gadget/function/u_serial.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c index 8962f96ae729..729b0472bab0 100644 --- a/drivers/usb/gadget/function/u_serial.c +++ b/drivers/usb/gadget/function/u_serial.c @@ -575,9 +575,12 @@ static int gs_start_io(struct gs_port *port) * we didn't in gs_start_tx() */ tty_wakeup(port->port.tty); } else { - gs_free_requests(ep, head, &port->read_allocated); - gs_free_requests(port->port_usb->in, &port->write_pool, - &port->write_allocated); + /* Free reqs only if we are still connected */ + if (port->port_usb) { + gs_free_requests(ep, head, &port->read_allocated); + gs_free_requests(port->port_usb->in, &port->write_pool, + &port->write_allocated); + } status = -EIO; } -- 2.25.1

2 1

[PATCH OLK-6.6] net/mlx5: DR, prevent potential error pointer dereference
by Wang Wensheng 07 Jan '25

07 Jan '25

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v6.6.67 commit 325cf73a1b449fea3158ab99d03a7a717aad1618 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMV CVE: CVE-2024-56660 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=325c… -------------------------------- [ Upstream commit 11776cff0b563c8b8a4fa76cab620bfb633a8cb8 ] The dr_domain_add_vport_cap() function generally returns NULL on error but sometimes we want it to return ERR_PTR(-EBUSY) so the caller can retry. The problem here is that "ret" can be either -EBUSY or -ENOMEM and if it's and -ENOMEM then the error pointer is propogated back and eventually dereferenced in dr_ste_v0_build_src_gvmi_qpn_tag(). Fixes: 11a45def2e19 ("net/mlx5: DR, Add support for SF vports") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Reviewed-by: Tariq Toukan <tariqt(a)nvidia.com> Link: https://patch.msgid.link/07477254-e179-43e2-b1b3-3b9db4674195@stanley.mount… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c index 3d74109f8230..49f22cad92bf 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c @@ -297,7 +297,9 @@ dr_domain_add_vport_cap(struct mlx5dr_domain *dmn, u16 vport) if (ret) { mlx5dr_dbg(dmn, "Couldn't insert new vport into xarray (%d)\n", ret); kvfree(vport_caps); - return ERR_PTR(ret); + if (ret == -EBUSY) + return ERR_PTR(-EBUSY); + return NULL; } return vport_caps; -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] BMA: Fix Oops and spin lock deadlock problem, and change the version number.
by Yuan Can 07 Jan '25

07 Jan '25

From: Wujiahai <wujiahai(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBD74A CVE: NA ----------------------------------------- 1. Prevents iBMA driver from causing Oops problems. 2. The spin lock deadlock bug of the ibma iBMA is fixed. 3. Change the iBMA driver version. Fixes: ea190d90c609 ("Huawei BMA: Adding Huawei BMA driver: host_edma_drv") Signed-off-by: Wujiahai <wujiahai(a)huawei.com> --- drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/bma_devintf.c | 10 ++++++++-- drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c | 9 --------- .../net/ethernet/huawei/bma/kbox_drv/kbox_include.h | 2 +- drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 6 files changed, 12 insertions(+), 15 deletions(-) diff --git a/drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c b/drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c index 4be8a4fc6cec..275c2cdfe5db 100644 --- a/drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c +++ b/drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c @@ -28,7 +28,7 @@ #ifdef DRV_VERSION #define CDEV_VERSION MICRO_TO_STR(DRV_VERSION) #else -#define CDEV_VERSION "0.3.8" +#define CDEV_VERSION "0.3.10" #endif #define CDEV_DEFAULT_NUM 4 diff --git a/drivers/net/ethernet/huawei/bma/edma_drv/bma_devintf.c b/drivers/net/ethernet/huawei/bma/edma_drv/bma_devintf.c index 556130ab8a65..baa65b8885ff 100644 --- a/drivers/net/ethernet/huawei/bma/edma_drv/bma_devintf.c +++ b/drivers/net/ethernet/huawei/bma/edma_drv/bma_devintf.c @@ -135,6 +135,7 @@ static void bma_priv_clean_up(struct bma_priv_data_s *bma_priv) int i = 0; struct bma_priv_data_s *priv = bma_priv; struct edma_recv_msg_s *msg = NULL; + unsigned long flags = 0; if (!priv) return; @@ -144,6 +145,7 @@ static void bma_priv_clean_up(struct bma_priv_data_s *bma_priv) return; } + spin_lock_irqsave(&priv->recv_msg_lock, flags); for (i = 0; i < priv->user.max_recvmsg_nums; i++) { ret = edma_host_recv_msg(&g_bma_dev->edma_host, priv, &msg); if (ret) @@ -151,6 +153,7 @@ static void bma_priv_clean_up(struct bma_priv_data_s *bma_priv) kfree(msg); } + spin_unlock_irqrestore(&priv->recv_msg_lock, flags); priv->user.type = TYPE_UNKNOWN; priv->user.sub_type = 0; @@ -419,8 +422,8 @@ EXPORT_SYMBOL(bma_intf_int_to_bmc); int bma_intf_is_link_ok(void) { - if ((&g_bma_dev->edma_host != NULL) && - (g_bma_dev->edma_host.statistics.remote_status == REGISTERED)) + if (g_bma_dev && + g_bma_dev->edma_host.statistics.remote_status == REGISTERED) return 1; return 0; } @@ -432,6 +435,7 @@ int bma_cdev_recv_msg(void *handle, char __user *data, size_t count) struct edma_recv_msg_s *msg = NULL; int result = 0; int len = 0; + unsigned long flags = 0; if (!handle || !data || count == 0) { BMA_LOG(DLOG_DEBUG, "input NULL point!\n"); @@ -440,7 +444,9 @@ int bma_cdev_recv_msg(void *handle, char __user *data, size_t count) priv = (struct bma_priv_data_s *)handle; + spin_lock_irqsave(&priv->recv_msg_lock, flags); result = edma_host_recv_msg(&g_bma_dev->edma_host, priv, &msg); + spin_unlock_irqrestore(&priv->recv_msg_lock, flags); if (result != 0) return -ENODATA; diff --git a/drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h b/drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h index d1c62a77a434..7639b11a3f50 100644 --- a/drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h +++ b/drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h @@ -71,7 +71,7 @@ struct bma_pci_dev_s { #ifdef DRV_VERSION #define BMA_VERSION MICRO_TO_STR(DRV_VERSION) #else -#define BMA_VERSION "0.3.8" +#define BMA_VERSION "0.3.10" #endif #ifdef CONFIG_ARM64 diff --git a/drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c b/drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c index 4641e359e8fc..d9da64b94eb9 100644 --- a/drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c +++ b/drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c @@ -1069,21 +1069,14 @@ int edma_host_recv_msg(struct edma_host_s *edma_host, struct bma_priv_data_s *priv, struct edma_recv_msg_s **msg) { - unsigned long flags = 0; struct list_head *entry = NULL; struct edma_recv_msg_s *msg_tmp = NULL; - struct bma_dev_s *bma_dev = NULL; if (!edma_host || !priv || !msg) return -EAGAIN; - bma_dev = list_entry(edma_host, struct bma_dev_s, edma_host); - - spin_lock_irqsave(&bma_dev->priv_list_lock, flags); - if (list_empty(&priv->recv_msgs)) { priv->user.cur_recvmsg_nums = 0; - spin_unlock_irqrestore(&bma_dev->priv_list_lock, flags); BMA_LOG(DLOG_DEBUG, "recv msgs empty\n"); return -EAGAIN; } @@ -1095,8 +1088,6 @@ int edma_host_recv_msg(struct edma_host_s *edma_host, if (priv->user.cur_recvmsg_nums > 0) priv->user.cur_recvmsg_nums--; - spin_unlock_irqrestore(&bma_dev->priv_list_lock, flags); - *msg = msg_tmp; BMA_LOG(DLOG_DEBUG, "msg->msg_len = %d\n", (int)msg_tmp->msg_len); diff --git a/drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h b/drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h index 8371903e2c33..0d82ee6f7c83 100644 --- a/drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h +++ b/drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h @@ -23,7 +23,7 @@ #ifdef DRV_VERSION #define KBOX_VERSION MICRO_TO_STR(DRV_VERSION) #else -#define KBOX_VERSION "0.3.8" +#define KBOX_VERSION "0.3.10" #endif #define UNUSED(x) (x = x) diff --git a/drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h b/drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h index f03e6eccde6c..242d3ec128d3 100644 --- a/drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h +++ b/drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h @@ -31,7 +31,7 @@ extern "C" { #ifdef DRV_VERSION #define VETH_VERSION MICRO_TO_STR(DRV_VERSION) #else -#define VETH_VERSION "0.3.8" +#define VETH_VERSION "0.3.10" #endif #define MODULE_NAME "veth" -- 2.22.0

2 1

[PATCH OLK-6.6] net: enetc: Do not configure preemptible TCs if SIs do not support
by Li Huafei 07 Jan '25

07 Jan '25

From: Wei Fang <wei.fang(a)nxp.com> stable inclusion from stable-v6.6.66 commit 66127f0d1ecf00604aeab71132bde398fd9ec7c9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAO0 CVE: CVE-2024-56649 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b2420b8c81ec674552d00c55d46245e5c184b260 ] Both ENETC PF and VF drivers share enetc_setup_tc_mqprio() to configure MQPRIO. And enetc_setup_tc_mqprio() calls enetc_change_preemptible_tcs() to configure preemptible TCs. However, only PF is able to configure preemptible TCs. Because only PF has related registers, while VF does not have these registers. So for VF, its hw->port pointer is NULL. Therefore, VF will access an invalid pointer when accessing a non-existent register, which will cause a crash issue. The simplified log is as follows. root@ls1028ardb:~# tc qdisc add dev eno0vf0 parent root handle 100: \ mqprio num_tc 4 map 0 0 1 1 2 2 3 3 queues 1@0 1@1 1@2 1@3 hw 1 [ 187.290775] Unable to handle kernel paging request at virtual address 0000000000001f00 [ 187.424831] pc : enetc_mm_commit_preemptible_tcs+0x1c4/0x400 [ 187.430518] lr : enetc_mm_commit_preemptible_tcs+0x30c/0x400 [ 187.511140] Call trace: [ 187.513588] enetc_mm_commit_preemptible_tcs+0x1c4/0x400 [ 187.518918] enetc_setup_tc_mqprio+0x180/0x214 [ 187.523374] enetc_vf_setup_tc+0x1c/0x30 [ 187.527306] mqprio_enable_offload+0x144/0x178 [ 187.531766] mqprio_init+0x3ec/0x668 [ 187.535351] qdisc_create+0x15c/0x488 [ 187.539023] tc_modify_qdisc+0x398/0x73c [ 187.542958] rtnetlink_rcv_msg+0x128/0x378 [ 187.547064] netlink_rcv_skb+0x60/0x130 [ 187.550910] rtnetlink_rcv+0x18/0x24 [ 187.554492] netlink_unicast+0x300/0x36c [ 187.558425] netlink_sendmsg+0x1a8/0x420 [ 187.606759] ---[ end trace 0000000000000000 ]--- In addition, some PFs also do not support configuring preemptible TCs, such as eno1 and eno3 on LS1028A. It won't crash like it does for VFs, but we should prevent these PFs from accessing these unimplemented registers. Fixes: 827145392a4a ("net: enetc: only commit preemptible TCs to hardware when MM TX is active") Signed-off-by: Wei Fang <wei.fang(a)nxp.com> Suggested-by: Vladimir Oltean <vladimir.oltean(a)nxp.com> Reviewed-by: Frank Li <Frank.Li(a)nxp.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/net/ethernet/freescale/enetc/enetc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c index c17b9e338516..87b27bd7a13b 100644 --- a/drivers/net/ethernet/freescale/enetc/enetc.c +++ b/drivers/net/ethernet/freescale/enetc/enetc.c @@ -28,6 +28,9 @@ EXPORT_SYMBOL_GPL(enetc_port_mac_wr); static void enetc_change_preemptible_tcs(struct enetc_ndev_priv *priv, u8 preemptible_tcs) { + if (!(priv->si->hw_features & ENETC_SI_F_QBU)) + return; + priv->preemptible_tcs = preemptible_tcs; enetc_mm_commit_preemptible_tcs(priv); } -- 2.25.1

2 1

[PATCH OLK-6.6] nvme-pci: fix freeing of the HMB descriptor table
by Yu Kuai 07 Jan '25

07 Jan '25

From: Christoph Hellwig <hch(a)lst.de> stable inclusion from stable-v6.6.64 commit cee3bff51a35cab1c5d842d409a7b11caefe2386 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGGM CVE: CVE-2024-56756 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3c2fb1ca8086eb139b2a551358137525ae8e0d7a ] The HMB descriptor table is sized to the maximum number of descriptors that could be used for a given device, but __nvme_alloc_host_mem could break out of the loop earlier on memory allocation failure and end up using less descriptors than planned for, which leads to an incorrect size passed to dma_free_coherent. In practice this was not showing up because the number of descriptors tends to be low and the dma coherent allocator always allocates and frees at least a page. Fixes: 87ad72a59a38 ("nvme-pci: implement host memory buffer support") Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- drivers/nvme/host/pci.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index b701969cf1c2..e0b502573b42 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -153,6 +153,7 @@ struct nvme_dev { /* host memory buffer support: */ u64 host_mem_size; u32 nr_host_mem_descs; + u32 host_mem_descs_size; dma_addr_t host_mem_descs_dma; struct nvme_host_mem_buf_desc *host_mem_descs; void **host_mem_desc_bufs; @@ -1929,10 +1930,10 @@ static void nvme_free_host_mem(struct nvme_dev *dev) kfree(dev->host_mem_desc_bufs); dev->host_mem_desc_bufs = NULL; - dma_free_coherent(dev->dev, - dev->nr_host_mem_descs * sizeof(*dev->host_mem_descs), + dma_free_coherent(dev->dev, dev->host_mem_descs_size, dev->host_mem_descs, dev->host_mem_descs_dma); dev->host_mem_descs = NULL; + dev->host_mem_descs_size = 0; dev->nr_host_mem_descs = 0; } @@ -1940,7 +1941,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, u32 chunk_size) { struct nvme_host_mem_buf_desc *descs; - u32 max_entries, len; + u32 max_entries, len, descs_size; dma_addr_t descs_dma; int i = 0; void **bufs; @@ -1953,8 +1954,9 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, if (dev->ctrl.hmmaxd && dev->ctrl.hmmaxd < max_entries) max_entries = dev->ctrl.hmmaxd; - descs = dma_alloc_coherent(dev->dev, max_entries * sizeof(*descs), - &descs_dma, GFP_KERNEL); + descs_size = max_entries * sizeof(*descs); + descs = dma_alloc_coherent(dev->dev, descs_size, &descs_dma, + GFP_KERNEL); if (!descs) goto out; @@ -1983,6 +1985,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, dev->host_mem_size = size; dev->host_mem_descs = descs; dev->host_mem_descs_dma = descs_dma; + dev->host_mem_descs_size = descs_size; dev->host_mem_desc_bufs = bufs; return 0; @@ -1997,8 +2000,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, kfree(bufs); out_free_descs: - dma_free_coherent(dev->dev, max_entries * sizeof(*descs), descs, - descs_dma); + dma_free_coherent(dev->dev, descs_size, descs, descs_dma); out: dev->host_mem_descs = NULL; return -ENOMEM; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
by Zeng Heng 07 Jan '25

07 Jan '25

From: Yongliang Gao <leonylgao(a)tencent.com> stable inclusion from stable-v6.6.64 commit dd4b1cbcc916fad5d10c2662b62def9f05e453d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGFG CVE: CVE-2024-56739 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e8ba8a2bc4f60a1065f23d6a0e7cbea945a0f40d ] If the __rtc_read_time call fails,, the struct rtc_time tm; may contain uninitialized data, or an illegal date/time read from the RTC hardware. When calling rtc_tm_to_ktime later, the result may be a very large value (possibly KTIME_MAX). If there are periodic timers in rtc->timerqueue, they will continually expire, may causing kernel softlockup. Fixes: 6610e0893b8b ("RTC: Rework RTC code to use timerqueue for events") Signed-off-by: Yongliang Gao <leonylgao(a)tencent.com> Acked-by: Jingqun Li <jingqunli(a)tencent.com> Link: https://lore.kernel.org/r/20241011043153.3788112-1-leonylgao@gmail.com Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/rtc/interface.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c index ce051f91829f..1ab619fb978a 100644 --- a/drivers/rtc/interface.c +++ b/drivers/rtc/interface.c @@ -914,13 +914,18 @@ void rtc_timer_do_work(struct work_struct *work) struct timerqueue_node *next; ktime_t now; struct rtc_time tm; + int err; struct rtc_device *rtc = container_of(work, struct rtc_device, irqwork); mutex_lock(&rtc->ops_lock); again: - __rtc_read_time(rtc, &tm); + err = __rtc_read_time(rtc, &tm); + if (err) { + mutex_unlock(&rtc->ops_lock); + return; + } now = rtc_tm_to_ktime(tm); while ((next = timerqueue_getnext(&rtc->timerqueue))) { if (next->expires > now) -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
by Zeng Heng 07 Jan '25

07 Jan '25

From: Yongliang Gao <leonylgao(a)tencent.com> stable inclusion from stable-v6.6.64 commit dd4b1cbcc916fad5d10c2662b62def9f05e453d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGFG CVE: CVE-2024-56739 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e8ba8a2bc4f60a1065f23d6a0e7cbea945a0f40d ] If the __rtc_read_time call fails,, the struct rtc_time tm; may contain uninitialized data, or an illegal date/time read from the RTC hardware. When calling rtc_tm_to_ktime later, the result may be a very large value (possibly KTIME_MAX). If there are periodic timers in rtc->timerqueue, they will continually expire, may causing kernel softlockup. Fixes: 6610e0893b8b ("RTC: Rework RTC code to use timerqueue for events") Signed-off-by: Yongliang Gao <leonylgao(a)tencent.com> Acked-by: Jingqun Li <jingqunli(a)tencent.com> Link: https://lore.kernel.org/r/20241011043153.3788112-1-leonylgao@gmail.com Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/rtc/interface.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c index 16fbcf6835f3..809ada324e4d 100644 --- a/drivers/rtc/interface.c +++ b/drivers/rtc/interface.c @@ -908,13 +908,18 @@ void rtc_timer_do_work(struct work_struct *work) struct timerqueue_node *next; ktime_t now; struct rtc_time tm; + int err; struct rtc_device *rtc = container_of(work, struct rtc_device, irqwork); mutex_lock(&rtc->ops_lock); again: - __rtc_read_time(rtc, &tm); + err = __rtc_read_time(rtc, &tm); + if (err) { + mutex_unlock(&rtc->ops_lock); + return; + } now = rtc_tm_to_ktime(tm); while ((next = timerqueue_getnext(&rtc->timerqueue))) { if (next->expires > now) -- 2.25.1

2 1

[PATCH OLK-5.10] rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
by Zeng Heng 07 Jan '25

07 Jan '25

From: Yongliang Gao <leonylgao(a)tencent.com> stable inclusion from stable-v6.6.64 commit dd4b1cbcc916fad5d10c2662b62def9f05e453d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGFG CVE: CVE-2024-56739 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e8ba8a2bc4f60a1065f23d6a0e7cbea945a0f40d ] If the __rtc_read_time call fails,, the struct rtc_time tm; may contain uninitialized data, or an illegal date/time read from the RTC hardware. When calling rtc_tm_to_ktime later, the result may be a very large value (possibly KTIME_MAX). If there are periodic timers in rtc->timerqueue, they will continually expire, may causing kernel softlockup. Fixes: 6610e0893b8b ("RTC: Rework RTC code to use timerqueue for events") Signed-off-by: Yongliang Gao <leonylgao(a)tencent.com> Acked-by: Jingqun Li <jingqunli(a)tencent.com> Link: https://lore.kernel.org/r/20241011043153.3788112-1-leonylgao@gmail.com Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/rtc/interface.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c index 16fbcf6835f3..809ada324e4d 100644 --- a/drivers/rtc/interface.c +++ b/drivers/rtc/interface.c @@ -908,13 +908,18 @@ void rtc_timer_do_work(struct work_struct *work) struct timerqueue_node *next; ktime_t now; struct rtc_time tm; + int err; struct rtc_device *rtc = container_of(work, struct rtc_device, irqwork); mutex_lock(&rtc->ops_lock); again: - __rtc_read_time(rtc, &tm); + err = __rtc_read_time(rtc, &tm); + if (err) { + mutex_unlock(&rtc->ops_lock); + return; + } now = rtc_tm_to_ktime(tm); while ((next = timerqueue_getnext(&rtc->timerqueue))) { if (next->expires > now) -- 2.25.1

2 1

[PATCH OLK-6.6] io_uring: check for overflows in io_pin_pages
by Long Li 07 Jan '25

07 Jan '25

From: Pavel Begunkov <asml.silence(a)gmail.com> mainline inclusion from mainline-v6.10-rc2 commit 0c0a4eae26ac78379d0c1db053de168a8febc6c9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFR CVE: CVE-2024-53187 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- WARNING: CPU: 0 PID: 5834 at io_uring/memmap.c:144 io_pin_pages+0x149/0x180 io_uring/memmap.c:144 CPU: 0 UID: 0 PID: 5834 Comm: syz-executor825 Not tainted 6.12.0-next-20241118-syzkaller #0 Call Trace: <TASK> __io_uaddr_map+0xfb/0x2d0 io_uring/memmap.c:183 io_rings_map io_uring/io_uring.c:2611 [inline] io_allocate_scq_urings+0x1c0/0x650 io_uring/io_uring.c:3470 io_uring_create+0x5b5/0xc00 io_uring/io_uring.c:3692 io_uring_setup io_uring/io_uring.c:3781 [inline] ... </TASK> io_pin_pages()'s uaddr parameter came directly from the user and can be garbage. Don't just add size to it as it can overflow. Cc: stable(a)vger.kernel.org Reported-by: syzbot+2159cbb522b02847c053(a)syzkaller.appspotmail.com Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Link: https://lore.kernel.org/r/1b7520ddb168e1d537d64be47414a0629d0d8f8f.17325810… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: io_uring/rsrc.c io_uring/memmap.c [Conflicts due to io_pin_pages() move to io_uring/memmap.c in mainline] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- io_uring/rsrc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index 0f9dcde72ebf..7ca3d2d2290e 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -879,7 +879,12 @@ struct page **io_pin_pages(unsigned long ubuf, unsigned long len, int *npages) struct page **pages = NULL; int pret, ret = -ENOMEM; - end = (ubuf + len + PAGE_SIZE - 1) >> PAGE_SHIFT; + if (check_add_overflow(ubuf, len, &end)) + return ERR_PTR(-EOVERFLOW); + if (check_add_overflow(end, PAGE_SIZE - 1, &end)) + return ERR_PTR(-EOVERFLOW); + + end = end >> PAGE_SHIFT; start = ubuf >> PAGE_SHIFT; nr_pages = end - start; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] NFSv4: Fix deadlock during the running of state manager
by Li Lingfeng 07 Jan '25

07 Jan '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBAFF1 -------------------------------- Unlinking file may cause the following deadlock in state manager: [root@localhost test]# cat /proc/2943/stack [<0>] rpc_wait_bit_killable+0x1a/0x90 [<0>] _nfs4_proc_delegreturn+0x60f/0x760 [<0>] nfs4_proc_delegreturn+0x13d/0x2a0 [<0>] nfs_do_return_delegation+0xba/0x110 [<0>] nfs_end_delegation_return+0x32c/0x620 [<0>] nfs_complete_unlink+0xc7/0x290 [<0>] nfs_dentry_iput+0x36/0x50 [<0>] __dentry_kill+0xaa/0x250 [<0>] dput.part.0+0x26c/0x4d0 [<0>] __put_nfs_open_context+0x1d9/0x260 [<0>] nfs4_open_reclaim+0x77/0xa0 [<0>] nfs4_do_reclaim+0x385/0xf40 [<0>] nfs4_state_manager+0x762/0x14e0 [<0>] nfs4_run_state_manager+0x181/0x330 [<0>] kthread+0x1a7/0x1f0 [<0>] ret_from_fork+0x34/0x60 [<0>] ret_from_fork_asm+0x1a/0x30 [root@localhost test]# It can be reproduced by following steps: 1) client: open file 2) client: unlink file 3) server: service restart(trigger state manager in client) 4) client: close file(in nfs4_open_reclaim, between nfs4_do_open_reclaim and put_nfs_open_context) Since the file has been open, unlinking will just set DCACHE_NFSFS_RENAMED for the dentry like this: nfs_unlink nfs_sillyrename nfs_async_unlink // set DCACHE_NFSFS_RENAMED Restarting service will trigger state manager in client. (1) NFS4_SLOT_TBL_DRAINING will be set to nfs4_slot_table since session has been reset. (2) DCACHE_NFSFS_RENAMED is detected in nfs_dentry_iput. Therefore, nfs_complete_unlink is called to trigger delegation return. (3) Due to the slot table being in draining state and sa_privileged being 0, the delegation return will be queued and wait. nfs4_state_manager nfs4_reset_session nfs4_begin_drain_session nfs4_drain_slot_tbl // set NFS4_SLOT_TBL_DRAINING (1) nfs4_do_reclaim nfs4_open_reclaim __put_nfs_open_context __dentry_kill nfs_dentry_iput // check DCACHE_NFSFS_RENAMED (2) nfs_complete_unlink nfs_end_delegation_return nfs_do_return_delegation nfs4_proc_delegreturn _nfs4_proc_delegreturn rpc_run_task ... nfs4_delegreturn_prepare nfs4_setup_sequence nfs4_slot_tbl_draining // check NFS4_SLOT_TBL_DRAINING // and sa_privileged is 0 (3) rpc_sleep_on // set queued and add to slot_tbl_waitq // rpc_task is async and wait in __rpc_execute rpc_wait_for_completion_task __rpc_wait_for_completion_task out_of_line_wait_on_bit rpc_wait_bit_killable // wait for rpc_task to complete <-------- can not get here to wake up rpc_task --------> nfs4_end_drain_session nfs4_end_drain_slot_table nfs41_wake_slot_table On the one hand, the state manager is blocked by the unfinished delegation return. As a result, nfs4_end_drain_session cannot be invoked to clear NFS4_SLOT_TBL_DRAINING and wake up waiting tasks. On the other hand, since NFS4_SLOT_TBL_DRAINING is not cleared, delegation return can only wait in the queue, resulting in a deadlock. Fix it by turning the delegation return into a privileged operation for the case where the nfs_client is in NFS4CLNT_RECLAIM_REBOOT state. Fixes: 977fcc2b0b41 ("NFS: Add a delegation return into nfs4_proc_unlink_setup()") Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/nfs4proc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index 5985f326550e..282e5559b176 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -6295,7 +6295,8 @@ static int _nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, co data->lr.roc = false; } - if (!data->inode) + if (!data->inode || + test_bit(NFS4CLNT_RECLAIM_REBOOT, &server->nfs_client->cl_state)) nfs4_init_sequence(&data->args.seq_args, &data->res.seq_res, 1, 1); else -- 2.31.1

2 1

[PATCH OLK-6.6] mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
by Zeng Heng 07 Jan '25

07 Jan '25

From: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> stable inclusion from stable-v6.6.64 commit e1ef62e8d262e3f27446d26742208c1c81e9ee18 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDOS CVE: CVE-2024-56691 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 686fb77712a4bc94b76a0c5ae74c60118b7a0d79 ] While design wise the idea of converting the driver to use the hierarchy of the IRQ chips is correct, the implementation has (inherited) flaws. This was unveiled when platform_get_irq() had started WARN() on IRQ 0 that is supposed to be a Linux IRQ number (also known as vIRQ). Rework the driver to respect IRQ domain when creating each MFD device separately, as the domain is not the same for all of them. Fixes: 9c6235c86332 ("mfd: intel_soc_pmic_bxtwc: Add bxt_wcove_usbc device") Fixes: d2061f9cc32d ("usb: typec: add driver for Intel Whiskey Cove PMIC USB Type-C PHY") Fixes: 57129044f504 ("mfd: intel_soc_pmic_bxtwc: Use chained IRQs for second level IRQ chips") Reported-by: Zhang Ning <zhangn1985(a)outlook.com> Closes: https://lore.kernel.org/r/TY2PR01MB3322FEDCDC048B7D3794F922CDBA2@TY2PR01MB3… Tested-by: Zhang Ning <zhangn1985(a)outlook.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Acked-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Link: https://lore.kernel.org/r/20241005193029.1929139-2-andriy.shevchenko@linux.… Signed-off-by: Lee Jones <lee(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/mfd/intel_soc_pmic_bxtwc.c | 57 +++++++++++++++++++++--------- drivers/usb/typec/tcpm/wcove.c | 4 --- 2 files changed, 40 insertions(+), 21 deletions(-) diff --git a/drivers/mfd/intel_soc_pmic_bxtwc.c b/drivers/mfd/intel_soc_pmic_bxtwc.c index 8dac0d41f64f..6ea98321bbf2 100644 --- a/drivers/mfd/intel_soc_pmic_bxtwc.c +++ b/drivers/mfd/intel_soc_pmic_bxtwc.c @@ -241,16 +241,6 @@ static struct mfd_cell bxt_wc_dev[] = { .num_resources = ARRAY_SIZE(thermal_resources), .resources = thermal_resources, }, - { - .name = "bxt_wcove_usbc", - .num_resources = ARRAY_SIZE(usbc_resources), - .resources = usbc_resources, - }, - { - .name = "bxt_wcove_ext_charger", - .num_resources = ARRAY_SIZE(charger_resources), - .resources = charger_resources, - }, { .name = "bxt_wcove_bcu", .num_resources = ARRAY_SIZE(bcu_resources), @@ -272,6 +262,19 @@ static struct mfd_cell bxt_wc_dev[] = { }, }; +static struct mfd_cell bxt_wc_chgr_dev[] = { + { + .name = "bxt_wcove_usbc", + .num_resources = ARRAY_SIZE(usbc_resources), + .resources = usbc_resources, + }, + { + .name = "bxt_wcove_ext_charger", + .num_resources = ARRAY_SIZE(charger_resources), + .resources = charger_resources, + }, +}; + static int regmap_ipc_byte_reg_read(void *context, unsigned int reg, unsigned int *val) { @@ -426,6 +429,26 @@ static int bxtwc_add_chained_irq_chip(struct intel_soc_pmic *pmic, 0, chip, data); } +static int bxtwc_add_chained_devices(struct intel_soc_pmic *pmic, + const struct mfd_cell *cells, int n_devs, + struct regmap_irq_chip_data *pdata, + int pirq, int irq_flags, + const struct regmap_irq_chip *chip, + struct regmap_irq_chip_data **data) +{ + struct device *dev = pmic->dev; + struct irq_domain *domain; + int ret; + + ret = bxtwc_add_chained_irq_chip(pmic, pdata, pirq, irq_flags, chip, data); + if (ret) + return dev_err_probe(dev, ret, "Failed to add %s IRQ chip\n", chip->name); + + domain = regmap_irq_get_domain(*data); + + return devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE, cells, n_devs, NULL, 0, domain); +} + static int bxtwc_probe(struct platform_device *pdev) { struct device *dev = &pdev->dev; @@ -501,14 +524,14 @@ static int bxtwc_probe(struct platform_device *pdev) if (ret) return dev_err_probe(dev, ret, "Failed to add ADC IRQ chip\n"); - /* Add chained IRQ handler for CHGR IRQs */ - ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, - BXTWC_CHGR_LVL1_IRQ, - IRQF_ONESHOT, - &bxtwc_regmap_irq_chip_chgr, - &pmic->irq_chip_data_chgr); + ret = bxtwc_add_chained_devices(pmic, bxt_wc_chgr_dev, ARRAY_SIZE(bxt_wc_chgr_dev), + pmic->irq_chip_data, + BXTWC_CHGR_LVL1_IRQ, + IRQF_ONESHOT, + &bxtwc_regmap_irq_chip_chgr, + &pmic->irq_chip_data_chgr); if (ret) - return dev_err_probe(dev, ret, "Failed to add CHGR IRQ chip\n"); + return ret; /* Add chained IRQ handler for CRIT IRQs */ ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, diff --git a/drivers/usb/typec/tcpm/wcove.c b/drivers/usb/typec/tcpm/wcove.c index 87d4abde0ea2..e08244f555f0 100644 --- a/drivers/usb/typec/tcpm/wcove.c +++ b/drivers/usb/typec/tcpm/wcove.c @@ -621,10 +621,6 @@ static int wcove_typec_probe(struct platform_device *pdev) if (irq < 0) return irq; - irq = regmap_irq_get_virq(pmic->irq_chip_data_chgr, irq); - if (irq < 0) - return irq; - ret = guid_parse(WCOVE_DSM_UUID, &wcove->guid); if (ret) return ret; -- 2.25.1

2 1