- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/5] arm64: Add support for FEAT_{LS64, LS64_V}
by Yushan Wang 15 Apr '25

15 Apr '25

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IC1F41 ---------------------------------------------------------------------- arm64: Add support for FEAT_{LS64, LS64_V} Yicong Yang (5): arm64: Provide basic EL2 setup for FEAT_{LS64, LS64_V} usage at EL0/1 arm64: Add support for FEAT_{LS64, LS64_V} kselftest/arm64: Add HWCAP test for FEAT_{LS64, LS64_V} arm64: Add ESR.DFSC definition of unsupported exclusive or atomic access KVM: arm64: Handle DABT caused by LS64* instructions on unsupported memory Documentation/arch/arm64/booting.rst | 12 +++ Documentation/arch/arm64/elf_hwcaps.rst | 6 ++ arch/arm64/include/asm/el2_setup.h | 11 +++ arch/arm64/include/asm/esr.h | 8 ++ arch/arm64/include/asm/hwcap.h | 3 + arch/arm64/include/asm/kvm_emulate.h | 1 + arch/arm64/include/uapi/asm/hwcap.h | 6 ++ arch/arm64/kernel/cpufeature.c | 51 +++++++++++++ arch/arm64/kernel/cpuinfo.c | 2 + arch/arm64/kvm/inject_fault.c | 35 +++++++++ arch/arm64/kvm/mmu.c | 22 +++++- arch/arm64/tools/cpucaps | 4 +- tools/testing/selftests/arm64/abi/hwcap.c | 90 +++++++++++++++++++++++ 13 files changed, 248 insertions(+), 3 deletions(-) -- 2.33.0

2 6

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 75a881466e41d16638b3e857fdb7107a4b9173b5
by kernel test robot 15 Apr '25

15 Apr '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 75a881466e41d16638b3e857fdb7107a4b9173b5 !15843 tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503271858.j6vJ9Bhc-lkp@intel.com https://lore.kernel.org/oe-kbuild/202504081102.ziLuPC5Y-lkp@intel.com arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x162: unsupported intra-function call arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1a2: unsupported intra-function call arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1c2: unsupported intra-function call arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1d2: unsupported intra-function call arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1e1: unsupported intra-function call arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1e2: unsupported intra-function call arch/x86/entry/entry_64.o: warning: objtool: If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE. crypto/proc.o: warning: objtool: missing symbol for section .exit.text drivers/gpu/drm/ttm/ttm_object.c:60: error: Cannot parse struct or union! drivers/pinctrl/core.c:1338: error: Cannot parse struct or union! include/linux/filter.h:332:4: warning: cast between incompatible function types from 'int (* const)(struct bpf_map *, void *)' to 'u64 (*)(u64, u64, u64, u64, u64)' {aka 'long long unsigned int (*)(long long unsigned int, long long unsigned int, long long unsigned int, long long unsigned int, long long unsigned int)'} [-Wcast-function-type] include/linux/filter.h:332:4: warning: cast between incompatible function types from 'int (* const)(struct bpf_map *, void *, void *, u64)' {aka 'int (* const)(struct bpf_map *, void *, void *, long long unsigned int)'} to 'u64 (*)(u64, u64, u64, u64, u64)' {aka 'long long unsigned int (*)(long long unsigned int, long long unsigned int, long long unsigned int, long long unsigned int, long long unsigned int)'} [-Wcast-function-type] include/linux/filter.h:332:4: warning: cast between incompatible function types from 'void * (* const)(struct bpf_map *, void *)' to 'u64 (*)(u64, u64, u64, u64, u64)' {aka 'long long unsigned int (*)(long long unsigned int, long long unsigned int, long long unsigned int, long long unsigned int, long long unsigned int)'} [-Wcast-function-type] init/Kconfig:34: syntax error kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace' mm/page_ext.o: warning: objtool: missing symbol for section .meminit.text Unverified Error/Warning (likely false positive, kindly check if interested): 789 | eprintk("kgdbts: ERROR: beyond end of test on" 795 | eprintk("kgdbts: ERROR: put buffer overflow on" ./samples/mic/mpssd/mpssd.c: 40 linux/version.h not needed. block/blk-throttle.c:2377:1-7: preceding lock on line 2269 drivers/base/regmap/regmap.o: warning: objtool: regmap_raw_read() falls through to next function _regmap_raw_read() drivers/gpu/drm/i915/i915_gem.o: warning: objtool: i915_gem_fault() falls through to next function i915_gem_object_ggtt_pin() drivers/gpu/drm/i915/intel_display.o: warning: objtool: _intel_compute_tile_offset() falls through to next function skl_format_to_fourcc() drivers/gpu/drm/i915/intel_display.o: warning: objtool: skl_plane_stride() falls through to next function skl_plane_ctl() drivers/gpu/drm/i915/vlv_dsi_pll.o: warning: objtool: bxt_dsi_pll_enable() falls through to next function bxt_dsi_reset_clocks() drivers/net/ethernet/intel/e1000/e1000_main.o: warning: objtool: e1000_watchdog() falls through to next function e1000_82547_tx_fifo_stall_task() mm/kasan/kasan_init.c:220: warning: Function parameter or member 'shadow_end' not described in 'kasan_populate_zero_shadow' mm/kasan/kasan_init.c:220: warning: Function parameter or member 'shadow_start' not described in 'kasan_populate_zero_shadow' Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow | `-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow |-- arm64-randconfig-001-20250414 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- eprintk(-kgdbts:ERROR:beyond-end-of-test-on | `-- eprintk(-kgdbts:ERROR:put-buffer-overflow-on |-- arm64-randconfig-002-20250414 | `-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- arm64-randconfig-003-20250414 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-lo | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-void-u64)-aka-int-(-const)(struct-bpf_map-void-void-long-long-unsigned-int)-to-u64-(-)(u64 | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-void-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-l | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow | `-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow |-- arm64-randconfig-004-20250414 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-053-20250415 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-054-20250415 | `-- init-Kconfig:syntax-error |-- x86_64-allnoconfig | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration | `-- samples-mic-mpssd-mpssd.c:linux-version.h-not-needed. |-- x86_64-allyesconfig | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow | `-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type |-- x86_64-buildonly-randconfig-001-20250414 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20250414 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-003-20250414 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20250414 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow | `-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow |-- x86_64-buildonly-randconfig-005-20250414 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20250414 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- crypto-proc.o:warning:objtool:missing-symbol-for-section-.exit.text | `-- mm-page_ext.o:warning:objtool:missing-symbol-for-section-.meminit.text |-- x86_64-defconfig | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | `-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized-in-this-function |-- x86_64-randconfig-101-20250415 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-102-20250415 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow | `-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow |-- x86_64-randconfig-103-20250415 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- block-blk-throttle.c:preceding-lock-on-line | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow | `-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow |-- x86_64-randconfig-104-20250415 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-i915-i915_gem.o:warning:objtool:i915_gem_fault-falls-through-to-next-function-i915_gem_object_ggtt_pin() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:_intel_compute_tile_offset-falls-through-to-next-function-skl_format_to_fourcc() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:skl_plane_stride-falls-through-to-next-function-skl_plane_ctl() | |-- drivers-gpu-drm-i915-vlv_dsi_pll.o:warning:objtool:bxt_dsi_pll_enable-falls-through-to-next-function-bxt_dsi_reset_clocks() | |-- drivers-gpu-drm-radeon-evergreen_cs.o:warning:objtool:evergreen_surface_check-falls-through-to-next-function-evergreen_cs_track_validate_htile() | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow | `-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow |-- x86_64-randconfig-121-20250415 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-radeon-evergreen_cs.o:warning:objtool:evergreen_surface_check-falls-through-to-next-function-evergreen_cs_track_validate_htile() | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-md-raid5.o:warning:objtool:raid5_compute_sector-falls-through-to-next-function-raid5_compute_blocknr() | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-122-20250415 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- block-blk-cgroup.c:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-123-20250415 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-md-raid5.o:warning:objtool:raid5_compute_sector-falls-through-to-next-function-raid5_compute_blocknr() | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration `-- x86_64-randconfig-161-20250415 |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration elapsed time: 1459m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250414 gcc-14.2.0 arm64 randconfig-002-20250414 gcc-14.2.0 arm64 randconfig-003-20250414 gcc-8.5.0 arm64 randconfig-004-20250414 gcc-6.5.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250414 clang-20 x86_64 buildonly-randconfig-002-20250414 clang-20 x86_64 buildonly-randconfig-003-20250414 clang-20 x86_64 buildonly-randconfig-004-20250414 clang-20 x86_64 buildonly-randconfig-005-20250414 clang-20 x86_64 buildonly-randconfig-006-20250414 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 v2 0/2] CVE-2024-57795
by Liu Jian 15 Apr '25

15 Apr '25

CVE-2024-57795 Zhu Yanjun (2): RDMA/rxe: Remove the direct link to net_device RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests drivers/infiniband/sw/rxe/rxe.c | 22 ++++++++++++---------- drivers/infiniband/sw/rxe/rxe.h | 3 ++- drivers/infiniband/sw/rxe/rxe_mcast.c | 22 ++++++++++++++++++++-- drivers/infiniband/sw/rxe/rxe_net.c | 25 ++++++++++++++++++++----- drivers/infiniband/sw/rxe/rxe_verbs.c | 26 +++++++++++++++++++++----- drivers/infiniband/sw/rxe/rxe_verbs.h | 11 ++++++++--- 6 files changed, 83 insertions(+), 26 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] PCI: AER: fix deadlock in do_recovery
by Qi Xi 15 Apr '25

15 Apr '25

From: Govindarajulu Varadarajan <gvaradar(a)cisco.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC1ERL -------------------------------- CPU0 CPU1 --------------------------------------------------------------------- __driver_attach() device_lock(&dev->mutex) <--- device mutex lock here driver_probe_device() pci_enable_sriov() pci_iov_add_virtfn() pci_device_add() aer_isr() <--- pci aer error do_recovery() broadcast_error_message() pci_walk_bus() down_read(&pci_bus_sem) <--- rd sem down_write(&pci_bus_sem) <-- stuck on wr sem report_error_detected() device_lock(&dev->mutex)<--- DEAD LOCK This can also happen when aer error occurs while pci_dev->sriov_config() is called. This patch does a pci_bus_walk and adds all the devices to a list. After unlocking (up_read) &pci_bus_sem, we go through the list and call err_handler of the devices with devic_lock() held. This way, we dont try to hold both locks at same time. v2: * Drop patch 1, 2 & 4. * Instead of locking 50+ devices, do get_device() and add them to a list. After unlocking &pci_bus_sem, go through the list call err_handler. v1: * Previous discussion here: https://lkml.org/lkml/2017/9/27/720 [ 70.984091] pcieport 0000:00:02.0: AER: Uncorrected (Non-Fatal) error received: id=0010 [ 70.984112] pcieport 0000:00:02.0: PCIe Bus Error: severity=Uncorrected (Non-Fatal), type=Transaction Layer, id=0010(Requester ID) [ 70.984116] pcieport 0000:00:02.0: device [8086:3c04] error status/mask=00004000/00100000 [ 70.984120] pcieport 0000:00:02.0: [14] Completion Timeout (First) ... [ 107.484190] INFO: task kworker/0:1:76 blocked for more than 30 seconds. [ 107.563619] Not tainted 4.13.0+ #28 [ 107.611618] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 107.705368] kworker/0:1 D 0 76 2 0x80000000 [ 107.771050] Workqueue: events aer_isr [ 107.814895] Call Trace: [ 107.844181] __schedule+0x312/0xa40 [ 107.885928] schedule+0x3d/0x90 [ 107.923506] schedule_preempt_disabled+0x15/0x20 [ 107.978773] __mutex_lock+0x304/0xa30 [ 108.022594] ? dev_printk_emit+0x3b/0x50 [ 108.069534] ? report_error_detected+0xa6/0x210 [ 108.123770] mutex_lock_nested+0x1b/0x20 [ 108.170713] ? mutex_lock_nested+0x1b/0x20 [ 108.219730] report_error_detected+0xa6/0x210 [ 108.271881] ? aer_recover_queue+0xe0/0xe0 [ 108.320904] pci_walk_bus+0x46/0x90 [ 108.362645] ? aer_recover_queue+0xe0/0xe0 [ 108.411658] broadcast_error_message+0xc3/0xf0 [ 108.464835] do_recovery+0x34/0x220 [ 108.506569] ? get_device_error_info+0x92/0x130 [ 108.560785] aer_isr+0x28f/0x3b0 [ 108.599410] process_one_work+0x277/0x6c0 [ 108.647399] worker_thread+0x4d/0x3b0 [ 108.691218] kthread+0x171/0x190 [ 108.729830] ? process_one_work+0x6c0/0x6c0 [ 108.779888] ? kthread_create_on_node+0x40/0x40 [ 108.834110] ret_from_fork+0x2a/0x40 [ 108.876916] INFO: task kworker/0:2:205 blocked for more than 30 seconds. [ 108.957129] Not tainted 4.13.0+ #28 [ 109.005114] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 109.098873] kworker/0:2 D 0 205 2 0x80000000 [ 109.164544] Workqueue: events work_for_cpu_fn [ 109.216681] Call Trace: [ 109.245943] __schedule+0x312/0xa40 [ 109.287687] ? rwsem_down_write_failed+0x308/0x4f0 [ 109.345021] schedule+0x3d/0x90 [ 109.382603] rwsem_down_write_failed+0x30d/0x4f0 [ 109.437869] ? __lock_acquire+0x75c/0x1410 [ 109.486910] call_rwsem_down_write_failed+0x17/0x30 [ 109.545287] ? call_rwsem_down_write_failed+0x17/0x30 [ 109.605752] down_write+0x88/0xb0 [ 109.645410] pci_device_add+0x158/0x240 [ 109.691313] pci_iov_add_virtfn+0x24f/0x340 [ 109.741375] pci_enable_sriov+0x32b/0x420 [ 109.789466] ? pci_read+0x2c/0x30 [ 109.829142] enic_probe+0x5d4/0xff0 [enic] [ 109.878184] ? trace_hardirqs_on+0xd/0x10 [ 109.926180] local_pci_probe+0x42/0xa0 [ 109.971037] work_for_cpu_fn+0x14/0x20 [ 110.015898] process_one_work+0x277/0x6c0 [ 110.063884] worker_thread+0x1d6/0x3b0 [ 110.108750] kthread+0x171/0x190 [ 110.147363] ? process_one_work+0x6c0/0x6c0 [ 110.197426] ? kthread_create_on_node+0x40/0x40 [ 110.251642] ret_from_fork+0x2a/0x40 [ 110.294448] INFO: task systemd-udevd:492 blocked for more than 30 seconds. [ 110.376742] Not tainted 4.13.0+ #28 [ 110.424715] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 110.518457] systemd-udevd D 0 492 444 0x80000180 [ 110.584116] Call Trace: [ 110.613382] __schedule+0x312/0xa40 [ 110.655127] ? wait_for_completion+0x14a/0x1d0 [ 110.708302] schedule+0x3d/0x90 [ 110.745875] schedule_timeout+0x26e/0x5b0 [ 110.793887] ? wait_for_completion+0x14a/0x1d0 [ 110.847068] wait_for_completion+0x169/0x1d0 [ 110.898165] ? wait_for_completion+0x169/0x1d0 [ 110.951354] ? wake_up_q+0x80/0x80 [ 110.992060] flush_work+0x237/0x300 [ 111.033795] ? flush_workqueue_prep_pwqs+0x1b0/0x1b0 [ 111.093224] ? wait_for_completion+0x5a/0x1d0 [ 111.145363] ? flush_work+0x237/0x300 [ 111.189189] work_on_cpu+0x94/0xb0 [ 111.229894] ? work_is_static_object+0x20/0x20 [ 111.283070] ? pci_device_shutdown+0x60/0x60 [ 111.334173] pci_device_probe+0x17a/0x190 [ 111.382163] driver_probe_device+0x2ff/0x450 [ 111.433260] __driver_attach+0x103/0x140 [ 111.480195] ? driver_probe_device+0x450/0x450 [ 111.533381] bus_for_each_dev+0x74/0xb0 [ 111.579276] driver_attach+0x1e/0x20 [ 111.622056] bus_add_driver+0x1ca/0x270 [ 111.667955] ? 0xffffffffc039c000 [ 111.707616] driver_register+0x60/0xe0 [ 111.752472] ? 0xffffffffc039c000 [ 111.792126] __pci_register_driver+0x6b/0x70 [ 111.843275] enic_init_module+0x38/0x1000 [enic] [ 111.898533] do_one_initcall+0x50/0x192 [ 111.944428] ? trace_hardirqs_on+0xd/0x10 [ 111.992408] do_init_module+0x5f/0x1f2 [ 112.037274] load_module+0x1740/0x1f70 [ 112.082148] SYSC_finit_module+0xd7/0xf0 [ 112.129083] ? SYSC_finit_module+0xd7/0xf0 [ 112.178106] SyS_finit_module+0xe/0x10 [ 112.222972] do_syscall_64+0x69/0x180 [ 112.266793] entry_SYSCALL64_slow_path+0x25/0x25 [ 112.322047] RIP: 0033:0x7f3da098b559 [ 112.364826] RSP: 002b:00007ffeb3306a38 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 112.455447] RAX: ffffffffffffffda RBX: 0000557fe41ed3d0 RCX: 00007f3da098b559 [ 112.540860] RDX: 0000000000000000 RSI: 00007f3da14c79c5 RDI: 0000000000000006 [ 112.626281] RBP: 00007f3da14c79c5 R08: 0000000000000000 R09: 00007ffeb3306b50 [ 112.711698] R10: 0000000000000006 R11: 0000000000000246 R12: 0000000000000000 [ 112.797114] R13: 0000557fe420e210 R14: 0000000000020000 R15: 0000557fe2c1ef4a [ 112.882568] Showing all locks held in the system: [ 112.956545] 5 locks held by kworker/0:1/76: [ 113.006616] #0: ("events"){+.+.}, at: [<ffffffffb00b10ed>] process_one_work+0x1ed/0x6c0 [ 113.104535] #1: ((&rpc->dpc_handler)){+.+.}, at: [<ffffffffb00b10ed>] process_one_work+0x1ed/0x6c0 [ 113.213894] #2: (&rpc->rpc_mutex){+.+.}, at: [<ffffffffb0505ca2>] aer_isr+0x32/0x3b0 [ 113.308711] #3: (pci_bus_sem){++++}, at: [<ffffffffb04ea18a>] pci_walk_bus+0x2a/0x90 [ 113.403501] #4: (&dev->mutex){....}, at: [<ffffffffb0505706>] report_error_detected+0xa6/0x210 [ 113.508715] 3 locks held by kworker/0:2/205: [ 113.559808] #0: ("events"){+.+.}, at: [<ffffffffb00b10ed>] process_one_work+0x1ed/0x6c0 [ 113.657718] #1: ((&wfc.work)){+.+.}, at: [<ffffffffb00b10ed>] process_one_work+0x1ed/0x6c0 [ 113.758745] #2: (pci_bus_sem){++++}, at: [<ffffffffb04ec978>] pci_device_add+0x158/0x240 [ 113.857710] 1 lock held by khungtaskd/239: [ 113.906729] #0: (tasklist_lock){.+.+}, at: [<ffffffffb00f07dd>] debug_show_all_locks+0x3d/0x1a0 [ 114.012972] 2 locks held by systemd-udevd/492: [ 114.066148] #0: (&dev->mutex){....}, at: [<ffffffffb06254d5>] __driver_attach+0x55/0x140 [ 114.165107] #1: (&dev->mutex){....}, at: [<ffffffffb06254f2>] __driver_attach+0x72/0x140 [ 114.281879] ============================================= Signed-off-by: Govindarajulu Varadarajan <gvaradar(a)cisco.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/pci/pcie/err.c | 48 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 47 insertions(+), 1 deletion(-) diff --git a/drivers/pci/pcie/err.c b/drivers/pci/pcie/err.c index 705893b5f7b0..1080181c78b7 100644 --- a/drivers/pci/pcie/err.c +++ b/drivers/pci/pcie/err.c @@ -171,6 +171,52 @@ static int report_resume(struct pci_dev *dev, void *data) return 0; } +struct aer_device_list { + struct device *dev; + struct hlist_node node; +}; + +static int aer_get_pci_dev(struct pci_dev *pdev, void *data) +{ + struct hlist_head *hhead = (struct hlist_head *)data; + struct device *dev = &pdev->dev; + struct aer_device_list *entry; + + entry = kmalloc(sizeof(*entry), GFP_KERNEL); + if (!entry) + /* continue with other devices, lets not return error */ + return 0; + + entry->dev = get_device(dev); + hlist_add_head(&entry->node, hhead); + + return 0; +} + +static void aer_pci_walk_bus(struct pci_bus *top, + int (*cb)(struct pci_dev *, void *), + void *result) +{ + HLIST_HEAD(dev_hlist); + struct hlist_node *tmp; + struct aer_device_list *entry; + + pci_walk_bus(top, aer_get_pci_dev, &dev_hlist); + hlist_for_each_entry_safe(entry, tmp, &dev_hlist, node) { + struct pci_dev *pdev = container_of(entry->dev, struct pci_dev, + dev); + int err; + + err = cb(pdev, result); + if (err) + dev_err(entry->dev, "AER: recovery handler failed: %d", + err); + put_device(entry->dev); + hlist_del(&entry->node); + kfree(entry); + } +} + /** * pci_walk_bridge - walk bridges potentially AER affected * @bridge: bridge which may be a Port, an RCEC, or an RCiEP @@ -189,7 +235,7 @@ static void pci_walk_bridge(struct pci_dev *bridge, void *userdata) { if (bridge->subordinate) - pci_walk_bus(bridge->subordinate, cb, userdata); + aer_pci_walk_bus(bridge->subordinate, cb, userdata); else cb(bridge, userdata); } -- 2.33.0

2 1

[PATCH] PCI: AER: fix deadlock in do_recovery
by Qi Xi 15 Apr '25

15 Apr '25

From: Govindarajulu Varadarajan <gvaradar(a)cisco.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC1ERL -------------------------------- CPU0 CPU1 --------------------------------------------------------------------- __driver_attach() device_lock(&dev->mutex) <--- device mutex lock here driver_probe_device() pci_enable_sriov() pci_iov_add_virtfn() pci_device_add() aer_isr() <--- pci aer error do_recovery() broadcast_error_message() pci_walk_bus() down_read(&pci_bus_sem) <--- rd sem down_write(&pci_bus_sem) <-- stuck on wr sem report_error_detected() device_lock(&dev->mutex)<--- DEAD LOCK This can also happen when aer error occurs while pci_dev->sriov_config() is called. This patch does a pci_bus_walk and adds all the devices to a list. After unlocking (up_read) &pci_bus_sem, we go through the list and call err_handler of the devices with devic_lock() held. This way, we dont try to hold both locks at same time. v2: * Drop patch 1, 2 & 4. * Instead of locking 50+ devices, do get_device() and add them to a list. After unlocking &pci_bus_sem, go through the list call err_handler. v1: * Previous discussion here: https://lkml.org/lkml/2017/9/27/720 [ 70.984091] pcieport 0000:00:02.0: AER: Uncorrected (Non-Fatal) error received: id=0010 [ 70.984112] pcieport 0000:00:02.0: PCIe Bus Error: severity=Uncorrected (Non-Fatal), type=Transaction Layer, id=0010(Requester ID) [ 70.984116] pcieport 0000:00:02.0: device [8086:3c04] error status/mask=00004000/00100000 [ 70.984120] pcieport 0000:00:02.0: [14] Completion Timeout (First) ... [ 107.484190] INFO: task kworker/0:1:76 blocked for more than 30 seconds. [ 107.563619] Not tainted 4.13.0+ #28 [ 107.611618] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 107.705368] kworker/0:1 D 0 76 2 0x80000000 [ 107.771050] Workqueue: events aer_isr [ 107.814895] Call Trace: [ 107.844181] __schedule+0x312/0xa40 [ 107.885928] schedule+0x3d/0x90 [ 107.923506] schedule_preempt_disabled+0x15/0x20 [ 107.978773] __mutex_lock+0x304/0xa30 [ 108.022594] ? dev_printk_emit+0x3b/0x50 [ 108.069534] ? report_error_detected+0xa6/0x210 [ 108.123770] mutex_lock_nested+0x1b/0x20 [ 108.170713] ? mutex_lock_nested+0x1b/0x20 [ 108.219730] report_error_detected+0xa6/0x210 [ 108.271881] ? aer_recover_queue+0xe0/0xe0 [ 108.320904] pci_walk_bus+0x46/0x90 [ 108.362645] ? aer_recover_queue+0xe0/0xe0 [ 108.411658] broadcast_error_message+0xc3/0xf0 [ 108.464835] do_recovery+0x34/0x220 [ 108.506569] ? get_device_error_info+0x92/0x130 [ 108.560785] aer_isr+0x28f/0x3b0 [ 108.599410] process_one_work+0x277/0x6c0 [ 108.647399] worker_thread+0x4d/0x3b0 [ 108.691218] kthread+0x171/0x190 [ 108.729830] ? process_one_work+0x6c0/0x6c0 [ 108.779888] ? kthread_create_on_node+0x40/0x40 [ 108.834110] ret_from_fork+0x2a/0x40 [ 108.876916] INFO: task kworker/0:2:205 blocked for more than 30 seconds. [ 108.957129] Not tainted 4.13.0+ #28 [ 109.005114] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 109.098873] kworker/0:2 D 0 205 2 0x80000000 [ 109.164544] Workqueue: events work_for_cpu_fn [ 109.216681] Call Trace: [ 109.245943] __schedule+0x312/0xa40 [ 109.287687] ? rwsem_down_write_failed+0x308/0x4f0 [ 109.345021] schedule+0x3d/0x90 [ 109.382603] rwsem_down_write_failed+0x30d/0x4f0 [ 109.437869] ? __lock_acquire+0x75c/0x1410 [ 109.486910] call_rwsem_down_write_failed+0x17/0x30 [ 109.545287] ? call_rwsem_down_write_failed+0x17/0x30 [ 109.605752] down_write+0x88/0xb0 [ 109.645410] pci_device_add+0x158/0x240 [ 109.691313] pci_iov_add_virtfn+0x24f/0x340 [ 109.741375] pci_enable_sriov+0x32b/0x420 [ 109.789466] ? pci_read+0x2c/0x30 [ 109.829142] enic_probe+0x5d4/0xff0 [enic] [ 109.878184] ? trace_hardirqs_on+0xd/0x10 [ 109.926180] local_pci_probe+0x42/0xa0 [ 109.971037] work_for_cpu_fn+0x14/0x20 [ 110.015898] process_one_work+0x277/0x6c0 [ 110.063884] worker_thread+0x1d6/0x3b0 [ 110.108750] kthread+0x171/0x190 [ 110.147363] ? process_one_work+0x6c0/0x6c0 [ 110.197426] ? kthread_create_on_node+0x40/0x40 [ 110.251642] ret_from_fork+0x2a/0x40 [ 110.294448] INFO: task systemd-udevd:492 blocked for more than 30 seconds. [ 110.376742] Not tainted 4.13.0+ #28 [ 110.424715] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 110.518457] systemd-udevd D 0 492 444 0x80000180 [ 110.584116] Call Trace: [ 110.613382] __schedule+0x312/0xa40 [ 110.655127] ? wait_for_completion+0x14a/0x1d0 [ 110.708302] schedule+0x3d/0x90 [ 110.745875] schedule_timeout+0x26e/0x5b0 [ 110.793887] ? wait_for_completion+0x14a/0x1d0 [ 110.847068] wait_for_completion+0x169/0x1d0 [ 110.898165] ? wait_for_completion+0x169/0x1d0 [ 110.951354] ? wake_up_q+0x80/0x80 [ 110.992060] flush_work+0x237/0x300 [ 111.033795] ? flush_workqueue_prep_pwqs+0x1b0/0x1b0 [ 111.093224] ? wait_for_completion+0x5a/0x1d0 [ 111.145363] ? flush_work+0x237/0x300 [ 111.189189] work_on_cpu+0x94/0xb0 [ 111.229894] ? work_is_static_object+0x20/0x20 [ 111.283070] ? pci_device_shutdown+0x60/0x60 [ 111.334173] pci_device_probe+0x17a/0x190 [ 111.382163] driver_probe_device+0x2ff/0x450 [ 111.433260] __driver_attach+0x103/0x140 [ 111.480195] ? driver_probe_device+0x450/0x450 [ 111.533381] bus_for_each_dev+0x74/0xb0 [ 111.579276] driver_attach+0x1e/0x20 [ 111.622056] bus_add_driver+0x1ca/0x270 [ 111.667955] ? 0xffffffffc039c000 [ 111.707616] driver_register+0x60/0xe0 [ 111.752472] ? 0xffffffffc039c000 [ 111.792126] __pci_register_driver+0x6b/0x70 [ 111.843275] enic_init_module+0x38/0x1000 [enic] [ 111.898533] do_one_initcall+0x50/0x192 [ 111.944428] ? trace_hardirqs_on+0xd/0x10 [ 111.992408] do_init_module+0x5f/0x1f2 [ 112.037274] load_module+0x1740/0x1f70 [ 112.082148] SYSC_finit_module+0xd7/0xf0 [ 112.129083] ? SYSC_finit_module+0xd7/0xf0 [ 112.178106] SyS_finit_module+0xe/0x10 [ 112.222972] do_syscall_64+0x69/0x180 [ 112.266793] entry_SYSCALL64_slow_path+0x25/0x25 [ 112.322047] RIP: 0033:0x7f3da098b559 [ 112.364826] RSP: 002b:00007ffeb3306a38 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 112.455447] RAX: ffffffffffffffda RBX: 0000557fe41ed3d0 RCX: 00007f3da098b559 [ 112.540860] RDX: 0000000000000000 RSI: 00007f3da14c79c5 RDI: 0000000000000006 [ 112.626281] RBP: 00007f3da14c79c5 R08: 0000000000000000 R09: 00007ffeb3306b50 [ 112.711698] R10: 0000000000000006 R11: 0000000000000246 R12: 0000000000000000 [ 112.797114] R13: 0000557fe420e210 R14: 0000000000020000 R15: 0000557fe2c1ef4a [ 112.882568] Showing all locks held in the system: [ 112.956545] 5 locks held by kworker/0:1/76: [ 113.006616] #0: ("events"){+.+.}, at: [<ffffffffb00b10ed>] process_one_work+0x1ed/0x6c0 [ 113.104535] #1: ((&rpc->dpc_handler)){+.+.}, at: [<ffffffffb00b10ed>] process_one_work+0x1ed/0x6c0 [ 113.213894] #2: (&rpc->rpc_mutex){+.+.}, at: [<ffffffffb0505ca2>] aer_isr+0x32/0x3b0 [ 113.308711] #3: (pci_bus_sem){++++}, at: [<ffffffffb04ea18a>] pci_walk_bus+0x2a/0x90 [ 113.403501] #4: (&dev->mutex){....}, at: [<ffffffffb0505706>] report_error_detected+0xa6/0x210 [ 113.508715] 3 locks held by kworker/0:2/205: [ 113.559808] #0: ("events"){+.+.}, at: [<ffffffffb00b10ed>] process_one_work+0x1ed/0x6c0 [ 113.657718] #1: ((&wfc.work)){+.+.}, at: [<ffffffffb00b10ed>] process_one_work+0x1ed/0x6c0 [ 113.758745] #2: (pci_bus_sem){++++}, at: [<ffffffffb04ec978>] pci_device_add+0x158/0x240 [ 113.857710] 1 lock held by khungtaskd/239: [ 113.906729] #0: (tasklist_lock){.+.+}, at: [<ffffffffb00f07dd>] debug_show_all_locks+0x3d/0x1a0 [ 114.012972] 2 locks held by systemd-udevd/492: [ 114.066148] #0: (&dev->mutex){....}, at: [<ffffffffb06254d5>] __driver_attach+0x55/0x140 [ 114.165107] #1: (&dev->mutex){....}, at: [<ffffffffb06254f2>] __driver_attach+0x72/0x140 [ 114.281879] ============================================= Signed-off-by: Govindarajulu Varadarajan <gvaradar(a)cisco.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/pci/pcie/err.c | 48 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 47 insertions(+), 1 deletion(-) diff --git a/drivers/pci/pcie/err.c b/drivers/pci/pcie/err.c index 705893b5f7b0..1080181c78b7 100644 --- a/drivers/pci/pcie/err.c +++ b/drivers/pci/pcie/err.c @@ -171,6 +171,52 @@ static int report_resume(struct pci_dev *dev, void *data) return 0; } +struct aer_device_list { + struct device *dev; + struct hlist_node node; +}; + +static int aer_get_pci_dev(struct pci_dev *pdev, void *data) +{ + struct hlist_head *hhead = (struct hlist_head *)data; + struct device *dev = &pdev->dev; + struct aer_device_list *entry; + + entry = kmalloc(sizeof(*entry), GFP_KERNEL); + if (!entry) + /* continue with other devices, lets not return error */ + return 0; + + entry->dev = get_device(dev); + hlist_add_head(&entry->node, hhead); + + return 0; +} + +static void aer_pci_walk_bus(struct pci_bus *top, + int (*cb)(struct pci_dev *, void *), + void *result) +{ + HLIST_HEAD(dev_hlist); + struct hlist_node *tmp; + struct aer_device_list *entry; + + pci_walk_bus(top, aer_get_pci_dev, &dev_hlist); + hlist_for_each_entry_safe(entry, tmp, &dev_hlist, node) { + struct pci_dev *pdev = container_of(entry->dev, struct pci_dev, + dev); + int err; + + err = cb(pdev, result); + if (err) + dev_err(entry->dev, "AER: recovery handler failed: %d", + err); + put_device(entry->dev); + hlist_del(&entry->node); + kfree(entry); + } +} + /** * pci_walk_bridge - walk bridges potentially AER affected * @bridge: bridge which may be a Port, an RCEC, or an RCiEP @@ -189,7 +235,7 @@ static void pci_walk_bridge(struct pci_dev *bridge, void *userdata) { if (bridge->subordinate) - pci_walk_bus(bridge->subordinate, cb, userdata); + aer_pci_walk_bus(bridge->subordinate, cb, userdata); else cb(bridge, userdata); } -- 2.33.0

1 0

[PATCH OLK-6.6] ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
by Qi Xi 15 Apr '25

15 Apr '25

From: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> mainline inclusion from mainline-v6.14-rc1 commit 301c26a018acb94dd537a4418cefa0f654500c6f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRED3 CVE: CVE-2024-58077 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 1f5664351410 ("ASoC: lower "no backend DAIs enabled for ... Port" log severity") ignores -EINVAL error message on common soc_pcm_ret(). It is used from many functions, ignoring -EINVAL is over-kill. The reason why -EINVAL was ignored was it really should only be used upon invalid parameters coming from userspace and in that case we don't want to log an error since we do not want to give userspace a way to do a denial-of-service attack on the syslog / diskspace. So don't use soc_pcm_ret() on .prepare callback is better idea. Link: https://lore.kernel.org/r/87v7vptzap.wl-kuninori.morimoto.gx@renesas.com Cc: Hans de Goede <hdegoede(a)redhat.com> Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> Link: https://patch.msgid.link/87bjxg8jju.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- sound/soc/soc-pcm.c | 32 ++++++++++++++++++++++++++++---- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 511446a30c05..60248a6820aa 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -38,7 +38,6 @@ static inline int _soc_pcm_ret(struct snd_soc_pcm_runtime *rtd, switch (ret) { case -EPROBE_DEFER: case -ENOTSUPP: - case -EINVAL: break; default: dev_err(rtd->dev, @@ -902,7 +901,13 @@ static int __soc_pcm_prepare(struct snd_soc_pcm_runtime *rtd, } out: - return soc_pcm_ret(rtd, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } /* PCM prepare ops for non-DPCM streams */ @@ -914,6 +919,13 @@ static int soc_pcm_prepare(struct snd_pcm_substream *substream) snd_soc_dpcm_mutex_lock(rtd); ret = __soc_pcm_prepare(rtd, substream); snd_soc_dpcm_mutex_unlock(rtd); + + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ return ret; } @@ -2461,7 +2473,13 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream) be->dpcm[stream].state = SND_SOC_DPCM_STATE_PREPARE; } - return soc_pcm_ret(fe, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) @@ -2501,7 +2519,13 @@ static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO); snd_soc_dpcm_mutex_unlock(fe); - return soc_pcm_ret(fe, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } static int dpcm_run_update_shutdown(struct snd_soc_pcm_runtime *fe, int stream) -- 2.33.0

2 1

[PATCH OLK-6.6] PCI: AER: fix deadlock in do_recovery
by Qi Xi 15 Apr '25

15 Apr '25

From: Govindarajulu Varadarajan <gvaradar(a)cisco.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC1ERL -------------------------------- CPU0 CPU1 --------------------------------------------------------------------- __driver_attach() device_lock(&dev->mutex) <--- device mutex lock here driver_probe_device() pci_enable_sriov() pci_iov_add_virtfn() pci_device_add() aer_isr() <--- pci aer error do_recovery() broadcast_error_message() pci_walk_bus() down_read(&pci_bus_sem) <--- rd sem down_write(&pci_bus_sem) <-- stuck on wr sem report_error_detected() device_lock(&dev->mutex)<--- DEAD LOCK This can also happen when aer error occurs while pci_dev->sriov_config() is called. This patch does a pci_bus_walk and adds all the devices to a list. After unlocking (up_read) &pci_bus_sem, we go through the list and call err_handler of the devices with devic_lock() held. This way, we dont try to hold both locks at same time. v2: * Drop patch 1, 2 & 4. * Instead of locking 50+ devices, do get_device() and add them to a list. After unlocking &pci_bus_sem, go through the list call err_handler. v1: * Previous discussion here: https://lkml.org/lkml/2017/9/27/720 [ 70.984091] pcieport 0000:00:02.0: AER: Uncorrected (Non-Fatal) error received: id=0010 [ 70.984112] pcieport 0000:00:02.0: PCIe Bus Error: severity=Uncorrected (Non-Fatal), type=Transaction Layer, id=0010(Requester ID) [ 70.984116] pcieport 0000:00:02.0: device [8086:3c04] error status/mask=00004000/00100000 [ 70.984120] pcieport 0000:00:02.0: [14] Completion Timeout (First) ... [ 107.484190] INFO: task kworker/0:1:76 blocked for more than 30 seconds. [ 107.563619] Not tainted 4.13.0+ #28 [ 107.611618] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 107.705368] kworker/0:1 D 0 76 2 0x80000000 [ 107.771050] Workqueue: events aer_isr [ 107.814895] Call Trace: [ 107.844181] __schedule+0x312/0xa40 [ 107.885928] schedule+0x3d/0x90 [ 107.923506] schedule_preempt_disabled+0x15/0x20 [ 107.978773] __mutex_lock+0x304/0xa30 [ 108.022594] ? dev_printk_emit+0x3b/0x50 [ 108.069534] ? report_error_detected+0xa6/0x210 [ 108.123770] mutex_lock_nested+0x1b/0x20 [ 108.170713] ? mutex_lock_nested+0x1b/0x20 [ 108.219730] report_error_detected+0xa6/0x210 [ 108.271881] ? aer_recover_queue+0xe0/0xe0 [ 108.320904] pci_walk_bus+0x46/0x90 [ 108.362645] ? aer_recover_queue+0xe0/0xe0 [ 108.411658] broadcast_error_message+0xc3/0xf0 [ 108.464835] do_recovery+0x34/0x220 [ 108.506569] ? get_device_error_info+0x92/0x130 [ 108.560785] aer_isr+0x28f/0x3b0 [ 108.599410] process_one_work+0x277/0x6c0 [ 108.647399] worker_thread+0x4d/0x3b0 [ 108.691218] kthread+0x171/0x190 [ 108.729830] ? process_one_work+0x6c0/0x6c0 [ 108.779888] ? kthread_create_on_node+0x40/0x40 [ 108.834110] ret_from_fork+0x2a/0x40 [ 108.876916] INFO: task kworker/0:2:205 blocked for more than 30 seconds. [ 108.957129] Not tainted 4.13.0+ #28 [ 109.005114] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 109.098873] kworker/0:2 D 0 205 2 0x80000000 [ 109.164544] Workqueue: events work_for_cpu_fn [ 109.216681] Call Trace: [ 109.245943] __schedule+0x312/0xa40 [ 109.287687] ? rwsem_down_write_failed+0x308/0x4f0 [ 109.345021] schedule+0x3d/0x90 [ 109.382603] rwsem_down_write_failed+0x30d/0x4f0 [ 109.437869] ? __lock_acquire+0x75c/0x1410 [ 109.486910] call_rwsem_down_write_failed+0x17/0x30 [ 109.545287] ? call_rwsem_down_write_failed+0x17/0x30 [ 109.605752] down_write+0x88/0xb0 [ 109.645410] pci_device_add+0x158/0x240 [ 109.691313] pci_iov_add_virtfn+0x24f/0x340 [ 109.741375] pci_enable_sriov+0x32b/0x420 [ 109.789466] ? pci_read+0x2c/0x30 [ 109.829142] enic_probe+0x5d4/0xff0 [enic] [ 109.878184] ? trace_hardirqs_on+0xd/0x10 [ 109.926180] local_pci_probe+0x42/0xa0 [ 109.971037] work_for_cpu_fn+0x14/0x20 [ 110.015898] process_one_work+0x277/0x6c0 [ 110.063884] worker_thread+0x1d6/0x3b0 [ 110.108750] kthread+0x171/0x190 [ 110.147363] ? process_one_work+0x6c0/0x6c0 [ 110.197426] ? kthread_create_on_node+0x40/0x40 [ 110.251642] ret_from_fork+0x2a/0x40 [ 110.294448] INFO: task systemd-udevd:492 blocked for more than 30 seconds. [ 110.376742] Not tainted 4.13.0+ #28 [ 110.424715] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 110.518457] systemd-udevd D 0 492 444 0x80000180 [ 110.584116] Call Trace: [ 110.613382] __schedule+0x312/0xa40 [ 110.655127] ? wait_for_completion+0x14a/0x1d0 [ 110.708302] schedule+0x3d/0x90 [ 110.745875] schedule_timeout+0x26e/0x5b0 [ 110.793887] ? wait_for_completion+0x14a/0x1d0 [ 110.847068] wait_for_completion+0x169/0x1d0 [ 110.898165] ? wait_for_completion+0x169/0x1d0 [ 110.951354] ? wake_up_q+0x80/0x80 [ 110.992060] flush_work+0x237/0x300 [ 111.033795] ? flush_workqueue_prep_pwqs+0x1b0/0x1b0 [ 111.093224] ? wait_for_completion+0x5a/0x1d0 [ 111.145363] ? flush_work+0x237/0x300 [ 111.189189] work_on_cpu+0x94/0xb0 [ 111.229894] ? work_is_static_object+0x20/0x20 [ 111.283070] ? pci_device_shutdown+0x60/0x60 [ 111.334173] pci_device_probe+0x17a/0x190 [ 111.382163] driver_probe_device+0x2ff/0x450 [ 111.433260] __driver_attach+0x103/0x140 [ 111.480195] ? driver_probe_device+0x450/0x450 [ 111.533381] bus_for_each_dev+0x74/0xb0 [ 111.579276] driver_attach+0x1e/0x20 [ 111.622056] bus_add_driver+0x1ca/0x270 [ 111.667955] ? 0xffffffffc039c000 [ 111.707616] driver_register+0x60/0xe0 [ 111.752472] ? 0xffffffffc039c000 [ 111.792126] __pci_register_driver+0x6b/0x70 [ 111.843275] enic_init_module+0x38/0x1000 [enic] [ 111.898533] do_one_initcall+0x50/0x192 [ 111.944428] ? trace_hardirqs_on+0xd/0x10 [ 111.992408] do_init_module+0x5f/0x1f2 [ 112.037274] load_module+0x1740/0x1f70 [ 112.082148] SYSC_finit_module+0xd7/0xf0 [ 112.129083] ? SYSC_finit_module+0xd7/0xf0 [ 112.178106] SyS_finit_module+0xe/0x10 [ 112.222972] do_syscall_64+0x69/0x180 [ 112.266793] entry_SYSCALL64_slow_path+0x25/0x25 [ 112.322047] RIP: 0033:0x7f3da098b559 [ 112.364826] RSP: 002b:00007ffeb3306a38 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 112.455447] RAX: ffffffffffffffda RBX: 0000557fe41ed3d0 RCX: 00007f3da098b559 [ 112.540860] RDX: 0000000000000000 RSI: 00007f3da14c79c5 RDI: 0000000000000006 [ 112.626281] RBP: 00007f3da14c79c5 R08: 0000000000000000 R09: 00007ffeb3306b50 [ 112.711698] R10: 0000000000000006 R11: 0000000000000246 R12: 0000000000000000 [ 112.797114] R13: 0000557fe420e210 R14: 0000000000020000 R15: 0000557fe2c1ef4a [ 112.882568] Showing all locks held in the system: [ 112.956545] 5 locks held by kworker/0:1/76: [ 113.006616] #0: ("events"){+.+.}, at: [<ffffffffb00b10ed>] process_one_work+0x1ed/0x6c0 [ 113.104535] #1: ((&rpc->dpc_handler)){+.+.}, at: [<ffffffffb00b10ed>] process_one_work+0x1ed/0x6c0 [ 113.213894] #2: (&rpc->rpc_mutex){+.+.}, at: [<ffffffffb0505ca2>] aer_isr+0x32/0x3b0 [ 113.308711] #3: (pci_bus_sem){++++}, at: [<ffffffffb04ea18a>] pci_walk_bus+0x2a/0x90 [ 113.403501] #4: (&dev->mutex){....}, at: [<ffffffffb0505706>] report_error_detected+0xa6/0x210 [ 113.508715] 3 locks held by kworker/0:2/205: [ 113.559808] #0: ("events"){+.+.}, at: [<ffffffffb00b10ed>] process_one_work+0x1ed/0x6c0 [ 113.657718] #1: ((&wfc.work)){+.+.}, at: [<ffffffffb00b10ed>] process_one_work+0x1ed/0x6c0 [ 113.758745] #2: (pci_bus_sem){++++}, at: [<ffffffffb04ec978>] pci_device_add+0x158/0x240 [ 113.857710] 1 lock held by khungtaskd/239: [ 113.906729] #0: (tasklist_lock){.+.+}, at: [<ffffffffb00f07dd>] debug_show_all_locks+0x3d/0x1a0 [ 114.012972] 2 locks held by systemd-udevd/492: [ 114.066148] #0: (&dev->mutex){....}, at: [<ffffffffb06254d5>] __driver_attach+0x55/0x140 [ 114.165107] #1: (&dev->mutex){....}, at: [<ffffffffb06254f2>] __driver_attach+0x72/0x140 [ 114.281879] ============================================= Signed-off-by: Govindarajulu Varadarajan <gvaradar(a)cisco.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/pci/pcie/err.c | 48 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 47 insertions(+), 1 deletion(-) diff --git a/drivers/pci/pcie/err.c b/drivers/pci/pcie/err.c index 705893b5f7b0..573dbf4c77e1 100644 --- a/drivers/pci/pcie/err.c +++ b/drivers/pci/pcie/err.c @@ -171,6 +171,52 @@ static int report_resume(struct pci_dev *dev, void *data) return 0; } +struct aer_device_list { + struct device *dev; + struct hlist_node node; +}; + +int aer_get_pci_dev(struct pci_dev *pdev, void *data) +{ + struct hlist_head *hhead = (struct hlist_head *)data; + struct device *dev = &pdev->dev; + struct aer_device_list *entry; + + entry = kmalloc(sizeof(*entry), GFP_KERNEL); + if (!entry) + /* continue with other devices, lets not return error */ + return 0; + + entry->dev = get_device(dev); + hlist_add_head(&entry->node, hhead); + + return 0; +} + +static void aer_pci_walk_bus(struct pci_bus *top, + int (*cb)(struct pci_dev *, void *), + void *result) +{ + HLIST_HEAD(dev_hlist); + struct hlist_node *tmp; + struct aer_device_list *entry; + + pci_walk_bus(top, aer_get_pci_dev, &dev_hlist); + hlist_for_each_entry_safe(entry, tmp, &dev_hlist, node) { + struct pci_dev *pdev = container_of(entry->dev, struct pci_dev, + dev); + int err; + + err = cb(pdev, result); + if (err) + dev_err(entry->dev, "AER: recovery handler failed: %d", + err); + put_device(entry->dev); + hlist_del(&entry->node); + kfree(entry); + } +} + /** * pci_walk_bridge - walk bridges potentially AER affected * @bridge: bridge which may be a Port, an RCEC, or an RCiEP @@ -189,7 +235,7 @@ static void pci_walk_bridge(struct pci_dev *bridge, void *userdata) { if (bridge->subordinate) - pci_walk_bus(bridge->subordinate, cb, userdata); + aer_pci_walk_bus(bridge->subordinate, cb, userdata); else cb(bridge, userdata); } -- 2.33.0

2 1

[PATCH OLK-5.10] iommu/arm-smmu-v3: Fix the extra atc tlb flush
by Zhang Zekun 15 Apr '25

15 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBZUQU ------------------------------------------- The tlb invalidation code for smmu pagetable prefetch problem might cause a extra tlb invalidation for atc. Prevent it from happening. Fixes: 2da3f6871b6e ("iommu/arm-smmu-v3: Reducing the CMD_SYNC times") Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 ++++--- drivers/iommu/io-pgtable-arm.c | 2 +- include/linux/io-pgtable.h | 1 + 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index cedc1eda7250..89df2034f8f5 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -2311,9 +2311,7 @@ static void arm_smmu_tlb_inv_walk(unsigned long iova, size_t size, size_t granule, void *cookie) { #ifdef CONFIG_HISILICON_ERRATUM_162100602 - struct arm_smmu_domain *smmu_domain = cookie; - - if (!size && smmu_domain->smmu->options & ARM_SMMU_OPT_SYNC_BATCH) { + if (!size) { arm_smmu_tlb_inv_range_domain(iova, granule, granule, true, cookie); return; } @@ -2584,6 +2582,9 @@ static int arm_smmu_domain_finalise(struct iommu_domain *domain, else if (smmu->features & ARM_SMMU_FEAT_BBML2) pgtbl_cfg.quirks |= IO_PGTABLE_QUIRK_ARM_BBML2; + if (smmu_domain->smmu->options & ARM_SMMU_OPT_SYNC_BATCH) + pgtbl_cfg.quirks |= IO_PGTABLE_QUIRK_HISI_ERRATA; + pgtbl_ops = alloc_io_pgtable_ops(fmt, &pgtbl_cfg, smmu_domain); if (!pgtbl_ops) return -ENOMEM; diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c index dc80f2661ff7..e8a6a38db48f 100644 --- a/drivers/iommu/io-pgtable-arm.c +++ b/drivers/iommu/io-pgtable-arm.c @@ -365,7 +365,7 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova, if (pte) __arm_lpae_free_pages(cptep, tblsz, cfg); #ifdef CONFIG_HISILICON_ERRATUM_162100602 - if (lvl <= 2) + if (lvl <= 2 && (cfg->quirks & IO_PGTABLE_QUIRK_HISI_ERRATA)) io_pgtable_tlb_flush_walk(&data->iop, iova, 0, ARM_LPAE_GRANULE(data)); #endif } else if (!cfg->coherent_walk && !(pte & ARM_LPAE_PTE_SW_SYNC)) { diff --git a/include/linux/io-pgtable.h b/include/linux/io-pgtable.h index 27b994e42ec4..7fc863011474 100644 --- a/include/linux/io-pgtable.h +++ b/include/linux/io-pgtable.h @@ -100,6 +100,7 @@ struct io_pgtable_cfg { #define IO_PGTABLE_QUIRK_ARM_HD BIT(6) #define IO_PGTABLE_QUIRK_ARM_BBML1 BIT(7) #define IO_PGTABLE_QUIRK_ARM_BBML2 BIT(8) + #define IO_PGTABLE_QUIRK_HISI_ERRATA BIT(9) unsigned long quirks; unsigned long pgsize_bitmap; unsigned int ias; -- 2.22.0

2 1

[PATCH OLK-5.10] soc: hisilicon: Serialize the online and onfline the acpi devices
by Zhang Zekun 15 Apr '25

15 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC0DU9 ----------------------------------------------- The parallelization of hbm on and off can cause problems, such as the abnormal state of acpi device. Force paralleize the routine of power on/off the hbm device, which can fix various the abnormal state of acpi devices. Fixes: 039ec3f73992 ("soc: hisilicon: hisi_hbmdev: Add power domain control methods") Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/acpi/device_sysfs.c | 8 +++ drivers/acpi/osl.c | 5 ++ drivers/soc/hisilicon/hisi_hbmdev.c | 83 +++++++++++++++++++---------- include/linux/acpi.h | 2 + 4 files changed, 69 insertions(+), 29 deletions(-) diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c index 57ee8314dfb8..0f0bde3a41f6 100644 --- a/drivers/acpi/device_sysfs.c +++ b/drivers/acpi/device_sysfs.c @@ -359,6 +359,11 @@ static ssize_t power_state_show(struct device *dev, static DEVICE_ATTR_RO(power_state); +static struct acpi_platform_list no_eject_plat_info[] = { + {"HISI ", "HIP11 ", 0, ACPI_SIG_IORT, all_versions, NULL, 0}, + { } +}; + static ssize_t eject_store(struct device *d, struct device_attribute *attr, const char *buf, size_t count) @@ -378,6 +383,9 @@ eject_store(struct device *d, struct device_attribute *attr, if (ACPI_FAILURE(status) || !acpi_device->flags.ejectable) return -ENODEV; + if (acpi_match_platform_list(no_eject_plat_info) >= 0) + return -ENODEV; + get_device(&acpi_device->dev); status = acpi_hotplug_schedule(acpi_device, ACPI_OST_EC_OSPM_EJECT); if (ACPI_SUCCESS(status)) diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c index 0418febc5cf2..213eb9b63776 100644 --- a/drivers/acpi/osl.c +++ b/drivers/acpi/osl.c @@ -1194,6 +1194,11 @@ bool acpi_queue_hotplug_work(struct work_struct *work) return queue_work(kacpi_hotplug_wq, work); } +void flush_hotplug_workqueue(void) +{ + flush_workqueue(kacpi_hotplug_wq); +} + acpi_status acpi_os_create_semaphore(u32 max_units, u32 initial_units, acpi_handle * handle) { diff --git a/drivers/soc/hisilicon/hisi_hbmdev.c b/drivers/soc/hisilicon/hisi_hbmdev.c index 7ed874ff2206..cb65da2c5463 100644 --- a/drivers/soc/hisilicon/hisi_hbmdev.c +++ b/drivers/soc/hisilicon/hisi_hbmdev.c @@ -19,6 +19,7 @@ struct cdev_node { struct list_head clist; }; +static struct mutex dev_lock; struct cdev_node cdev_list; static int get_pxm(struct acpi_device *acpi_device, void *arg) @@ -54,21 +55,6 @@ static ssize_t pxms_show(struct device *dev, } static DEVICE_ATTR_RO(pxms); -static int memdev_power_on(struct acpi_device *adev) -{ - acpi_handle handle = adev->handle; - acpi_status status; - - /* Power on and online the devices */ - status = acpi_evaluate_object(handle, "_ON", NULL, NULL); - if (ACPI_FAILURE(status)) { - acpi_handle_warn(handle, "Power on failed (0x%x)\n", status); - return -ENODEV; - } - - return 0; -} - static int hbmdev_check(struct acpi_device *adev, void *arg) { const char *hid = acpi_device_hid(adev); @@ -79,34 +65,61 @@ static int hbmdev_check(struct acpi_device *adev, void *arg) *found = true; return -1; } - - /* There might be devices have not attached */ - if (!adev->handler) - return 0; - - adev->handler->hotplug.demand_offline = true; } return 0; } -static int memdev_power_off(struct acpi_device *adev) +static int memdev_power_on(struct acpi_device *adev) { acpi_handle handle = adev->handle; + struct acpi_device *child; acpi_status status; - acpi_scan_lock_acquire(); - acpi_dev_for_each_child(adev, hbmdev_check, NULL); - acpi_scan_lock_release(); + list_for_each_entry(child, &adev->children, node) { + unsigned long long sta = 0; - /* Eject the devices and power off */ - status = acpi_evaluate_object(handle, "_OFF", NULL, NULL); + status = acpi_evaluate_integer(child->handle, "_STA", NULL, &sta); + if (ACPI_FAILURE(status) || (sta & ACPI_STA_DEVICE_ENABLED)) + return -EINVAL; + } + + /* Power on and online the devices */ + status = acpi_evaluate_object(handle, "_ON", NULL, NULL); if (ACPI_FAILURE(status)) { + acpi_handle_warn(handle, "Power on failed (0x%x)\n", status); return -ENODEV; } + return 0; } +static void memdev_power_off(struct acpi_device *adev) +{ + struct acpi_device *child; + + list_for_each_entry(child, &adev->children, node) { + const char *hid = acpi_device_hid(child); + acpi_status status; + + if (strcmp(hid, ACPI_MEMORY_DEVICE_HID)) + continue; + + if (!child->handler) + continue; + + child->handler->hotplug.demand_offline = true; + + get_device(&child->dev); + status = acpi_hotplug_schedule(child, ACPI_OST_EC_OSPM_EJECT); + if (ACPI_SUCCESS(status)) + continue; + + put_device(&child->dev); + + } +} + static ssize_t state_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count) { @@ -114,23 +127,33 @@ static ssize_t state_store(struct device *dev, struct device_attribute *attr, const int type = online_type_from_str(buf); int ret; + if (!mutex_trylock(&dev_lock)) + return -EBUSY; + /* Disallow pending on the mutex to avoid potential hung task*/ ret = lock_device_hotplug_sysfs(); - if (ret) + if (ret) { + mutex_unlock(&dev_lock); return ret; + } switch (type) { case STATE_ONLINE: ret = memdev_power_on(adev); break; case STATE_OFFLINE: - ret = memdev_power_off(adev); + memdev_power_off(adev); break; default: break; } + unlock_device_hotplug(); + acpi_os_wait_events_complete(); + flush_hotplug_workqueue(); + + mutex_unlock(&dev_lock); if (ret) return ret; @@ -212,6 +235,8 @@ static int __init hbmdev_init(void) if (acpi_match_platform_list(hbm_plat_info) < 0) return 0; + mutex_init(&dev_lock); + return container_init(); } module_init(hbmdev_init); diff --git a/include/linux/acpi.h b/include/linux/acpi.h index 38ad6478c4b9..0d4f5ccfc059 100644 --- a/include/linux/acpi.h +++ b/include/linux/acpi.h @@ -1416,12 +1416,14 @@ static inline void acpi_init_pcc(void) { } #ifdef CONFIG_ACPI extern int acpi_platform_notify(struct device *dev, enum kobject_action action); +extern void flush_hotplug_workqueue(void); #else static inline int acpi_platform_notify(struct device *dev, enum kobject_action action) { return 0; } +static inline void flush_hotplug_workqueue(void) {} #endif struct acpi_pptt_processor * -- 2.22.0

2 1

[PATCH OLK-5.10] soc: hisilicon: Serialize the online and onfline the acpi devices
by Zhang Zekun 15 Apr '25

15 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC0DU9 ----------------------------------------------- The parallelization of hbm on and off can cause problems, such as the abnormal state of acpi device. Force paralleize the routine of power on/off the hbm device, which can fix various the abnormal state of acpi devices. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/acpi/device_sysfs.c | 8 +++ drivers/acpi/osl.c | 5 ++ drivers/soc/hisilicon/hisi_hbmdev.c | 83 +++++++++++++++++++---------- include/linux/acpi.h | 2 + 4 files changed, 69 insertions(+), 29 deletions(-) diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c index 57ee8314dfb8..0f0bde3a41f6 100644 --- a/drivers/acpi/device_sysfs.c +++ b/drivers/acpi/device_sysfs.c @@ -359,6 +359,11 @@ static ssize_t power_state_show(struct device *dev, static DEVICE_ATTR_RO(power_state); +static struct acpi_platform_list no_eject_plat_info[] = { + {"HISI ", "HIP11 ", 0, ACPI_SIG_IORT, all_versions, NULL, 0}, + { } +}; + static ssize_t eject_store(struct device *d, struct device_attribute *attr, const char *buf, size_t count) @@ -378,6 +383,9 @@ eject_store(struct device *d, struct device_attribute *attr, if (ACPI_FAILURE(status) || !acpi_device->flags.ejectable) return -ENODEV; + if (acpi_match_platform_list(no_eject_plat_info) >= 0) + return -ENODEV; + get_device(&acpi_device->dev); status = acpi_hotplug_schedule(acpi_device, ACPI_OST_EC_OSPM_EJECT); if (ACPI_SUCCESS(status)) diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c index 0418febc5cf2..213eb9b63776 100644 --- a/drivers/acpi/osl.c +++ b/drivers/acpi/osl.c @@ -1194,6 +1194,11 @@ bool acpi_queue_hotplug_work(struct work_struct *work) return queue_work(kacpi_hotplug_wq, work); } +void flush_hotplug_workqueue(void) +{ + flush_workqueue(kacpi_hotplug_wq); +} + acpi_status acpi_os_create_semaphore(u32 max_units, u32 initial_units, acpi_handle * handle) { diff --git a/drivers/soc/hisilicon/hisi_hbmdev.c b/drivers/soc/hisilicon/hisi_hbmdev.c index 7ed874ff2206..cb65da2c5463 100644 --- a/drivers/soc/hisilicon/hisi_hbmdev.c +++ b/drivers/soc/hisilicon/hisi_hbmdev.c @@ -19,6 +19,7 @@ struct cdev_node { struct list_head clist; }; +static struct mutex dev_lock; struct cdev_node cdev_list; static int get_pxm(struct acpi_device *acpi_device, void *arg) @@ -54,21 +55,6 @@ static ssize_t pxms_show(struct device *dev, } static DEVICE_ATTR_RO(pxms); -static int memdev_power_on(struct acpi_device *adev) -{ - acpi_handle handle = adev->handle; - acpi_status status; - - /* Power on and online the devices */ - status = acpi_evaluate_object(handle, "_ON", NULL, NULL); - if (ACPI_FAILURE(status)) { - acpi_handle_warn(handle, "Power on failed (0x%x)\n", status); - return -ENODEV; - } - - return 0; -} - static int hbmdev_check(struct acpi_device *adev, void *arg) { const char *hid = acpi_device_hid(adev); @@ -79,34 +65,61 @@ static int hbmdev_check(struct acpi_device *adev, void *arg) *found = true; return -1; } - - /* There might be devices have not attached */ - if (!adev->handler) - return 0; - - adev->handler->hotplug.demand_offline = true; } return 0; } -static int memdev_power_off(struct acpi_device *adev) +static int memdev_power_on(struct acpi_device *adev) { acpi_handle handle = adev->handle; + struct acpi_device *child; acpi_status status; - acpi_scan_lock_acquire(); - acpi_dev_for_each_child(adev, hbmdev_check, NULL); - acpi_scan_lock_release(); + list_for_each_entry(child, &adev->children, node) { + unsigned long long sta = 0; - /* Eject the devices and power off */ - status = acpi_evaluate_object(handle, "_OFF", NULL, NULL); + status = acpi_evaluate_integer(child->handle, "_STA", NULL, &sta); + if (ACPI_FAILURE(status) || (sta & ACPI_STA_DEVICE_ENABLED)) + return -EINVAL; + } + + /* Power on and online the devices */ + status = acpi_evaluate_object(handle, "_ON", NULL, NULL); if (ACPI_FAILURE(status)) { + acpi_handle_warn(handle, "Power on failed (0x%x)\n", status); return -ENODEV; } + return 0; } +static void memdev_power_off(struct acpi_device *adev) +{ + struct acpi_device *child; + + list_for_each_entry(child, &adev->children, node) { + const char *hid = acpi_device_hid(child); + acpi_status status; + + if (strcmp(hid, ACPI_MEMORY_DEVICE_HID)) + continue; + + if (!child->handler) + continue; + + child->handler->hotplug.demand_offline = true; + + get_device(&child->dev); + status = acpi_hotplug_schedule(child, ACPI_OST_EC_OSPM_EJECT); + if (ACPI_SUCCESS(status)) + continue; + + put_device(&child->dev); + + } +} + static ssize_t state_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count) { @@ -114,23 +127,33 @@ static ssize_t state_store(struct device *dev, struct device_attribute *attr, const int type = online_type_from_str(buf); int ret; + if (!mutex_trylock(&dev_lock)) + return -EBUSY; + /* Disallow pending on the mutex to avoid potential hung task*/ ret = lock_device_hotplug_sysfs(); - if (ret) + if (ret) { + mutex_unlock(&dev_lock); return ret; + } switch (type) { case STATE_ONLINE: ret = memdev_power_on(adev); break; case STATE_OFFLINE: - ret = memdev_power_off(adev); + memdev_power_off(adev); break; default: break; } + unlock_device_hotplug(); + acpi_os_wait_events_complete(); + flush_hotplug_workqueue(); + + mutex_unlock(&dev_lock); if (ret) return ret; @@ -212,6 +235,8 @@ static int __init hbmdev_init(void) if (acpi_match_platform_list(hbm_plat_info) < 0) return 0; + mutex_init(&dev_lock); + return container_init(); } module_init(hbmdev_init); diff --git a/include/linux/acpi.h b/include/linux/acpi.h index 38ad6478c4b9..0d4f5ccfc059 100644 --- a/include/linux/acpi.h +++ b/include/linux/acpi.h @@ -1416,12 +1416,14 @@ static inline void acpi_init_pcc(void) { } #ifdef CONFIG_ACPI extern int acpi_platform_notify(struct device *dev, enum kobject_action action); +extern void flush_hotplug_workqueue(void); #else static inline int acpi_platform_notify(struct device *dev, enum kobject_action action) { return 0; } +static inline void flush_hotplug_workqueue(void) {} #endif struct acpi_pptt_processor * -- 2.22.0

2 1

[PATCH OLK-5.10] iommu/arm-smmu-v3: Fix the extra atc tlb flush
by Zhang Zekun 15 Apr '25

15 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBZUQU ------------------------------------------- The tlb invalidation code for smmu pagetable prefetch problem might cause a extra tlb invalidation for atc. Prevent it from happening. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 ++++--- drivers/iommu/io-pgtable-arm.c | 2 +- include/linux/io-pgtable.h | 1 + 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index cedc1eda7250..89df2034f8f5 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -2311,9 +2311,7 @@ static void arm_smmu_tlb_inv_walk(unsigned long iova, size_t size, size_t granule, void *cookie) { #ifdef CONFIG_HISILICON_ERRATUM_162100602 - struct arm_smmu_domain *smmu_domain = cookie; - - if (!size && smmu_domain->smmu->options & ARM_SMMU_OPT_SYNC_BATCH) { + if (!size) { arm_smmu_tlb_inv_range_domain(iova, granule, granule, true, cookie); return; } @@ -2584,6 +2582,9 @@ static int arm_smmu_domain_finalise(struct iommu_domain *domain, else if (smmu->features & ARM_SMMU_FEAT_BBML2) pgtbl_cfg.quirks |= IO_PGTABLE_QUIRK_ARM_BBML2; + if (smmu_domain->smmu->options & ARM_SMMU_OPT_SYNC_BATCH) + pgtbl_cfg.quirks |= IO_PGTABLE_QUIRK_HISI_ERRATA; + pgtbl_ops = alloc_io_pgtable_ops(fmt, &pgtbl_cfg, smmu_domain); if (!pgtbl_ops) return -ENOMEM; diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c index dc80f2661ff7..e8a6a38db48f 100644 --- a/drivers/iommu/io-pgtable-arm.c +++ b/drivers/iommu/io-pgtable-arm.c @@ -365,7 +365,7 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova, if (pte) __arm_lpae_free_pages(cptep, tblsz, cfg); #ifdef CONFIG_HISILICON_ERRATUM_162100602 - if (lvl <= 2) + if (lvl <= 2 && (cfg->quirks & IO_PGTABLE_QUIRK_HISI_ERRATA)) io_pgtable_tlb_flush_walk(&data->iop, iova, 0, ARM_LPAE_GRANULE(data)); #endif } else if (!cfg->coherent_walk && !(pte & ARM_LPAE_PTE_SW_SYNC)) { diff --git a/include/linux/io-pgtable.h b/include/linux/io-pgtable.h index 27b994e42ec4..7fc863011474 100644 --- a/include/linux/io-pgtable.h +++ b/include/linux/io-pgtable.h @@ -100,6 +100,7 @@ struct io_pgtable_cfg { #define IO_PGTABLE_QUIRK_ARM_HD BIT(6) #define IO_PGTABLE_QUIRK_ARM_BBML1 BIT(7) #define IO_PGTABLE_QUIRK_ARM_BBML2 BIT(8) + #define IO_PGTABLE_QUIRK_HISI_ERRATA BIT(9) unsigned long quirks; unsigned long pgsize_bitmap; unsigned int ias; -- 2.22.0

2 1

[PATCH OLK-6.6 0/8] LoongArch: sync internal repository 20250414
by Hongchen Zhang 15 Apr '25

15 Apr '25

Ard Biesheuvel (1): objtool: Fix C jump table annotations for Clang Gao Qihang (1): LoongArch: Preserve firmware configuration if ACPI requires. Hongchen Zhang (1): LoongArch: set CONFIG_CPU_HAS_LBT=y Juxin Gao (1): LoongArch: configs: set CONFIG_UNWINDER_ORC=y Ming Wang (1): LoongArch: configs: Disable CONFIG_RT_GROUP_SCHED to prevent cgroup2 issues Tiezhu Yang (3): LoongArch: Handle fp, lsx, lasx and lbt assembly symbols LoongArch: Make some signal and ptrace functions non-static LoongArch: Export some signal functions arch/loongarch/configs/loongson3_defconfig | 3 +- arch/loongarch/include/asm/fpu.h | 6 ++++ arch/loongarch/include/asm/lbt.h | 4 +++ arch/loongarch/kernel/Makefile | 1 + arch/loongarch/kernel/extern.c | 31 ++++++++++++++++++ arch/loongarch/kernel/fpu.S | 6 ++++ arch/loongarch/kernel/lbt.S | 4 +++ arch/loongarch/kernel/ptrace.c | 37 +++++++++++++++------- arch/loongarch/kernel/signal.c | 28 +++------------- arch/loongarch/pci/acpi.c | 14 ++++++-- include/linux/compiler.h | 2 +- tools/objtool/check.c | 7 ++-- tools/objtool/include/objtool/special.h | 2 +- 13 files changed, 103 insertions(+), 42 deletions(-) create mode 100644 arch/loongarch/kernel/extern.c -- 2.43.0

2 10

[PATCH OLK-6.6 1/8] objtool: Fix C jump table annotations for Clang
by Hongchen Zhang 15 Apr '25

15 Apr '25

From: Ard Biesheuvel <ardb(a)kernel.org> mainline inclusion from mainline-v6.14-rc5 commit 73cfc53cc3b6380eccf013049574485f64cb83ca category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC10DU CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A C jump table (such as the one used by the BPF interpreter) is a const global array of absolute code addresses, and this means that the actual values in the table may not be known until the kernel is booted (e.g., when using KASLR or when the kernel VA space is sized dynamically). When using PIE codegen, the compiler will default to placing such const global objects in .data.rel.ro (which is annotated as writable), rather than .rodata (which is annotated as read-only). As C jump tables are explicitly emitted into .rodata, this used to result in warnings for LoongArch builds (which uses PIE codegen for the entire kernel) like Warning: setting incorrect section attributes for .rodata..c_jump_table due to the fact that the explicitly specified .rodata section inherited the read-write annotation that the compiler uses for such objects when using PIE codegen. This warning was suppressed by explicitly adding the read-only annotation to the __attribute__((section(""))) string, by commit c5b1184decc8 ("compiler.h: specify correct attribute for .rodata..c_jump_table") Unfortunately, this hack does not work on Clang's integrated assembler, which happily interprets the appended section type and permission specifiers as part of the section name, which therefore no longer matches the hard-coded pattern '.rodata..c_jump_table' that objtool expects, causing it to emit a warning kernel/bpf/core.o: warning: objtool: ___bpf_prog_run+0x20: sibling call from callable instruction with modified stack frame Work around this, by emitting C jump tables into .data.rel.ro instead, which is treated as .rodata by the linker script for all builds, not just PIE based ones. Fixes: c5b1184decc8 ("compiler.h: specify correct attribute for .rodata..c_jump_table") Tested-by: Tiezhu Yang <yangtiezhu(a)loongson.cn> # on LoongArch Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Link: https://lore.kernel.org/r/20250221135704.431269-6-ardb+git@google.com Signed-off-by: Josh Poimboeuf <jpoimboe(a)kernel.org> --- include/linux/compiler.h | 2 +- tools/objtool/check.c | 7 ++++--- tools/objtool/include/objtool/special.h | 2 +- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/include/linux/compiler.h b/include/linux/compiler.h index db140f106f3d..c61c59e26e1b 100644 --- a/include/linux/compiler.h +++ b/include/linux/compiler.h @@ -133,7 +133,7 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val, #define annotate_unreachable() __annotate_unreachable(__COUNTER__) /* Annotate a C jump table to allow objtool to follow the code flow */ -#define __annotate_jump_table __section(".rodata..c_jump_table,\"a\",@progbits #") +#define __annotate_jump_table __section(".data.rel.ro.c_jump_table") #else /* !CONFIG_OBJTOOL */ #define annotate_reachable() diff --git a/tools/objtool/check.c b/tools/objtool/check.c index 6e9dd6d6db37..c88131a4b1d3 100644 --- a/tools/objtool/check.c +++ b/tools/objtool/check.c @@ -2559,13 +2559,14 @@ static void mark_rodata(struct objtool_file *file) * * - .rodata: can contain GCC switch tables * - .rodata.<func>: same, if -fdata-sections is being used - * - .rodata..c_jump_table: contains C annotated jump tables + * - .data.rel.ro.c_jump_table: contains C annotated jump tables * * .rodata.str1.* sections are ignored; they don't contain jump tables. */ for_each_sec(file, sec) { - if (!strncmp(sec->name, ".rodata", 7) && - !strstr(sec->name, ".str1.")) { + if ((!strncmp(sec->name, ".rodata", 7) && + !strstr(sec->name, ".str1.")) || + !strncmp(sec->name, ".data.rel.ro", 12)) { sec->rodata = true; found = true; } diff --git a/tools/objtool/include/objtool/special.h b/tools/objtool/include/objtool/special.h index 86d4af9c5aa9..89ee12b1a138 100644 --- a/tools/objtool/include/objtool/special.h +++ b/tools/objtool/include/objtool/special.h @@ -10,7 +10,7 @@ #include <objtool/check.h> #include <objtool/elf.h> -#define C_JUMP_TABLE_SECTION ".rodata..c_jump_table" +#define C_JUMP_TABLE_SECTION ".data.rel.ro.c_jump_table" struct special_alt { struct list_head list; -- 2.43.0

2 8

[PATCH openEuler-1.0-LTS] tty: goldfish: Use tty_port_destroy() to destroy port
by Gu Bowen 15 Apr '25

15 Apr '25

From: Wang Weiyang <wangweiyang2(a)huawei.com> stable inclusion from stable-v4.19.247 commit 326192b99c903a2193d820c30ed936cc2402382c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6XS CVE: CVE-2022-49399 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 507b05063d1b7a1fcb9f7d7c47586fc4f3508f98 ] In goldfish_tty_probe(), the port initialized through tty_port_init() should be destroyed in error paths.In goldfish_tty_remove(), qtty->port also should be destroyed or else might leak resources. Fix the above by calling tty_port_destroy(). Fixes: 666b7793d4bf ("goldfish: tty driver") Reviewed-by: Jiri Slaby <jirislaby(a)kernel.org> Signed-off-by: Wang Weiyang <wangweiyang2(a)huawei.com> Link: https://lore.kernel.org/r/20220328115844.86032-1-wangweiyang2@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/tty/goldfish.c [Context conflicts due to commit 499e13aac6c7 ("tty: goldfish: Fix free_irq() on remove") has merged.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/tty/goldfish.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c index 48ea55beaf43..d6e82eb61fc2 100644 --- a/drivers/tty/goldfish.c +++ b/drivers/tty/goldfish.c @@ -407,6 +407,7 @@ static int goldfish_tty_probe(struct platform_device *pdev) err_tty_register_device_failed: free_irq(irq, qtty); err_dec_line_count: + tty_port_destroy(&qtty->port); goldfish_tty_current_line_count--; if (goldfish_tty_current_line_count == 0) goldfish_tty_delete_driver(); @@ -428,6 +429,7 @@ static int goldfish_tty_remove(struct platform_device *pdev) iounmap(qtty->base); qtty->base = NULL; free_irq(qtty->irq, qtty); + tty_port_destroy(&qtty->port); goldfish_tty_current_line_count--; if (goldfish_tty_current_line_count == 0) goldfish_tty_delete_driver(); -- 2.25.1

2 1

[PATCH OLK-5.10] drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
by Wang Zhaolong 15 Apr '25

15 Apr '25

From: Jiang Liu <gerry(a)linux.alibaba.com> mainline inclusion from mainline-v6.14-rc3 commit 1abb2648698bf10783d2236a6b4a7ca5e8021699 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC78 CVE: CVE-2025-21780 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- It malicious user provides a small pptable through sysfs and then a bigger pptable, it may cause buffer overflow attack in function smu_sys_set_pp_table(). Reviewed-by: Lijo Lazar <lijo.lazar(a)amd.com> Signed-off-by: Jiang Liu <gerry(a)linux.alibaba.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Conflicts: drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c [The smu->mutex in the context has not been removed.] Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c index ee27970cfff9..98c9ac875daa 100644 --- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c @@ -325,12 +325,14 @@ int smu_sys_set_pp_table(struct smu_context *smu, void *buf, size_t size) dev_err(smu->adev->dev, "pp table size not matched !\n"); return -EIO; } mutex_lock(&smu->mutex); - if (!smu_table->hardcode_pptable) + if (!smu_table->hardcode_pptable || smu_table->power_play_table_size < size) { + kfree(smu_table->hardcode_pptable); smu_table->hardcode_pptable = kzalloc(size, GFP_KERNEL); + } if (!smu_table->hardcode_pptable) { ret = -ENOMEM; goto failed; } -- 2.34.3

2 1

[PATCH OLK-6.6 0/4] Some mainline patches merged into olk-6.6: drivers/hwmon
by Lifeng Zheng 15 Apr '25

15 Apr '25

From: Xinghai Cen <cenxinghai(a)h-partners.com> Some mainline patches merged into olk-6.6: drivers/hwmon Huisong Li (2): hwmon: Fix the missing of 'average' word in hwmon_power_attr_templates hwmon: (acpi_power_meter) Replace the deprecated hwmon_device_register Kai-Heng Feng (2): ACPI: IPMI: Add helper to wait for when SMI is selected hwmon: (acpi_power_meter) Ensure IPMI space handler is ready on Dell systems drivers/acpi/acpi_ipmi.c | 23 +- drivers/hwmon/acpi_power_meter.c | 874 ++++++++++++++++--------------- drivers/hwmon/hwmon.c | 4 +- include/acpi/acpi_bus.h | 5 + 4 files changed, 469 insertions(+), 437 deletions(-) -- 2.33.0

2 5

[PATCH OLK-6.6 0/2] soc cache: Add support for HiSilicon L3 cache
by Yushan Wang 15 Apr '25

15 Apr '25

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IC15TR ---------------------------------------------------------------------- This series adds support for HiSilicon SoC cache lockdown and cache maintenance operations. Cache lockdown feature prevents cache entries from being evicted from L3 cache. It can be enabled by calling mmap function to the file (`/dev/hisi_soc_cache_mgmt`). This feature is implemented in the driver hisi_soc_l3c. Cache maintenance feature, following Arm64's CHI spec[1], enables users to raise certain transactions to the memory residing in the cache. This can be achieved by calling ioctl function to the same file as above. This feature is implemented in the driver hisi_soc_hha. L3 cache and L3 cache PMU share the same memory resource, which makes one fails to probe while another is on board. Since both devices rely on distinct information exported by ACPI, their probing functions should be unrelated. Workaround the resource conflict check by replacing devm_ioremap_resource() to devm_ioremap() instead. [1] https://developer.arm.com/documentation/ihi0050/latest/ Yushan Wang (2): soc cache: Add framework driver for HiSilicon SoC cache soc cache: Support cache maintenance for HiSilicon SoC Hydra Home Agent drivers/soc/hisilicon/Kconfig | 22 + drivers/soc/hisilicon/Makefile | 3 + .../soc/hisilicon/hisi_soc_cache_framework.c | 381 ++++++++++++++++++ .../soc/hisilicon/hisi_soc_cache_framework.h | 77 ++++ drivers/soc/hisilicon/hisi_soc_hha.c | 188 +++++++++ .../uapi/misc/hisi_soc_cache/hisi_soc_cache.h | 35 ++ 6 files changed, 706 insertions(+) create mode 100644 drivers/soc/hisilicon/hisi_soc_cache_framework.c create mode 100644 drivers/soc/hisilicon/hisi_soc_cache_framework.h create mode 100644 drivers/soc/hisilicon/hisi_soc_hha.c create mode 100644 include/uapi/misc/hisi_soc_cache/hisi_soc_cache.h -- 2.33.0

2 3

[PATCH OLK-6.6 v8 0/7] Add support for IPIv
by Jinqian Yang 15 Apr '25

15 Apr '25

Patch#1 Allocate VM table and save vpeid in it Patch#2 avoid sending multi-SGIs in IPIV Patch#3 Set base address of vm table and targe ITS when vpe schedule and deschedule Patch#4 Register ipiv exception interrupt Patch#5 Add interface KVM_CAP_ARM_IPIV_MODE Patch#6 Probe and configure IPIV capacity on HIP12 Patch#7 Use KABI_EXTEND to perform kabi repair for IPIV Jinqian Yang (2): kvm: arm64: avoid sending multi-SGIs in IPIV kabi: Use KABI_EXTEND to perform kabi repair for IPIV Xiang Chen (5): kvm: hisi_virt: Allocate VM table and save vpeid in it irqchip: gicv3-its: Set base address of vm table and targe ITS when vpe schedule and deschedule kvm: hisi_virt: Register ipiv exception interrupt kvm: arm64: Add interface KVM_CAP_ARM_IPIV_MODE kvm: hisi_virt: Probe and configure IPIV capacity on HIP12 .../admin-guide/kernel-parameters.txt | 3 + arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/include/asm/sysreg.h | 3 + arch/arm64/kvm/arm.c | 16 +++ arch/arm64/kvm/hisilicon/hisi_virt.c | 38 ++++++++ arch/arm64/kvm/hisilicon/hisi_virt.h | 11 +++ arch/arm64/kvm/sys_regs.c | 11 +++ arch/arm64/kvm/vgic/vgic-init.c | 44 ++++++++- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 1 + drivers/irqchip/irq-gic-v3-its.c | 97 ++++++++++++++++++- drivers/irqchip/irq-gic-v3.c | 33 +++++++ include/linux/irqchip/arm-gic-v3.h | 24 +++++ include/linux/irqchip/arm-gic-v4.h | 2 + include/uapi/linux/kvm.h | 2 + 14 files changed, 282 insertions(+), 4 deletions(-) -- 2.33.0

2 8

[PATCH OLK-6.6 0/9] CVE-2024-50102
by Qi Xi 15 Apr '25

15 Apr '25

*** BLURB HERE *** David Gow (1): x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit David Laight (1): x86: fix off-by-one in access_ok() Linus Torvalds (5): runtime constants: deal with old decrepit linkers runtime constants: add x86 architecture support x86: fix whitespace in runtime-const assembler output x86/uaccess: Improve the 8-byte getuser() case x86: fix user address masking non-canonical speculation issue Stephen Brennan (1): dcache: keep dentry_hashtable or d_hash_shift even when not used Thomas Gleixner (1): x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() arch/x86/include/asm/runtime-const.h | 61 +++++++++++++++++++++ arch/x86/include/asm/uaccess_64.h | 49 ++++++++++------- arch/x86/kernel/cpu/common.c | 10 ++++ arch/x86/kernel/vmlinux.lds.S | 4 ++ arch/x86/lib/getuser.S | 80 ++++++++++------------------ fs/dcache.c | 9 +++- include/asm-generic/vmlinux.lds.h | 7 +++ 7 files changed, 149 insertions(+), 71 deletions(-) create mode 100644 arch/x86/include/asm/runtime-const.h -- 2.33.0

2 10

[PATCH OLK-6.6 v8 0/7] Add support for IPIv
by Jinqian Yang 15 Apr '25

15 Apr '25

Patch#1 Allocate VM table and save vpeid in it Patch#2 avoid sending multi-SGIs in IPIV Patch#3 Set base address of vm table and targe ITS when vpe schedule and deschedule Patch#4 Register ipiv exception interrupt Patch#5 Add interface KVM_CAP_ARM_IPIV_MODE Patch#6 Probe and configure IPIV capacity on HIP12 Patch#7 Use KABI_EXTEND to perform kabi repair for IPIV Jinqian Yang (2): kvm: arm64: avoid sending multi-SGIs in IPIV kabi: Use KABI_EXTEND to perform kabi repair for IPIV Xiang Chen (5): kvm: hisi_virt: Allocate VM table and save vpeid in it irqchip: gicv3-its: Set base address of vm table and targe ITS when vpe schedule and deschedule kvm: hisi_virt: Register ipiv exception interrupt kvm: arm64: Add interface KVM_CAP_ARM_IPIV_MODE kvm: hisi_virt: Probe and configure IPIV capacity on HIP12 .../admin-guide/kernel-parameters.txt | 3 + arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/include/asm/sysreg.h | 3 + arch/arm64/kvm/arm.c | 16 +++ arch/arm64/kvm/hisilicon/hisi_virt.c | 38 ++++++++ arch/arm64/kvm/hisilicon/hisi_virt.h | 11 +++ arch/arm64/kvm/sys_regs.c | 11 +++ arch/arm64/kvm/vgic/vgic-init.c | 44 ++++++++- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 1 + drivers/irqchip/irq-gic-v3-its.c | 97 ++++++++++++++++++- drivers/irqchip/irq-gic-v3.c | 33 +++++++ include/linux/irqchip/arm-gic-v3.h | 24 +++++ include/linux/irqchip/arm-gic-v4.h | 2 + include/uapi/linux/kvm.h | 2 + 14 files changed, 282 insertions(+), 4 deletions(-) -- 2.33.0

2 8

[PATCH OLK-6.6 0/2] soc cache: Add support for HiSilicon L3 cache
by Yushan Wang 15 Apr '25

15 Apr '25

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IC15TR ---------------------------------------------------------------------- This series adds support for HiSilicon SoC cache lockdown and cache maintenance operations. Cache lockdown feature prevents cache entries from being evicted from L3 cache. It can be enabled by calling mmap function to the file (`/dev/hisi_soc_cache_mgmt`). This feature is implemented in the driver hisi_soc_l3c. Cache maintenance feature, following Arm64's CHI spec[1], enables users to raise certain transactions to the memory residing in the cache. This can be achieved by calling ioctl function to the same file as above. This feature is implemented in the driver hisi_soc_hha. L3 cache and L3 cache PMU share the same memory resource, which makes one fails to probe while another is on board. Since both devices rely on distinct information exported by ACPI, their probing functions should be unrelated. Workaround the resource conflict check by replacing devm_ioremap_resource() to devm_ioremap() instead. [1] https://developer.arm.com/documentation/ihi0050/latest/ Yushan Wang (2): soc cache: Add framework driver for HiSilicon SoC cache soc cache: Support cache maintenance for HiSilicon SoC Hydra Home Agent drivers/soc/hisilicon/Kconfig | 22 + drivers/soc/hisilicon/Makefile | 3 + .../soc/hisilicon/hisi_soc_cache_framework.c | 381 ++++++++++++++++++ .../soc/hisilicon/hisi_soc_cache_framework.h | 77 ++++ drivers/soc/hisilicon/hisi_soc_hha.c | 188 +++++++++ .../uapi/misc/hisi_soc_cache/hisi_soc_cache.h | 35 ++ 6 files changed, 706 insertions(+) create mode 100644 drivers/soc/hisilicon/hisi_soc_cache_framework.c create mode 100644 drivers/soc/hisilicon/hisi_soc_cache_framework.h create mode 100644 drivers/soc/hisilicon/hisi_soc_hha.c create mode 100644 include/uapi/misc/hisi_soc_cache/hisi_soc_cache.h -- 2.33.0

2 3

[PATCH 0/2] soc cache: Add support for HiSilicon L3 cache
by Yushan Wang 15 Apr '25

15 Apr '25

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IC15TR ---------------------------------------------------------------------- This series adds support for HiSilicon SoC cache lockdown and cache maintenance operations. Cache lockdown feature prevents cache entries from being evicted from L3 cache. It can be enabled by calling mmap function to the file (`/dev/hisi_soc_cache_mgmt`). This feature is implemented in the driver hisi_soc_l3c. Cache maintenance feature, following Arm64's CHI spec[1], enables users to raise certain transactions to the memory residing in the cache. This can be achieved by calling ioctl function to the same file as above. This feature is implemented in the driver hisi_soc_hha. L3 cache and L3 cache PMU share the same memory resource, which makes one fails to probe while another is on board. Since both devices rely on distinct information exported by ACPI, their probing functions should be unrelated. Workaround the resource conflict check by replacing devm_ioremap_resource() to devm_ioremap() instead. [1] https://developer.arm.com/documentation/ihi0050/latest/ Yushan Wang (2): soc cache: Add framework driver for HiSilicon SoC cache soc cache: Support cache maintenance for HiSilicon SoC Hydra Home Agent drivers/soc/hisilicon/Kconfig | 22 + drivers/soc/hisilicon/Makefile | 3 + .../soc/hisilicon/hisi_soc_cache_framework.c | 381 ++++++++++++++++++ .../soc/hisilicon/hisi_soc_cache_framework.h | 77 ++++ drivers/soc/hisilicon/hisi_soc_hha.c | 188 +++++++++ .../uapi/misc/hisi_soc_cache/hisi_soc_cache.h | 35 ++ 6 files changed, 706 insertions(+) create mode 100644 drivers/soc/hisilicon/hisi_soc_cache_framework.c create mode 100644 drivers/soc/hisilicon/hisi_soc_cache_framework.h create mode 100644 drivers/soc/hisilicon/hisi_soc_hha.c create mode 100644 include/uapi/misc/hisi_soc_cache/hisi_soc_cache.h -- 2.33.0

1 2

[PATCH OLK-6.6] RDMA/rxe: Remove the direct link to net_device
by Liu Jian 15 Apr '25

15 Apr '25

From: Zhu Yanjun <yanjun.zhu(a)linux.dev> mainline inclusion from mainline-v6.13-rc6 commit 2ac5415022d16d63d912a39a06f32f1f51140261 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBID2B CVE: CVE-2024-57795 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- The similar patch in siw is in the link: https://git.kernel.org/rdma/rdma/c/16b87037b48889 This problem also occurred in RXE. The following analyze this problem. In the following Call Traces: " BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0 net/core/dev.c:8782 Read of size 4 at addr ffff8880554640b0 by task kworker/1:4/5295 CPU: 1 UID: 0 PID: 5295 Comm: kworker/1:4 Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: infiniband ib_cache_event_task Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 dev_get_flags+0x188/0x1d0 net/core/dev.c:8782 rxe_query_port+0x12d/0x260 drivers/infiniband/sw/rxe/rxe_verbs.c:60 __ib_query_port drivers/infiniband/core/device.c:2111 [inline] ib_query_port+0x168/0x7d0 drivers/infiniband/core/device.c:2143 ib_cache_update+0x1a9/0xb80 drivers/infiniband/core/cache.c:1494 ib_cache_event_task+0xf3/0x1e0 drivers/infiniband/core/cache.c:1568 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> " 1). In the link [1], " infiniband syz2: set down " This means that on 839.350575, the event ib_cache_event_task was sent andi queued in ib_wq. 2). In the link [1], " team0 (unregistering): Port device team_slave_0 removed " It indicates that before 843.251853, the net device should be freed. 3). In the link [1], " BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0 " This means that on 850.559070, this slab-use-after-free problem occurred. In all, on 839.350575, the event ib_cache_event_task was sent and queued in ib_wq, before 843.251853, the net device veth was freed. on 850.559070, this event was executed, and the mentioned freed net device was called. Thus, the above call trace occurred. [1] https://syzkaller.appspot.com/x/log.txt?x=12e7025f980000 Reported-by: syzbot+4b87489410b4efd181bf(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4b87489410b4efd181bf Fixes: 8700e3e7c485 ("Soft RoCE driver") Signed-off-by: Zhu Yanjun <yanjun.zhu(a)linux.dev> Link: https://patch.msgid.link/20241220222325.2487767-1-yanjun.zhu@linux.dev Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/sw/rxe/rxe_net.c [Did not backport af48f95492dc.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/infiniband/sw/rxe/rxe.c | 23 +++++++++++++++++++---- drivers/infiniband/sw/rxe/rxe.h | 3 ++- drivers/infiniband/sw/rxe/rxe_mcast.c | 22 ++++++++++++++++++++-- drivers/infiniband/sw/rxe/rxe_net.c | 25 ++++++++++++++++++++----- drivers/infiniband/sw/rxe/rxe_verbs.c | 26 +++++++++++++++++++++----- drivers/infiniband/sw/rxe/rxe_verbs.h | 11 ++++++++--- 6 files changed, 90 insertions(+), 20 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c index 0f8356cea293..1fb4fa4514bf 100644 --- a/drivers/infiniband/sw/rxe/rxe.c +++ b/drivers/infiniband/sw/rxe/rxe.c @@ -40,6 +40,8 @@ void rxe_dealloc(struct ib_device *ib_dev) /* initialize rxe device parameters */ static void rxe_init_device_param(struct rxe_dev *rxe) { + struct net_device *ndev; + rxe->max_inline_data = RXE_MAX_INLINE_DATA; rxe->attr.vendor_id = RXE_VENDOR_ID; @@ -71,8 +73,15 @@ static void rxe_init_device_param(struct rxe_dev *rxe) rxe->attr.max_fast_reg_page_list_len = RXE_MAX_FMR_PAGE_LIST_LEN; rxe->attr.max_pkeys = RXE_MAX_PKEYS; rxe->attr.local_ca_ack_delay = RXE_LOCAL_CA_ACK_DELAY; + + ndev = rxe_ib_device_get_netdev(&rxe->ib_dev); + if (!ndev) + return; + addrconf_addr_eui48((unsigned char *)&rxe->attr.sys_image_guid, - rxe->ndev->dev_addr); + ndev->dev_addr); + + dev_put(ndev); rxe->max_ucontext = RXE_MAX_UCONTEXT; } @@ -109,10 +118,15 @@ static void rxe_init_port_param(struct rxe_port *port) static void rxe_init_ports(struct rxe_dev *rxe) { struct rxe_port *port = &rxe->port; + struct net_device *ndev; rxe_init_port_param(port); + ndev = rxe_ib_device_get_netdev(&rxe->ib_dev); + if (!ndev) + return; addrconf_addr_eui48((unsigned char *)&port->port_guid, - rxe->ndev->dev_addr); + ndev->dev_addr); + dev_put(ndev); spin_lock_init(&port->port_lock); } @@ -169,12 +183,13 @@ void rxe_set_mtu(struct rxe_dev *rxe, unsigned int ndev_mtu) /* called by ifc layer to create new rxe device. * The caller should allocate memory for rxe by calling ib_alloc_device. */ -int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name) +int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name, + struct net_device *ndev) { rxe_init(rxe); rxe_set_mtu(rxe, mtu); - return rxe_register_device(rxe, ibdev_name); + return rxe_register_device(rxe, ibdev_name, ndev); } static int rxe_newlink(const char *ibdev_name, struct net_device *ndev) diff --git a/drivers/infiniband/sw/rxe/rxe.h b/drivers/infiniband/sw/rxe/rxe.h index d8fb2c7af30a..fe7f97066732 100644 --- a/drivers/infiniband/sw/rxe/rxe.h +++ b/drivers/infiniband/sw/rxe/rxe.h @@ -139,7 +139,8 @@ enum resp_states { void rxe_set_mtu(struct rxe_dev *rxe, unsigned int dev_mtu); -int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name); +int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name, + struct net_device *ndev); void rxe_rcv(struct sk_buff *skb); diff --git a/drivers/infiniband/sw/rxe/rxe_mcast.c b/drivers/infiniband/sw/rxe/rxe_mcast.c index 86cc2e18a7fd..07ff47bae31d 100644 --- a/drivers/infiniband/sw/rxe/rxe_mcast.c +++ b/drivers/infiniband/sw/rxe/rxe_mcast.c @@ -31,10 +31,19 @@ static int rxe_mcast_add(struct rxe_dev *rxe, union ib_gid *mgid) { unsigned char ll_addr[ETH_ALEN]; + struct net_device *ndev; + int ret; + + ndev = rxe_ib_device_get_netdev(&rxe->ib_dev); + if (!ndev) + return -ENODEV; ipv6_eth_mc_map((struct in6_addr *)mgid->raw, ll_addr); - return dev_mc_add(rxe->ndev, ll_addr); + ret = dev_mc_add(ndev, ll_addr); + dev_put(ndev); + + return ret; } /** @@ -47,10 +56,19 @@ static int rxe_mcast_add(struct rxe_dev *rxe, union ib_gid *mgid) static int rxe_mcast_del(struct rxe_dev *rxe, union ib_gid *mgid) { unsigned char ll_addr[ETH_ALEN]; + struct net_device *ndev; + int ret; + + ndev = rxe_ib_device_get_netdev(&rxe->ib_dev); + if (!ndev) + return -ENODEV; ipv6_eth_mc_map((struct in6_addr *)mgid->raw, ll_addr); - return dev_mc_del(rxe->ndev, ll_addr); + ret = dev_mc_del(ndev, ll_addr); + dev_put(ndev); + + return ret; } /** diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c index e5827064ab1e..e2859bbc9a71 100644 --- a/drivers/infiniband/sw/rxe/rxe_net.c +++ b/drivers/infiniband/sw/rxe/rxe_net.c @@ -509,7 +509,16 @@ struct sk_buff *rxe_init_packet(struct rxe_dev *rxe, struct rxe_av *av, */ const char *rxe_parent_name(struct rxe_dev *rxe, unsigned int port_num) { - return rxe->ndev->name; + struct net_device *ndev; + char *ndev_name; + + ndev = rxe_ib_device_get_netdev(&rxe->ib_dev); + if (!ndev) + return NULL; + ndev_name = ndev->name; + dev_put(ndev); + + return ndev_name; } int rxe_net_add(const char *ibdev_name, struct net_device *ndev) @@ -521,9 +530,7 @@ int rxe_net_add(const char *ibdev_name, struct net_device *ndev) if (!rxe) return -ENOMEM; - rxe->ndev = ndev; - - err = rxe_add(rxe, ndev->mtu, ibdev_name); + err = rxe_add(rxe, ndev->mtu, ibdev_name, ndev); if (err) { ib_dealloc_device(&rxe->ib_dev); return err; @@ -571,10 +578,18 @@ void rxe_port_down(struct rxe_dev *rxe) void rxe_set_port_state(struct rxe_dev *rxe) { - if (netif_running(rxe->ndev) && netif_carrier_ok(rxe->ndev)) + struct net_device *ndev; + + ndev = rxe_ib_device_get_netdev(&rxe->ib_dev); + if (!ndev) + return; + + if (netif_running(ndev) && netif_carrier_ok(ndev)) rxe_port_up(rxe); else rxe_port_down(rxe); + + dev_put(ndev); } static int rxe_notify(struct notifier_block *not_blk, diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c index dbb9baa4ffd0..c4726f894fc2 100644 --- a/drivers/infiniband/sw/rxe/rxe_verbs.c +++ b/drivers/infiniband/sw/rxe/rxe_verbs.c @@ -41,6 +41,7 @@ static int rxe_query_port(struct ib_device *ibdev, u32 port_num, struct ib_port_attr *attr) { struct rxe_dev *rxe = to_rdev(ibdev); + struct net_device *ndev; int err, ret; if (port_num != 1) { @@ -49,6 +50,12 @@ static int rxe_query_port(struct ib_device *ibdev, goto err_out; } + ndev = rxe_ib_device_get_netdev(ibdev); + if (!ndev) { + err = -ENODEV; + goto err_out; + } + memcpy(attr, &rxe->port.attr, sizeof(*attr)); mutex_lock(&rxe->usdev_lock); @@ -57,13 +64,14 @@ static int rxe_query_port(struct ib_device *ibdev, if (attr->state == IB_PORT_ACTIVE) attr->phys_state = IB_PORT_PHYS_STATE_LINK_UP; - else if (dev_get_flags(rxe->ndev) & IFF_UP) + else if (dev_get_flags(ndev) & IFF_UP) attr->phys_state = IB_PORT_PHYS_STATE_POLLING; else attr->phys_state = IB_PORT_PHYS_STATE_DISABLED; mutex_unlock(&rxe->usdev_lock); + dev_put(ndev); return ret; err_out: @@ -1428,9 +1436,16 @@ static const struct attribute_group rxe_attr_group = { static int rxe_enable_driver(struct ib_device *ib_dev) { struct rxe_dev *rxe = container_of(ib_dev, struct rxe_dev, ib_dev); + struct net_device *ndev; + + ndev = rxe_ib_device_get_netdev(ib_dev); + if (!ndev) + return -ENODEV; rxe_set_port_state(rxe); - dev_info(&rxe->ib_dev.dev, "added %s\n", netdev_name(rxe->ndev)); + dev_info(&rxe->ib_dev.dev, "added %s\n", netdev_name(ndev)); + + dev_put(ndev); return 0; } @@ -1498,7 +1513,8 @@ static const struct ib_device_ops rxe_dev_ops = { INIT_RDMA_OBJ_SIZE(ib_mw, rxe_mw, ibmw), }; -int rxe_register_device(struct rxe_dev *rxe, const char *ibdev_name) +int rxe_register_device(struct rxe_dev *rxe, const char *ibdev_name, + struct net_device *ndev) { int err; struct ib_device *dev = &rxe->ib_dev; @@ -1510,13 +1526,13 @@ int rxe_register_device(struct rxe_dev *rxe, const char *ibdev_name) dev->num_comp_vectors = num_possible_cpus(); dev->local_dma_lkey = 0; addrconf_addr_eui48((unsigned char *)&dev->node_guid, - rxe->ndev->dev_addr); + ndev->dev_addr); dev->uverbs_cmd_mask |= BIT_ULL(IB_USER_VERBS_CMD_POST_SEND) | BIT_ULL(IB_USER_VERBS_CMD_REQ_NOTIFY_CQ); ib_set_device_ops(dev, &rxe_dev_ops); - err = ib_device_set_netdev(&rxe->ib_dev, rxe->ndev, 1); + err = ib_device_set_netdev(&rxe->ib_dev, ndev, 1); if (err) return err; diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h index ccb9d19ffe8a..4242b24a47da 100644 --- a/drivers/infiniband/sw/rxe/rxe_verbs.h +++ b/drivers/infiniband/sw/rxe/rxe_verbs.h @@ -369,6 +369,7 @@ struct rxe_port { u32 qp_gsi_index; }; +#define RXE_PORT 1 struct rxe_dev { struct ib_device ib_dev; struct ib_device_attr attr; @@ -376,8 +377,6 @@ struct rxe_dev { int max_inline_data; struct mutex usdev_lock; - struct net_device *ndev; - struct rxe_pool uc_pool; struct rxe_pool pd_pool; struct rxe_pool ah_pool; @@ -405,6 +404,11 @@ struct rxe_dev { struct crypto_shash *tfm; }; +static inline struct net_device *rxe_ib_device_get_netdev(struct ib_device *dev) +{ + return ib_device_get_netdev(dev, RXE_PORT); +} + static inline void rxe_counter_inc(struct rxe_dev *rxe, enum rxe_counters index) { atomic64_inc(&rxe->stats_counters[index]); @@ -470,6 +474,7 @@ static inline struct rxe_pd *rxe_mw_pd(struct rxe_mw *mw) return to_rpd(mw->ibmw.pd); } -int rxe_register_device(struct rxe_dev *rxe, const char *ibdev_name); +int rxe_register_device(struct rxe_dev *rxe, const char *ibdev_name, + struct net_device *ndev); #endif /* RXE_VERBS_H */ -- 2.34.1

2 1

[openeuler:OLK-6.6 2123/2123] vmlinux.o: warning: objtool: kasan_report+0x10b: RET before UNTRAIN
by kernel test robot 15 Apr '25

15 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 8e04020e957c517ad3fb6bb3caa90e037dc3d5b8 commit: b73666e1e9554c77a69a647427cf77782e0bd9aa [2123/2123] x86/xen: don't do PV iret hypercall through hypercall page config: x86_64-buildonly-randconfig-002-20250415 (https://download.01.org/0day-ci/archive/20250415/202504150515.bR3H6UHH-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250415/202504150515.bR3H6UHH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504150515.bR3H6UHH-lkp@intel.com/ All warnings (new ones prefixed by >>): >> vmlinux.o: warning: objtool: kasan_report+0x10b: RET before UNTRAIN -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2861/2861] llvm-objcopy: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory
by kernel test robot 15 Apr '25

15 Apr '25

Hi Sean, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 1afd05e282420aba2d2fc2132a8c2e52d4d9b253 commit: 5476cb89ef2297bd36f8b38e27b54617b6f63236 [2861/2861] x86/vdso: Implement a vDSO for Intel SGX enclave call config: x86_64-buildonly-randconfig-003-20250414 (https://download.01.org/0day-ci/archive/20250415/202504150150.pd024mOU-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250415/202504150150.pd024mOU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504150150.pd024mOU-lkp@intel.com/ All errors (new ones prefixed by >>): >> llvm-objcopy: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 v8 0/7] Add support for IPIv
by Jinqian Yang 14 Apr '25

14 Apr '25

Patch#1 Allocate VM table and save vpeid in it Patch#2 avoid sending multi-SGIs in IPIV Patch#3 Set base address of vm table and targe ITS when vpe schedule and deschedule Patch#4 Register ipiv exception interrupt Patch#5 Add interface KVM_CAP_ARM_IPIV_MODE Patch#6 Probe and configure IPIV capacity on HIP12 Patch#7 Use KABI_EXTEND to perform kabi repair for IPIV Jinqian Yang (2): kvm: arm64: avoid sending multi-SGIs in IPIV kabi: Use KABI_EXTEND to perform kabi repair for IPIV Xiang Chen (5): kvm: hisi_virt: Allocate VM table and save vpeid in it irqchip: gicv3-its: Set base address of vm table and targe ITS when vpe schedule and deschedule kvm: hisi_virt: Register ipiv exception interrupt kvm: arm64: Add interface KVM_CAP_ARM_IPIV_MODE kvm: hisi_virt: Probe and configure IPIV capacity on HIP12 .../admin-guide/kernel-parameters.txt | 3 + arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/include/asm/sysreg.h | 3 + arch/arm64/kvm/arm.c | 16 +++ arch/arm64/kvm/hisilicon/hisi_virt.c | 38 ++++++++ arch/arm64/kvm/hisilicon/hisi_virt.h | 11 +++ arch/arm64/kvm/sys_regs.c | 11 +++ arch/arm64/kvm/vgic/vgic-init.c | 44 ++++++++- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 1 + drivers/irqchip/irq-gic-v3-its.c | 97 ++++++++++++++++++- drivers/irqchip/irq-gic-v3.c | 33 +++++++ include/linux/irqchip/arm-gic-v3.h | 24 +++++ include/linux/irqchip/arm-gic-v4.h | 2 + include/uapi/linux/kvm.h | 2 + 14 files changed, 282 insertions(+), 4 deletions(-) -- 2.33.0

2 8

[PATCH OLK-6.6] perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12
by Yushan Wang 14 Apr '25

14 Apr '25

From: Yicong Yang <yangyicong(a)hisilicon.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IC07S9 ---------------------------------------------------------------------- Add data source encoding for HiSilicon HIP12 and coresponding mapping to the perf's memory data source. This will help to synthesize the data and support upper layer tools like perf-mem and perf-c2c. Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Signed-off-by: Yushan Wang <wangyushan12(a)huawei.com> Signed-off-by: Qizhi Zhang <zhangqizhi3(a)h-partners.com> --- arch/arm64/include/asm/cputype.h | 2 + tools/arch/arm64/include/asm/cputype.h | 2 + .../util/arm-spe-decoder/arm-spe-decoder.h | 17 +++ tools/perf/util/arm-spe.c | 103 ++++++++++++++++++ 4 files changed, 124 insertions(+) diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h index 5c1cadeb032d..ae983d335456 100644 --- a/arch/arm64/include/asm/cputype.h +++ b/arch/arm64/include/asm/cputype.h @@ -137,6 +137,7 @@ #define HISI_CPU_PART_TSV110 0xD01 #define HISI_CPU_PART_LINXICORE9100 0xD02 +#define HISI_CPU_PART_HIP12 0xD06 #define APPLE_CPU_PART_M1_ICESTORM 0x022 #define APPLE_CPU_PART_M1_FIRESTORM 0x023 @@ -217,6 +218,7 @@ #define MIDR_FUJITSU_A64FX MIDR_CPU_MODEL(ARM_CPU_IMP_FUJITSU, FUJITSU_CPU_PART_A64FX) #define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110) #define MIDR_HISI_LINXICORE9100 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_LINXICORE9100) +#define MIDR_HISI_HIP12 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_HIP12) #define MIDR_APPLE_M1_ICESTORM MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM) #define MIDR_APPLE_M1_FIRESTORM MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM) #define MIDR_APPLE_M1_ICESTORM_PRO MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM_PRO) diff --git a/tools/arch/arm64/include/asm/cputype.h b/tools/arch/arm64/include/asm/cputype.h index 329d41f8c923..8ade4dc85fcb 100644 --- a/tools/arch/arm64/include/asm/cputype.h +++ b/tools/arch/arm64/include/asm/cputype.h @@ -120,6 +120,7 @@ #define FUJITSU_CPU_PART_A64FX 0x001 #define HISI_CPU_PART_TSV110 0xD01 +#define HISI_CPU_PART_HIP12 0xD06 #define APPLE_CPU_PART_M1_ICESTORM 0x022 #define APPLE_CPU_PART_M1_FIRESTORM 0x023 @@ -183,6 +184,7 @@ #define MIDR_NVIDIA_CARMEL MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_CARMEL) #define MIDR_FUJITSU_A64FX MIDR_CPU_MODEL(ARM_CPU_IMP_FUJITSU, FUJITSU_CPU_PART_A64FX) #define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110) +#define MIDR_HISI_HIP12 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_HIP12) #define MIDR_APPLE_M1_ICESTORM MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM) #define MIDR_APPLE_M1_FIRESTORM MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM) #define MIDR_APPLE_M1_ICESTORM_PRO MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM_PRO) diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h index 1443c28545a9..713d778a4fad 100644 --- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h @@ -67,6 +67,23 @@ enum arm_spe_neoverse_data_source { ARM_SPE_NV_DRAM = 0xe, }; +enum arm_spe_hisi_hip_data_source { + ARM_SPE_HISI_HIP_PEER_CPU = 0, + ARM_SPE_HISI_HIP_PEER_CPU_HITM = 1, + ARM_SPE_HISI_HIP_L3 = 2, + ARM_SPE_HISI_HIP_L3_HITM = 3, + ARM_SPE_HISI_HIP_PEER_CLUSTER = 4, + ARM_SPE_HISI_HIP_PEER_CLUSTER_HITM = 5, + ARM_SPE_HISI_HIP_REMOTE_SOCKET = 6, + ARM_SPE_HISI_HIP_REMOTE_SOCKET_HITM = 7, + ARM_SPE_HISI_HIP_LOCAL = 8, + ARM_SPE_HISI_HIP_REMOTE = 9, + ARM_SPE_HISI_HIP_NC_DEV = 13, + ARM_SPE_HISI_HIP_L2 = 16, + ARM_SPE_HISI_HIP_L2_HITM = 17, + ARM_SPE_HISI_HIP_L1 = 18, +}; + struct arm_spe_record { enum arm_spe_sample_type type; int err; diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c index afbd5869f6bf..dbc437532fb7 100644 --- a/tools/perf/util/arm-spe.c +++ b/tools/perf/util/arm-spe.c @@ -416,6 +416,11 @@ static const struct midr_range neoverse_spe[] = { {}, }; +static const struct midr_range hisi_hip_ds_encoding_cpus[] = { + MIDR_ALL_VERSIONS(MIDR_HISI_HIP12), + {}, +}; + static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *record, union perf_mem_data_src *data_src) { @@ -515,10 +520,106 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco data_src->mem_lvl |= PERF_MEM_LVL_REM_CCE1; } +static void arm_spe__synth_data_source_hisi_hip(const struct arm_spe_record *record, + union perf_mem_data_src *data_src) +{ + /* Use common synthesis method to handle store operations */ + if (record->op & ARM_SPE_OP_ST) { + arm_spe__synth_data_source_generic(record, data_src); + return; + } + + switch (record->source) { + case ARM_SPE_HISI_HIP_PEER_CPU: + data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; + break; + case ARM_SPE_HISI_HIP_PEER_CPU_HITM: + data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3; + data_src->mem_snoop = PERF_MEM_SNOOP_HITM; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; + break; + case ARM_SPE_HISI_HIP_L3: + data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; + break; + case ARM_SPE_HISI_HIP_L3_HITM: + data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3; + data_src->mem_snoop = PERF_MEM_SNOOP_HITM; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; + break; + case ARM_SPE_HISI_HIP_PEER_CLUSTER: + data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; + break; + case ARM_SPE_HISI_HIP_PEER_CLUSTER_HITM: + data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3; + data_src->mem_snoop = PERF_MEM_SNOOP_HITM; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; + break; + case ARM_SPE_HISI_HIP_REMOTE_SOCKET: + data_src->mem_lvl = PERF_MEM_LVL_REM_CCE2; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE; + data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; + break; + case ARM_SPE_HISI_HIP_REMOTE_SOCKET_HITM: + data_src->mem_lvl = PERF_MEM_LVL_REM_CCE2; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE; + data_src->mem_snoop = PERF_MEM_SNOOP_HITM; + data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; + break; + case ARM_SPE_HISI_HIP_LOCAL: + data_src->mem_lvl = PERF_MEM_LVL_LOC_RAM | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_RAM; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; + break; + case ARM_SPE_HISI_HIP_REMOTE: + data_src->mem_lvl = PERF_MEM_LVL_REM_RAM1 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_RAM; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; + data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; + break; + case ARM_SPE_HISI_HIP_NC_DEV: + data_src->mem_lvl = PERF_MEM_LVL_IO | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_IO; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; + break; + case ARM_SPE_HISI_HIP_L2: + data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; + break; + case ARM_SPE_HISI_HIP_L2_HITM: + data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2; + data_src->mem_snoop = PERF_MEM_SNOOP_HITM; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; + break; + case ARM_SPE_HISI_HIP_L1: + data_src->mem_lvl = PERF_MEM_LVL_L1 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L1; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; + break; + default: + break; + } +} + static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr) { union perf_mem_data_src data_src = { .mem_op = PERF_MEM_OP_NA }; bool is_neoverse = is_midr_in_range_list(midr, neoverse_spe); + bool is_hisilicon = is_midr_in_range_list(midr, hisi_hip_ds_encoding_cpus); if (record->op & ARM_SPE_OP_LD) data_src.mem_op = PERF_MEM_OP_LOAD; @@ -529,6 +630,8 @@ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 m if (is_neoverse) arm_spe__synth_data_source_neoverse(record, &data_src); + else if (is_hisilicon) + arm_spe__synth_data_source_hisi_hip(record, &data_src); else arm_spe__synth_data_source_generic(record, &data_src); -- 2.33.0

2 1

[PATCH OLK-6.6] perf arm64: kprobe: Enable OPTPROBE for arm64
by Yushan Wang 14 Apr '25

14 Apr '25

From: Qinxin Xia <xiaqinxin(a)huawei.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IC0ZB4 ---------------------------------------------------------------------- This patch introduce optprobe for ARM64. In optprobe, probed instruction is replaced by a branch instruction to trampoline. Performance of optprobe on Hip08 platform is test using kprobe example module to analyze the latency of a kernel function, and here is the result: common kprobe: [280709.846380] do_empty returned 0 and took 1530 ns to execute [280709.852057] do_empty returned 0 and took 550 ns to execute [280709.857631] do_empty returned 0 and took 440 ns to execute [280709.863215] do_empty returned 0 and took 380 ns to execute [280709.868787] do_empty returned 0 and took 360 ns to execute [280709.874362] do_empty returned 0 and took 340 ns to execute [280709.879936] do_empty returned 0 and took 320 ns to execute [280709.885505] do_empty returned 0 and took 300 ns to execute [280709.891075] do_empty returned 0 and took 280 ns to execute [280709.896646] do_empty returned 0 and took 290 ns to execute optprobe: [ 2965.964572] do_empty returned 0 and took 90 ns to execute [ 2965.969952] do_empty returned 0 and took 80 ns to execute [ 2965.975332] do_empty returned 0 and took 70 ns to execute [ 2965.980714] do_empty returned 0 and took 60 ns to execute [ 2965.986128] do_empty returned 0 and took 80 ns to execute [ 2965.991507] do_empty returned 0 and took 70 ns to execute [ 2965.996884] do_empty returned 0 and took 70 ns to execute [ 2966.002262] do_empty returned 0 and took 80 ns to execute [ 2966.007642] do_empty returned 0 and took 70 ns to execute [ 2966.013020] do_empty returned 0 and took 70 ns to execute [ 2966.018400] do_empty returned 0 and took 70 ns to execute As the result shows, optprobe can greatly reduce the latency. Big latency of common kprobe will significantly impact the real result while doing performance analysis or debugging performance issues in lab, so optprobe is useful in this scenario. The trampoline design is illustrated in the following diagram. Some commands will be replaced in arch_prepare_optimized_kprobe. +------------------optprobe_template_entry---------------------+ |- Saving stacks and registers | |- Loading params for callback | +------------------optprobe_template_common--------------------+ |- nop | |(replaced to the branch jump to optprobe_common) | |- Restore stacks and registers | +-------------optprobe_template_restore_orig_insn--------------+ |- nop | |(replaced to the kprobe->opcode) | +----------------optprobe_template_restore_end-----------------+ |- nop | |(replaced to next address of the probe point) | +------------------optprobe_template_val-----------------------+ |- 0 (two 32-bit words) | |(replaced to params for optprobe_optimized_callback) | +-----------------optprobe_template_orig_addr------------------+ |- 0 (two 32-bit words) | |(replaced to origin probe point address) | +-------------------optprobe_template_end----------------------+ |- nop | +--------------------------------------------------------------+ Co-developed-by: Qi Liu <liuqi115(a)huawei.com> Signed-off-by: Qi Liu <liuqi115(a)huawei.com> Signed-off-by: Qinxin Xia <xiaqinxin(a)huawei.com> Signed-off-by: Qizhi Zhang <zhangqizhi3(a)h-partners.com> Signed-off-by: Yushan Wang <wangyushan12(a)huawei.com> --- arch/arm64/Kconfig | 1 + arch/arm64/include/asm/kprobes.h | 22 ++ arch/arm64/kernel/probes/Makefile | 2 + arch/arm64/kernel/probes/opt_arm64.c | 243 ++++++++++++++++++ .../arm64/kernel/probes/optprobe_trampoline.S | 113 ++++++++ 5 files changed, 381 insertions(+) create mode 100644 arch/arm64/kernel/probes/opt_arm64.c create mode 100644 arch/arm64/kernel/probes/optprobe_trampoline.S diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 9da9d58f1c02..194051628457 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -240,6 +240,7 @@ config ARM64 select HAVE_SYSCALL_TRACEPOINTS select HAVE_KPROBES select HAVE_KRETPROBES + select HAVE_OPTPROBES select HAVE_GENERIC_VDSO select HOTPLUG_CORE_SYNC_DEAD if HOTPLUG_CPU select HOTPLUG_SMT if (SMP && HOTPLUG_CPU) diff --git a/arch/arm64/include/asm/kprobes.h b/arch/arm64/include/asm/kprobes.h index 05cd82eeca13..e4972645a381 100644 --- a/arch/arm64/include/asm/kprobes.h +++ b/arch/arm64/include/asm/kprobes.h @@ -39,6 +39,28 @@ void arch_remove_kprobe(struct kprobe *); int kprobe_fault_handler(struct pt_regs *regs, unsigned int fsr); int kprobe_exceptions_notify(struct notifier_block *self, unsigned long val, void *data); + +struct arch_optimized_insn { + kprobe_opcode_t orig_insn[1]; + kprobe_opcode_t *trampoline; +}; + +#define MAX_OPTIMIZED_LENGTH sizeof(kprobe_opcode_t) +#define MAX_OPTINSN_SIZE \ + ((unsigned long)optprobe_template_end - (unsigned long)optprobe_template_entry) + +extern __visible kprobe_opcode_t optprobe_template_entry[]; +extern __visible kprobe_opcode_t optprobe_template_val[]; +extern __visible kprobe_opcode_t optprobe_template_orig_addr[]; +extern __visible kprobe_opcode_t optprobe_template_common[]; +extern __visible kprobe_opcode_t optprobe_template_end[]; +extern __visible kprobe_opcode_t optprobe_template_restore_begin[]; +extern __visible kprobe_opcode_t optprobe_template_restore_orig_insn[]; +extern __visible kprobe_opcode_t optprobe_template_restore_end[]; +extern __visible kprobe_opcode_t optinsn_slot[]; + +void optprobe_common(void); + void __kretprobe_trampoline(void); void __kprobes *trampoline_probe_handler(struct pt_regs *regs); diff --git a/arch/arm64/kernel/probes/Makefile b/arch/arm64/kernel/probes/Makefile index 8e4be92e25b1..7b2885b23ff6 100644 --- a/arch/arm64/kernel/probes/Makefile +++ b/arch/arm64/kernel/probes/Makefile @@ -4,3 +4,5 @@ obj-$(CONFIG_KPROBES) += kprobes.o decode-insn.o \ simulate-insn.o obj-$(CONFIG_UPROBES) += uprobes.o decode-insn.o \ simulate-insn.o +obj-$(CONFIG_OPTPROBES) += opt_arm64.o \ + optprobe_trampoline.o diff --git a/arch/arm64/kernel/probes/opt_arm64.c b/arch/arm64/kernel/probes/opt_arm64.c new file mode 100644 index 000000000000..976ab264350d --- /dev/null +++ b/arch/arm64/kernel/probes/opt_arm64.c @@ -0,0 +1,243 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Code for Kernel probes Jump optimization. + * + * Copyright (C) 2025 HiSilicon Limited + */ + +#include <linux/jump_label.h> +#include <linux/kprobes.h> + +#include <asm/cacheflush.h> +#include <asm/compiler.h> +#include <asm/insn.h> +#include <asm/kprobes.h> +#include <asm/patching.h> + +#define OPTPROBE_BATCH_SIZE 64 + +#define TMPL_VAL_IDX \ + (optprobe_template_val - optprobe_template_entry) +#define TMPL_ORIGN_ADDR \ + (optprobe_template_orig_addr - optprobe_template_entry) +#define TMPL_CALL_COMMON \ + (optprobe_template_common - optprobe_template_entry) +#define TMPL_RESTORE_ORIGN_INSN \ + (optprobe_template_restore_orig_insn - optprobe_template_entry) +#define TMPL_RESTORE_END \ + (optprobe_template_restore_end - optprobe_template_entry) + +#define OPT_SLOT_SIZE 65536 +#define OPT_INSN_PAGES (OPT_SLOT_SIZE / PAGE_SIZE) + +static bool insn_page_in_use[OPT_INSN_PAGES]; + +void *alloc_optinsn_page(void) +{ + int i; + + for (i = 0; i < OPT_INSN_PAGES; i++) { + if (!insn_page_in_use[i]) { + insn_page_in_use[i] = true; + return (void *)((unsigned long)optinsn_slot + PAGE_SIZE * i); + } + } + + return NULL; +} + +void free_optinsn_page(void *page) +{ + unsigned long idx = (unsigned long)page - (unsigned long)optinsn_slot; + + WARN_ONCE(idx & (PAGE_SIZE - 1), "Invalid idx with wrong align\n"); + idx >>= PAGE_SHIFT; + if (WARN_ONCE(idx >= OPT_INSN_PAGES, "Invalid idx with wrong size\n")) + return; + insn_page_in_use[idx] = false; +} + +/* + * In ARM ISA, kprobe opt always replace one instruction (4 bytes + * aligned and 4 bytes long). It is impossible to encounter another + * kprobe in the address range. So always return 0. + */ +int arch_check_optimized_kprobe(struct optimized_kprobe *op) +{ + return 0; +} + +int arch_prepared_optinsn(struct arch_optimized_insn *optinsn) +{ + return optinsn->trampoline != NULL; +} + +int arch_within_optimized_kprobe(struct optimized_kprobe *op, kprobe_opcode_t *addr) +{ + return op->kp.addr == addr; +} + +static int optprobe_check_branch_limit(unsigned long pc, unsigned long addr) +{ + long offset; + + if ((pc & 0x3) || (addr & 0x3)) + return -ERANGE; + + offset = (long)addr - (long)pc; + if (offset < -SZ_128M || offset >= SZ_128M) + return -ERANGE; + + return 0; +} + +int arch_prepare_optimized_kprobe(struct optimized_kprobe *op, struct kprobe *orig) +{ + kprobe_opcode_t *code, *buf; + int ret = -ENOMEM; + u32 insn; + int i; + + buf = kzalloc(MAX_OPTINSN_SIZE, GFP_KERNEL); + if (!buf) + return ret; + + code = get_optinsn_slot(); + if (!code) + goto out; + + if (optprobe_check_branch_limit((unsigned long)code, (unsigned long)orig->addr + 8)) { + ret = -ERANGE; + goto error; + } + + memcpy(buf, optprobe_template_entry, MAX_OPTINSN_SIZE); + + insn = aarch64_insn_gen_branch_imm((unsigned long)&code[TMPL_CALL_COMMON], + (unsigned long)&optprobe_common, + AARCH64_INSN_BRANCH_LINK); + if (insn == AARCH64_BREAK_FAULT) { + ret = -ERANGE; + goto error; + } + + buf[TMPL_CALL_COMMON] = insn; + + insn = aarch64_insn_gen_branch_imm((unsigned long)&code[TMPL_RESTORE_END], + (unsigned long)(op->kp.addr + 1), + AARCH64_INSN_BRANCH_NOLINK); + if (insn == AARCH64_BREAK_FAULT) { + ret = -ERANGE; + goto error; + } + + buf[TMPL_RESTORE_END] = insn; + + buf[TMPL_VAL_IDX] = cpu_to_le32(lower_32_bits((unsigned long)op)); + buf[TMPL_VAL_IDX + 1] = cpu_to_le32(upper_32_bits((unsigned long)op)); + buf[TMPL_ORIGN_ADDR] = cpu_to_le32(lower_32_bits((unsigned long)orig->addr)); + buf[TMPL_ORIGN_ADDR + 1] = cpu_to_le32(upper_32_bits((unsigned long)orig->addr)); + + buf[TMPL_RESTORE_ORIGN_INSN] = orig->opcode; + + /* Setup template */ + for (i = 0; i < MAX_OPTINSN_SIZE / MAX_OPTIMIZED_LENGTH; i++) + aarch64_insn_patch_text_nosync(code + i, buf[i]); + + flush_icache_range((unsigned long)code, (unsigned long)(&code[TMPL_VAL_IDX])); + /* Set op->optinsn.trampoline means prepared. */ + op->optinsn.trampoline = code; + + return 0; +error: + free_optinsn_slot(code, 0); + +out: + kfree(buf); + return ret; +} + +void arch_optimize_kprobes(struct list_head *oplist) +{ + struct optimized_kprobe *op, *tmp; + kprobe_opcode_t insns[OPTPROBE_BATCH_SIZE]; + void *addrs[OPTPROBE_BATCH_SIZE]; + int i = 0; + + list_for_each_entry_safe(op, tmp, oplist, list) { + WARN_ON(kprobe_disabled(&op->kp)); + + /* + * Backup instructions which will be replaced + * by jump address + */ + memcpy(op->optinsn.orig_insn, op->kp.addr, AARCH64_INSN_SIZE); + + addrs[i] = op->kp.addr; + insns[i] = aarch64_insn_gen_branch_imm((unsigned long)op->kp.addr, + (unsigned long)op->optinsn.trampoline, + AARCH64_INSN_BRANCH_NOLINK); + + list_del_init(&op->list); + if (++i == OPTPROBE_BATCH_SIZE) + break; + } + + aarch64_insn_patch_text(addrs, insns, i); +} + +void arch_unoptimize_kprobe(struct optimized_kprobe *op) +{ + arch_arm_kprobe(&op->kp); +} + +/* + * Recover original instructions and breakpoints from relative jumps. + * Caller must call with locking kprobe_mutex. + */ +void arch_unoptimize_kprobes(struct list_head *oplist, + struct list_head *done_list) +{ + struct optimized_kprobe *op, *tmp; + kprobe_opcode_t insns[OPTPROBE_BATCH_SIZE]; + void *addrs[OPTPROBE_BATCH_SIZE]; + int i = 0; + + list_for_each_entry_safe(op, tmp, oplist, list) { + addrs[i] = op->kp.addr; + insns[i] = BRK64_OPCODE_KPROBES; + list_move(&op->list, done_list); + + if (++i == OPTPROBE_BATCH_SIZE) + break; + } + + aarch64_insn_patch_text(addrs, insns, i); +} + +void arch_remove_optimized_kprobe(struct optimized_kprobe *op) +{ + if (op->optinsn.trampoline) { + free_optinsn_slot(op->optinsn.trampoline, 1); + op->optinsn.trampoline = NULL; + } + +} + +void optprobe_optimized_callback(struct optimized_kprobe *op, struct pt_regs *regs) +{ + if (kprobe_disabled(&op->kp)) + return; + + guard(preempt)(); + + if (kprobe_running()) { + kprobes_inc_nmissed_count(&op->kp); + } else { + __this_cpu_write(current_kprobe, &op->kp); + get_kprobe_ctlblk()->kprobe_status = KPROBE_HIT_ACTIVE; + opt_pre_handler(&op->kp, regs); + __this_cpu_write(current_kprobe, NULL); + } +} +NOKPROBE_SYMBOL(optprobe_optimized_callback) diff --git a/arch/arm64/kernel/probes/optprobe_trampoline.S b/arch/arm64/kernel/probes/optprobe_trampoline.S new file mode 100644 index 000000000000..d08f39c5d8c5 --- /dev/null +++ b/arch/arm64/kernel/probes/optprobe_trampoline.S @@ -0,0 +1,113 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * trampoline entry and return code for optprobes. + */ + +#include <linux/linkage.h> +#include <asm/asm-offsets.h> +#include <asm/assembler.h> + +#define OPT_SLOT_SIZE 65536 + + .global optinsn_slot +optinsn_slot: + .space OPT_SLOT_SIZE + +SYM_CODE_START(optprobe_common) + stp x2, x3, [sp, #S_X2] + stp x4, x5, [sp, #S_X4] + stp x6, x7, [sp, #S_X6] + stp x8, x9, [sp, #S_X8] + stp x10, x11, [sp, #S_X10] + stp x12, x13, [sp, #S_X12] + stp x14, x15, [sp, #S_X14] + stp x16, x17, [sp, #S_X16] + stp x18, x19, [sp, #S_X18] + stp x20, x21, [sp, #S_X20] + stp x22, x23, [sp, #S_X22] + stp x24, x25, [sp, #S_X24] + stp x26, x27, [sp, #S_X26] + stp x28, x29, [sp, #S_X28] + add x2, sp, #PT_REGS_SIZE + str x2, [sp, #S_SP] + /* Construct a useful saved PSTATE */ + mrs x2, nzcv + mrs x3, daif + orr x2, x2, x3 + mrs x3, CurrentEL + orr x2, x2, x3 + mrs x3, SPSel + orr x2, x2, x3 + stp x1, x2, [sp, #S_PC] + + /* set the pt_regs address to x1 */ + mov x1, sp + /* store lr of optprobe_common temporary */ + stp x29, x30, [sp, #-16]! + mov x29, sp + + bl optprobe_optimized_callback + + ldp x29, x30, [sp], #16 + + ldr x0, [sp, #S_PSTATE] + and x0, x0, #(PSR_N_BIT | PSR_Z_BIT | PSR_C_BIT | PSR_V_BIT) + msr nzcv, x0 + + ldp x0, x1, [sp, #S_X0] + ldp x2, x3, [sp, #S_X2] + ldp x4, x5, [sp, #S_X4] + ldp x6, x7, [sp, #S_X6] + ldp x8, x9, [sp, #S_X8] + ldp x10, x11, [sp, #S_X10] + ldp x12, x13, [sp, #S_X12] + ldp x14, x15, [sp, #S_X14] + ldp x16, x17, [sp, #S_X16] + ldp x18, x19, [sp, #S_X18] + ldp x20, x21, [sp, #S_X20] + ldp x22, x23, [sp, #S_X22] + ldp x24, x25, [sp, #S_X24] + ldp x26, x27, [sp, #S_X26] + ldp x28, x29, [sp, #S_X28] + ret +SYM_CODE_END(optprobe_common) + + .global optprobe_template_entry +optprobe_template_entry: + stp x29, x30, [sp, #-16]! + mov x29, sp + ldr x30, 2f + stp x29, x30, [sp, #-16]! + mov x29, sp + sub sp, sp, #PT_REGS_SIZE + str lr, [sp, #S_LR] + stp x0, x1, [sp, #S_X0] + /* Get parameters to optimized_callback() */ + ldr x0, 1f + ldr x1, 2f + .global optprobe_template_common +optprobe_template_common: + nop + ldr lr, [sp, #S_LR] + add sp, sp, #PT_REGS_SIZE + ldp x29, x30, [sp], #16 + ldp x29, x30, [sp], #16 + .global optprobe_template_restore_orig_insn +optprobe_template_restore_orig_insn: + nop + .global optprobe_template_restore_end +optprobe_template_restore_end: + nop + .balign + .global optprobe_template_val +optprobe_template_val: + 1: .long 0 + .long 0 + .balign + .global optprobe_template_orig_addr +optprobe_template_orig_addr: + 2: .long 0 + .long 0 + .global optprobe_template_end +optprobe_template_end: + nop -- 2.33.0

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2025-22013
by Huang Xiaojia 14 Apr '25

14 Apr '25

*** BLURB HERE *** Mark Rutland (1): KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state Yue Haibing (1): arm64/fpsimd: Remove unused declaration fpsimd_kvm_prepare() arch/arm64/include/asm/fpsimd.h | 1 - arch/arm64/kernel/fpsimd.c | 25 ------------------------- arch/arm64/kvm/fpsimd.c | 33 +++++++++------------------------ 3 files changed, 9 insertions(+), 50 deletions(-) -- 2.34.1

2 3

[openeuler:OLK-6.6 2121/2121] mm/kasan/shadow.c:90: undefined reference to `__memcpy_mc'
by kernel test robot 14 Apr '25

14 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 856215a06729654f070692189189edc4570084a0 commit: b991780c836ceb9a479c6c6e385e914b487e353a [2121/2121] arm64: introduce copy_mc_to_kernel() implementation config: arm64-randconfig-003-20250414 (https://download.01.org/0day-ci/archive/20250414/202504142028.WisA9n7Q-lkp@…) compiler: aarch64-linux-gcc (GCC) 8.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250414/202504142028.WisA9n7Q-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504142028.WisA9n7Q-lkp@intel.com/ All errors (new ones prefixed by >>): aarch64-linux-ld: Unexpected GOT/PLT entries detected! aarch64-linux-ld: Unexpected run-time procedure linkages detected! aarch64-linux-ld: mm/kasan/shadow.o: in function `memcpy_mc': >> mm/kasan/shadow.c:90: undefined reference to `__memcpy_mc' vim +90 mm/kasan/shadow.c 81 82 #ifdef __HAVE_ARCH_MEMCPY_MC 83 #undef memcpy_mc 84 int memcpy_mc(void *dest, const void *src, size_t len) 85 { 86 if (!kasan_check_range(src, len, false, _RET_IP_) || 87 !kasan_check_range(dest, len, true, _RET_IP_)) 88 return (int)len; 89 > 90 return __memcpy_mc(dest, src, len); 91 } 92 #endif 93 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] crypto: loongson: add wst se chip support
by Hongchen Zhang 14 Apr '25

14 Apr '25

From: Qunqin Zhao <zhaoqunqin(a)loongson.cn> LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IC1081 CVE: NA -------------------------------- Add support for WST se chip support for LS*5000*. Signed-off-by: Qunqin Zhao <zhaoqunqin(a)loongson.cn> --- arch/loongarch/configs/loongson3_defconfig | 1 + drivers/crypto/Kconfig | 1 + drivers/crypto/Makefile | 1 + drivers/crypto/sedriver/Kconfig | 8 + drivers/crypto/sedriver/Makefile | 7 + drivers/crypto/sedriver/wst_se_common_type.h | 98 ++ drivers/crypto/sedriver/wst_se_define.h | 27 + drivers/crypto/sedriver/wst_se_echip_driver.c | 1368 +++++++++++++++++ drivers/crypto/sedriver/wst_se_echip_driver.h | 184 +++ drivers/crypto/sedriver/wst_se_ktrans.h | 17 + 10 files changed, 1712 insertions(+) create mode 100644 drivers/crypto/sedriver/Kconfig create mode 100644 drivers/crypto/sedriver/Makefile create mode 100644 drivers/crypto/sedriver/wst_se_common_type.h create mode 100644 drivers/crypto/sedriver/wst_se_define.h create mode 100644 drivers/crypto/sedriver/wst_se_echip_driver.c create mode 100644 drivers/crypto/sedriver/wst_se_echip_driver.h create mode 100644 drivers/crypto/sedriver/wst_se_ktrans.h diff --git a/arch/loongarch/configs/loongson3_defconfig b/arch/loongarch/configs/loongson3_defconfig index 980f5f2c99a1..cf359d1a2554 100644 --- a/arch/loongarch/configs/loongson3_defconfig +++ b/arch/loongarch/configs/loongson3_defconfig @@ -2177,6 +2177,7 @@ CONFIG_CRYPTO_CRC32_LOONGARCH=m CONFIG_CRYPTO_DEV_NITROX_CNN55XX=m CONFIG_CRYPTO_DEV_CHELSIO=m CONFIG_CRYPTO_DEV_VIRTIO=m +CONFIG_SW_SE_CHIP=m CONFIG_SIGNED_PE_FILE_VERIFICATION=y CONFIG_SECONDARY_TRUSTED_KEYRING=y CONFIG_SYSTEM_BLACKLIST_KEYRING=y diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig index b84a921d293f..efd6a855bca3 100644 --- a/drivers/crypto/Kconfig +++ b/drivers/crypto/Kconfig @@ -836,5 +836,6 @@ config CRYPTO_DEV_SA2UL source "drivers/crypto/aspeed/Kconfig" source "drivers/crypto/starfive/Kconfig" source "drivers/crypto/montage/Kconfig" +source "drivers/crypto/sedriver/Kconfig" endif # CRYPTO_HW diff --git a/drivers/crypto/Makefile b/drivers/crypto/Makefile index 5247d2bf09ce..6ad337bad109 100644 --- a/drivers/crypto/Makefile +++ b/drivers/crypto/Makefile @@ -54,3 +54,4 @@ obj-$(CONFIG_CRYPTO_DEV_AMLOGIC_GXL) += amlogic/ obj-y += intel/ obj-y += starfive/ obj-y += montage/ +obj-$(CONFIG_SW_SE_CHIP) += sedriver/ diff --git a/drivers/crypto/sedriver/Kconfig b/drivers/crypto/sedriver/Kconfig new file mode 100644 index 000000000000..6a11bdf1e5fa --- /dev/null +++ b/drivers/crypto/sedriver/Kconfig @@ -0,0 +1,8 @@ +# +# se chip configuration +# +config SW_SE_CHIP + tristate "wst se chip driver" + depends on LOONGARCH + help + If unsure, say N. diff --git a/drivers/crypto/sedriver/Makefile b/drivers/crypto/sedriver/Makefile new file mode 100644 index 000000000000..0ee095d1a1d2 --- /dev/null +++ b/drivers/crypto/sedriver/Makefile @@ -0,0 +1,7 @@ +# +# Makefile for SE CHIP Driver +# + +obj-$(CONFIG_SW_SE_CHIP) += sw_se_echip_drv.o +sw_se_echip_drv-objs := wst_se_echip_driver.o + diff --git a/drivers/crypto/sedriver/wst_se_common_type.h b/drivers/crypto/sedriver/wst_se_common_type.h new file mode 100644 index 000000000000..e29e9bccaa6d --- /dev/null +++ b/drivers/crypto/sedriver/wst_se_common_type.h @@ -0,0 +1,98 @@ +#ifndef _WST_SE_COMMON_TYPE_H +#define _WST_SE_COMMON_TYPE_H + +#include <linux/kernel.h> /* We're doing kernel work */ +#include <linux/module.h> /* Specifically, a module */ +#include <linux/errno.h> +#include <linux/init.h> +#include <linux/poll.h> +#include <linux/pci.h> +#include <linux/types.h> +#include <linux/fs.h> +#include <linux/interrupt.h> +#include <linux/workqueue.h> +#include <linux/mm.h> +#include <linux/sched.h> +#include <linux/slab.h> +#include <linux/wait.h> +#include <linux/version.h> +#include <linux/ioport.h> +#include <linux/time.h> +#include <linux/pagemap.h> +#include <linux/delay.h> +#include <linux/list.h> +#include <linux/uaccess.h> +#include <linux/io.h> +#include <asm/mman.h> +#include <asm/irq.h> +#include <asm/dma.h> + +#define WST_GO_CHANNEL0 0x0002 +#define WST_GO_CHANNEL1 0x0000 +#define WST_GO_CHANNEL2 0x0001 + +#define SE_OK 0 + +struct loongson_sedriver_irq { + char *pat; + int irq; +}; + +typedef struct tag_dma_buf_ctl { + struct list_head list; + unsigned char *pDmaBuf; +} dmabuf_ctl, *pdmabuf_ctl; + +typedef struct tag_Queue_container { + struct list_head m_Head; + unsigned int qlen; + unsigned int max_qlen; +} QUEUE_CONTAIN, *PQUEUE_CONTAIN; + + +static inline int wst_InitQueue(struct tag_Queue_container *pQueue, int count) +{ + INIT_LIST_HEAD(&pQueue->m_Head); + pQueue->qlen = 0; + pQueue->max_qlen = count; + return 0; +} + + +static inline struct list_head *wst_Popfront_Que(struct tag_Queue_container *pQueue) +{ + struct list_head *pNode = NULL; + + if (list_empty(&pQueue->m_Head)) + return NULL; + + pQueue->qlen--; + pNode = pQueue->m_Head.next; + list_del(pNode); + return pNode; +} + + +static inline int wst_Pushback_Que(struct tag_Queue_container *pQueue, void *pNode) +{ + if (unlikely(pQueue->qlen >= pQueue->max_qlen)) + return -1; + + pQueue->qlen++; + list_add_tail((struct list_head *)(pNode), &pQueue->m_Head); + return 0; +} + +#define READUBUF 0 +#define WRITEUBUF 1 + +static inline int wst_cpyusrbuf(unsigned char *puserbuf, + unsigned char *pkbuf, size_t num, int orient) +{ + if (orient == READUBUF) + return copy_from_user(pkbuf, puserbuf, num); + else + return copy_to_user(puserbuf, pkbuf, num); +} + +#endif diff --git a/drivers/crypto/sedriver/wst_se_define.h b/drivers/crypto/sedriver/wst_se_define.h new file mode 100644 index 000000000000..7a29f1029afa --- /dev/null +++ b/drivers/crypto/sedriver/wst_se_define.h @@ -0,0 +1,27 @@ +#ifndef _WST_SE_DEFINE_H +#define _WST_SE_DEFINE_H + + +typedef void (*PSECallBackfn)(void *pParam); + +#define WST_SE_OK 0 //function syccess +#define WST_SE_FAILURE 1 +#define WST_SE_ERROR_MALLOC 2 +#define WST_SE_ERROR_OPEN 3 +#define WST_SE_ERROR_ID 4 +#define WST_SE_ERROR_OPERTYPE 5 +#define WST_SE_ERROR_KEYID 6 +#define WST_SE_NOT_SUPPORT 7 +#define WST_SE_ERROR_FULL 8 +#define WST_SE_VERIFY_ERROR 0xb +#define WST_SE_NOT_SUPPORT_VERIFY 0xd +#define WST_SE_ERROR_LENGTH 0xc +#define WST_SE_HAS_OPEN 0xd +#define WST_COPY_MEM_ERROR 0xe +#define WST_SE_PARAM_ERROR 0xf + +#define BASE_ERROR 0x1000 +#define WST_SE_ERROR_LICENSE 0x100b +#define WST_SE_ERROR_NOT_SUPPORT_TYPE 0x100d + +#endif diff --git a/drivers/crypto/sedriver/wst_se_echip_driver.c b/drivers/crypto/sedriver/wst_se_echip_driver.c new file mode 100644 index 000000000000..66e34549d209 --- /dev/null +++ b/drivers/crypto/sedriver/wst_se_echip_driver.c @@ -0,0 +1,1368 @@ +#include <linux/semaphore.h> +#include <linux/moduleparam.h> +#include <linux/kthread.h> +#include <linux/module.h> +#include <linux/of_device.h> +#include <linux/workqueue.h> +#include <linux/platform_device.h> +#include <linux/crypto.h> +#include <crypto/internal/skcipher.h> +#include <linux/acpi.h> +#include <asm/loongson.h> +#include "wst_se_echip_driver.h" + +#define LS_CRYPTO_SE_ADDR1 TO_UNCACHE(LOONGSON_REG_BASE+0x0400) +#define LS_CRYPTO_SE_ADDR2 TO_UNCACHE(0xc0010200000) +#define DRIVER_VERSION "01.10.220111" +DEFINE_SPINLOCK(g_reclistlock); +DEFINE_SPINLOCK(g_sendlistlock); +DEFINE_SPINLOCK(g_getdmabuflock); + +unsigned char *g_pCacheInBuf = NULL, *g_pCacheOutBuf = NULL; +static struct class *g_psecclass; +static struct device *g_psecdev; +static SECHIPDRV_CTRL *g_psechipDrvCtrl; +static int g_isechip_Major = -1; +static struct semaphore g_lowsema, g_lowirqsema; +static atomic_t g_sendtotallen; +static struct tag_Queue_container g_RecQueueContainer; +static struct tag_Queue_container g_SendQueueContainer; +static int g_suspend; +static struct semaphore g_dmabufsem; +struct loongson_sedriver_irq se_irq[] = { + { + .pat = "se-irq", + }, + { + .pat = "se-lirq", + }, +}; +static struct tag_Queue_container g_DmaBQueueContainer; +static struct tag_dma_buf_ctl *g_pdmadatabuf; +static int g_iDmaBufNum; +static struct work_struct g_recwork, g_sendwork; +static struct workqueue_struct *g_worksendqueue, *g_workrecqueue; +static irqreturn_t se_interrupt(int irq, void *p); +static irqreturn_t wst_low_channel_status(int irq, void *p); +static void globalmem_do_send_op(struct work_struct *p); +static void globalmem_do_rec_op(struct work_struct *p); +static int g_iUseIntr = 1; +module_param(g_iUseIntr, int, 0644); + +static int se_init_dma_buf(int idatasize, int idatanum) +{ + int i; + struct tag_dma_buf_ctl *pdmactl; + + wst_InitQueue(&g_DmaBQueueContainer, idatanum); + g_pdmadatabuf = kmalloc((sizeof(struct tag_dma_buf_ctl)*idatanum), GFP_KERNEL); + if (!g_pdmadatabuf) + return -1; + for (i = 0; i < idatanum; i++) { + pdmactl = &g_pdmadatabuf[i]; + pdmactl->pDmaBuf = (unsigned char *)__get_free_page(GFP_KERNEL|GFP_DMA); + if (!pdmactl->pDmaBuf) { + g_iDmaBufNum = i; + return SE_OK; + } + wst_Pushback_Que(&g_DmaBQueueContainer, pdmactl); + } + g_iDmaBufNum = i; + sema_init(&g_dmabufsem, 1); + return SE_OK; +} + +static int se_del_dma_buf(void) +{ + int i; + struct tag_dma_buf_ctl *pdmactl; + + for (i = 0; i < g_iDmaBufNum; i++) { + pdmactl = &g_pdmadatabuf[i]; + if (pdmactl) { + free_page((unsigned long)pdmactl->pDmaBuf); + pdmactl->pDmaBuf = NULL; + } + } + kfree(g_pdmadatabuf); + g_pdmadatabuf = NULL; + return 0; +} + +struct tag_dma_buf_ctl *se_get_dma_buf(int ikernel) +{ + struct tag_dma_buf_ctl *pbufctl = NULL; + unsigned long ultimeout = 0; + + ultimeout = jiffies+20*HZ; + while (1) { + spin_lock(&g_getdmabuflock); + pbufctl = (struct tag_dma_buf_ctl *)wst_Popfront_Que(&g_DmaBQueueContainer); + spin_unlock(&g_getdmabuflock); + if (pbufctl) + return pbufctl; + if (down_timeout(&g_dmabufsem, ultimeout)) + return NULL; + } + return pbufctl; +} + +int se_free_dma_buf(struct tag_dma_buf_ctl *pdmabufctl) +{ + spin_lock(&g_getdmabuflock); + wst_Pushback_Que(&g_DmaBQueueContainer, pdmabufctl); + spin_unlock(&g_getdmabuflock); + if (g_dmabufsem.count <= 0) + up(&g_dmabufsem); + + return 0; +} + +static unsigned long bytes_align(struct device *pdev, unsigned long ulVirAddr) +{ + unsigned char diff; + unsigned long ulPhyAddr = (unsigned long)__pa((void *)ulVirAddr); + + if ((ulPhyAddr & 0x000000000000003f) == 0) + return ulVirAddr; + diff = ((long)ulPhyAddr & (~(0x000000000000003f))) + 64 - ulPhyAddr; + ulVirAddr += diff; + + return ulVirAddr; +} + +static unsigned long descri_bytes_align(unsigned long ulVirAddr) +{ + unsigned char diff; + unsigned long ulPhyAddr = ulVirAddr; + + if ((ulPhyAddr & (~0x00000000ffffffe0)) == 0) + return ulVirAddr; + diff = ((long)ulPhyAddr & 0x00000000ffffffe0) + 32 - ulPhyAddr; + ulVirAddr += diff; + return ulVirAddr; +} + +int se_printk_hex(unsigned char *buff, int length) +{ + unsigned char *string_tmp = buff; + int i; + int count = 0; + + for (i = 0; i < length; i++, count++) { + if (count < 16) + pr_info("%02x ", string_tmp[i]); + else { + count = 0; + pr_info("\n%02x ", string_tmp[i]); + continue; + } + } + pr_info("\n"); + return 0; +} + +static int se_ChipInit(SECHIPDRV_CTRL *pDrvCtrl) +{ + dma_addr_t ulBusAddr; + unsigned long ulVirAddr; + int i = 0, j = 0; + unsigned int dmaoldmask; + + for (i = 0; i < SWCHANNELNUM; i++) { + ulVirAddr = (unsigned long)dma_alloc_coherent( + pDrvCtrl->pdev, + (SE_BDQUEUE_LEN * SE_BD_LENGTH+32), + &ulBusAddr, GFP_KERNEL + ); + if (ulVirAddr == 0 || ulBusAddr == 0) + return -EFAULT; + memset((void *)ulVirAddr, 0, (SE_BDQUEUE_LEN*SE_BD_LENGTH)); + + pDrvCtrl->ulBDMemBasePhy[i] = ulBusAddr; + pDrvCtrl->ulBDMemBase[i] = ulVirAddr; + pDrvCtrl->ulCurrBdReadPtr[i] = 0; + pDrvCtrl->ulCurrBdWritePtr[i] = 0; + pDrvCtrl->ulCurrReadPtr[i] = 0; + pDrvCtrl->ulCurrWritePtr[i] = 0; + } + for (i = 0; i < SE_BDQUEUE_LEN; i++) { + for (j = 0; j < SWCHANNELNUM; j++) + (&((SE_BASIC_BD *)(pDrvCtrl->ulBDMemBase[j]))[i])->ucRetCode = 0x0f; + } + ulBusAddr = descri_bytes_align(pDrvCtrl->ulBDMemBasePhy[0]); + HandleWrite32(pDrvCtrl, SE_HREG_BQBA0, HIULONG(ulBusAddr)); + HandleWrite32(pDrvCtrl, SE_LREG_BQBA0, LOULONG(ulBusAddr)); + HandleWrite32(pDrvCtrl, SE_REG_BQS0, SE_BDQUEUE_LEN - 1); + HandleWrite32(pDrvCtrl, SE_REG_RQRP0, pDrvCtrl->ulCurrBdReadPtr[0]); + HandleWrite32(pDrvCtrl, SE_REG_BQWP0, pDrvCtrl->ulCurrBdWritePtr[0]); + + ulBusAddr = descri_bytes_align(pDrvCtrl->ulBDMemBasePhy[1]); + HandleWrite32(pDrvCtrl, SE_HREG_BQBA1, HIULONG(ulBusAddr)); + HandleWrite32(pDrvCtrl, SE_LREG_BQBA1, LOULONG(ulBusAddr)); + HandleWrite32(pDrvCtrl, SE_REG_BQS1, SE_BDQUEUE_LEN - 1); + HandleWrite32(pDrvCtrl, SE_REG_RQRP1, pDrvCtrl->ulCurrBdReadPtr[1]); + HandleWrite32(pDrvCtrl, SE_REG_BQWP1, pDrvCtrl->ulCurrBdWritePtr[1]); + HandleRead32(pDrvCtrl, SE_REG_MSK, &dmaoldmask); + HandleWrite32(pDrvCtrl, SE_REG_MSK, (dmaoldmask | DMA0_CTRL_CHANNEL_ENABLE | DMA1_CTRL_CHANNEL_ENABLE)); + if (g_iUseIntr != 0) + HandleWrite32(pDrvCtrl, SE_LOWREG_INQ, 1); + else + HandleWrite32(pDrvCtrl, SE_LOWREG_INQ, 0); + mdelay(1000); + + return SE_OK; +} + +static void se_ChipRelease(SECHIPDRV_CTRL *pDrvCtrl) +{ + int i; + + for (i = 0; i < SWCHANNELNUM; i++) { + if (pDrvCtrl->ulBDMemBase[i]) { + dma_free_coherent( + pDrvCtrl->pdev, + (SE_BDQUEUE_LEN * SE_BD_LENGTH), + (void *)pDrvCtrl->ulBDMemBase[i], + pDrvCtrl->ulBDMemBasePhy[i] + ); + pDrvCtrl->ulBDMemBase[i] = 0; + pDrvCtrl->ulBDMemBasePhy[i] = 0; + } + } +} + +static void SE_RESET(SECHIPDRV_CTRL *pdrvctl) +{ + + unsigned int reg; + unsigned long ulreg64, uladdr = LS_CRYPTO_SE_ADDR1; + + HandleRead32(pdrvctl, SE_REG_RESET, &reg); + HandleWrite32(pdrvctl, SE_REG_RESET, reg|SE_DMA_CONTROL_RESET); + mdelay(300); + HandleWrite32(pdrvctl, SE_REG_RESET, (reg&(~SE_DMA_CONTROL_RESET))|SE_DMA_CONTROL_SET); + mdelay(300); + ulreg64 = readq((volatile void __iomem *)uladdr); + if ((ulreg64 & 0xf0000000000000) != 0xf0000000000000) + writeq(ulreg64|0xf0000000000000, (volatile void __iomem *)uladdr); + HandleWrite32(pdrvctl, SE_INT_CLR, 0xf); +} + +static int wst_init(void) +{ + int iRes = SE_OK; + static u64 wst_dma_mask = DMA_BIT_MASK(64); + char cName[256]; + SECHIPDRV_CTRL *pdrvctl = NULL; + + pdrvctl = kmalloc(sizeof(SECHIPDRV_CTRL), GFP_KERNEL); + if (pdrvctl == NULL) + return -ENOMEM; + memset(pdrvctl, 0, sizeof(SECHIPDRV_CTRL)); + pdrvctl->ulMemBase = LS_CRYPTO_SE_ADDR2; + memset(cName, 0, 256); + sema_init(&(pdrvctl->sema), 0); + rwlock_init(&(pdrvctl->mr_lock)); + rwlock_init(&(pdrvctl->mr_lowlock)); + g_psechipDrvCtrl = pdrvctl; + g_psechipDrvCtrl->pdev = g_psecdev; + g_psechipDrvCtrl->pdev->dma_mask = &wst_dma_mask; + g_psechipDrvCtrl->pdev->coherent_dma_mask = (unsigned long long)&wst_dma_mask; + wst_InitQueue(&g_RecQueueContainer, 2000); + wst_InitQueue(&g_SendQueueContainer, 2000); + SE_RESET(pdrvctl); + pdrvctl->ilowIrq = 0; + pdrvctl->iIrq = se_irq[0].irq; + iRes = request_irq(pdrvctl->iIrq, &se_interrupt, IRQF_SHARED, "wst-se-hirq", pdrvctl); + if (iRes) { + pr_err("request_irq err\n"); + pdrvctl->iIrq = 0; + goto err; + } + if (g_iUseIntr == 1) { + pdrvctl->ilowIrq = se_irq[1].irq; + iRes = request_irq(pdrvctl->ilowIrq, &wst_low_channel_status, IRQF_SHARED, "wst-se-lirq", pdrvctl); + if (iRes) { + pr_err("\nrequest_lowirq err, iRes=0x%x\n", iRes); + pdrvctl->ilowIrq = 0; + goto err; + } + } + if (se_ChipInit(pdrvctl) != SE_OK) { + iRes = -ENODEV; + goto err; + } + return SE_OK; +err: + if (pdrvctl != NULL) { + if (pdrvctl->iIrq) { + free_irq(pdrvctl->iIrq, pdrvctl); + pdrvctl->iIrq = 0; + } + if (pdrvctl->ilowIrq) { + free_irq(pdrvctl->ilowIrq, pdrvctl); + pdrvctl->ilowIrq = 0; + } + se_ChipRelease(pdrvctl); + kfree(pdrvctl); + g_psechipDrvCtrl = NULL; + } + return iRes; +} + +static void wst_clear(void) +{ + SECHIPDRV_CTRL *pdrvctl = NULL; + + pdrvctl = g_psechipDrvCtrl; + if (pdrvctl) { + if (pdrvctl->iIrq) { + free_irq(pdrvctl->iIrq, pdrvctl); + pdrvctl->iIrq = 0; + } + if (pdrvctl->ilowIrq) { + free_irq(pdrvctl->ilowIrq, pdrvctl); + pdrvctl->ilowIrq = 0; + } + se_ChipRelease(pdrvctl); + kfree(pdrvctl); + g_psechipDrvCtrl = NULL; + } +} +static void globalmem_do_send_op(struct work_struct *p) +{ + SE_BASIC_BD *pCurBD; + unsigned int ulCurrWritePtr, ulWritePtr; + unsigned short len = 0; + unsigned long ulCurrAddrInput = 0, ulCurrAddrOutput = 0; + SECHIPDRV_CTRL *pdrvctl; + unsigned char *pInPtr; + unsigned short usInlen; + unsigned char *pOutPtr; + unsigned short *pusOutlen; + int iChannel; + unsigned char ucFlag; + unsigned char ucOpCode; + unsigned char *pucRetCode; + PSECallBackfn pcallback; + void *pParma; + int iKernel; + struct completion *mycomplete; + SEND_PACKAGE *psendpackage; + unsigned long ulflag; + unsigned long ultimeout; + int rv = 0; + + while (1) { +PROG: + spin_lock_irq(&g_sendlistlock); + psendpackage = (SEND_PACKAGE *)wst_Popfront_Que(&g_SendQueueContainer); + if (!psendpackage) { + spin_unlock_irq(&g_sendlistlock); + return; + } + spin_unlock_irq(&g_sendlistlock); + pdrvctl = psendpackage->pdrvctl; + pInPtr = psendpackage->pInPtr; + usInlen = psendpackage->usInlen; + pOutPtr = psendpackage->pOutPtr; + pusOutlen = psendpackage->pusOutlen; + iChannel = psendpackage->iChannel; + ucFlag = psendpackage->ucFlag; + ucOpCode = psendpackage->ucOpCode; + pucRetCode = psendpackage->pucRetCode; + pcallback = psendpackage->pcallback; + pParma = psendpackage->pParma; + iKernel = psendpackage->iKernel; + mycomplete = psendpackage->mycomplete; + ultimeout = psendpackage->ulendtime; + kfree(psendpackage); + + if (iKernel == 0) { + while (time_before(jiffies, ultimeout)) { +#ifdef CONFIG_MIPS + if ((pdrvctl->ulCurrBdReadPtr[iChannel] == ((pdrvctl->ulCurrBdWritePtr[iChannel] + 1) & (SE_BDQUEUE_LEN-1))) + || ((atomic_read(&g_sendtotallen) + *pusOutlen + SE_FILL_LEN) > SE_MAX_SEND_LEN)) +#else + if (pdrvctl->ulCurrBdReadPtr[iChannel] == ((pdrvctl->ulCurrBdWritePtr[iChannel] + 1) & (SE_BDQUEUE_LEN-1))) +#endif + { + down_timeout(&(pdrvctl->sema), 1*HZ); + rv = WST_SE_ERROR_FULL; + } else { + rv = 0; + break; + } + } + if (rv != 0x0) { + *pucRetCode = WST_SE_ERROR_FULL; + complete(mycomplete); + goto PROG; + } + } else { + ultimeout = jiffies+1*HZ; + while (time_before(jiffies, ultimeout)) { +#ifdef CONFIG_MIPS + if ((pdrvctl->ulCurrBdReadPtr[iChannel] == ((pdrvctl->ulCurrBdWritePtr[iChannel] + 1) & (SE_BDQUEUE_LEN-1))) + || ((atomic_read(&g_sendtotallen) + *pusOutlen + SE_FILL_LEN) > SE_MAX_SEND_LEN)) +#else + if (pdrvctl->ulCurrBdReadPtr[iChannel] == ((pdrvctl->ulCurrBdWritePtr[iChannel] + 1) & (SE_BDQUEUE_LEN-1))) +#endif + { + rv = WST_SE_ERROR_FULL; + } else { + rv = 0; + break; + } + } + if (rv != 0x0) { + *pucRetCode = WST_SE_ERROR_FULL; + if (pcallback) + pcallback(pParma); + goto PROG; + } + } + ulCurrWritePtr = pdrvctl->ulCurrBdWritePtr[iChannel]; + ulWritePtr = (ulCurrWritePtr + 1) & (SE_BDQUEUE_LEN-1); + + pCurBD = &((SE_BASIC_BD *)(pdrvctl->ulBDMemBase[iChannel]))[ulCurrWritePtr]; + memset(pCurBD, 0x0, sizeof(SE_BASIC_BD)); + if (pcallback != NULL) { + (pdrvctl->pcallback)[iChannel][ulCurrWritePtr] = pcallback; + pdrvctl->pParma[iChannel][ulCurrWritePtr] = pParma; + } else { + (pdrvctl->pcallback)[iChannel][ulCurrWritePtr] = NULL; + pdrvctl->pParma[iChannel][ulCurrWritePtr] = NULL; + } + + pdrvctl->ikernel[iChannel][ulCurrWritePtr] = iKernel; + pdrvctl->stsemphore[iChannel][ulCurrWritePtr] = mycomplete; + + if (pInPtr == pOutPtr) { + if (pOutPtr) { + len = usInlen >= *pusOutlen ? usInlen : *pusOutlen; + if (len) { + ulCurrAddrOutput = dma_map_single(pdrvctl->pdev, pOutPtr, len, DMA_BIDIRECTIONAL); + if (ulCurrAddrOutput == 0) { + TRACEERR("map ulCurrAddrOutput error\n"); + *pucRetCode = WST_SE_FAILURE; + if (iKernel == 0) { + complete(mycomplete); + } else { + *pucRetCode = WST_SE_FAILURE; + if (pcallback) + pcallback(pParma); + } + goto PROG; + } + pCurBD->ulOutputLPtr = LOULONG(ulCurrAddrOutput); + pCurBD->ulOutputHPtr = HIULONG(ulCurrAddrOutput); + pCurBD->ulInputLPtr = pCurBD->ulOutputLPtr; + pCurBD->ulInputHPtr = pCurBD->ulOutputHPtr; + } + } + } else { + if (pOutPtr && (*pusOutlen)) { + ulCurrAddrOutput = dma_map_single(pdrvctl->pdev, pOutPtr, *pusOutlen, DMA_FROM_DEVICE); + if (ulCurrAddrOutput == 0) { + TRACEERR("map ulCurrAddrOutput error\n"); + *pucRetCode = WST_SE_FAILURE; + if (iKernel == 0) { + complete(mycomplete); + } else { + *pucRetCode = WST_SE_FAILURE; + if (pcallback) + pcallback(pParma); + } + goto PROG; + } + pCurBD->ulOutputLPtr = LOULONG(ulCurrAddrOutput); + pCurBD->ulOutputHPtr = HIULONG(ulCurrAddrOutput); + } + if (usInlen && pInPtr) { + ulCurrAddrInput = dma_map_single(pdrvctl->pdev, pInPtr, usInlen, DMA_TO_DEVICE); + if (ulCurrAddrInput == 0) { + if (ulCurrAddrOutput) { + dma_unmap_single(pdrvctl->pdev, ulCurrAddrOutput, *pusOutlen, DMA_FROM_DEVICE); + pCurBD->ulOutputLPtr = 0; + pCurBD->ulOutputHPtr = 0; + } + *pucRetCode = WST_SE_FAILURE; + if (iKernel == 0) { + complete(mycomplete); + } else { + *pucRetCode = WST_SE_FAILURE; + if (pcallback) + pcallback(pParma); + } + goto PROG; + } + pCurBD->ulInputLPtr = LOULONG(ulCurrAddrInput); + pCurBD->ulInputHPtr = HIULONG(ulCurrAddrInput); + } + } + pCurBD->ucOpCode = ucOpCode & 0x0f; + pCurBD->ucFlag = ucFlag & 0x7; + pCurBD->usInputLength = usInlen; + if (pusOutlen) + pCurBD->usOutputLength = *pusOutlen; + + pCurBD->ucRetCode = 0x0f; + + pdrvctl->pusOutlen[iChannel][ulCurrWritePtr] = pusOutlen; + pdrvctl->usInlen[iChannel][ulCurrWritePtr] = usInlen&0xffff; + if (ulCurrAddrOutput) + pdrvctl->ulOutputPtr[iChannel][ulCurrWritePtr] = (unsigned long *)ulCurrAddrOutput; + else + pdrvctl->ulOutputPtr[iChannel][ulCurrWritePtr] = 0; + if (ulCurrAddrInput) + pdrvctl->ulInputPtr[iChannel][ulCurrWritePtr] = (unsigned long *)ulCurrAddrInput; + else + pdrvctl->ulInputPtr[iChannel][ulCurrWritePtr] = 0; + pdrvctl->pucRetCode[iChannel][ulCurrWritePtr] = pucRetCode; + +#ifdef CONFIG_MIPS + atomic_add((*(pdrvctl->pusOutlen[iChannel][ulCurrWritePtr]) + SE_FILL_LEN), &g_sendtotallen); +#endif + write_lock_irqsave(&(pdrvctl->mr_lock), ulflag); + if (iChannel == 0) + HandleWrite32(pdrvctl, SE_REG_BQWP0, ulWritePtr); + else + HandleWrite32(pdrvctl, SE_REG_BQWP1, ulWritePtr); + write_unlock_irqrestore(&(pdrvctl->mr_lock), ulflag); + pdrvctl->ulCurrBdWritePtr[iChannel] = ulWritePtr; + } +} + +static int se_hardtrans( + SECHIPDRV_CTRL *pdrvctl, + unsigned char *pInPtr, + unsigned short usInlen, + unsigned char *pOutPtr, + unsigned short *pusOutlen, + int iChannel, + unsigned char ucFlag, + unsigned char ucOpCode, + unsigned char *pucRetCode, + PSECallBackfn pcallback, + void *pParma, + int iKernel, + struct completion *mycomplete + ) +{ + SEND_PACKAGE *psendpackage; + gfp_t gfp_flag; + + if (in_interrupt()) + gfp_flag = GFP_ATOMIC; + else + gfp_flag = GFP_KERNEL; + if (g_suspend == 1) + return WST_SE_FAILURE; + psendpackage = kmalloc(sizeof(SEND_PACKAGE), gfp_flag); + if (psendpackage == NULL) + return -1; + + psendpackage->pdrvctl = pdrvctl; + psendpackage->pInPtr = pInPtr; + psendpackage->usInlen = usInlen; + psendpackage->pOutPtr = pOutPtr; + psendpackage->pusOutlen = pusOutlen; + psendpackage->iChannel = iChannel; + psendpackage->ucFlag = ucFlag; + psendpackage->ucOpCode = ucOpCode; + psendpackage->pucRetCode = pucRetCode; + psendpackage->pcallback = pcallback; + psendpackage->pParma = pParma; + psendpackage->iKernel = iKernel; + psendpackage->mycomplete = mycomplete; + psendpackage->ulendtime = jiffies+30*HZ; + spin_lock_irq(&g_sendlistlock); + if (wst_Pushback_Que(&g_SendQueueContainer, psendpackage) == -1) { + spin_unlock_irq(&g_sendlistlock); + kfree(psendpackage); + return WST_SE_ERROR_FULL; + } + spin_unlock_irq(&g_sendlistlock); + queue_work(g_worksendqueue, &g_sendwork); + return 0; +} + +static irqreturn_t wst_low_channel_status(int irq, void *p) +{ + SECHIPDRV_CTRL *pdrvctl = (SECHIPDRV_CTRL *)p; + int64_t ulIntStat = 0; + unsigned long ulflag; + + read_lock_irqsave(&(pdrvctl->mr_lock), ulflag); + HandleRead64(pdrvctl, SE_LOWREG_STS, &ulIntStat); + if (ulIntStat == 2) { + HandleWrite64(pdrvctl, SE_LOWINT_CLEAR, 2); + up(&g_lowirqsema); + } + read_unlock_irqrestore(&(pdrvctl->mr_lock), ulflag); + + return IRQ_HANDLED; +} + +static int se_useropen(struct inode *inode, struct file *file) +{ + if (MINOR(inode->i_rdev) != 0) + return -ENODEV; + + return SE_OK; +} + +static ssize_t wst_low_channel_userwrite_op( + SECHIPDRV_CTRL *pdrvctl, + SWCommuData *UserCommuData, + int iskernel + ) +{ + unsigned long long addr = 0, outaddr = 0; + int ilen; + int count = SE_OK; + unsigned long long ulsendlen; + unsigned char *m_pCacheInBuf; + unsigned char *m_pCacheOutBuf; + unsigned long ulflag; + + if ((g_pCacheInBuf == NULL) || (g_pCacheOutBuf == NULL)) + return -EFAULT; + + m_pCacheInBuf = (unsigned char *)bytes_align(0, (unsigned long)g_pCacheInBuf); + m_pCacheOutBuf = (unsigned char *)bytes_align(0, (unsigned long)g_pCacheOutBuf); + if (iskernel == 0) { + if (wst_cpyusrbuf((void *)(UserCommuData->pucInbuf), (void *)m_pCacheInBuf, UserCommuData->usInputLen, READUBUF)) { + TRACEERR("copy user data error\n"); + return -EFAULT; + } + } else + + memcpy((void *)m_pCacheInBuf, (void *)(UserCommuData->pucInbuf), UserCommuData->usInputLen); + ilen = UserCommuData->usInputLen >= UserCommuData->usOutputLen ? UserCommuData->usInputLen:UserCommuData->usOutputLen; + addr = dma_map_single(pdrvctl->pdev, m_pCacheInBuf, ilen, DMA_TO_DEVICE); + if (addr == 0) { + TRACEERR("transfer buffer is err\n"); + return -EFAULT; + } + outaddr = dma_map_single(pdrvctl->pdev, m_pCacheOutBuf, ilen, DMA_FROM_DEVICE); + if (outaddr == 0) { + TRACEERR("transfer buffer is err\n"); + dma_unmap_single(pdrvctl->pdev, addr, ilen, DMA_TO_DEVICE); + return -EFAULT; + } + ulsendlen = (UserCommuData->usInputLen/8); + ulsendlen = (ulsendlen & 0x00000000ffffffff) << 32; + write_lock_irqsave(&(pdrvctl->mr_lock), ulflag); + HandleWrite64(pdrvctl, SE_WRITE_REG1, ulsendlen); + HandleWrite64(pdrvctl, SE_WRITE_REG2, addr); + HandleWrite64(pdrvctl, SE_WRITE_REG3, outaddr); + write_unlock_irqrestore(&(pdrvctl->mr_lock), ulflag); + if (g_iUseIntr != 0) { + if (down_interruptible(&g_lowirqsema) == -EINTR) { + count = -EINTR; + goto EXIT; + } + } else { + unsigned long start_jiffies = 0, end_jiffies = 0; + int64_t ulIntStat = 0; + + start_jiffies = jiffies; + end_jiffies = jiffies; + while (1) { + write_lock_irqsave(&(pdrvctl->mr_lock), ulflag); + HandleRead64(pdrvctl, SE_LOWREG_SR, &ulIntStat); + end_jiffies = jiffies; + if (ulIntStat == 1) { + HandleWrite64(pdrvctl, SE_LOWREG_SR, 0); + write_unlock_irqrestore(&(pdrvctl->mr_lock), ulflag); + break; + } + write_unlock_irqrestore(&(pdrvctl->mr_lock), ulflag); + if (jiffies_to_msecs(end_jiffies-start_jiffies)/1000 >= 90) { + count = -EFAULT; + goto EXIT; + } + } + } + dma_unmap_single(pdrvctl->pdev, addr, ilen, DMA_TO_DEVICE); + dma_unmap_single(pdrvctl->pdev, outaddr, ilen, DMA_FROM_DEVICE); + if (UserCommuData->usOutputLen) { + if (iskernel == 0) { + if (wst_cpyusrbuf(UserCommuData->pucOutbuf, m_pCacheOutBuf, UserCommuData->usOutputLen, WRITEUBUF)) + return -EFAULT; + } else + memcpy(UserCommuData->pucOutbuf, m_pCacheOutBuf, UserCommuData->usOutputLen); + } + return count; +EXIT: + dma_unmap_single(pdrvctl->pdev, addr, ilen, DMA_TO_DEVICE); + dma_unmap_single(pdrvctl->pdev, outaddr, ilen, DMA_FROM_DEVICE); + return count; +} + +static ssize_t se_userwrite(struct file *file, const char *buf, size_t count, loff_t *ppos) +{ + unsigned char *pCacheBuf = NULL, *pCacheOutBuf = NULL, *pCacheBufalign = NULL, *pCacheOutBufalign = NULL; + SECHIPDRV_CTRL *pdrvctl = NULL; + SWCommuData *pCommuData = NULL; + int iCommuDatalen = 0; + int pucRetCode = 0; + unsigned short iChannel = 0; + unsigned char ucFlag = 0, ucOpCode = 0; + int *ppucRetCode; + struct completion mycomplete; + struct tag_dma_buf_ctl *pbufinctl = NULL; + int iret = 0; + + if (count == 0) { + TRACEERR("count=0\n"); + return SE_OK; + } + + if (MINOR(file->f_path.dentry->d_inode->i_rdev) != 0) + return -ENODEV; + + iCommuDatalen = sizeof(SWCommuData); + if (count != iCommuDatalen) + return -EINVAL; + + pdrvctl = g_psechipDrvCtrl; + pCommuData = kmalloc(iCommuDatalen, GFP_KERNEL); + if (!pCommuData) { + TRACEERR("pCommuData NULL\n"); + return -ENOMEM; + } + if (wst_cpyusrbuf((void *)buf, (void *)pCommuData, iCommuDatalen, READUBUF)) { + TRACEERR("copy user data error\n"); + count = -EFAULT; + goto EXIT; + } + switch ((pCommuData->usFlags)&0x000f) { + case WST_GO_CHANNEL2: + if ((pCommuData->usInputLen > DMA_BUFSIZE) || (pCommuData->usOutputLen > DMA_BUFSIZE)) { + TRACEERR("len is error\n"); + count = -EINVAL; + goto EXIT; + } + if (down_interruptible(&g_lowsema) == -EINTR) { + count = -EINTR; + goto EXIT; + } + count = wst_low_channel_userwrite_op(pdrvctl, pCommuData, 0); + up(&g_lowsema); + goto EXIT; + case WST_GO_CHANNEL0: + if (pCommuData->usInputLen == 0) { + count = -EINVAL; + goto EXIT; + } + if (pCommuData->usInputLen != 0) { + if (pCommuData->usInputLen > DMA_BUFSIZE) { + count = -EINVAL; + goto EXIT; + } + ucFlag = INPUT_VALID; + if (pCommuData->usOutputLen) + ucFlag |= OUTPUT_VALID; + } + + iChannel = 0; + ucOpCode = 0x0; + break; + case WST_GO_CHANNEL1: + if (pCommuData->usInputLen == 0) { + count = -EINVAL; + goto EXIT; + } + if (pCommuData->usInputLen != 0) { + if (pCommuData->usInputLen > DMA_BUFSIZE) { + count = -EINVAL; + goto EXIT; + } + ucFlag = INPUT_VALID; + if (pCommuData->usOutputLen) + ucFlag |= OUTPUT_VALID; + } + iChannel = 1; + ucOpCode = 0x0; + break; + default: + { + count = -EINVAL; + goto EXIT; + } + } + pbufinctl = se_get_dma_buf(0); + if (pbufinctl == NULL) { + TRACEERR("kmalloc pCacheBuf error\n"); + count = -ENOMEM; + goto EXIT; + } + pCacheBuf = pbufinctl->pDmaBuf; + pCacheBufalign = pCacheBuf; + + if (wst_cpyusrbuf((void *)(pCommuData->pucInbuf), (void *)pCacheBufalign, + pCommuData->usInputLen, READUBUF)) { + TRACEERR("cpyuserbuf pCacheBufalign error\n"); + count = -ENOMEM; + goto EXIT; + } + + pCacheOutBuf = pbufinctl->pDmaBuf; + pCacheOutBufalign = pCacheOutBuf; + + ppucRetCode = &pucRetCode; + + count = SE_OK; + init_completion(&mycomplete); + iret = se_hardtrans( + pdrvctl, + pCacheBufalign, + pCommuData->usInputLen, + pCacheOutBufalign, + &(pCommuData->usOutputLen), + iChannel, + ucFlag, + ucOpCode, + (unsigned char *)ppucRetCode, + 0, + 0, + 0, + &mycomplete + ); + if (iret == -1) { + count = -EIO; + goto EXIT; + } + if (!wait_for_completion_timeout(&mycomplete, msecs_to_jiffies(60*1000))) { + count = -EFAULT; + goto EXIT; + } + if (pucRetCode != SE_OK) { + count = -(SE_BASEERR+pucRetCode); + goto EXIT; + } + + if (pCommuData->pucOutbuf) { + if (wst_cpyusrbuf(pCommuData->pucOutbuf, pCacheOutBufalign, + pCommuData->usOutputLen, WRITEUBUF)) { + count = -EFAULT; + goto EXIT; + } + } +EXIT: + if (pbufinctl) + se_free_dma_buf(pbufinctl); + kfree(pCommuData); + return count; +} +static void globalmem_do_rec_op(struct work_struct *p) +{ + INT_MESSAGE *intmessage; + unsigned long ulflags1; + + while (1) { + spin_lock_irqsave(&g_reclistlock, ulflags1); + intmessage = (INT_MESSAGE *)wst_Popfront_Que(&g_RecQueueContainer); + spin_unlock_irqrestore(&g_reclistlock, ulflags1); + if (!intmessage) + return; + intmessage->pcallback(intmessage->pParma); + kfree(intmessage); + } +} +static irqreturn_t se_interrupt(int irq, void *p) +{ + SECHIPDRV_CTRL *pdrvctl; + SE_BASIC_BD *pCurBD; + unsigned int ulCurrReadPtr, ulReadPtr; + int iChannel; + int len = 0; + int i; + unsigned char ucMyRetCode = 0; + unsigned long ulIntStat; + int istatus[2] = {1, 2}; + unsigned long ulflags; + + pdrvctl = (SECHIPDRV_CTRL *)p; + if (!pdrvctl) + return IRQ_HANDLED; + + read_lock_irqsave(&(pdrvctl->mr_lock), ulflags); + HandleRead32(pdrvctl, SE_REG_STS, &ulIntStat); + read_unlock_irqrestore(&(pdrvctl->mr_lock), ulflags); + if ((!(ulIntStat & INT_STAT_DMA_MASK)) || (ulIntStat == 0xffffffff)) + return IRQ_HANDLED; + + for (i = 0; i <= 1; i++) { + if (ulIntStat & istatus[i]) { + if (i == 0) { + read_lock_irqsave(&(pdrvctl->mr_lock), ulflags); + HandleWrite32(pdrvctl, SE_INT_CLR, 1); + HandleRead32(pdrvctl, SE_REG_RQRP0, &ulReadPtr); + read_unlock_irqrestore(&(pdrvctl->mr_lock), ulflags); + iChannel = 0; + } else { + read_lock_irqsave(&(pdrvctl->mr_lock), ulflags); + HandleWrite32(pdrvctl, SE_INT_CLR, 2); + HandleRead32(pdrvctl, SE_REG_RQRP1, &ulReadPtr); + read_unlock_irqrestore(&(pdrvctl->mr_lock), ulflags); + iChannel = 1; + } + } else + continue; + ulCurrReadPtr = pdrvctl->ulCurrReadPtr[iChannel]; + while (1) { + if (ulCurrReadPtr != ulReadPtr) { + pCurBD = &((SE_BASIC_BD *)(pdrvctl->ulBDMemBase[iChannel]))[ulCurrReadPtr]; + if ((pCurBD->ucRetCode == 0x0f) || ((pCurBD->ucFlag & 0x8) != 0x8)) { + continue; + } else { + if (pdrvctl->ulInputPtr[iChannel][ulCurrReadPtr] == pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr]) { + if (pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr]) { + len = (*(pdrvctl->pusOutlen[iChannel][ulCurrReadPtr])) >= pdrvctl->usInlen[iChannel][ulCurrReadPtr] ? + (*(pdrvctl->pusOutlen[iChannel][ulCurrReadPtr])):pdrvctl->usInlen[iChannel][ulCurrReadPtr]; + dma_unmap_single( + pdrvctl->pdev, + (unsigned long)(pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr]), + len, + DMA_BIDIRECTIONAL + ); + pCurBD->ulOutputLPtr = 0; + pCurBD->ulOutputHPtr = 0; + pCurBD->ulInputHPtr = 0; + pCurBD->ulInputLPtr = 0; + pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr] = 0; + } + } else { + if (pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr]) { + dma_unmap_single( + pdrvctl->pdev, + (unsigned long)(pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr]), + *(pdrvctl->pusOutlen[iChannel][ulCurrReadPtr]), DMA_FROM_DEVICE + ); + smp_wmb(); + pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr] = 0; + } + if (pdrvctl->ulInputPtr[iChannel][ulCurrReadPtr]) { + dma_unmap_single( + pdrvctl->pdev, + (unsigned long)(pdrvctl->ulInputPtr[iChannel][ulCurrReadPtr]), + pdrvctl->usInlen[iChannel][ulCurrReadPtr], + DMA_TO_DEVICE + ); + pdrvctl->ulInputPtr[iChannel][ulCurrReadPtr] = 0; + } + } + ucMyRetCode = pCurBD->ucRetCode; + memcpy(pdrvctl->pucRetCode[iChannel][ulCurrReadPtr], &ucMyRetCode, 1); + if (pCurBD->ucRetCode != SE_OK) + pr_info("\nstatus %x\n", pCurBD->ucRetCode); +#ifdef CONFIG_MIPS + atomic_sub(((*(pdrvctl->pusOutlen[iChannel][ulCurrReadPtr])) + SE_FILL_LEN), &g_sendtotallen); +#endif + if ((pdrvctl->ikernel)[iChannel][ulCurrReadPtr] != 0) { + if (pdrvctl->pcallback[iChannel][ulCurrReadPtr]) { + INT_MESSAGE *intmessage = NULL; + unsigned long ulflags1; + + intmessage = (INT_MESSAGE *)kmalloc(sizeof(INT_MESSAGE), GFP_ATOMIC); + if (!intmessage) + return IRQ_HANDLED; + intmessage->pcallback = pdrvctl->pcallback[iChannel][ulCurrReadPtr]; + intmessage->pParma = pdrvctl->pParma[iChannel][ulCurrReadPtr]; + spin_lock_irqsave(&g_reclistlock, ulflags1); + wst_Pushback_Que(&g_RecQueueContainer, intmessage); + spin_unlock_irqrestore(&g_reclistlock, ulflags1); + queue_work(g_workrecqueue, &g_recwork); + } + } else { + complete(pdrvctl->stsemphore[iChannel][ulCurrReadPtr]); + } + ulCurrReadPtr = ((ulCurrReadPtr + 1)&(SE_BDQUEUE_LEN - 1)); + pdrvctl->ulCurrReadPtr[iChannel] = ulCurrReadPtr; + pdrvctl->ulCurrBdReadPtr[iChannel] = ulCurrReadPtr; + if (pdrvctl->sema.count <= 0) + up(&(pdrvctl->sema)); + } + } else + + break; + } + } + return IRQ_HANDLED; +} + +static int se_userrelease(struct inode *inode, struct file *file) +{ + return SE_OK; +} + +ssize_t se_kernelwrite( + unsigned char *pInPtr, + unsigned short usInlen, + unsigned char *pOutPtr, + unsigned short *pusOutlen, + unsigned char ucFlag, + unsigned char *pucRetCode, + PSECallBackfn pcallback, + void *pParma + ) +{ + int iret; + SECHIPDRV_CTRL *pdrvctl; + int iChannel; + unsigned char ucOpCode; + SWCommuData CommuData; + + pdrvctl = g_psechipDrvCtrl; + + switch (ucFlag) { + case WST_GO_CHANNEL2: + { + CommuData.pucInbuf = pInPtr; + CommuData.pucOutbuf = pOutPtr; + CommuData.usFlags = 0; + CommuData.usInputLen = usInlen; + CommuData.usOutputLen = *pusOutlen; + CommuData.usReserve = 0; + if (down_interruptible(&g_lowsema) == -EINTR) + return -EINTR; + iret = wst_low_channel_userwrite_op(pdrvctl, &CommuData, 1); + up(&g_lowsema); + return iret; + } + case WST_GO_CHANNEL0: + if (pcallback == NULL) + return WST_SE_PARAM_ERROR; + if (usInlen == 0) + return -EINVAL; + ucFlag = 0; + if (usInlen != 0) { + if (usInlen > DMA_BUFSIZE) + return -EINVAL; + ucFlag = INPUT_VALID; + if (*pusOutlen) + ucFlag |= OUTPUT_VALID; + } + iChannel = 0; + ucOpCode = 0x0; + break; + case WST_GO_CHANNEL1: + if (pcallback == NULL) + return WST_SE_PARAM_ERROR; + if (usInlen == 0) { + return -EINVAL; + } + ucFlag = 0; + if (usInlen != 0) { + if (usInlen > DMA_BUFSIZE) + return -EINVAL; + ucFlag = INPUT_VALID; + if (*pusOutlen) + ucFlag |= OUTPUT_VALID; + } + iChannel = 1; + ucOpCode = 0x0; + break; + default: + return -EINVAL; + } + iret = se_hardtrans( + pdrvctl, + pInPtr, + usInlen, + pOutPtr, + pusOutlen, + iChannel, + ucFlag, + ucOpCode, + pucRetCode, + pcallback, + pParma, + 1, + NULL + ); + if (iret == -1) + return -EIO; + + return SE_OK; +} +EXPORT_SYMBOL(se_kernelwrite); + +static long se_userioctl(struct file *filp, u_int cmd, u_long arg) +{ + long iret = SE_OK; + SECHIPDRV_CTRL *pdrvctl = g_psechipDrvCtrl; + unsigned long ulvalue; + + HandleRead64(pdrvctl, 0x120, &ulvalue); + pr_info("read reg value is 0x%lx in offset 120\n", ulvalue); + HandleRead64(pdrvctl, 0x118, &ulvalue); + pr_info("read reg value is 0x%lx in offset 118\n", ulvalue); + + return iret; +} + + +static const struct file_operations SE_fops = { + .owner = THIS_MODULE, + .write = se_userwrite, + .open = se_useropen, + .release = se_userrelease, + .unlocked_ioctl = se_userioctl, + .compat_ioctl = se_userioctl +}; + +int se_chip_load(void) +{ + int iRes = SE_OK; + + if (g_isechip_Major >= 0) + return WST_SE_HAS_OPEN; + g_psechipDrvCtrl = NULL; + iRes = se_init_dma_buf(DMA_BUFSIZE, CTL_DMABUFNUM); + if (iRes != SE_OK) + return WST_SE_ERROR_MALLOC; + iRes = register_chrdev(0, CRYNAME, &SE_fops); + if (iRes < 0) + goto EXIT; + + g_isechip_Major = iRes; + iRes = 0; + g_psecclass = class_create(CRYNAME); + if (IS_ERR(g_psecclass)) { + iRes = PTR_ERR(g_psecclass); + goto EXIT; + } + g_psecdev = device_create(g_psecclass, NULL, MKDEV(g_isechip_Major, 0), NULL, CRYNAME); + if (IS_ERR(g_psecdev)) { + iRes = PTR_ERR(g_psecdev); + goto EXIT; + } + iRes = wst_init(); + if (iRes != SE_OK) + goto EXIT; + + sema_init(&g_lowsema, 1); + sema_init(&g_lowirqsema, 0); + atomic_set(&g_sendtotallen, 0); + g_pCacheInBuf = (unsigned char *)__get_free_page(GFP_DMA); + if (IS_ERR(g_pCacheInBuf)) { + iRes = PTR_ERR(g_pCacheInBuf); + goto EXIT; + } + g_pCacheOutBuf = (unsigned char *)__get_free_page(GFP_DMA); + if (IS_ERR(g_pCacheOutBuf)) { + iRes = PTR_ERR(g_pCacheOutBuf); + goto EXIT; + } + + g_worksendqueue = alloc_workqueue("seworksendqueue", + WQ_MEM_RECLAIM|__WQ_ORDERED|WQ_UNBOUND, 1); + if (IS_ERR(g_worksendqueue)) { + iRes = PTR_ERR(g_worksendqueue); + goto EXIT; + } + g_workrecqueue = alloc_workqueue("seworkrecqueue", WQ_MEM_RECLAIM|__WQ_ORDERED, 0); + if (IS_ERR(g_workrecqueue)) { + iRes = PTR_ERR(g_workrecqueue); + goto EXIT; + } + INIT_WORK(&g_recwork, globalmem_do_rec_op); + INIT_WORK(&g_sendwork, globalmem_do_send_op); + pr_info("this driver version is %s\n", DRIVER_VERSION); + + return SE_OK; +EXIT: + se_del_dma_buf(); + if (g_pCacheInBuf) { + + free_page((unsigned long)g_pCacheInBuf); + g_pCacheInBuf = NULL; + } + if (g_pCacheOutBuf) { + + free_page((unsigned long)g_pCacheOutBuf); + g_pCacheOutBuf = NULL; + } + if (g_worksendqueue) { + destroy_workqueue(g_worksendqueue); + g_worksendqueue = NULL; + } + if (g_workrecqueue) { + destroy_workqueue(g_workrecqueue); + g_workrecqueue = NULL; + } + wst_clear(); + if (g_psecdev) { + device_unregister(g_psecdev); + g_psecdev = NULL; + } + if (g_psecclass) { + class_destroy(g_psecclass); + g_psecclass = NULL; + } + if (g_isechip_Major >= 0) { + unregister_chrdev(g_isechip_Major, CRYNAME); + g_isechip_Major = -1; + } + return iRes; +} + +void se_chip_unload(void) +{ + SECHIPDRV_CTRL *pdrvctl = NULL; + + pdrvctl = g_psechipDrvCtrl; + + up(&pdrvctl->sema); + if (g_pCacheInBuf) { + + free_page((unsigned long)g_pCacheInBuf); + g_pCacheInBuf = NULL; + } + if (g_pCacheOutBuf) { + + free_page((unsigned long)g_pCacheOutBuf); + g_pCacheOutBuf = NULL; + } + if (g_worksendqueue) { + cancel_work_sync(&g_sendwork); + destroy_workqueue(g_worksendqueue); + g_worksendqueue = NULL; + } + if (g_workrecqueue) { + cancel_work_sync(&g_recwork); + destroy_workqueue(g_workrecqueue); + g_workrecqueue = NULL; + } + wst_clear(); + if (g_psecdev) { + device_destroy(g_psecclass, MKDEV(g_isechip_Major, 0)); + g_psecdev = NULL; + } + if (g_psecclass) { + class_destroy(g_psecclass); + g_psecclass = NULL; + } + if (g_isechip_Major >= 0) { + unregister_chrdev(g_isechip_Major, CRYNAME); + g_isechip_Major = -1; + } + se_del_dma_buf(); +} + +static int loongson_cryp_get_irq(struct platform_device *pdev, char *pat) +{ + int i; + struct resource *res = pdev->resource; + + for (i = 0; i < pdev->num_resources; i++) { + if (strcmp(res[i].name, pat) == 0) + return res[i].start; + } + return -1; + +} +static int loongson_cryp_probe(struct platform_device *pdev) +{ + int i; + + if (ACPI_COMPANION(&pdev->dev)) { + se_irq[0].irq = platform_get_irq(pdev, 1); + se_irq[1].irq = platform_get_irq(pdev, 0); + } else { + for (i = 0; i < pdev->num_resources; i++) { + se_irq[i].irq = loongson_cryp_get_irq(pdev, + se_irq[i].pat); + if (se_irq[i].irq < 0) { + pr_warn("ERROR:sedriver get irq failed\n"); + return -1; + } + } + } + + return se_chip_load(); +} +static int loongson_cryp_remove(struct platform_device *pdev) +{ + se_chip_unload(); + return 0; +} +static int loongson_cryp_suspend(struct platform_device *pdev, pm_message_t state) +{ + g_suspend = 1; + cancel_work_sync(&g_recwork); + cancel_work_sync(&g_sendwork); + flush_work(&g_recwork); + flush_work(&g_sendwork); + se_chip_unload(); + return 0; +} + +static int loongson_cryp_resume(struct platform_device *pdev) +{ + int i; + + g_suspend = 0; + g_worksendqueue = NULL; + g_workrecqueue = NULL; + g_isechip_Major = -1; + g_pCacheInBuf = NULL; + g_pCacheOutBuf = NULL; + g_iUseIntr = 1; + spin_lock_init(&g_reclistlock); + spin_lock_init(&g_sendlistlock); + spin_lock_init(&g_getdmabuflock); + + for (i = 0; i < pdev->num_resources; i++) { + se_irq[i].irq = loongson_cryp_get_irq(pdev, se_irq[i].pat); + + if (se_irq[i].irq < 0) { + pr_warn("ERROR:sedriver get irq failed\n"); + return -1; + } + } + se_chip_load(); + return 0; +} + +static const struct acpi_device_id loongson_cryp_acpi_match[] = { + {"LOON0003"}, + {} +}; +MODULE_DEVICE_TABLE(acpi, loongson_cryp_acpi_match); + +static struct platform_driver loongson_cryp_driver = { + .probe = loongson_cryp_probe, + .remove = loongson_cryp_remove, + .suspend = loongson_cryp_suspend, + .resume = loongson_cryp_resume, + .driver = { + .name = "loongson3_crypto", + .acpi_match_table = ACPI_PTR(loongson_cryp_acpi_match), + }, +}; + +static int __init initmodule(void) +{ + return platform_driver_register(&loongson_cryp_driver); +} + +static void __exit exitmodule(void) +{ + platform_driver_unregister(&loongson_cryp_driver); +} + +module_init(initmodule); +module_exit(exitmodule); + +MODULE_ALIAS("platform:loongson3_crypto"); +MODULE_AUTHOR("dcm"); +MODULE_DESCRIPTION("se encryption chip driver Co westone"); +MODULE_VERSION(DRIVER_VERSION); +MODULE_LICENSE("GPL"); diff --git a/drivers/crypto/sedriver/wst_se_echip_driver.h b/drivers/crypto/sedriver/wst_se_echip_driver.h new file mode 100644 index 000000000000..3e562e55faac --- /dev/null +++ b/drivers/crypto/sedriver/wst_se_echip_driver.h @@ -0,0 +1,184 @@ +#ifndef _WST_SE_ECHIP_DRIVER_H +#define _WST_SE_ECHIP_DRIVER_H +#include "wst_se_ktrans.h" + +#define CRYNAME "wst-se" + +#define SWBUFNUM 512 +#define SWCHANNELNUM 2 +#define CTL_DMABUFNUM 512 + +#define DMA_MASK 0xffffffff +#define SE_DMA_CONTROL_RESET 0x80000000 +#define SE_DMA_CONTROL_SET 0x00000000 + +#define SE_BASEERR 1000 + +#define SE_MAX_SEND_LEN (3*2048) +#define SE_FILL_LEN 48 +#define SE_BD_LENGTH sizeof(SE_BASIC_BD) +#define SE_BDQUEUE_LEN SWBUFNUM +#define DMA0_CTRL_CHANNEL_ENABLE 1 +#define DMA0_CTRL_CHANNEL_DISABLE 0xfffffffe +#define DMA1_CTRL_CHANNEL_ENABLE 2 +#define DMA1_CTRL_CHANNEL_DISABLE 0xfffffffd + +#define SE_REG_RESET 0 +#define SE_REG_STS 0x08 +#define SE_INT_CTRL 0x10 +#define SE_REG_MSK 0x18 +#define SE_INT_CLR 0x20 + +#define SE_LREG_BQBA0 0x100 +#define SE_HREG_BQBA0 0x108 +#define SE_REG_BQS0 0x110 +#define SE_REG_BQWP0 0x118 +#define SE_REG_RQRP0 0x120 + +#define SE_LREG_BQBA1 0x128 +#define SE_HREG_BQBA1 0x130 +#define SE_REG_BQS1 0x138 +#define SE_REG_BQWP1 0x140 +#define SE_REG_RQRP1 0x148 + +#define SE_WRITE_REG1 0x200 +#define SE_WRITE_REG2 0x208 +#define SE_WRITE_REG3 0x210 +#define SE_LOWREG_STS 0x240 +#define SE_LOWINT_CLEAR 0x248 +#define SE_LOWREG_INQ 0x1600 +#define SE_LOWREG_SR 0x1608 +#define INPUT_VALID 0x4 +#define OUTPUT_VALID 0x8 +#define SE_LOWINT_CLR 0x228 +#define INT_STAT_DMA0_PACK_DONE 1 +#define INT_STAT_DMA1_PACK_DONE 2 +#define INT_STAT_DMA_MASK (INT_STAT_DMA0_PACK_DONE|INT_STAT_DMA1_PACK_DONE) + +typedef struct tagSEdrvctl { + + unsigned long ulMemBase; + struct device *pdev; + struct device dev; + unsigned int ulCurrBdReadPtr[SWCHANNELNUM]; + unsigned int ulCurrBdWritePtr[SWCHANNELNUM]; + unsigned int ulCurrReadPtr[SWCHANNELNUM]; + unsigned int ulCurrWritePtr[SWCHANNELNUM]; + PSECallBackfn pcallback[SWCHANNELNUM][SWBUFNUM]; + void *pParma[SWCHANNELNUM][SWBUFNUM]; + struct completion *stsemphore[SWCHANNELNUM][SWBUFNUM]; + int ikernel[SWCHANNELNUM][SWBUFNUM]; + unsigned long ulBDMemBasePhy[SWCHANNELNUM]; + unsigned long ulBDMemBase[SWCHANNELNUM]; + unsigned short *pusOutlen[SWCHANNELNUM][SWBUFNUM]; + unsigned short usInlen[SWCHANNELNUM][SWBUFNUM]; + unsigned long *ulOutputPtr[SWCHANNELNUM][SWBUFNUM]; + unsigned long *ulInputPtr[SWCHANNELNUM][SWBUFNUM]; + unsigned char *pucRetCode[SWCHANNELNUM][SWBUFNUM]; + rwlock_t mr_lock; + rwlock_t mr_lowlock; + spinlock_t readlock; + struct semaphore sema; + int iIrq; + int ilowIrq; +} SECHIPDRV_CTRL; + +typedef struct tagSEBasicBD { + + unsigned int ucOpCode:4, + ucFlag:4, + ucRetCode:8, + ucInCtxLength:8, + ucOutCtxLength:8; + unsigned int usInputLength:16, + usOutputLength:16; + unsigned int ulCtxLPtr; + unsigned int ulCtxHPtr; + unsigned int ulInputLPtr; + unsigned int ulInputHPtr; + unsigned int ulOutputLPtr; + unsigned int ulOutputHPtr; + +} SE_BASIC_BD; + +#define SW_CONT_BUF_SIZE 0x100 +#define DMA_BUFSIZE 0x1000 + +#define PAGE_NUM (DMA_BUFSIZE/PAGE_SIZE+1) + +typedef struct _SW_GET_STAT { + unsigned long TXD; + unsigned long RXD; +} SW_GET_STAT, *PSW_GET_STAT; + +DEFINE_SPINLOCK(g_writelock); + +#define HandleRead32(handle, addr, pData) \ + do { \ + smp_mb(); \ + *(pData) = readl((void *)(handle->ulMemBase + addr)); \ + } while (0) + +#define HandleWrite32(handle, addr, value)\ + do { \ + writel(value, (void *)(handle->ulMemBase + addr)); \ + smp_mb(); \ + } while (0) + +#define HandleRead64(handle, addr, pData) \ + do { \ + smp_mb(); \ + *(pData) = readq((void *)(handle->ulMemBase + addr)); \ + } while (0) + +#define HandleWrite64(handle, addr, value)\ + do { \ + writeq(value, (void *)(handle->ulMemBase + addr)); \ + smp_mb(); \ + } while (0) + + +#define SPRINTF sprintf + +#define HIULONG(w) ((unsigned int)((((unsigned long long)w) >> 32) & 0x00000000ffffffff)) +#define LOULONG(w) ((unsigned int)((unsigned long long)w) & 0x00000000ffffffff) + +#ifdef DEBUG_DRIVER + #define TRACEMSG(fmt, args...) printk(KERN_DEBUG "msg: " fmt, ##args) +#else + #define TRACEMSG(fmt, args...) +#endif + +#ifdef DEBUG_DRIVER_ERROR + #define TRACEERR(fmt, args...) printk(KERN_DEBUG "err: " fmt, ##args) +#else + #define TRACEERR(fmt, args...) +#endif + +#define HIBYTE(w) ((unsigned char)(((unsigned short)(w) >> 8) & 0xFF)) +#define LOBYTE(w) ((unsigned char)(w)) + +typedef struct ST_SEND_PACKAGE { + struct list_head list; + SECHIPDRV_CTRL *pdrvctl; + unsigned char *pInPtr; + unsigned short usInlen; + unsigned char *pOutPtr; + unsigned short *pusOutlen; + int iChannel; + unsigned char ucFlag; + unsigned char ucOpCode; + unsigned char *pucRetCode; + PSECallBackfn pcallback; + void *pParma; + int iKernel; + struct completion *mycomplete; + unsigned long ulendtime; +} SEND_PACKAGE; + +typedef struct ST_INT_MESSAGE { + struct list_head list; + PSECallBackfn pcallback; + void *pParma; +} INT_MESSAGE; +#endif diff --git a/drivers/crypto/sedriver/wst_se_ktrans.h b/drivers/crypto/sedriver/wst_se_ktrans.h new file mode 100644 index 000000000000..da6c4b8f2824 --- /dev/null +++ b/drivers/crypto/sedriver/wst_se_ktrans.h @@ -0,0 +1,17 @@ +#ifndef _WST_SE_KTRANS_H +#define _WST_SE_KTRANS_H + +#include "wst_se_common_type.h" +#include "wst_se_define.h" + + +typedef struct tagSWCOMMUDATA { + unsigned short usFlags; + unsigned short usInputLen; + unsigned short usOutputLen; + unsigned short usReserve; + unsigned char *pucInbuf; + unsigned char *pucOutbuf; +} SWCommuData; + +#endif -- 2.33.0

2 1

[PATCH OLK-6.6 0/7] LoongArch: sync internal repository 20250414
by Hongchen Zhang 14 Apr '25

14 Apr '25

Ard Biesheuvel (1): objtool: Fix C jump table annotations for Clang Gao Qihang (1): LoongArch: Preserve firmware configuration if ACPI requires. Juxin Gao (1): LoongArch: configs: set CONFIG_UNWINDER_ORC=y Ming Wang (1): LoongArch: configs: Disable CONFIG_RT_GROUP_SCHED to prevent cgroup2 issues Tiezhu Yang (3): LoongArch: Handle fp, lsx, lasx and lbt assembly symbols LoongArch: Make some signal and ptrace functions non-static LoongArch: Export some signal functions arch/loongarch/configs/loongson3_defconfig | 2 +- arch/loongarch/include/asm/fpu.h | 6 ++++ arch/loongarch/include/asm/lbt.h | 4 +++ arch/loongarch/kernel/Makefile | 1 + arch/loongarch/kernel/extern.c | 31 ++++++++++++++++++ arch/loongarch/kernel/fpu.S | 6 ++++ arch/loongarch/kernel/lbt.S | 4 +++ arch/loongarch/kernel/ptrace.c | 37 +++++++++++++++------- arch/loongarch/kernel/signal.c | 28 +++------------- arch/loongarch/pci/acpi.c | 14 ++++++-- include/linux/compiler.h | 2 +- tools/objtool/check.c | 7 ++-- tools/objtool/include/objtool/special.h | 2 +- 13 files changed, 102 insertions(+), 42 deletions(-) create mode 100644 arch/loongarch/kernel/extern.c -- 2.33.0

2 8

[PATCH OLK-6.6] crypto: loongson: add wst se chip support
by Hongchen Zhang 14 Apr '25

14 Apr '25

From: Qunqin Zhao <zhaoqunqin(a)loongson.cn> LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IC10DU CVE: NA -------------------------------- Add support for WST se chip support for LS*5000*. Signed-off-by: Qunqin Zhao <zhaoqunqin(a)loongson.cn> --- arch/loongarch/configs/loongson3_defconfig | 1 + drivers/crypto/Kconfig | 1 + drivers/crypto/Makefile | 1 + drivers/crypto/sedriver/Kconfig | 8 + drivers/crypto/sedriver/Makefile | 7 + drivers/crypto/sedriver/wst_se_common_type.h | 98 ++ drivers/crypto/sedriver/wst_se_define.h | 27 + drivers/crypto/sedriver/wst_se_echip_driver.c | 1368 +++++++++++++++++ drivers/crypto/sedriver/wst_se_echip_driver.h | 184 +++ drivers/crypto/sedriver/wst_se_ktrans.h | 17 + 10 files changed, 1712 insertions(+) create mode 100644 drivers/crypto/sedriver/Kconfig create mode 100644 drivers/crypto/sedriver/Makefile create mode 100644 drivers/crypto/sedriver/wst_se_common_type.h create mode 100644 drivers/crypto/sedriver/wst_se_define.h create mode 100644 drivers/crypto/sedriver/wst_se_echip_driver.c create mode 100644 drivers/crypto/sedriver/wst_se_echip_driver.h create mode 100644 drivers/crypto/sedriver/wst_se_ktrans.h diff --git a/arch/loongarch/configs/loongson3_defconfig b/arch/loongarch/configs/loongson3_defconfig index 980f5f2c99a1..cf359d1a2554 100644 --- a/arch/loongarch/configs/loongson3_defconfig +++ b/arch/loongarch/configs/loongson3_defconfig @@ -2177,6 +2177,7 @@ CONFIG_CRYPTO_CRC32_LOONGARCH=m CONFIG_CRYPTO_DEV_NITROX_CNN55XX=m CONFIG_CRYPTO_DEV_CHELSIO=m CONFIG_CRYPTO_DEV_VIRTIO=m +CONFIG_SW_SE_CHIP=m CONFIG_SIGNED_PE_FILE_VERIFICATION=y CONFIG_SECONDARY_TRUSTED_KEYRING=y CONFIG_SYSTEM_BLACKLIST_KEYRING=y diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig index b84a921d293f..efd6a855bca3 100644 --- a/drivers/crypto/Kconfig +++ b/drivers/crypto/Kconfig @@ -836,5 +836,6 @@ config CRYPTO_DEV_SA2UL source "drivers/crypto/aspeed/Kconfig" source "drivers/crypto/starfive/Kconfig" source "drivers/crypto/montage/Kconfig" +source "drivers/crypto/sedriver/Kconfig" endif # CRYPTO_HW diff --git a/drivers/crypto/Makefile b/drivers/crypto/Makefile index 5247d2bf09ce..6ad337bad109 100644 --- a/drivers/crypto/Makefile +++ b/drivers/crypto/Makefile @@ -54,3 +54,4 @@ obj-$(CONFIG_CRYPTO_DEV_AMLOGIC_GXL) += amlogic/ obj-y += intel/ obj-y += starfive/ obj-y += montage/ +obj-$(CONFIG_SW_SE_CHIP) += sedriver/ diff --git a/drivers/crypto/sedriver/Kconfig b/drivers/crypto/sedriver/Kconfig new file mode 100644 index 000000000000..6a11bdf1e5fa --- /dev/null +++ b/drivers/crypto/sedriver/Kconfig @@ -0,0 +1,8 @@ +# +# se chip configuration +# +config SW_SE_CHIP + tristate "wst se chip driver" + depends on LOONGARCH + help + If unsure, say N. diff --git a/drivers/crypto/sedriver/Makefile b/drivers/crypto/sedriver/Makefile new file mode 100644 index 000000000000..0ee095d1a1d2 --- /dev/null +++ b/drivers/crypto/sedriver/Makefile @@ -0,0 +1,7 @@ +# +# Makefile for SE CHIP Driver +# + +obj-$(CONFIG_SW_SE_CHIP) += sw_se_echip_drv.o +sw_se_echip_drv-objs := wst_se_echip_driver.o + diff --git a/drivers/crypto/sedriver/wst_se_common_type.h b/drivers/crypto/sedriver/wst_se_common_type.h new file mode 100644 index 000000000000..e29e9bccaa6d --- /dev/null +++ b/drivers/crypto/sedriver/wst_se_common_type.h @@ -0,0 +1,98 @@ +#ifndef _WST_SE_COMMON_TYPE_H +#define _WST_SE_COMMON_TYPE_H + +#include <linux/kernel.h> /* We're doing kernel work */ +#include <linux/module.h> /* Specifically, a module */ +#include <linux/errno.h> +#include <linux/init.h> +#include <linux/poll.h> +#include <linux/pci.h> +#include <linux/types.h> +#include <linux/fs.h> +#include <linux/interrupt.h> +#include <linux/workqueue.h> +#include <linux/mm.h> +#include <linux/sched.h> +#include <linux/slab.h> +#include <linux/wait.h> +#include <linux/version.h> +#include <linux/ioport.h> +#include <linux/time.h> +#include <linux/pagemap.h> +#include <linux/delay.h> +#include <linux/list.h> +#include <linux/uaccess.h> +#include <linux/io.h> +#include <asm/mman.h> +#include <asm/irq.h> +#include <asm/dma.h> + +#define WST_GO_CHANNEL0 0x0002 +#define WST_GO_CHANNEL1 0x0000 +#define WST_GO_CHANNEL2 0x0001 + +#define SE_OK 0 + +struct loongson_sedriver_irq { + char *pat; + int irq; +}; + +typedef struct tag_dma_buf_ctl { + struct list_head list; + unsigned char *pDmaBuf; +} dmabuf_ctl, *pdmabuf_ctl; + +typedef struct tag_Queue_container { + struct list_head m_Head; + unsigned int qlen; + unsigned int max_qlen; +} QUEUE_CONTAIN, *PQUEUE_CONTAIN; + + +static inline int wst_InitQueue(struct tag_Queue_container *pQueue, int count) +{ + INIT_LIST_HEAD(&pQueue->m_Head); + pQueue->qlen = 0; + pQueue->max_qlen = count; + return 0; +} + + +static inline struct list_head *wst_Popfront_Que(struct tag_Queue_container *pQueue) +{ + struct list_head *pNode = NULL; + + if (list_empty(&pQueue->m_Head)) + return NULL; + + pQueue->qlen--; + pNode = pQueue->m_Head.next; + list_del(pNode); + return pNode; +} + + +static inline int wst_Pushback_Que(struct tag_Queue_container *pQueue, void *pNode) +{ + if (unlikely(pQueue->qlen >= pQueue->max_qlen)) + return -1; + + pQueue->qlen++; + list_add_tail((struct list_head *)(pNode), &pQueue->m_Head); + return 0; +} + +#define READUBUF 0 +#define WRITEUBUF 1 + +static inline int wst_cpyusrbuf(unsigned char *puserbuf, + unsigned char *pkbuf, size_t num, int orient) +{ + if (orient == READUBUF) + return copy_from_user(pkbuf, puserbuf, num); + else + return copy_to_user(puserbuf, pkbuf, num); +} + +#endif diff --git a/drivers/crypto/sedriver/wst_se_define.h b/drivers/crypto/sedriver/wst_se_define.h new file mode 100644 index 000000000000..7a29f1029afa --- /dev/null +++ b/drivers/crypto/sedriver/wst_se_define.h @@ -0,0 +1,27 @@ +#ifndef _WST_SE_DEFINE_H +#define _WST_SE_DEFINE_H + + +typedef void (*PSECallBackfn)(void *pParam); + +#define WST_SE_OK 0 //function syccess +#define WST_SE_FAILURE 1 +#define WST_SE_ERROR_MALLOC 2 +#define WST_SE_ERROR_OPEN 3 +#define WST_SE_ERROR_ID 4 +#define WST_SE_ERROR_OPERTYPE 5 +#define WST_SE_ERROR_KEYID 6 +#define WST_SE_NOT_SUPPORT 7 +#define WST_SE_ERROR_FULL 8 +#define WST_SE_VERIFY_ERROR 0xb +#define WST_SE_NOT_SUPPORT_VERIFY 0xd +#define WST_SE_ERROR_LENGTH 0xc +#define WST_SE_HAS_OPEN 0xd +#define WST_COPY_MEM_ERROR 0xe +#define WST_SE_PARAM_ERROR 0xf + +#define BASE_ERROR 0x1000 +#define WST_SE_ERROR_LICENSE 0x100b +#define WST_SE_ERROR_NOT_SUPPORT_TYPE 0x100d + +#endif diff --git a/drivers/crypto/sedriver/wst_se_echip_driver.c b/drivers/crypto/sedriver/wst_se_echip_driver.c new file mode 100644 index 000000000000..66e34549d209 --- /dev/null +++ b/drivers/crypto/sedriver/wst_se_echip_driver.c @@ -0,0 +1,1368 @@ +#include <linux/semaphore.h> +#include <linux/moduleparam.h> +#include <linux/kthread.h> +#include <linux/module.h> +#include <linux/of_device.h> +#include <linux/workqueue.h> +#include <linux/platform_device.h> +#include <linux/crypto.h> +#include <crypto/internal/skcipher.h> +#include <linux/acpi.h> +#include <asm/loongson.h> +#include "wst_se_echip_driver.h" + +#define LS_CRYPTO_SE_ADDR1 TO_UNCACHE(LOONGSON_REG_BASE+0x0400) +#define LS_CRYPTO_SE_ADDR2 TO_UNCACHE(0xc0010200000) +#define DRIVER_VERSION "01.10.220111" +DEFINE_SPINLOCK(g_reclistlock); +DEFINE_SPINLOCK(g_sendlistlock); +DEFINE_SPINLOCK(g_getdmabuflock); + +unsigned char *g_pCacheInBuf = NULL, *g_pCacheOutBuf = NULL; +static struct class *g_psecclass; +static struct device *g_psecdev; +static SECHIPDRV_CTRL *g_psechipDrvCtrl; +static int g_isechip_Major = -1; +static struct semaphore g_lowsema, g_lowirqsema; +static atomic_t g_sendtotallen; +static struct tag_Queue_container g_RecQueueContainer; +static struct tag_Queue_container g_SendQueueContainer; +static int g_suspend; +static struct semaphore g_dmabufsem; +struct loongson_sedriver_irq se_irq[] = { + { + .pat = "se-irq", + }, + { + .pat = "se-lirq", + }, +}; +static struct tag_Queue_container g_DmaBQueueContainer; +static struct tag_dma_buf_ctl *g_pdmadatabuf; +static int g_iDmaBufNum; +static struct work_struct g_recwork, g_sendwork; +static struct workqueue_struct *g_worksendqueue, *g_workrecqueue; +static irqreturn_t se_interrupt(int irq, void *p); +static irqreturn_t wst_low_channel_status(int irq, void *p); +static void globalmem_do_send_op(struct work_struct *p); +static void globalmem_do_rec_op(struct work_struct *p); +static int g_iUseIntr = 1; +module_param(g_iUseIntr, int, 0644); + +static int se_init_dma_buf(int idatasize, int idatanum) +{ + int i; + struct tag_dma_buf_ctl *pdmactl; + + wst_InitQueue(&g_DmaBQueueContainer, idatanum); + g_pdmadatabuf = kmalloc((sizeof(struct tag_dma_buf_ctl)*idatanum), GFP_KERNEL); + if (!g_pdmadatabuf) + return -1; + for (i = 0; i < idatanum; i++) { + pdmactl = &g_pdmadatabuf[i]; + pdmactl->pDmaBuf = (unsigned char *)__get_free_page(GFP_KERNEL|GFP_DMA); + if (!pdmactl->pDmaBuf) { + g_iDmaBufNum = i; + return SE_OK; + } + wst_Pushback_Que(&g_DmaBQueueContainer, pdmactl); + } + g_iDmaBufNum = i; + sema_init(&g_dmabufsem, 1); + return SE_OK; +} + +static int se_del_dma_buf(void) +{ + int i; + struct tag_dma_buf_ctl *pdmactl; + + for (i = 0; i < g_iDmaBufNum; i++) { + pdmactl = &g_pdmadatabuf[i]; + if (pdmactl) { + free_page((unsigned long)pdmactl->pDmaBuf); + pdmactl->pDmaBuf = NULL; + } + } + kfree(g_pdmadatabuf); + g_pdmadatabuf = NULL; + return 0; +} + +struct tag_dma_buf_ctl *se_get_dma_buf(int ikernel) +{ + struct tag_dma_buf_ctl *pbufctl = NULL; + unsigned long ultimeout = 0; + + ultimeout = jiffies+20*HZ; + while (1) { + spin_lock(&g_getdmabuflock); + pbufctl = (struct tag_dma_buf_ctl *)wst_Popfront_Que(&g_DmaBQueueContainer); + spin_unlock(&g_getdmabuflock); + if (pbufctl) + return pbufctl; + if (down_timeout(&g_dmabufsem, ultimeout)) + return NULL; + } + return pbufctl; +} + +int se_free_dma_buf(struct tag_dma_buf_ctl *pdmabufctl) +{ + spin_lock(&g_getdmabuflock); + wst_Pushback_Que(&g_DmaBQueueContainer, pdmabufctl); + spin_unlock(&g_getdmabuflock); + if (g_dmabufsem.count <= 0) + up(&g_dmabufsem); + + return 0; +} + +static unsigned long bytes_align(struct device *pdev, unsigned long ulVirAddr) +{ + unsigned char diff; + unsigned long ulPhyAddr = (unsigned long)__pa((void *)ulVirAddr); + + if ((ulPhyAddr & 0x000000000000003f) == 0) + return ulVirAddr; + diff = ((long)ulPhyAddr & (~(0x000000000000003f))) + 64 - ulPhyAddr; + ulVirAddr += diff; + + return ulVirAddr; +} + +static unsigned long descri_bytes_align(unsigned long ulVirAddr) +{ + unsigned char diff; + unsigned long ulPhyAddr = ulVirAddr; + + if ((ulPhyAddr & (~0x00000000ffffffe0)) == 0) + return ulVirAddr; + diff = ((long)ulPhyAddr & 0x00000000ffffffe0) + 32 - ulPhyAddr; + ulVirAddr += diff; + return ulVirAddr; +} + +int se_printk_hex(unsigned char *buff, int length) +{ + unsigned char *string_tmp = buff; + int i; + int count = 0; + + for (i = 0; i < length; i++, count++) { + if (count < 16) + pr_info("%02x ", string_tmp[i]); + else { + count = 0; + pr_info("\n%02x ", string_tmp[i]); + continue; + } + } + pr_info("\n"); + return 0; +} + +static int se_ChipInit(SECHIPDRV_CTRL *pDrvCtrl) +{ + dma_addr_t ulBusAddr; + unsigned long ulVirAddr; + int i = 0, j = 0; + unsigned int dmaoldmask; + + for (i = 0; i < SWCHANNELNUM; i++) { + ulVirAddr = (unsigned long)dma_alloc_coherent( + pDrvCtrl->pdev, + (SE_BDQUEUE_LEN * SE_BD_LENGTH+32), + &ulBusAddr, GFP_KERNEL + ); + if (ulVirAddr == 0 || ulBusAddr == 0) + return -EFAULT; + memset((void *)ulVirAddr, 0, (SE_BDQUEUE_LEN*SE_BD_LENGTH)); + + pDrvCtrl->ulBDMemBasePhy[i] = ulBusAddr; + pDrvCtrl->ulBDMemBase[i] = ulVirAddr; + pDrvCtrl->ulCurrBdReadPtr[i] = 0; + pDrvCtrl->ulCurrBdWritePtr[i] = 0; + pDrvCtrl->ulCurrReadPtr[i] = 0; + pDrvCtrl->ulCurrWritePtr[i] = 0; + } + for (i = 0; i < SE_BDQUEUE_LEN; i++) { + for (j = 0; j < SWCHANNELNUM; j++) + (&((SE_BASIC_BD *)(pDrvCtrl->ulBDMemBase[j]))[i])->ucRetCode = 0x0f; + } + ulBusAddr = descri_bytes_align(pDrvCtrl->ulBDMemBasePhy[0]); + HandleWrite32(pDrvCtrl, SE_HREG_BQBA0, HIULONG(ulBusAddr)); + HandleWrite32(pDrvCtrl, SE_LREG_BQBA0, LOULONG(ulBusAddr)); + HandleWrite32(pDrvCtrl, SE_REG_BQS0, SE_BDQUEUE_LEN - 1); + HandleWrite32(pDrvCtrl, SE_REG_RQRP0, pDrvCtrl->ulCurrBdReadPtr[0]); + HandleWrite32(pDrvCtrl, SE_REG_BQWP0, pDrvCtrl->ulCurrBdWritePtr[0]); + + ulBusAddr = descri_bytes_align(pDrvCtrl->ulBDMemBasePhy[1]); + HandleWrite32(pDrvCtrl, SE_HREG_BQBA1, HIULONG(ulBusAddr)); + HandleWrite32(pDrvCtrl, SE_LREG_BQBA1, LOULONG(ulBusAddr)); + HandleWrite32(pDrvCtrl, SE_REG_BQS1, SE_BDQUEUE_LEN - 1); + HandleWrite32(pDrvCtrl, SE_REG_RQRP1, pDrvCtrl->ulCurrBdReadPtr[1]); + HandleWrite32(pDrvCtrl, SE_REG_BQWP1, pDrvCtrl->ulCurrBdWritePtr[1]); + HandleRead32(pDrvCtrl, SE_REG_MSK, &dmaoldmask); + HandleWrite32(pDrvCtrl, SE_REG_MSK, (dmaoldmask | DMA0_CTRL_CHANNEL_ENABLE | DMA1_CTRL_CHANNEL_ENABLE)); + if (g_iUseIntr != 0) + HandleWrite32(pDrvCtrl, SE_LOWREG_INQ, 1); + else + HandleWrite32(pDrvCtrl, SE_LOWREG_INQ, 0); + mdelay(1000); + + return SE_OK; +} + +static void se_ChipRelease(SECHIPDRV_CTRL *pDrvCtrl) +{ + int i; + + for (i = 0; i < SWCHANNELNUM; i++) { + if (pDrvCtrl->ulBDMemBase[i]) { + dma_free_coherent( + pDrvCtrl->pdev, + (SE_BDQUEUE_LEN * SE_BD_LENGTH), + (void *)pDrvCtrl->ulBDMemBase[i], + pDrvCtrl->ulBDMemBasePhy[i] + ); + pDrvCtrl->ulBDMemBase[i] = 0; + pDrvCtrl->ulBDMemBasePhy[i] = 0; + } + } +} + +static void SE_RESET(SECHIPDRV_CTRL *pdrvctl) +{ + + unsigned int reg; + unsigned long ulreg64, uladdr = LS_CRYPTO_SE_ADDR1; + + HandleRead32(pdrvctl, SE_REG_RESET, &reg); + HandleWrite32(pdrvctl, SE_REG_RESET, reg|SE_DMA_CONTROL_RESET); + mdelay(300); + HandleWrite32(pdrvctl, SE_REG_RESET, (reg&(~SE_DMA_CONTROL_RESET))|SE_DMA_CONTROL_SET); + mdelay(300); + ulreg64 = readq((volatile void __iomem *)uladdr); + if ((ulreg64 & 0xf0000000000000) != 0xf0000000000000) + writeq(ulreg64|0xf0000000000000, (volatile void __iomem *)uladdr); + HandleWrite32(pdrvctl, SE_INT_CLR, 0xf); +} + +static int wst_init(void) +{ + int iRes = SE_OK; + static u64 wst_dma_mask = DMA_BIT_MASK(64); + char cName[256]; + SECHIPDRV_CTRL *pdrvctl = NULL; + + pdrvctl = kmalloc(sizeof(SECHIPDRV_CTRL), GFP_KERNEL); + if (pdrvctl == NULL) + return -ENOMEM; + memset(pdrvctl, 0, sizeof(SECHIPDRV_CTRL)); + pdrvctl->ulMemBase = LS_CRYPTO_SE_ADDR2; + memset(cName, 0, 256); + sema_init(&(pdrvctl->sema), 0); + rwlock_init(&(pdrvctl->mr_lock)); + rwlock_init(&(pdrvctl->mr_lowlock)); + g_psechipDrvCtrl = pdrvctl; + g_psechipDrvCtrl->pdev = g_psecdev; + g_psechipDrvCtrl->pdev->dma_mask = &wst_dma_mask; + g_psechipDrvCtrl->pdev->coherent_dma_mask = (unsigned long long)&wst_dma_mask; + wst_InitQueue(&g_RecQueueContainer, 2000); + wst_InitQueue(&g_SendQueueContainer, 2000); + SE_RESET(pdrvctl); + pdrvctl->ilowIrq = 0; + pdrvctl->iIrq = se_irq[0].irq; + iRes = request_irq(pdrvctl->iIrq, &se_interrupt, IRQF_SHARED, "wst-se-hirq", pdrvctl); + if (iRes) { + pr_err("request_irq err\n"); + pdrvctl->iIrq = 0; + goto err; + } + if (g_iUseIntr == 1) { + pdrvctl->ilowIrq = se_irq[1].irq; + iRes = request_irq(pdrvctl->ilowIrq, &wst_low_channel_status, IRQF_SHARED, "wst-se-lirq", pdrvctl); + if (iRes) { + pr_err("\nrequest_lowirq err, iRes=0x%x\n", iRes); + pdrvctl->ilowIrq = 0; + goto err; + } + } + if (se_ChipInit(pdrvctl) != SE_OK) { + iRes = -ENODEV; + goto err; + } + return SE_OK; +err: + if (pdrvctl != NULL) { + if (pdrvctl->iIrq) { + free_irq(pdrvctl->iIrq, pdrvctl); + pdrvctl->iIrq = 0; + } + if (pdrvctl->ilowIrq) { + free_irq(pdrvctl->ilowIrq, pdrvctl); + pdrvctl->ilowIrq = 0; + } + se_ChipRelease(pdrvctl); + kfree(pdrvctl); + g_psechipDrvCtrl = NULL; + } + return iRes; +} + +static void wst_clear(void) +{ + SECHIPDRV_CTRL *pdrvctl = NULL; + + pdrvctl = g_psechipDrvCtrl; + if (pdrvctl) { + if (pdrvctl->iIrq) { + free_irq(pdrvctl->iIrq, pdrvctl); + pdrvctl->iIrq = 0; + } + if (pdrvctl->ilowIrq) { + free_irq(pdrvctl->ilowIrq, pdrvctl); + pdrvctl->ilowIrq = 0; + } + se_ChipRelease(pdrvctl); + kfree(pdrvctl); + g_psechipDrvCtrl = NULL; + } +} +static void globalmem_do_send_op(struct work_struct *p) +{ + SE_BASIC_BD *pCurBD; + unsigned int ulCurrWritePtr, ulWritePtr; + unsigned short len = 0; + unsigned long ulCurrAddrInput = 0, ulCurrAddrOutput = 0; + SECHIPDRV_CTRL *pdrvctl; + unsigned char *pInPtr; + unsigned short usInlen; + unsigned char *pOutPtr; + unsigned short *pusOutlen; + int iChannel; + unsigned char ucFlag; + unsigned char ucOpCode; + unsigned char *pucRetCode; + PSECallBackfn pcallback; + void *pParma; + int iKernel; + struct completion *mycomplete; + SEND_PACKAGE *psendpackage; + unsigned long ulflag; + unsigned long ultimeout; + int rv = 0; + + while (1) { +PROG: + spin_lock_irq(&g_sendlistlock); + psendpackage = (SEND_PACKAGE *)wst_Popfront_Que(&g_SendQueueContainer); + if (!psendpackage) { + spin_unlock_irq(&g_sendlistlock); + return; + } + spin_unlock_irq(&g_sendlistlock); + pdrvctl = psendpackage->pdrvctl; + pInPtr = psendpackage->pInPtr; + usInlen = psendpackage->usInlen; + pOutPtr = psendpackage->pOutPtr; + pusOutlen = psendpackage->pusOutlen; + iChannel = psendpackage->iChannel; + ucFlag = psendpackage->ucFlag; + ucOpCode = psendpackage->ucOpCode; + pucRetCode = psendpackage->pucRetCode; + pcallback = psendpackage->pcallback; + pParma = psendpackage->pParma; + iKernel = psendpackage->iKernel; + mycomplete = psendpackage->mycomplete; + ultimeout = psendpackage->ulendtime; + kfree(psendpackage); + + if (iKernel == 0) { + while (time_before(jiffies, ultimeout)) { +#ifdef CONFIG_MIPS + if ((pdrvctl->ulCurrBdReadPtr[iChannel] == ((pdrvctl->ulCurrBdWritePtr[iChannel] + 1) & (SE_BDQUEUE_LEN-1))) + || ((atomic_read(&g_sendtotallen) + *pusOutlen + SE_FILL_LEN) > SE_MAX_SEND_LEN)) +#else + if (pdrvctl->ulCurrBdReadPtr[iChannel] == ((pdrvctl->ulCurrBdWritePtr[iChannel] + 1) & (SE_BDQUEUE_LEN-1))) +#endif + { + down_timeout(&(pdrvctl->sema), 1*HZ); + rv = WST_SE_ERROR_FULL; + } else { + rv = 0; + break; + } + } + if (rv != 0x0) { + *pucRetCode = WST_SE_ERROR_FULL; + complete(mycomplete); + goto PROG; + } + } else { + ultimeout = jiffies+1*HZ; + while (time_before(jiffies, ultimeout)) { +#ifdef CONFIG_MIPS + if ((pdrvctl->ulCurrBdReadPtr[iChannel] == ((pdrvctl->ulCurrBdWritePtr[iChannel] + 1) & (SE_BDQUEUE_LEN-1))) + || ((atomic_read(&g_sendtotallen) + *pusOutlen + SE_FILL_LEN) > SE_MAX_SEND_LEN)) +#else + if (pdrvctl->ulCurrBdReadPtr[iChannel] == ((pdrvctl->ulCurrBdWritePtr[iChannel] + 1) & (SE_BDQUEUE_LEN-1))) +#endif + { + rv = WST_SE_ERROR_FULL; + } else { + rv = 0; + break; + } + } + if (rv != 0x0) { + *pucRetCode = WST_SE_ERROR_FULL; + if (pcallback) + pcallback(pParma); + goto PROG; + } + } + ulCurrWritePtr = pdrvctl->ulCurrBdWritePtr[iChannel]; + ulWritePtr = (ulCurrWritePtr + 1) & (SE_BDQUEUE_LEN-1); + + pCurBD = &((SE_BASIC_BD *)(pdrvctl->ulBDMemBase[iChannel]))[ulCurrWritePtr]; + memset(pCurBD, 0x0, sizeof(SE_BASIC_BD)); + if (pcallback != NULL) { + (pdrvctl->pcallback)[iChannel][ulCurrWritePtr] = pcallback; + pdrvctl->pParma[iChannel][ulCurrWritePtr] = pParma; + } else { + (pdrvctl->pcallback)[iChannel][ulCurrWritePtr] = NULL; + pdrvctl->pParma[iChannel][ulCurrWritePtr] = NULL; + } + + pdrvctl->ikernel[iChannel][ulCurrWritePtr] = iKernel; + pdrvctl->stsemphore[iChannel][ulCurrWritePtr] = mycomplete; + + if (pInPtr == pOutPtr) { + if (pOutPtr) { + len = usInlen >= *pusOutlen ? usInlen : *pusOutlen; + if (len) { + ulCurrAddrOutput = dma_map_single(pdrvctl->pdev, pOutPtr, len, DMA_BIDIRECTIONAL); + if (ulCurrAddrOutput == 0) { + TRACEERR("map ulCurrAddrOutput error\n"); + *pucRetCode = WST_SE_FAILURE; + if (iKernel == 0) { + complete(mycomplete); + } else { + *pucRetCode = WST_SE_FAILURE; + if (pcallback) + pcallback(pParma); + } + goto PROG; + } + pCurBD->ulOutputLPtr = LOULONG(ulCurrAddrOutput); + pCurBD->ulOutputHPtr = HIULONG(ulCurrAddrOutput); + pCurBD->ulInputLPtr = pCurBD->ulOutputLPtr; + pCurBD->ulInputHPtr = pCurBD->ulOutputHPtr; + } + } + } else { + if (pOutPtr && (*pusOutlen)) { + ulCurrAddrOutput = dma_map_single(pdrvctl->pdev, pOutPtr, *pusOutlen, DMA_FROM_DEVICE); + if (ulCurrAddrOutput == 0) { + TRACEERR("map ulCurrAddrOutput error\n"); + *pucRetCode = WST_SE_FAILURE; + if (iKernel == 0) { + complete(mycomplete); + } else { + *pucRetCode = WST_SE_FAILURE; + if (pcallback) + pcallback(pParma); + } + goto PROG; + } + pCurBD->ulOutputLPtr = LOULONG(ulCurrAddrOutput); + pCurBD->ulOutputHPtr = HIULONG(ulCurrAddrOutput); + } + if (usInlen && pInPtr) { + ulCurrAddrInput = dma_map_single(pdrvctl->pdev, pInPtr, usInlen, DMA_TO_DEVICE); + if (ulCurrAddrInput == 0) { + if (ulCurrAddrOutput) { + dma_unmap_single(pdrvctl->pdev, ulCurrAddrOutput, *pusOutlen, DMA_FROM_DEVICE); + pCurBD->ulOutputLPtr = 0; + pCurBD->ulOutputHPtr = 0; + } + *pucRetCode = WST_SE_FAILURE; + if (iKernel == 0) { + complete(mycomplete); + } else { + *pucRetCode = WST_SE_FAILURE; + if (pcallback) + pcallback(pParma); + } + goto PROG; + } + pCurBD->ulInputLPtr = LOULONG(ulCurrAddrInput); + pCurBD->ulInputHPtr = HIULONG(ulCurrAddrInput); + } + } + pCurBD->ucOpCode = ucOpCode & 0x0f; + pCurBD->ucFlag = ucFlag & 0x7; + pCurBD->usInputLength = usInlen; + if (pusOutlen) + pCurBD->usOutputLength = *pusOutlen; + + pCurBD->ucRetCode = 0x0f; + + pdrvctl->pusOutlen[iChannel][ulCurrWritePtr] = pusOutlen; + pdrvctl->usInlen[iChannel][ulCurrWritePtr] = usInlen&0xffff; + if (ulCurrAddrOutput) + pdrvctl->ulOutputPtr[iChannel][ulCurrWritePtr] = (unsigned long *)ulCurrAddrOutput; + else + pdrvctl->ulOutputPtr[iChannel][ulCurrWritePtr] = 0; + if (ulCurrAddrInput) + pdrvctl->ulInputPtr[iChannel][ulCurrWritePtr] = (unsigned long *)ulCurrAddrInput; + else + pdrvctl->ulInputPtr[iChannel][ulCurrWritePtr] = 0; + pdrvctl->pucRetCode[iChannel][ulCurrWritePtr] = pucRetCode; + +#ifdef CONFIG_MIPS + atomic_add((*(pdrvctl->pusOutlen[iChannel][ulCurrWritePtr]) + SE_FILL_LEN), &g_sendtotallen); +#endif + write_lock_irqsave(&(pdrvctl->mr_lock), ulflag); + if (iChannel == 0) + HandleWrite32(pdrvctl, SE_REG_BQWP0, ulWritePtr); + else + HandleWrite32(pdrvctl, SE_REG_BQWP1, ulWritePtr); + write_unlock_irqrestore(&(pdrvctl->mr_lock), ulflag); + pdrvctl->ulCurrBdWritePtr[iChannel] = ulWritePtr; + } +} + +static int se_hardtrans( + SECHIPDRV_CTRL *pdrvctl, + unsigned char *pInPtr, + unsigned short usInlen, + unsigned char *pOutPtr, + unsigned short *pusOutlen, + int iChannel, + unsigned char ucFlag, + unsigned char ucOpCode, + unsigned char *pucRetCode, + PSECallBackfn pcallback, + void *pParma, + int iKernel, + struct completion *mycomplete + ) +{ + SEND_PACKAGE *psendpackage; + gfp_t gfp_flag; + + if (in_interrupt()) + gfp_flag = GFP_ATOMIC; + else + gfp_flag = GFP_KERNEL; + if (g_suspend == 1) + return WST_SE_FAILURE; + psendpackage = kmalloc(sizeof(SEND_PACKAGE), gfp_flag); + if (psendpackage == NULL) + return -1; + + psendpackage->pdrvctl = pdrvctl; + psendpackage->pInPtr = pInPtr; + psendpackage->usInlen = usInlen; + psendpackage->pOutPtr = pOutPtr; + psendpackage->pusOutlen = pusOutlen; + psendpackage->iChannel = iChannel; + psendpackage->ucFlag = ucFlag; + psendpackage->ucOpCode = ucOpCode; + psendpackage->pucRetCode = pucRetCode; + psendpackage->pcallback = pcallback; + psendpackage->pParma = pParma; + psendpackage->iKernel = iKernel; + psendpackage->mycomplete = mycomplete; + psendpackage->ulendtime = jiffies+30*HZ; + spin_lock_irq(&g_sendlistlock); + if (wst_Pushback_Que(&g_SendQueueContainer, psendpackage) == -1) { + spin_unlock_irq(&g_sendlistlock); + kfree(psendpackage); + return WST_SE_ERROR_FULL; + } + spin_unlock_irq(&g_sendlistlock); + queue_work(g_worksendqueue, &g_sendwork); + return 0; +} + +static irqreturn_t wst_low_channel_status(int irq, void *p) +{ + SECHIPDRV_CTRL *pdrvctl = (SECHIPDRV_CTRL *)p; + int64_t ulIntStat = 0; + unsigned long ulflag; + + read_lock_irqsave(&(pdrvctl->mr_lock), ulflag); + HandleRead64(pdrvctl, SE_LOWREG_STS, &ulIntStat); + if (ulIntStat == 2) { + HandleWrite64(pdrvctl, SE_LOWINT_CLEAR, 2); + up(&g_lowirqsema); + } + read_unlock_irqrestore(&(pdrvctl->mr_lock), ulflag); + + return IRQ_HANDLED; +} + +static int se_useropen(struct inode *inode, struct file *file) +{ + if (MINOR(inode->i_rdev) != 0) + return -ENODEV; + + return SE_OK; +} + +static ssize_t wst_low_channel_userwrite_op( + SECHIPDRV_CTRL *pdrvctl, + SWCommuData *UserCommuData, + int iskernel + ) +{ + unsigned long long addr = 0, outaddr = 0; + int ilen; + int count = SE_OK; + unsigned long long ulsendlen; + unsigned char *m_pCacheInBuf; + unsigned char *m_pCacheOutBuf; + unsigned long ulflag; + + if ((g_pCacheInBuf == NULL) || (g_pCacheOutBuf == NULL)) + return -EFAULT; + + m_pCacheInBuf = (unsigned char *)bytes_align(0, (unsigned long)g_pCacheInBuf); + m_pCacheOutBuf = (unsigned char *)bytes_align(0, (unsigned long)g_pCacheOutBuf); + if (iskernel == 0) { + if (wst_cpyusrbuf((void *)(UserCommuData->pucInbuf), (void *)m_pCacheInBuf, UserCommuData->usInputLen, READUBUF)) { + TRACEERR("copy user data error\n"); + return -EFAULT; + } + } else + + memcpy((void *)m_pCacheInBuf, (void *)(UserCommuData->pucInbuf), UserCommuData->usInputLen); + ilen = UserCommuData->usInputLen >= UserCommuData->usOutputLen ? UserCommuData->usInputLen:UserCommuData->usOutputLen; + addr = dma_map_single(pdrvctl->pdev, m_pCacheInBuf, ilen, DMA_TO_DEVICE); + if (addr == 0) { + TRACEERR("transfer buffer is err\n"); + return -EFAULT; + } + outaddr = dma_map_single(pdrvctl->pdev, m_pCacheOutBuf, ilen, DMA_FROM_DEVICE); + if (outaddr == 0) { + TRACEERR("transfer buffer is err\n"); + dma_unmap_single(pdrvctl->pdev, addr, ilen, DMA_TO_DEVICE); + return -EFAULT; + } + ulsendlen = (UserCommuData->usInputLen/8); + ulsendlen = (ulsendlen & 0x00000000ffffffff) << 32; + write_lock_irqsave(&(pdrvctl->mr_lock), ulflag); + HandleWrite64(pdrvctl, SE_WRITE_REG1, ulsendlen); + HandleWrite64(pdrvctl, SE_WRITE_REG2, addr); + HandleWrite64(pdrvctl, SE_WRITE_REG3, outaddr); + write_unlock_irqrestore(&(pdrvctl->mr_lock), ulflag); + if (g_iUseIntr != 0) { + if (down_interruptible(&g_lowirqsema) == -EINTR) { + count = -EINTR; + goto EXIT; + } + } else { + unsigned long start_jiffies = 0, end_jiffies = 0; + int64_t ulIntStat = 0; + + start_jiffies = jiffies; + end_jiffies = jiffies; + while (1) { + write_lock_irqsave(&(pdrvctl->mr_lock), ulflag); + HandleRead64(pdrvctl, SE_LOWREG_SR, &ulIntStat); + end_jiffies = jiffies; + if (ulIntStat == 1) { + HandleWrite64(pdrvctl, SE_LOWREG_SR, 0); + write_unlock_irqrestore(&(pdrvctl->mr_lock), ulflag); + break; + } + write_unlock_irqrestore(&(pdrvctl->mr_lock), ulflag); + if (jiffies_to_msecs(end_jiffies-start_jiffies)/1000 >= 90) { + count = -EFAULT; + goto EXIT; + } + } + } + dma_unmap_single(pdrvctl->pdev, addr, ilen, DMA_TO_DEVICE); + dma_unmap_single(pdrvctl->pdev, outaddr, ilen, DMA_FROM_DEVICE); + if (UserCommuData->usOutputLen) { + if (iskernel == 0) { + if (wst_cpyusrbuf(UserCommuData->pucOutbuf, m_pCacheOutBuf, UserCommuData->usOutputLen, WRITEUBUF)) + return -EFAULT; + } else + memcpy(UserCommuData->pucOutbuf, m_pCacheOutBuf, UserCommuData->usOutputLen); + } + return count; +EXIT: + dma_unmap_single(pdrvctl->pdev, addr, ilen, DMA_TO_DEVICE); + dma_unmap_single(pdrvctl->pdev, outaddr, ilen, DMA_FROM_DEVICE); + return count; +} + +static ssize_t se_userwrite(struct file *file, const char *buf, size_t count, loff_t *ppos) +{ + unsigned char *pCacheBuf = NULL, *pCacheOutBuf = NULL, *pCacheBufalign = NULL, *pCacheOutBufalign = NULL; + SECHIPDRV_CTRL *pdrvctl = NULL; + SWCommuData *pCommuData = NULL; + int iCommuDatalen = 0; + int pucRetCode = 0; + unsigned short iChannel = 0; + unsigned char ucFlag = 0, ucOpCode = 0; + int *ppucRetCode; + struct completion mycomplete; + struct tag_dma_buf_ctl *pbufinctl = NULL; + int iret = 0; + + if (count == 0) { + TRACEERR("count=0\n"); + return SE_OK; + } + + if (MINOR(file->f_path.dentry->d_inode->i_rdev) != 0) + return -ENODEV; + + iCommuDatalen = sizeof(SWCommuData); + if (count != iCommuDatalen) + return -EINVAL; + + pdrvctl = g_psechipDrvCtrl; + pCommuData = kmalloc(iCommuDatalen, GFP_KERNEL); + if (!pCommuData) { + TRACEERR("pCommuData NULL\n"); + return -ENOMEM; + } + if (wst_cpyusrbuf((void *)buf, (void *)pCommuData, iCommuDatalen, READUBUF)) { + TRACEERR("copy user data error\n"); + count = -EFAULT; + goto EXIT; + } + switch ((pCommuData->usFlags)&0x000f) { + case WST_GO_CHANNEL2: + if ((pCommuData->usInputLen > DMA_BUFSIZE) || (pCommuData->usOutputLen > DMA_BUFSIZE)) { + TRACEERR("len is error\n"); + count = -EINVAL; + goto EXIT; + } + if (down_interruptible(&g_lowsema) == -EINTR) { + count = -EINTR; + goto EXIT; + } + count = wst_low_channel_userwrite_op(pdrvctl, pCommuData, 0); + up(&g_lowsema); + goto EXIT; + case WST_GO_CHANNEL0: + if (pCommuData->usInputLen == 0) { + count = -EINVAL; + goto EXIT; + } + if (pCommuData->usInputLen != 0) { + if (pCommuData->usInputLen > DMA_BUFSIZE) { + count = -EINVAL; + goto EXIT; + } + ucFlag = INPUT_VALID; + if (pCommuData->usOutputLen) + ucFlag |= OUTPUT_VALID; + } + + iChannel = 0; + ucOpCode = 0x0; + break; + case WST_GO_CHANNEL1: + if (pCommuData->usInputLen == 0) { + count = -EINVAL; + goto EXIT; + } + if (pCommuData->usInputLen != 0) { + if (pCommuData->usInputLen > DMA_BUFSIZE) { + count = -EINVAL; + goto EXIT; + } + ucFlag = INPUT_VALID; + if (pCommuData->usOutputLen) + ucFlag |= OUTPUT_VALID; + } + iChannel = 1; + ucOpCode = 0x0; + break; + default: + { + count = -EINVAL; + goto EXIT; + } + } + pbufinctl = se_get_dma_buf(0); + if (pbufinctl == NULL) { + TRACEERR("kmalloc pCacheBuf error\n"); + count = -ENOMEM; + goto EXIT; + } + pCacheBuf = pbufinctl->pDmaBuf; + pCacheBufalign = pCacheBuf; + + if (wst_cpyusrbuf((void *)(pCommuData->pucInbuf), (void *)pCacheBufalign, + pCommuData->usInputLen, READUBUF)) { + TRACEERR("cpyuserbuf pCacheBufalign error\n"); + count = -ENOMEM; + goto EXIT; + } + + pCacheOutBuf = pbufinctl->pDmaBuf; + pCacheOutBufalign = pCacheOutBuf; + + ppucRetCode = &pucRetCode; + + count = SE_OK; + init_completion(&mycomplete); + iret = se_hardtrans( + pdrvctl, + pCacheBufalign, + pCommuData->usInputLen, + pCacheOutBufalign, + &(pCommuData->usOutputLen), + iChannel, + ucFlag, + ucOpCode, + (unsigned char *)ppucRetCode, + 0, + 0, + 0, + &mycomplete + ); + if (iret == -1) { + count = -EIO; + goto EXIT; + } + if (!wait_for_completion_timeout(&mycomplete, msecs_to_jiffies(60*1000))) { + count = -EFAULT; + goto EXIT; + } + if (pucRetCode != SE_OK) { + count = -(SE_BASEERR+pucRetCode); + goto EXIT; + } + + if (pCommuData->pucOutbuf) { + if (wst_cpyusrbuf(pCommuData->pucOutbuf, pCacheOutBufalign, + pCommuData->usOutputLen, WRITEUBUF)) { + count = -EFAULT; + goto EXIT; + } + } +EXIT: + if (pbufinctl) + se_free_dma_buf(pbufinctl); + kfree(pCommuData); + return count; +} +static void globalmem_do_rec_op(struct work_struct *p) +{ + INT_MESSAGE *intmessage; + unsigned long ulflags1; + + while (1) { + spin_lock_irqsave(&g_reclistlock, ulflags1); + intmessage = (INT_MESSAGE *)wst_Popfront_Que(&g_RecQueueContainer); + spin_unlock_irqrestore(&g_reclistlock, ulflags1); + if (!intmessage) + return; + intmessage->pcallback(intmessage->pParma); + kfree(intmessage); + } +} +static irqreturn_t se_interrupt(int irq, void *p) +{ + SECHIPDRV_CTRL *pdrvctl; + SE_BASIC_BD *pCurBD; + unsigned int ulCurrReadPtr, ulReadPtr; + int iChannel; + int len = 0; + int i; + unsigned char ucMyRetCode = 0; + unsigned long ulIntStat; + int istatus[2] = {1, 2}; + unsigned long ulflags; + + pdrvctl = (SECHIPDRV_CTRL *)p; + if (!pdrvctl) + return IRQ_HANDLED; + + read_lock_irqsave(&(pdrvctl->mr_lock), ulflags); + HandleRead32(pdrvctl, SE_REG_STS, &ulIntStat); + read_unlock_irqrestore(&(pdrvctl->mr_lock), ulflags); + if ((!(ulIntStat & INT_STAT_DMA_MASK)) || (ulIntStat == 0xffffffff)) + return IRQ_HANDLED; + + for (i = 0; i <= 1; i++) { + if (ulIntStat & istatus[i]) { + if (i == 0) { + read_lock_irqsave(&(pdrvctl->mr_lock), ulflags); + HandleWrite32(pdrvctl, SE_INT_CLR, 1); + HandleRead32(pdrvctl, SE_REG_RQRP0, &ulReadPtr); + read_unlock_irqrestore(&(pdrvctl->mr_lock), ulflags); + iChannel = 0; + } else { + read_lock_irqsave(&(pdrvctl->mr_lock), ulflags); + HandleWrite32(pdrvctl, SE_INT_CLR, 2); + HandleRead32(pdrvctl, SE_REG_RQRP1, &ulReadPtr); + read_unlock_irqrestore(&(pdrvctl->mr_lock), ulflags); + iChannel = 1; + } + } else + continue; + ulCurrReadPtr = pdrvctl->ulCurrReadPtr[iChannel]; + while (1) { + if (ulCurrReadPtr != ulReadPtr) { + pCurBD = &((SE_BASIC_BD *)(pdrvctl->ulBDMemBase[iChannel]))[ulCurrReadPtr]; + if ((pCurBD->ucRetCode == 0x0f) || ((pCurBD->ucFlag & 0x8) != 0x8)) { + continue; + } else { + if (pdrvctl->ulInputPtr[iChannel][ulCurrReadPtr] == pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr]) { + if (pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr]) { + len = (*(pdrvctl->pusOutlen[iChannel][ulCurrReadPtr])) >= pdrvctl->usInlen[iChannel][ulCurrReadPtr] ? + (*(pdrvctl->pusOutlen[iChannel][ulCurrReadPtr])):pdrvctl->usInlen[iChannel][ulCurrReadPtr]; + dma_unmap_single( + pdrvctl->pdev, + (unsigned long)(pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr]), + len, + DMA_BIDIRECTIONAL + ); + pCurBD->ulOutputLPtr = 0; + pCurBD->ulOutputHPtr = 0; + pCurBD->ulInputHPtr = 0; + pCurBD->ulInputLPtr = 0; + pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr] = 0; + } + } else { + if (pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr]) { + dma_unmap_single( + pdrvctl->pdev, + (unsigned long)(pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr]), + *(pdrvctl->pusOutlen[iChannel][ulCurrReadPtr]), DMA_FROM_DEVICE + ); + smp_wmb(); + pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr] = 0; + } + if (pdrvctl->ulInputPtr[iChannel][ulCurrReadPtr]) { + dma_unmap_single( + pdrvctl->pdev, + (unsigned long)(pdrvctl->ulInputPtr[iChannel][ulCurrReadPtr]), + pdrvctl->usInlen[iChannel][ulCurrReadPtr], + DMA_TO_DEVICE + ); + pdrvctl->ulInputPtr[iChannel][ulCurrReadPtr] = 0; + } + } + ucMyRetCode = pCurBD->ucRetCode; + memcpy(pdrvctl->pucRetCode[iChannel][ulCurrReadPtr], &ucMyRetCode, 1); + if (pCurBD->ucRetCode != SE_OK) + pr_info("\nstatus %x\n", pCurBD->ucRetCode); +#ifdef CONFIG_MIPS + atomic_sub(((*(pdrvctl->pusOutlen[iChannel][ulCurrReadPtr])) + SE_FILL_LEN), &g_sendtotallen); +#endif + if ((pdrvctl->ikernel)[iChannel][ulCurrReadPtr] != 0) { + if (pdrvctl->pcallback[iChannel][ulCurrReadPtr]) { + INT_MESSAGE *intmessage = NULL; + unsigned long ulflags1; + + intmessage = (INT_MESSAGE *)kmalloc(sizeof(INT_MESSAGE), GFP_ATOMIC); + if (!intmessage) + return IRQ_HANDLED; + intmessage->pcallback = pdrvctl->pcallback[iChannel][ulCurrReadPtr]; + intmessage->pParma = pdrvctl->pParma[iChannel][ulCurrReadPtr]; + spin_lock_irqsave(&g_reclistlock, ulflags1); + wst_Pushback_Que(&g_RecQueueContainer, intmessage); + spin_unlock_irqrestore(&g_reclistlock, ulflags1); + queue_work(g_workrecqueue, &g_recwork); + } + } else { + complete(pdrvctl->stsemphore[iChannel][ulCurrReadPtr]); + } + ulCurrReadPtr = ((ulCurrReadPtr + 1)&(SE_BDQUEUE_LEN - 1)); + pdrvctl->ulCurrReadPtr[iChannel] = ulCurrReadPtr; + pdrvctl->ulCurrBdReadPtr[iChannel] = ulCurrReadPtr; + if (pdrvctl->sema.count <= 0) + up(&(pdrvctl->sema)); + } + } else + + break; + } + } + return IRQ_HANDLED; +} + +static int se_userrelease(struct inode *inode, struct file *file) +{ + return SE_OK; +} + +ssize_t se_kernelwrite( + unsigned char *pInPtr, + unsigned short usInlen, + unsigned char *pOutPtr, + unsigned short *pusOutlen, + unsigned char ucFlag, + unsigned char *pucRetCode, + PSECallBackfn pcallback, + void *pParma + ) +{ + int iret; + SECHIPDRV_CTRL *pdrvctl; + int iChannel; + unsigned char ucOpCode; + SWCommuData CommuData; + + pdrvctl = g_psechipDrvCtrl; + + switch (ucFlag) { + case WST_GO_CHANNEL2: + { + CommuData.pucInbuf = pInPtr; + CommuData.pucOutbuf = pOutPtr; + CommuData.usFlags = 0; + CommuData.usInputLen = usInlen; + CommuData.usOutputLen = *pusOutlen; + CommuData.usReserve = 0; + if (down_interruptible(&g_lowsema) == -EINTR) + return -EINTR; + iret = wst_low_channel_userwrite_op(pdrvctl, &CommuData, 1); + up(&g_lowsema); + return iret; + } + case WST_GO_CHANNEL0: + if (pcallback == NULL) + return WST_SE_PARAM_ERROR; + if (usInlen == 0) + return -EINVAL; + ucFlag = 0; + if (usInlen != 0) { + if (usInlen > DMA_BUFSIZE) + return -EINVAL; + ucFlag = INPUT_VALID; + if (*pusOutlen) + ucFlag |= OUTPUT_VALID; + } + iChannel = 0; + ucOpCode = 0x0; + break; + case WST_GO_CHANNEL1: + if (pcallback == NULL) + return WST_SE_PARAM_ERROR; + if (usInlen == 0) { + return -EINVAL; + } + ucFlag = 0; + if (usInlen != 0) { + if (usInlen > DMA_BUFSIZE) + return -EINVAL; + ucFlag = INPUT_VALID; + if (*pusOutlen) + ucFlag |= OUTPUT_VALID; + } + iChannel = 1; + ucOpCode = 0x0; + break; + default: + return -EINVAL; + } + iret = se_hardtrans( + pdrvctl, + pInPtr, + usInlen, + pOutPtr, + pusOutlen, + iChannel, + ucFlag, + ucOpCode, + pucRetCode, + pcallback, + pParma, + 1, + NULL + ); + if (iret == -1) + return -EIO; + + return SE_OK; +} +EXPORT_SYMBOL(se_kernelwrite); + +static long se_userioctl(struct file *filp, u_int cmd, u_long arg) +{ + long iret = SE_OK; + SECHIPDRV_CTRL *pdrvctl = g_psechipDrvCtrl; + unsigned long ulvalue; + + HandleRead64(pdrvctl, 0x120, &ulvalue); + pr_info("read reg value is 0x%lx in offset 120\n", ulvalue); + HandleRead64(pdrvctl, 0x118, &ulvalue); + pr_info("read reg value is 0x%lx in offset 118\n", ulvalue); + + return iret; +} + + +static const struct file_operations SE_fops = { + .owner = THIS_MODULE, + .write = se_userwrite, + .open = se_useropen, + .release = se_userrelease, + .unlocked_ioctl = se_userioctl, + .compat_ioctl = se_userioctl +}; + +int se_chip_load(void) +{ + int iRes = SE_OK; + + if (g_isechip_Major >= 0) + return WST_SE_HAS_OPEN; + g_psechipDrvCtrl = NULL; + iRes = se_init_dma_buf(DMA_BUFSIZE, CTL_DMABUFNUM); + if (iRes != SE_OK) + return WST_SE_ERROR_MALLOC; + iRes = register_chrdev(0, CRYNAME, &SE_fops); + if (iRes < 0) + goto EXIT; + + g_isechip_Major = iRes; + iRes = 0; + g_psecclass = class_create(CRYNAME); + if (IS_ERR(g_psecclass)) { + iRes = PTR_ERR(g_psecclass); + goto EXIT; + } + g_psecdev = device_create(g_psecclass, NULL, MKDEV(g_isechip_Major, 0), NULL, CRYNAME); + if (IS_ERR(g_psecdev)) { + iRes = PTR_ERR(g_psecdev); + goto EXIT; + } + iRes = wst_init(); + if (iRes != SE_OK) + goto EXIT; + + sema_init(&g_lowsema, 1); + sema_init(&g_lowirqsema, 0); + atomic_set(&g_sendtotallen, 0); + g_pCacheInBuf = (unsigned char *)__get_free_page(GFP_DMA); + if (IS_ERR(g_pCacheInBuf)) { + iRes = PTR_ERR(g_pCacheInBuf); + goto EXIT; + } + g_pCacheOutBuf = (unsigned char *)__get_free_page(GFP_DMA); + if (IS_ERR(g_pCacheOutBuf)) { + iRes = PTR_ERR(g_pCacheOutBuf); + goto EXIT; + } + + g_worksendqueue = alloc_workqueue("seworksendqueue", + WQ_MEM_RECLAIM|__WQ_ORDERED|WQ_UNBOUND, 1); + if (IS_ERR(g_worksendqueue)) { + iRes = PTR_ERR(g_worksendqueue); + goto EXIT; + } + g_workrecqueue = alloc_workqueue("seworkrecqueue", WQ_MEM_RECLAIM|__WQ_ORDERED, 0); + if (IS_ERR(g_workrecqueue)) { + iRes = PTR_ERR(g_workrecqueue); + goto EXIT; + } + INIT_WORK(&g_recwork, globalmem_do_rec_op); + INIT_WORK(&g_sendwork, globalmem_do_send_op); + pr_info("this driver version is %s\n", DRIVER_VERSION); + + return SE_OK; +EXIT: + se_del_dma_buf(); + if (g_pCacheInBuf) { + + free_page((unsigned long)g_pCacheInBuf); + g_pCacheInBuf = NULL; + } + if (g_pCacheOutBuf) { + + free_page((unsigned long)g_pCacheOutBuf); + g_pCacheOutBuf = NULL; + } + if (g_worksendqueue) { + destroy_workqueue(g_worksendqueue); + g_worksendqueue = NULL; + } + if (g_workrecqueue) { + destroy_workqueue(g_workrecqueue); + g_workrecqueue = NULL; + } + wst_clear(); + if (g_psecdev) { + device_unregister(g_psecdev); + g_psecdev = NULL; + } + if (g_psecclass) { + class_destroy(g_psecclass); + g_psecclass = NULL; + } + if (g_isechip_Major >= 0) { + unregister_chrdev(g_isechip_Major, CRYNAME); + g_isechip_Major = -1; + } + return iRes; +} + +void se_chip_unload(void) +{ + SECHIPDRV_CTRL *pdrvctl = NULL; + + pdrvctl = g_psechipDrvCtrl; + + up(&pdrvctl->sema); + if (g_pCacheInBuf) { + + free_page((unsigned long)g_pCacheInBuf); + g_pCacheInBuf = NULL; + } + if (g_pCacheOutBuf) { + + free_page((unsigned long)g_pCacheOutBuf); + g_pCacheOutBuf = NULL; + } + if (g_worksendqueue) { + cancel_work_sync(&g_sendwork); + destroy_workqueue(g_worksendqueue); + g_worksendqueue = NULL; + } + if (g_workrecqueue) { + cancel_work_sync(&g_recwork); + destroy_workqueue(g_workrecqueue); + g_workrecqueue = NULL; + } + wst_clear(); + if (g_psecdev) { + device_destroy(g_psecclass, MKDEV(g_isechip_Major, 0)); + g_psecdev = NULL; + } + if (g_psecclass) { + class_destroy(g_psecclass); + g_psecclass = NULL; + } + if (g_isechip_Major >= 0) { + unregister_chrdev(g_isechip_Major, CRYNAME); + g_isechip_Major = -1; + } + se_del_dma_buf(); +} + +static int loongson_cryp_get_irq(struct platform_device *pdev, char *pat) +{ + int i; + struct resource *res = pdev->resource; + + for (i = 0; i < pdev->num_resources; i++) { + if (strcmp(res[i].name, pat) == 0) + return res[i].start; + } + return -1; + +} +static int loongson_cryp_probe(struct platform_device *pdev) +{ + int i; + + if (ACPI_COMPANION(&pdev->dev)) { + se_irq[0].irq = platform_get_irq(pdev, 1); + se_irq[1].irq = platform_get_irq(pdev, 0); + } else { + for (i = 0; i < pdev->num_resources; i++) { + se_irq[i].irq = loongson_cryp_get_irq(pdev, + se_irq[i].pat); + if (se_irq[i].irq < 0) { + pr_warn("ERROR:sedriver get irq failed\n"); + return -1; + } + } + } + + return se_chip_load(); +} +static int loongson_cryp_remove(struct platform_device *pdev) +{ + se_chip_unload(); + return 0; +} +static int loongson_cryp_suspend(struct platform_device *pdev, pm_message_t state) +{ + g_suspend = 1; + cancel_work_sync(&g_recwork); + cancel_work_sync(&g_sendwork); + flush_work(&g_recwork); + flush_work(&g_sendwork); + se_chip_unload(); + return 0; +} + +static int loongson_cryp_resume(struct platform_device *pdev) +{ + int i; + + g_suspend = 0; + g_worksendqueue = NULL; + g_workrecqueue = NULL; + g_isechip_Major = -1; + g_pCacheInBuf = NULL; + g_pCacheOutBuf = NULL; + g_iUseIntr = 1; + spin_lock_init(&g_reclistlock); + spin_lock_init(&g_sendlistlock); + spin_lock_init(&g_getdmabuflock); + + for (i = 0; i < pdev->num_resources; i++) { + se_irq[i].irq = loongson_cryp_get_irq(pdev, se_irq[i].pat); + + if (se_irq[i].irq < 0) { + pr_warn("ERROR:sedriver get irq failed\n"); + return -1; + } + } + se_chip_load(); + return 0; +} + +static const struct acpi_device_id loongson_cryp_acpi_match[] = { + {"LOON0003"}, + {} +}; +MODULE_DEVICE_TABLE(acpi, loongson_cryp_acpi_match); + +static struct platform_driver loongson_cryp_driver = { + .probe = loongson_cryp_probe, + .remove = loongson_cryp_remove, + .suspend = loongson_cryp_suspend, + .resume = loongson_cryp_resume, + .driver = { + .name = "loongson3_crypto", + .acpi_match_table = ACPI_PTR(loongson_cryp_acpi_match), + }, +}; + +static int __init initmodule(void) +{ + return platform_driver_register(&loongson_cryp_driver); +} + +static void __exit exitmodule(void) +{ + platform_driver_unregister(&loongson_cryp_driver); +} + +module_init(initmodule); +module_exit(exitmodule); + +MODULE_ALIAS("platform:loongson3_crypto"); +MODULE_AUTHOR("dcm"); +MODULE_DESCRIPTION("se encryption chip driver Co westone"); +MODULE_VERSION(DRIVER_VERSION); +MODULE_LICENSE("GPL"); diff --git a/drivers/crypto/sedriver/wst_se_echip_driver.h b/drivers/crypto/sedriver/wst_se_echip_driver.h new file mode 100644 index 000000000000..3e562e55faac --- /dev/null +++ b/drivers/crypto/sedriver/wst_se_echip_driver.h @@ -0,0 +1,184 @@ +#ifndef _WST_SE_ECHIP_DRIVER_H +#define _WST_SE_ECHIP_DRIVER_H +#include "wst_se_ktrans.h" + +#define CRYNAME "wst-se" + +#define SWBUFNUM 512 +#define SWCHANNELNUM 2 +#define CTL_DMABUFNUM 512 + +#define DMA_MASK 0xffffffff +#define SE_DMA_CONTROL_RESET 0x80000000 +#define SE_DMA_CONTROL_SET 0x00000000 + +#define SE_BASEERR 1000 + +#define SE_MAX_SEND_LEN (3*2048) +#define SE_FILL_LEN 48 +#define SE_BD_LENGTH sizeof(SE_BASIC_BD) +#define SE_BDQUEUE_LEN SWBUFNUM +#define DMA0_CTRL_CHANNEL_ENABLE 1 +#define DMA0_CTRL_CHANNEL_DISABLE 0xfffffffe +#define DMA1_CTRL_CHANNEL_ENABLE 2 +#define DMA1_CTRL_CHANNEL_DISABLE 0xfffffffd + +#define SE_REG_RESET 0 +#define SE_REG_STS 0x08 +#define SE_INT_CTRL 0x10 +#define SE_REG_MSK 0x18 +#define SE_INT_CLR 0x20 + +#define SE_LREG_BQBA0 0x100 +#define SE_HREG_BQBA0 0x108 +#define SE_REG_BQS0 0x110 +#define SE_REG_BQWP0 0x118 +#define SE_REG_RQRP0 0x120 + +#define SE_LREG_BQBA1 0x128 +#define SE_HREG_BQBA1 0x130 +#define SE_REG_BQS1 0x138 +#define SE_REG_BQWP1 0x140 +#define SE_REG_RQRP1 0x148 + +#define SE_WRITE_REG1 0x200 +#define SE_WRITE_REG2 0x208 +#define SE_WRITE_REG3 0x210 +#define SE_LOWREG_STS 0x240 +#define SE_LOWINT_CLEAR 0x248 +#define SE_LOWREG_INQ 0x1600 +#define SE_LOWREG_SR 0x1608 +#define INPUT_VALID 0x4 +#define OUTPUT_VALID 0x8 +#define SE_LOWINT_CLR 0x228 +#define INT_STAT_DMA0_PACK_DONE 1 +#define INT_STAT_DMA1_PACK_DONE 2 +#define INT_STAT_DMA_MASK (INT_STAT_DMA0_PACK_DONE|INT_STAT_DMA1_PACK_DONE) + +typedef struct tagSEdrvctl { + + unsigned long ulMemBase; + struct device *pdev; + struct device dev; + unsigned int ulCurrBdReadPtr[SWCHANNELNUM]; + unsigned int ulCurrBdWritePtr[SWCHANNELNUM]; + unsigned int ulCurrReadPtr[SWCHANNELNUM]; + unsigned int ulCurrWritePtr[SWCHANNELNUM]; + PSECallBackfn pcallback[SWCHANNELNUM][SWBUFNUM]; + void *pParma[SWCHANNELNUM][SWBUFNUM]; + struct completion *stsemphore[SWCHANNELNUM][SWBUFNUM]; + int ikernel[SWCHANNELNUM][SWBUFNUM]; + unsigned long ulBDMemBasePhy[SWCHANNELNUM]; + unsigned long ulBDMemBase[SWCHANNELNUM]; + unsigned short *pusOutlen[SWCHANNELNUM][SWBUFNUM]; + unsigned short usInlen[SWCHANNELNUM][SWBUFNUM]; + unsigned long *ulOutputPtr[SWCHANNELNUM][SWBUFNUM]; + unsigned long *ulInputPtr[SWCHANNELNUM][SWBUFNUM]; + unsigned char *pucRetCode[SWCHANNELNUM][SWBUFNUM]; + rwlock_t mr_lock; + rwlock_t mr_lowlock; + spinlock_t readlock; + struct semaphore sema; + int iIrq; + int ilowIrq; +} SECHIPDRV_CTRL; + +typedef struct tagSEBasicBD { + + unsigned int ucOpCode:4, + ucFlag:4, + ucRetCode:8, + ucInCtxLength:8, + ucOutCtxLength:8; + unsigned int usInputLength:16, + usOutputLength:16; + unsigned int ulCtxLPtr; + unsigned int ulCtxHPtr; + unsigned int ulInputLPtr; + unsigned int ulInputHPtr; + unsigned int ulOutputLPtr; + unsigned int ulOutputHPtr; + +} SE_BASIC_BD; + +#define SW_CONT_BUF_SIZE 0x100 +#define DMA_BUFSIZE 0x1000 + +#define PAGE_NUM (DMA_BUFSIZE/PAGE_SIZE+1) + +typedef struct _SW_GET_STAT { + unsigned long TXD; + unsigned long RXD; +} SW_GET_STAT, *PSW_GET_STAT; + +DEFINE_SPINLOCK(g_writelock); + +#define HandleRead32(handle, addr, pData) \ + do { \ + smp_mb(); \ + *(pData) = readl((void *)(handle->ulMemBase + addr)); \ + } while (0) + +#define HandleWrite32(handle, addr, value)\ + do { \ + writel(value, (void *)(handle->ulMemBase + addr)); \ + smp_mb(); \ + } while (0) + +#define HandleRead64(handle, addr, pData) \ + do { \ + smp_mb(); \ + *(pData) = readq((void *)(handle->ulMemBase + addr)); \ + } while (0) + +#define HandleWrite64(handle, addr, value)\ + do { \ + writeq(value, (void *)(handle->ulMemBase + addr)); \ + smp_mb(); \ + } while (0) + + +#define SPRINTF sprintf + +#define HIULONG(w) ((unsigned int)((((unsigned long long)w) >> 32) & 0x00000000ffffffff)) +#define LOULONG(w) ((unsigned int)((unsigned long long)w) & 0x00000000ffffffff) + +#ifdef DEBUG_DRIVER + #define TRACEMSG(fmt, args...) printk(KERN_DEBUG "msg: " fmt, ##args) +#else + #define TRACEMSG(fmt, args...) +#endif + +#ifdef DEBUG_DRIVER_ERROR + #define TRACEERR(fmt, args...) printk(KERN_DEBUG "err: " fmt, ##args) +#else + #define TRACEERR(fmt, args...) +#endif + +#define HIBYTE(w) ((unsigned char)(((unsigned short)(w) >> 8) & 0xFF)) +#define LOBYTE(w) ((unsigned char)(w)) + +typedef struct ST_SEND_PACKAGE { + struct list_head list; + SECHIPDRV_CTRL *pdrvctl; + unsigned char *pInPtr; + unsigned short usInlen; + unsigned char *pOutPtr; + unsigned short *pusOutlen; + int iChannel; + unsigned char ucFlag; + unsigned char ucOpCode; + unsigned char *pucRetCode; + PSECallBackfn pcallback; + void *pParma; + int iKernel; + struct completion *mycomplete; + unsigned long ulendtime; +} SEND_PACKAGE; + +typedef struct ST_INT_MESSAGE { + struct list_head list; + PSECallBackfn pcallback; + void *pParma; +} INT_MESSAGE; +#endif diff --git a/drivers/crypto/sedriver/wst_se_ktrans.h b/drivers/crypto/sedriver/wst_se_ktrans.h new file mode 100644 index 000000000000..da6c4b8f2824 --- /dev/null +++ b/drivers/crypto/sedriver/wst_se_ktrans.h @@ -0,0 +1,17 @@ +#ifndef _WST_SE_KTRANS_H +#define _WST_SE_KTRANS_H + +#include "wst_se_common_type.h" +#include "wst_se_define.h" + + +typedef struct tagSWCOMMUDATA { + unsigned short usFlags; + unsigned short usInputLen; + unsigned short usOutputLen; + unsigned short usReserve; + unsigned char *pucInbuf; + unsigned char *pucOutbuf; +} SWCommuData; + +#endif -- 2.33.0

2 1

[PATCH OLK-6.6] KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state
by Huang Xiaojia 14 Apr '25

14 Apr '25

From: Mark Rutland <mark.rutland(a)arm.com> stable inclusion from stable-v6.12.21 commit 79e140bba70bcacc5fe15bf8c0b958793fd7d56f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBZH7N CVE: CVE-2025-22013 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fbc7e61195e23f744814e78524b73b59faa54ab4 ] There are several problems with the way hyp code lazily saves the host's FPSIMD/SVE state, including: * Host SVE being discarded unexpectedly due to inconsistent configuration of TIF_SVE and CPACR_ELx.ZEN. This has been seen to result in QEMU crashes where SVE is used by memmove(), as reported by Eric Auger: https://issues.redhat.com/browse/RHEL-68997 * Host SVE state is discarded *after* modification by ptrace, which was an unintentional ptrace ABI change introduced with lazy discarding of SVE state. * The host FPMR value can be discarded when running a non-protected VM, where FPMR support is not exposed to a VM, and that VM uses FPSIMD/SVE. In these cases the hyp code does not save the host's FPMR before unbinding the host's FPSIMD/SVE/SME state, leaving a stale value in memory. Avoid these by eagerly saving and "flushing" the host's FPSIMD/SVE/SME state when loading a vCPU such that KVM does not need to save any of the host's FPSIMD/SVE/SME state. For clarity, fpsimd_kvm_prepare() is removed and the necessary call to fpsimd_save_and_flush_cpu_state() is placed in kvm_arch_vcpu_load_fp(). As 'fpsimd_state' and 'fpmr_ptr' should not be used, they are set to NULL; all uses of these will be removed in subsequent patches. Historical problems go back at least as far as v5.17, e.g. erroneous assumptions about TIF_SVE being clear in commit: 8383741ab2e773a9 ("KVM: arm64: Get rid of host SVE tracking/saving") ... and so this eager save+flush probably needs to be backported to ALL stable trees. Fixes: 93ae6b01bafee8fa ("KVM: arm64: Discard any SVE state when entering KVM guests") Fixes: 8c845e2731041f0f ("arm64/sve: Leave SVE enabled on syscall if we don't context switch") Fixes: ef3be86021c3bdf3 ("KVM: arm64: Add save/restore support for FPMR") Reported-by: Eric Auger <eauger(a)redhat.com> Reported-by: Wilco Dijkstra <wilco.dijkstra(a)arm.com> Reviewed-by: Mark Brown <broonie(a)kernel.org> Tested-by: Mark Brown <broonie(a)kernel.org> Tested-by: Eric Auger <eric.auger(a)redhat.com> Acked-by: Will Deacon <will(a)kernel.org> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: Florian Weimer <fweimer(a)redhat.com> Cc: Fuad Tabba <tabba(a)google.com> Cc: Jeremy Linton <jeremy.linton(a)arm.com> Cc: Marc Zyngier <maz(a)kernel.org> Cc: Oliver Upton <oliver.upton(a)linux.dev> Cc: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Reviewed-by: Oliver Upton <oliver.upton(a)linux.dev> Link: https://lore.kernel.org/r/20250210195226.1215254-2-mark.rutland@arm.com Signed-off-by: Marc Zyngier <maz(a)kernel.org> [ Mark: Handle vcpu/host flag conflict ] Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/arm64/kvm/fpsimd.c [Lack of commit ef3be86021c3bdf384c36d9d4aa1ee9fe65b95af] Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- arch/arm64/kernel/fpsimd.c | 25 ------------------------- arch/arm64/kvm/fpsimd.c | 33 +++++++++------------------------ 2 files changed, 9 insertions(+), 49 deletions(-) diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c index 0137d987631e..bd4f6c6ee0f3 100644 --- a/arch/arm64/kernel/fpsimd.c +++ b/arch/arm64/kernel/fpsimd.c @@ -1707,31 +1707,6 @@ void fpsimd_signal_preserve_current_state(void) sve_to_fpsimd(current); } -/* - * Called by KVM when entering the guest. - */ -void fpsimd_kvm_prepare(void) -{ - if (!system_supports_sve()) - return; - - /* - * KVM does not save host SVE state since we can only enter - * the guest from a syscall so the ABI means that only the - * non-saved SVE state needs to be saved. If we have left - * SVE enabled for performance reasons then update the task - * state to be FPSIMD only. - */ - get_cpu_fpsimd_context(); - - if (test_and_clear_thread_flag(TIF_SVE)) { - sve_to_fpsimd(current); - current->thread.fp_type = FP_STATE_FPSIMD; - } - - put_cpu_fpsimd_context(); -} - /* * Associate current's FPSIMD context with this cpu * The caller must have ownership of the cpu FPSIMD context before calling diff --git a/arch/arm64/kvm/fpsimd.c b/arch/arm64/kvm/fpsimd.c index 4f51293db173..9c444a277a17 100644 --- a/arch/arm64/kvm/fpsimd.c +++ b/arch/arm64/kvm/fpsimd.c @@ -77,15 +77,17 @@ void kvm_arch_vcpu_load_fp(struct kvm_vcpu *vcpu) if (!system_supports_fpsimd()) return; - fpsimd_kvm_prepare(); - /* - * We will check TIF_FOREIGN_FPSTATE just before entering the - * guest in kvm_arch_vcpu_ctxflush_fp() and override this to - * FP_STATE_FREE if the flag set. + * Ensure that any host FPSIMD/SVE/SME state is saved and unbound such + * that the host kernel is responsible for restoring this state upon + * return to userspace, and the hyp code doesn't need to save anything. + * + * When the host may use SME, fpsimd_save_and_flush_cpu_state() ensures + * that PSTATE.{SM,ZA} == {0,0}. */ - *host_data_ptr(fp_owner) = FP_STATE_HOST_OWNED; - *host_data_ptr(fpsimd_state) = kern_hyp_va(&current->thread.uw.fpsimd_state); + fpsimd_save_and_flush_cpu_state(); + *host_data_ptr(fp_owner) = FP_STATE_FREE; + *host_data_ptr(fpsimd_state) = NULL; vcpu_clear_flag(vcpu, HOST_SVE_ENABLED); if (read_sysreg(cpacr_el1) & CPACR_EL1_ZEN_EL0EN) @@ -95,23 +97,6 @@ void kvm_arch_vcpu_load_fp(struct kvm_vcpu *vcpu) vcpu_clear_flag(vcpu, HOST_SME_ENABLED); if (read_sysreg(cpacr_el1) & CPACR_EL1_SMEN_EL0EN) vcpu_set_flag(vcpu, HOST_SME_ENABLED); - - /* - * If PSTATE.SM is enabled then save any pending FP - * state and disable PSTATE.SM. If we leave PSTATE.SM - * enabled and the guest does not enable SME via - * CPACR_EL1.SMEN then operations that should be valid - * may generate SME traps from EL1 to EL1 which we - * can't intercept and which would confuse the guest. - * - * Do the same for PSTATE.ZA in the case where there - * is state in the registers which has not already - * been saved, this is very unlikely to happen. - */ - if (read_sysreg_s(SYS_SVCR) & (SVCR_SM_MASK | SVCR_ZA_MASK)) { - *host_data_ptr(fp_owner) = FP_STATE_FREE; - fpsimd_save_and_flush_cpu_state(); - } } } -- 2.34.1

2 1

[PATCH OLK-6.6] crypto: loongson: add wst se chip support
by Hongchen Zhang 14 Apr '25

14 Apr '25

From: Qunqin Zhao <zhaoqunqin(a)loongson.cn> LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IC10DU CVE: NA -------------------------------- Add support for WST se chip support for LS*5000*. Signed-off-by: Qunqin Zhao <zhaoqunqin(a)loongson.cn> --- arch/loongarch/configs/loongson3_defconfig | 1 + drivers/crypto/Kconfig | 1 + drivers/crypto/Makefile | 1 + drivers/crypto/sedriver/Kconfig | 8 + drivers/crypto/sedriver/Makefile | 7 + drivers/crypto/sedriver/wst_se_common_type.h | 98 ++ drivers/crypto/sedriver/wst_se_define.h | 27 + drivers/crypto/sedriver/wst_se_echip_driver.c | 1368 +++++++++++++++++ drivers/crypto/sedriver/wst_se_echip_driver.h | 184 +++ drivers/crypto/sedriver/wst_se_ktrans.h | 17 + 10 files changed, 1712 insertions(+) create mode 100644 drivers/crypto/sedriver/Kconfig create mode 100644 drivers/crypto/sedriver/Makefile create mode 100644 drivers/crypto/sedriver/wst_se_common_type.h create mode 100644 drivers/crypto/sedriver/wst_se_define.h create mode 100644 drivers/crypto/sedriver/wst_se_echip_driver.c create mode 100644 drivers/crypto/sedriver/wst_se_echip_driver.h create mode 100644 drivers/crypto/sedriver/wst_se_ktrans.h diff --git a/arch/loongarch/configs/loongson3_defconfig b/arch/loongarch/configs/loongson3_defconfig index 980f5f2c99a1..cf359d1a2554 100644 --- a/arch/loongarch/configs/loongson3_defconfig +++ b/arch/loongarch/configs/loongson3_defconfig @@ -2177,6 +2177,7 @@ CONFIG_CRYPTO_CRC32_LOONGARCH=m CONFIG_CRYPTO_DEV_NITROX_CNN55XX=m CONFIG_CRYPTO_DEV_CHELSIO=m CONFIG_CRYPTO_DEV_VIRTIO=m +CONFIG_SW_SE_CHIP=m CONFIG_SIGNED_PE_FILE_VERIFICATION=y CONFIG_SECONDARY_TRUSTED_KEYRING=y CONFIG_SYSTEM_BLACKLIST_KEYRING=y diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig index b84a921d293f..efd6a855bca3 100644 --- a/drivers/crypto/Kconfig +++ b/drivers/crypto/Kconfig @@ -836,5 +836,6 @@ config CRYPTO_DEV_SA2UL source "drivers/crypto/aspeed/Kconfig" source "drivers/crypto/starfive/Kconfig" source "drivers/crypto/montage/Kconfig" +source "drivers/crypto/sedriver/Kconfig" endif # CRYPTO_HW diff --git a/drivers/crypto/Makefile b/drivers/crypto/Makefile index 5247d2bf09ce..6ad337bad109 100644 --- a/drivers/crypto/Makefile +++ b/drivers/crypto/Makefile @@ -54,3 +54,4 @@ obj-$(CONFIG_CRYPTO_DEV_AMLOGIC_GXL) += amlogic/ obj-y += intel/ obj-y += starfive/ obj-y += montage/ +obj-$(CONFIG_SW_SE_CHIP) += sedriver/ diff --git a/drivers/crypto/sedriver/Kconfig b/drivers/crypto/sedriver/Kconfig new file mode 100644 index 000000000000..6a11bdf1e5fa --- /dev/null +++ b/drivers/crypto/sedriver/Kconfig @@ -0,0 +1,8 @@ +# +# se chip configuration +# +config SW_SE_CHIP + tristate "wst se chip driver" + depends on LOONGARCH + help + If unsure, say N. diff --git a/drivers/crypto/sedriver/Makefile b/drivers/crypto/sedriver/Makefile new file mode 100644 index 000000000000..0ee095d1a1d2 --- /dev/null +++ b/drivers/crypto/sedriver/Makefile @@ -0,0 +1,7 @@ +# +# Makefile for SE CHIP Driver +# + +obj-$(CONFIG_SW_SE_CHIP) += sw_se_echip_drv.o +sw_se_echip_drv-objs := wst_se_echip_driver.o + diff --git a/drivers/crypto/sedriver/wst_se_common_type.h b/drivers/crypto/sedriver/wst_se_common_type.h new file mode 100644 index 000000000000..e29e9bccaa6d --- /dev/null +++ b/drivers/crypto/sedriver/wst_se_common_type.h @@ -0,0 +1,98 @@ +#ifndef _WST_SE_COMMON_TYPE_H +#define _WST_SE_COMMON_TYPE_H + +#include <linux/kernel.h> /* We're doing kernel work */ +#include <linux/module.h> /* Specifically, a module */ +#include <linux/errno.h> +#include <linux/init.h> +#include <linux/poll.h> +#include <linux/pci.h> +#include <linux/types.h> +#include <linux/fs.h> +#include <linux/interrupt.h> +#include <linux/workqueue.h> +#include <linux/mm.h> +#include <linux/sched.h> +#include <linux/slab.h> +#include <linux/wait.h> +#include <linux/version.h> +#include <linux/ioport.h> +#include <linux/time.h> +#include <linux/pagemap.h> +#include <linux/delay.h> +#include <linux/list.h> +#include <linux/uaccess.h> +#include <linux/io.h> +#include <asm/mman.h> +#include <asm/irq.h> +#include <asm/dma.h> + +#define WST_GO_CHANNEL0 0x0002 +#define WST_GO_CHANNEL1 0x0000 +#define WST_GO_CHANNEL2 0x0001 + +#define SE_OK 0 + +struct loongson_sedriver_irq { + char *pat; + int irq; +}; + +typedef struct tag_dma_buf_ctl { + struct list_head list; + unsigned char *pDmaBuf; +} dmabuf_ctl, *pdmabuf_ctl; + +typedef struct tag_Queue_container { + struct list_head m_Head; + unsigned int qlen; + unsigned int max_qlen; +} QUEUE_CONTAIN, *PQUEUE_CONTAIN; + + +static inline int wst_InitQueue(struct tag_Queue_container *pQueue, int count) +{ + INIT_LIST_HEAD(&pQueue->m_Head); + pQueue->qlen = 0; + pQueue->max_qlen = count; + return 0; +} + + +static inline struct list_head *wst_Popfront_Que(struct tag_Queue_container *pQueue) +{ + struct list_head *pNode = NULL; + + if (list_empty(&pQueue->m_Head)) + return NULL; + + pQueue->qlen--; + pNode = pQueue->m_Head.next; + list_del(pNode); + return pNode; +} + + +static inline int wst_Pushback_Que(struct tag_Queue_container *pQueue, void *pNode) +{ + if (unlikely(pQueue->qlen >= pQueue->max_qlen)) + return -1; + + pQueue->qlen++; + list_add_tail((struct list_head *)(pNode), &pQueue->m_Head); + return 0; +} + +#define READUBUF 0 +#define WRITEUBUF 1 + +static inline int wst_cpyusrbuf(unsigned char *puserbuf, + unsigned char *pkbuf, size_t num, int orient) +{ + if (orient == READUBUF) + return copy_from_user(pkbuf, puserbuf, num); + else + return copy_to_user(puserbuf, pkbuf, num); +} + +#endif diff --git a/drivers/crypto/sedriver/wst_se_define.h b/drivers/crypto/sedriver/wst_se_define.h new file mode 100644 index 000000000000..7a29f1029afa --- /dev/null +++ b/drivers/crypto/sedriver/wst_se_define.h @@ -0,0 +1,27 @@ +#ifndef _WST_SE_DEFINE_H +#define _WST_SE_DEFINE_H + + +typedef void (*PSECallBackfn)(void *pParam); + +#define WST_SE_OK 0 //function syccess +#define WST_SE_FAILURE 1 +#define WST_SE_ERROR_MALLOC 2 +#define WST_SE_ERROR_OPEN 3 +#define WST_SE_ERROR_ID 4 +#define WST_SE_ERROR_OPERTYPE 5 +#define WST_SE_ERROR_KEYID 6 +#define WST_SE_NOT_SUPPORT 7 +#define WST_SE_ERROR_FULL 8 +#define WST_SE_VERIFY_ERROR 0xb +#define WST_SE_NOT_SUPPORT_VERIFY 0xd +#define WST_SE_ERROR_LENGTH 0xc +#define WST_SE_HAS_OPEN 0xd +#define WST_COPY_MEM_ERROR 0xe +#define WST_SE_PARAM_ERROR 0xf + +#define BASE_ERROR 0x1000 +#define WST_SE_ERROR_LICENSE 0x100b +#define WST_SE_ERROR_NOT_SUPPORT_TYPE 0x100d + +#endif diff --git a/drivers/crypto/sedriver/wst_se_echip_driver.c b/drivers/crypto/sedriver/wst_se_echip_driver.c new file mode 100644 index 000000000000..66e34549d209 --- /dev/null +++ b/drivers/crypto/sedriver/wst_se_echip_driver.c @@ -0,0 +1,1368 @@ +#include <linux/semaphore.h> +#include <linux/moduleparam.h> +#include <linux/kthread.h> +#include <linux/module.h> +#include <linux/of_device.h> +#include <linux/workqueue.h> +#include <linux/platform_device.h> +#include <linux/crypto.h> +#include <crypto/internal/skcipher.h> +#include <linux/acpi.h> +#include <asm/loongson.h> +#include "wst_se_echip_driver.h" + +#define LS_CRYPTO_SE_ADDR1 TO_UNCACHE(LOONGSON_REG_BASE+0x0400) +#define LS_CRYPTO_SE_ADDR2 TO_UNCACHE(0xc0010200000) +#define DRIVER_VERSION "01.10.220111" +DEFINE_SPINLOCK(g_reclistlock); +DEFINE_SPINLOCK(g_sendlistlock); +DEFINE_SPINLOCK(g_getdmabuflock); + +unsigned char *g_pCacheInBuf = NULL, *g_pCacheOutBuf = NULL; +static struct class *g_psecclass; +static struct device *g_psecdev; +static SECHIPDRV_CTRL *g_psechipDrvCtrl; +static int g_isechip_Major = -1; +static struct semaphore g_lowsema, g_lowirqsema; +static atomic_t g_sendtotallen; +static struct tag_Queue_container g_RecQueueContainer; +static struct tag_Queue_container g_SendQueueContainer; +static int g_suspend; +static struct semaphore g_dmabufsem; +struct loongson_sedriver_irq se_irq[] = { + { + .pat = "se-irq", + }, + { + .pat = "se-lirq", + }, +}; +static struct tag_Queue_container g_DmaBQueueContainer; +static struct tag_dma_buf_ctl *g_pdmadatabuf; +static int g_iDmaBufNum; +static struct work_struct g_recwork, g_sendwork; +static struct workqueue_struct *g_worksendqueue, *g_workrecqueue; +static irqreturn_t se_interrupt(int irq, void *p); +static irqreturn_t wst_low_channel_status(int irq, void *p); +static void globalmem_do_send_op(struct work_struct *p); +static void globalmem_do_rec_op(struct work_struct *p); +static int g_iUseIntr = 1; +module_param(g_iUseIntr, int, 0644); + +static int se_init_dma_buf(int idatasize, int idatanum) +{ + int i; + struct tag_dma_buf_ctl *pdmactl; + + wst_InitQueue(&g_DmaBQueueContainer, idatanum); + g_pdmadatabuf = kmalloc((sizeof(struct tag_dma_buf_ctl)*idatanum), GFP_KERNEL); + if (!g_pdmadatabuf) + return -1; + for (i = 0; i < idatanum; i++) { + pdmactl = &g_pdmadatabuf[i]; + pdmactl->pDmaBuf = (unsigned char *)__get_free_page(GFP_KERNEL|GFP_DMA); + if (!pdmactl->pDmaBuf) { + g_iDmaBufNum = i; + return SE_OK; + } + wst_Pushback_Que(&g_DmaBQueueContainer, pdmactl); + } + g_iDmaBufNum = i; + sema_init(&g_dmabufsem, 1); + return SE_OK; +} + +static int se_del_dma_buf(void) +{ + int i; + struct tag_dma_buf_ctl *pdmactl; + + for (i = 0; i < g_iDmaBufNum; i++) { + pdmactl = &g_pdmadatabuf[i]; + if (pdmactl) { + free_page((unsigned long)pdmactl->pDmaBuf); + pdmactl->pDmaBuf = NULL; + } + } + kfree(g_pdmadatabuf); + g_pdmadatabuf = NULL; + return 0; +} + +struct tag_dma_buf_ctl *se_get_dma_buf(int ikernel) +{ + struct tag_dma_buf_ctl *pbufctl = NULL; + unsigned long ultimeout = 0; + + ultimeout = jiffies+20*HZ; + while (1) { + spin_lock(&g_getdmabuflock); + pbufctl = (struct tag_dma_buf_ctl *)wst_Popfront_Que(&g_DmaBQueueContainer); + spin_unlock(&g_getdmabuflock); + if (pbufctl) + return pbufctl; + if (down_timeout(&g_dmabufsem, ultimeout)) + return NULL; + } + return pbufctl; +} + +int se_free_dma_buf(struct tag_dma_buf_ctl *pdmabufctl) +{ + spin_lock(&g_getdmabuflock); + wst_Pushback_Que(&g_DmaBQueueContainer, pdmabufctl); + spin_unlock(&g_getdmabuflock); + if (g_dmabufsem.count <= 0) + up(&g_dmabufsem); + + return 0; +} + +static unsigned long bytes_align(struct device *pdev, unsigned long ulVirAddr) +{ + unsigned char diff; + unsigned long ulPhyAddr = (unsigned long)__pa((void *)ulVirAddr); + + if ((ulPhyAddr & 0x000000000000003f) == 0) + return ulVirAddr; + diff = ((long)ulPhyAddr & (~(0x000000000000003f))) + 64 - ulPhyAddr; + ulVirAddr += diff; + + return ulVirAddr; +} + +static unsigned long descri_bytes_align(unsigned long ulVirAddr) +{ + unsigned char diff; + unsigned long ulPhyAddr = ulVirAddr; + + if ((ulPhyAddr & (~0x00000000ffffffe0)) == 0) + return ulVirAddr; + diff = ((long)ulPhyAddr & 0x00000000ffffffe0) + 32 - ulPhyAddr; + ulVirAddr += diff; + return ulVirAddr; +} + +int se_printk_hex(unsigned char *buff, int length) +{ + unsigned char *string_tmp = buff; + int i; + int count = 0; + + for (i = 0; i < length; i++, count++) { + if (count < 16) + pr_info("%02x ", string_tmp[i]); + else { + count = 0; + pr_info("\n%02x ", string_tmp[i]); + continue; + } + } + pr_info("\n"); + return 0; +} + +static int se_ChipInit(SECHIPDRV_CTRL *pDrvCtrl) +{ + dma_addr_t ulBusAddr; + unsigned long ulVirAddr; + int i = 0, j = 0; + unsigned int dmaoldmask; + + for (i = 0; i < SWCHANNELNUM; i++) { + ulVirAddr = (unsigned long)dma_alloc_coherent( + pDrvCtrl->pdev, + (SE_BDQUEUE_LEN * SE_BD_LENGTH+32), + &ulBusAddr, GFP_KERNEL + ); + if (ulVirAddr == 0 || ulBusAddr == 0) + return -EFAULT; + memset((void *)ulVirAddr, 0, (SE_BDQUEUE_LEN*SE_BD_LENGTH)); + + pDrvCtrl->ulBDMemBasePhy[i] = ulBusAddr; + pDrvCtrl->ulBDMemBase[i] = ulVirAddr; + pDrvCtrl->ulCurrBdReadPtr[i] = 0; + pDrvCtrl->ulCurrBdWritePtr[i] = 0; + pDrvCtrl->ulCurrReadPtr[i] = 0; + pDrvCtrl->ulCurrWritePtr[i] = 0; + } + for (i = 0; i < SE_BDQUEUE_LEN; i++) { + for (j = 0; j < SWCHANNELNUM; j++) + (&((SE_BASIC_BD *)(pDrvCtrl->ulBDMemBase[j]))[i])->ucRetCode = 0x0f; + } + ulBusAddr = descri_bytes_align(pDrvCtrl->ulBDMemBasePhy[0]); + HandleWrite32(pDrvCtrl, SE_HREG_BQBA0, HIULONG(ulBusAddr)); + HandleWrite32(pDrvCtrl, SE_LREG_BQBA0, LOULONG(ulBusAddr)); + HandleWrite32(pDrvCtrl, SE_REG_BQS0, SE_BDQUEUE_LEN - 1); + HandleWrite32(pDrvCtrl, SE_REG_RQRP0, pDrvCtrl->ulCurrBdReadPtr[0]); + HandleWrite32(pDrvCtrl, SE_REG_BQWP0, pDrvCtrl->ulCurrBdWritePtr[0]); + + ulBusAddr = descri_bytes_align(pDrvCtrl->ulBDMemBasePhy[1]); + HandleWrite32(pDrvCtrl, SE_HREG_BQBA1, HIULONG(ulBusAddr)); + HandleWrite32(pDrvCtrl, SE_LREG_BQBA1, LOULONG(ulBusAddr)); + HandleWrite32(pDrvCtrl, SE_REG_BQS1, SE_BDQUEUE_LEN - 1); + HandleWrite32(pDrvCtrl, SE_REG_RQRP1, pDrvCtrl->ulCurrBdReadPtr[1]); + HandleWrite32(pDrvCtrl, SE_REG_BQWP1, pDrvCtrl->ulCurrBdWritePtr[1]); + HandleRead32(pDrvCtrl, SE_REG_MSK, &dmaoldmask); + HandleWrite32(pDrvCtrl, SE_REG_MSK, (dmaoldmask | DMA0_CTRL_CHANNEL_ENABLE | DMA1_CTRL_CHANNEL_ENABLE)); + if (g_iUseIntr != 0) + HandleWrite32(pDrvCtrl, SE_LOWREG_INQ, 1); + else + HandleWrite32(pDrvCtrl, SE_LOWREG_INQ, 0); + mdelay(1000); + + return SE_OK; +} + +static void se_ChipRelease(SECHIPDRV_CTRL *pDrvCtrl) +{ + int i; + + for (i = 0; i < SWCHANNELNUM; i++) { + if (pDrvCtrl->ulBDMemBase[i]) { + dma_free_coherent( + pDrvCtrl->pdev, + (SE_BDQUEUE_LEN * SE_BD_LENGTH), + (void *)pDrvCtrl->ulBDMemBase[i], + pDrvCtrl->ulBDMemBasePhy[i] + ); + pDrvCtrl->ulBDMemBase[i] = 0; + pDrvCtrl->ulBDMemBasePhy[i] = 0; + } + } +} + +static void SE_RESET(SECHIPDRV_CTRL *pdrvctl) +{ + + unsigned int reg; + unsigned long ulreg64, uladdr = LS_CRYPTO_SE_ADDR1; + + HandleRead32(pdrvctl, SE_REG_RESET, &reg); + HandleWrite32(pdrvctl, SE_REG_RESET, reg|SE_DMA_CONTROL_RESET); + mdelay(300); + HandleWrite32(pdrvctl, SE_REG_RESET, (reg&(~SE_DMA_CONTROL_RESET))|SE_DMA_CONTROL_SET); + mdelay(300); + ulreg64 = readq((volatile void __iomem *)uladdr); + if ((ulreg64 & 0xf0000000000000) != 0xf0000000000000) + writeq(ulreg64|0xf0000000000000, (volatile void __iomem *)uladdr); + HandleWrite32(pdrvctl, SE_INT_CLR, 0xf); +} + +static int wst_init(void) +{ + int iRes = SE_OK; + static u64 wst_dma_mask = DMA_BIT_MASK(64); + char cName[256]; + SECHIPDRV_CTRL *pdrvctl = NULL; + + pdrvctl = kmalloc(sizeof(SECHIPDRV_CTRL), GFP_KERNEL); + if (pdrvctl == NULL) + return -ENOMEM; + memset(pdrvctl, 0, sizeof(SECHIPDRV_CTRL)); + pdrvctl->ulMemBase = LS_CRYPTO_SE_ADDR2; + memset(cName, 0, 256); + sema_init(&(pdrvctl->sema), 0); + rwlock_init(&(pdrvctl->mr_lock)); + rwlock_init(&(pdrvctl->mr_lowlock)); + g_psechipDrvCtrl = pdrvctl; + g_psechipDrvCtrl->pdev = g_psecdev; + g_psechipDrvCtrl->pdev->dma_mask = &wst_dma_mask; + g_psechipDrvCtrl->pdev->coherent_dma_mask = (unsigned long long)&wst_dma_mask; + wst_InitQueue(&g_RecQueueContainer, 2000); + wst_InitQueue(&g_SendQueueContainer, 2000); + SE_RESET(pdrvctl); + pdrvctl->ilowIrq = 0; + pdrvctl->iIrq = se_irq[0].irq; + iRes = request_irq(pdrvctl->iIrq, &se_interrupt, IRQF_SHARED, "wst-se-hirq", pdrvctl); + if (iRes) { + pr_err("request_irq err\n"); + pdrvctl->iIrq = 0; + goto err; + } + if (g_iUseIntr == 1) { + pdrvctl->ilowIrq = se_irq[1].irq; + iRes = request_irq(pdrvctl->ilowIrq, &wst_low_channel_status, IRQF_SHARED, "wst-se-lirq", pdrvctl); + if (iRes) { + pr_err("\nrequest_lowirq err, iRes=0x%x\n", iRes); + pdrvctl->ilowIrq = 0; + goto err; + } + } + if (se_ChipInit(pdrvctl) != SE_OK) { + iRes = -ENODEV; + goto err; + } + return SE_OK; +err: + if (pdrvctl != NULL) { + if (pdrvctl->iIrq) { + free_irq(pdrvctl->iIrq, pdrvctl); + pdrvctl->iIrq = 0; + } + if (pdrvctl->ilowIrq) { + free_irq(pdrvctl->ilowIrq, pdrvctl); + pdrvctl->ilowIrq = 0; + } + se_ChipRelease(pdrvctl); + kfree(pdrvctl); + g_psechipDrvCtrl = NULL; + } + return iRes; +} + +static void wst_clear(void) +{ + SECHIPDRV_CTRL *pdrvctl = NULL; + + pdrvctl = g_psechipDrvCtrl; + if (pdrvctl) { + if (pdrvctl->iIrq) { + free_irq(pdrvctl->iIrq, pdrvctl); + pdrvctl->iIrq = 0; + } + if (pdrvctl->ilowIrq) { + free_irq(pdrvctl->ilowIrq, pdrvctl); + pdrvctl->ilowIrq = 0; + } + se_ChipRelease(pdrvctl); + kfree(pdrvctl); + g_psechipDrvCtrl = NULL; + } +} +static void globalmem_do_send_op(struct work_struct *p) +{ + SE_BASIC_BD *pCurBD; + unsigned int ulCurrWritePtr, ulWritePtr; + unsigned short len = 0; + unsigned long ulCurrAddrInput = 0, ulCurrAddrOutput = 0; + SECHIPDRV_CTRL *pdrvctl; + unsigned char *pInPtr; + unsigned short usInlen; + unsigned char *pOutPtr; + unsigned short *pusOutlen; + int iChannel; + unsigned char ucFlag; + unsigned char ucOpCode; + unsigned char *pucRetCode; + PSECallBackfn pcallback; + void *pParma; + int iKernel; + struct completion *mycomplete; + SEND_PACKAGE *psendpackage; + unsigned long ulflag; + unsigned long ultimeout; + int rv = 0; + + while (1) { +PROG: + spin_lock_irq(&g_sendlistlock); + psendpackage = (SEND_PACKAGE *)wst_Popfront_Que(&g_SendQueueContainer); + if (!psendpackage) { + spin_unlock_irq(&g_sendlistlock); + return; + } + spin_unlock_irq(&g_sendlistlock); + pdrvctl = psendpackage->pdrvctl; + pInPtr = psendpackage->pInPtr; + usInlen = psendpackage->usInlen; + pOutPtr = psendpackage->pOutPtr; + pusOutlen = psendpackage->pusOutlen; + iChannel = psendpackage->iChannel; + ucFlag = psendpackage->ucFlag; + ucOpCode = psendpackage->ucOpCode; + pucRetCode = psendpackage->pucRetCode; + pcallback = psendpackage->pcallback; + pParma = psendpackage->pParma; + iKernel = psendpackage->iKernel; + mycomplete = psendpackage->mycomplete; + ultimeout = psendpackage->ulendtime; + kfree(psendpackage); + + if (iKernel == 0) { + while (time_before(jiffies, ultimeout)) { +#ifdef CONFIG_MIPS + if ((pdrvctl->ulCurrBdReadPtr[iChannel] == ((pdrvctl->ulCurrBdWritePtr[iChannel] + 1) & (SE_BDQUEUE_LEN-1))) + || ((atomic_read(&g_sendtotallen) + *pusOutlen + SE_FILL_LEN) > SE_MAX_SEND_LEN)) +#else + if (pdrvctl->ulCurrBdReadPtr[iChannel] == ((pdrvctl->ulCurrBdWritePtr[iChannel] + 1) & (SE_BDQUEUE_LEN-1))) +#endif + { + down_timeout(&(pdrvctl->sema), 1*HZ); + rv = WST_SE_ERROR_FULL; + } else { + rv = 0; + break; + } + } + if (rv != 0x0) { + *pucRetCode = WST_SE_ERROR_FULL; + complete(mycomplete); + goto PROG; + } + } else { + ultimeout = jiffies+1*HZ; + while (time_before(jiffies, ultimeout)) { +#ifdef CONFIG_MIPS + if ((pdrvctl->ulCurrBdReadPtr[iChannel] == ((pdrvctl->ulCurrBdWritePtr[iChannel] + 1) & (SE_BDQUEUE_LEN-1))) + || ((atomic_read(&g_sendtotallen) + *pusOutlen + SE_FILL_LEN) > SE_MAX_SEND_LEN)) +#else + if (pdrvctl->ulCurrBdReadPtr[iChannel] == ((pdrvctl->ulCurrBdWritePtr[iChannel] + 1) & (SE_BDQUEUE_LEN-1))) +#endif + { + rv = WST_SE_ERROR_FULL; + } else { + rv = 0; + break; + } + } + if (rv != 0x0) { + *pucRetCode = WST_SE_ERROR_FULL; + if (pcallback) + pcallback(pParma); + goto PROG; + } + } + ulCurrWritePtr = pdrvctl->ulCurrBdWritePtr[iChannel]; + ulWritePtr = (ulCurrWritePtr + 1) & (SE_BDQUEUE_LEN-1); + + pCurBD = &((SE_BASIC_BD *)(pdrvctl->ulBDMemBase[iChannel]))[ulCurrWritePtr]; + memset(pCurBD, 0x0, sizeof(SE_BASIC_BD)); + if (pcallback != NULL) { + (pdrvctl->pcallback)[iChannel][ulCurrWritePtr] = pcallback; + pdrvctl->pParma[iChannel][ulCurrWritePtr] = pParma; + } else { + (pdrvctl->pcallback)[iChannel][ulCurrWritePtr] = NULL; + pdrvctl->pParma[iChannel][ulCurrWritePtr] = NULL; + } + + pdrvctl->ikernel[iChannel][ulCurrWritePtr] = iKernel; + pdrvctl->stsemphore[iChannel][ulCurrWritePtr] = mycomplete; + + if (pInPtr == pOutPtr) { + if (pOutPtr) { + len = usInlen >= *pusOutlen ? usInlen : *pusOutlen; + if (len) { + ulCurrAddrOutput = dma_map_single(pdrvctl->pdev, pOutPtr, len, DMA_BIDIRECTIONAL); + if (ulCurrAddrOutput == 0) { + TRACEERR("map ulCurrAddrOutput error\n"); + *pucRetCode = WST_SE_FAILURE; + if (iKernel == 0) { + complete(mycomplete); + } else { + *pucRetCode = WST_SE_FAILURE; + if (pcallback) + pcallback(pParma); + } + goto PROG; + } + pCurBD->ulOutputLPtr = LOULONG(ulCurrAddrOutput); + pCurBD->ulOutputHPtr = HIULONG(ulCurrAddrOutput); + pCurBD->ulInputLPtr = pCurBD->ulOutputLPtr; + pCurBD->ulInputHPtr = pCurBD->ulOutputHPtr; + } + } + } else { + if (pOutPtr && (*pusOutlen)) { + ulCurrAddrOutput = dma_map_single(pdrvctl->pdev, pOutPtr, *pusOutlen, DMA_FROM_DEVICE); + if (ulCurrAddrOutput == 0) { + TRACEERR("map ulCurrAddrOutput error\n"); + *pucRetCode = WST_SE_FAILURE; + if (iKernel == 0) { + complete(mycomplete); + } else { + *pucRetCode = WST_SE_FAILURE; + if (pcallback) + pcallback(pParma); + } + goto PROG; + } + pCurBD->ulOutputLPtr = LOULONG(ulCurrAddrOutput); + pCurBD->ulOutputHPtr = HIULONG(ulCurrAddrOutput); + } + if (usInlen && pInPtr) { + ulCurrAddrInput = dma_map_single(pdrvctl->pdev, pInPtr, usInlen, DMA_TO_DEVICE); + if (ulCurrAddrInput == 0) { + if (ulCurrAddrOutput) { + dma_unmap_single(pdrvctl->pdev, ulCurrAddrOutput, *pusOutlen, DMA_FROM_DEVICE); + pCurBD->ulOutputLPtr = 0; + pCurBD->ulOutputHPtr = 0; + } + *pucRetCode = WST_SE_FAILURE; + if (iKernel == 0) { + complete(mycomplete); + } else { + *pucRetCode = WST_SE_FAILURE; + if (pcallback) + pcallback(pParma); + } + goto PROG; + } + pCurBD->ulInputLPtr = LOULONG(ulCurrAddrInput); + pCurBD->ulInputHPtr = HIULONG(ulCurrAddrInput); + } + } + pCurBD->ucOpCode = ucOpCode & 0x0f; + pCurBD->ucFlag = ucFlag & 0x7; + pCurBD->usInputLength = usInlen; + if (pusOutlen) + pCurBD->usOutputLength = *pusOutlen; + + pCurBD->ucRetCode = 0x0f; + + pdrvctl->pusOutlen[iChannel][ulCurrWritePtr] = pusOutlen; + pdrvctl->usInlen[iChannel][ulCurrWritePtr] = usInlen&0xffff; + if (ulCurrAddrOutput) + pdrvctl->ulOutputPtr[iChannel][ulCurrWritePtr] = (unsigned long *)ulCurrAddrOutput; + else + pdrvctl->ulOutputPtr[iChannel][ulCurrWritePtr] = 0; + if (ulCurrAddrInput) + pdrvctl->ulInputPtr[iChannel][ulCurrWritePtr] = (unsigned long *)ulCurrAddrInput; + else + pdrvctl->ulInputPtr[iChannel][ulCurrWritePtr] = 0; + pdrvctl->pucRetCode[iChannel][ulCurrWritePtr] = pucRetCode; + +#ifdef CONFIG_MIPS + atomic_add((*(pdrvctl->pusOutlen[iChannel][ulCurrWritePtr]) + SE_FILL_LEN), &g_sendtotallen); +#endif + write_lock_irqsave(&(pdrvctl->mr_lock), ulflag); + if (iChannel == 0) + HandleWrite32(pdrvctl, SE_REG_BQWP0, ulWritePtr); + else + HandleWrite32(pdrvctl, SE_REG_BQWP1, ulWritePtr); + write_unlock_irqrestore(&(pdrvctl->mr_lock), ulflag); + pdrvctl->ulCurrBdWritePtr[iChannel] = ulWritePtr; + } +} + +static int se_hardtrans( + SECHIPDRV_CTRL *pdrvctl, + unsigned char *pInPtr, + unsigned short usInlen, + unsigned char *pOutPtr, + unsigned short *pusOutlen, + int iChannel, + unsigned char ucFlag, + unsigned char ucOpCode, + unsigned char *pucRetCode, + PSECallBackfn pcallback, + void *pParma, + int iKernel, + struct completion *mycomplete + ) +{ + SEND_PACKAGE *psendpackage; + gfp_t gfp_flag; + + if (in_interrupt()) + gfp_flag = GFP_ATOMIC; + else + gfp_flag = GFP_KERNEL; + if (g_suspend == 1) + return WST_SE_FAILURE; + psendpackage = kmalloc(sizeof(SEND_PACKAGE), gfp_flag); + if (psendpackage == NULL) + return -1; + + psendpackage->pdrvctl = pdrvctl; + psendpackage->pInPtr = pInPtr; + psendpackage->usInlen = usInlen; + psendpackage->pOutPtr = pOutPtr; + psendpackage->pusOutlen = pusOutlen; + psendpackage->iChannel = iChannel; + psendpackage->ucFlag = ucFlag; + psendpackage->ucOpCode = ucOpCode; + psendpackage->pucRetCode = pucRetCode; + psendpackage->pcallback = pcallback; + psendpackage->pParma = pParma; + psendpackage->iKernel = iKernel; + psendpackage->mycomplete = mycomplete; + psendpackage->ulendtime = jiffies+30*HZ; + spin_lock_irq(&g_sendlistlock); + if (wst_Pushback_Que(&g_SendQueueContainer, psendpackage) == -1) { + spin_unlock_irq(&g_sendlistlock); + kfree(psendpackage); + return WST_SE_ERROR_FULL; + } + spin_unlock_irq(&g_sendlistlock); + queue_work(g_worksendqueue, &g_sendwork); + return 0; +} + +static irqreturn_t wst_low_channel_status(int irq, void *p) +{ + SECHIPDRV_CTRL *pdrvctl = (SECHIPDRV_CTRL *)p; + int64_t ulIntStat = 0; + unsigned long ulflag; + + read_lock_irqsave(&(pdrvctl->mr_lock), ulflag); + HandleRead64(pdrvctl, SE_LOWREG_STS, &ulIntStat); + if (ulIntStat == 2) { + HandleWrite64(pdrvctl, SE_LOWINT_CLEAR, 2); + up(&g_lowirqsema); + } + read_unlock_irqrestore(&(pdrvctl->mr_lock), ulflag); + + return IRQ_HANDLED; +} + +static int se_useropen(struct inode *inode, struct file *file) +{ + if (MINOR(inode->i_rdev) != 0) + return -ENODEV; + + return SE_OK; +} + +static ssize_t wst_low_channel_userwrite_op( + SECHIPDRV_CTRL *pdrvctl, + SWCommuData *UserCommuData, + int iskernel + ) +{ + unsigned long long addr = 0, outaddr = 0; + int ilen; + int count = SE_OK; + unsigned long long ulsendlen; + unsigned char *m_pCacheInBuf; + unsigned char *m_pCacheOutBuf; + unsigned long ulflag; + + if ((g_pCacheInBuf == NULL) || (g_pCacheOutBuf == NULL)) + return -EFAULT; + + m_pCacheInBuf = (unsigned char *)bytes_align(0, (unsigned long)g_pCacheInBuf); + m_pCacheOutBuf = (unsigned char *)bytes_align(0, (unsigned long)g_pCacheOutBuf); + if (iskernel == 0) { + if (wst_cpyusrbuf((void *)(UserCommuData->pucInbuf), (void *)m_pCacheInBuf, UserCommuData->usInputLen, READUBUF)) { + TRACEERR("copy user data error\n"); + return -EFAULT; + } + } else + + memcpy((void *)m_pCacheInBuf, (void *)(UserCommuData->pucInbuf), UserCommuData->usInputLen); + ilen = UserCommuData->usInputLen >= UserCommuData->usOutputLen ? UserCommuData->usInputLen:UserCommuData->usOutputLen; + addr = dma_map_single(pdrvctl->pdev, m_pCacheInBuf, ilen, DMA_TO_DEVICE); + if (addr == 0) { + TRACEERR("transfer buffer is err\n"); + return -EFAULT; + } + outaddr = dma_map_single(pdrvctl->pdev, m_pCacheOutBuf, ilen, DMA_FROM_DEVICE); + if (outaddr == 0) { + TRACEERR("transfer buffer is err\n"); + dma_unmap_single(pdrvctl->pdev, addr, ilen, DMA_TO_DEVICE); + return -EFAULT; + } + ulsendlen = (UserCommuData->usInputLen/8); + ulsendlen = (ulsendlen & 0x00000000ffffffff) << 32; + write_lock_irqsave(&(pdrvctl->mr_lock), ulflag); + HandleWrite64(pdrvctl, SE_WRITE_REG1, ulsendlen); + HandleWrite64(pdrvctl, SE_WRITE_REG2, addr); + HandleWrite64(pdrvctl, SE_WRITE_REG3, outaddr); + write_unlock_irqrestore(&(pdrvctl->mr_lock), ulflag); + if (g_iUseIntr != 0) { + if (down_interruptible(&g_lowirqsema) == -EINTR) { + count = -EINTR; + goto EXIT; + } + } else { + unsigned long start_jiffies = 0, end_jiffies = 0; + int64_t ulIntStat = 0; + + start_jiffies = jiffies; + end_jiffies = jiffies; + while (1) { + write_lock_irqsave(&(pdrvctl->mr_lock), ulflag); + HandleRead64(pdrvctl, SE_LOWREG_SR, &ulIntStat); + end_jiffies = jiffies; + if (ulIntStat == 1) { + HandleWrite64(pdrvctl, SE_LOWREG_SR, 0); + write_unlock_irqrestore(&(pdrvctl->mr_lock), ulflag); + break; + } + write_unlock_irqrestore(&(pdrvctl->mr_lock), ulflag); + if (jiffies_to_msecs(end_jiffies-start_jiffies)/1000 >= 90) { + count = -EFAULT; + goto EXIT; + } + } + } + dma_unmap_single(pdrvctl->pdev, addr, ilen, DMA_TO_DEVICE); + dma_unmap_single(pdrvctl->pdev, outaddr, ilen, DMA_FROM_DEVICE); + if (UserCommuData->usOutputLen) { + if (iskernel == 0) { + if (wst_cpyusrbuf(UserCommuData->pucOutbuf, m_pCacheOutBuf, UserCommuData->usOutputLen, WRITEUBUF)) + return -EFAULT; + } else + memcpy(UserCommuData->pucOutbuf, m_pCacheOutBuf, UserCommuData->usOutputLen); + } + return count; +EXIT: + dma_unmap_single(pdrvctl->pdev, addr, ilen, DMA_TO_DEVICE); + dma_unmap_single(pdrvctl->pdev, outaddr, ilen, DMA_FROM_DEVICE); + return count; +} + +static ssize_t se_userwrite(struct file *file, const char *buf, size_t count, loff_t *ppos) +{ + unsigned char *pCacheBuf = NULL, *pCacheOutBuf = NULL, *pCacheBufalign = NULL, *pCacheOutBufalign = NULL; + SECHIPDRV_CTRL *pdrvctl = NULL; + SWCommuData *pCommuData = NULL; + int iCommuDatalen = 0; + int pucRetCode = 0; + unsigned short iChannel = 0; + unsigned char ucFlag = 0, ucOpCode = 0; + int *ppucRetCode; + struct completion mycomplete; + struct tag_dma_buf_ctl *pbufinctl = NULL; + int iret = 0; + + if (count == 0) { + TRACEERR("count=0\n"); + return SE_OK; + } + + if (MINOR(file->f_path.dentry->d_inode->i_rdev) != 0) + return -ENODEV; + + iCommuDatalen = sizeof(SWCommuData); + if (count != iCommuDatalen) + return -EINVAL; + + pdrvctl = g_psechipDrvCtrl; + pCommuData = kmalloc(iCommuDatalen, GFP_KERNEL); + if (!pCommuData) { + TRACEERR("pCommuData NULL\n"); + return -ENOMEM; + } + if (wst_cpyusrbuf((void *)buf, (void *)pCommuData, iCommuDatalen, READUBUF)) { + TRACEERR("copy user data error\n"); + count = -EFAULT; + goto EXIT; + } + switch ((pCommuData->usFlags)&0x000f) { + case WST_GO_CHANNEL2: + if ((pCommuData->usInputLen > DMA_BUFSIZE) || (pCommuData->usOutputLen > DMA_BUFSIZE)) { + TRACEERR("len is error\n"); + count = -EINVAL; + goto EXIT; + } + if (down_interruptible(&g_lowsema) == -EINTR) { + count = -EINTR; + goto EXIT; + } + count = wst_low_channel_userwrite_op(pdrvctl, pCommuData, 0); + up(&g_lowsema); + goto EXIT; + case WST_GO_CHANNEL0: + if (pCommuData->usInputLen == 0) { + count = -EINVAL; + goto EXIT; + } + if (pCommuData->usInputLen != 0) { + if (pCommuData->usInputLen > DMA_BUFSIZE) { + count = -EINVAL; + goto EXIT; + } + ucFlag = INPUT_VALID; + if (pCommuData->usOutputLen) + ucFlag |= OUTPUT_VALID; + } + + iChannel = 0; + ucOpCode = 0x0; + break; + case WST_GO_CHANNEL1: + if (pCommuData->usInputLen == 0) { + count = -EINVAL; + goto EXIT; + } + if (pCommuData->usInputLen != 0) { + if (pCommuData->usInputLen > DMA_BUFSIZE) { + count = -EINVAL; + goto EXIT; + } + ucFlag = INPUT_VALID; + if (pCommuData->usOutputLen) + ucFlag |= OUTPUT_VALID; + } + iChannel = 1; + ucOpCode = 0x0; + break; + default: + { + count = -EINVAL; + goto EXIT; + } + } + pbufinctl = se_get_dma_buf(0); + if (pbufinctl == NULL) { + TRACEERR("kmalloc pCacheBuf error\n"); + count = -ENOMEM; + goto EXIT; + } + pCacheBuf = pbufinctl->pDmaBuf; + pCacheBufalign = pCacheBuf; + + if (wst_cpyusrbuf((void *)(pCommuData->pucInbuf), (void *)pCacheBufalign, + pCommuData->usInputLen, READUBUF)) { + TRACEERR("cpyuserbuf pCacheBufalign error\n"); + count = -ENOMEM; + goto EXIT; + } + + pCacheOutBuf = pbufinctl->pDmaBuf; + pCacheOutBufalign = pCacheOutBuf; + + ppucRetCode = &pucRetCode; + + count = SE_OK; + init_completion(&mycomplete); + iret = se_hardtrans( + pdrvctl, + pCacheBufalign, + pCommuData->usInputLen, + pCacheOutBufalign, + &(pCommuData->usOutputLen), + iChannel, + ucFlag, + ucOpCode, + (unsigned char *)ppucRetCode, + 0, + 0, + 0, + &mycomplete + ); + if (iret == -1) { + count = -EIO; + goto EXIT; + } + if (!wait_for_completion_timeout(&mycomplete, msecs_to_jiffies(60*1000))) { + count = -EFAULT; + goto EXIT; + } + if (pucRetCode != SE_OK) { + count = -(SE_BASEERR+pucRetCode); + goto EXIT; + } + + if (pCommuData->pucOutbuf) { + if (wst_cpyusrbuf(pCommuData->pucOutbuf, pCacheOutBufalign, + pCommuData->usOutputLen, WRITEUBUF)) { + count = -EFAULT; + goto EXIT; + } + } +EXIT: + if (pbufinctl) + se_free_dma_buf(pbufinctl); + kfree(pCommuData); + return count; +} +static void globalmem_do_rec_op(struct work_struct *p) +{ + INT_MESSAGE *intmessage; + unsigned long ulflags1; + + while (1) { + spin_lock_irqsave(&g_reclistlock, ulflags1); + intmessage = (INT_MESSAGE *)wst_Popfront_Que(&g_RecQueueContainer); + spin_unlock_irqrestore(&g_reclistlock, ulflags1); + if (!intmessage) + return; + intmessage->pcallback(intmessage->pParma); + kfree(intmessage); + } +} +static irqreturn_t se_interrupt(int irq, void *p) +{ + SECHIPDRV_CTRL *pdrvctl; + SE_BASIC_BD *pCurBD; + unsigned int ulCurrReadPtr, ulReadPtr; + int iChannel; + int len = 0; + int i; + unsigned char ucMyRetCode = 0; + unsigned long ulIntStat; + int istatus[2] = {1, 2}; + unsigned long ulflags; + + pdrvctl = (SECHIPDRV_CTRL *)p; + if (!pdrvctl) + return IRQ_HANDLED; + + read_lock_irqsave(&(pdrvctl->mr_lock), ulflags); + HandleRead32(pdrvctl, SE_REG_STS, &ulIntStat); + read_unlock_irqrestore(&(pdrvctl->mr_lock), ulflags); + if ((!(ulIntStat & INT_STAT_DMA_MASK)) || (ulIntStat == 0xffffffff)) + return IRQ_HANDLED; + + for (i = 0; i <= 1; i++) { + if (ulIntStat & istatus[i]) { + if (i == 0) { + read_lock_irqsave(&(pdrvctl->mr_lock), ulflags); + HandleWrite32(pdrvctl, SE_INT_CLR, 1); + HandleRead32(pdrvctl, SE_REG_RQRP0, &ulReadPtr); + read_unlock_irqrestore(&(pdrvctl->mr_lock), ulflags); + iChannel = 0; + } else { + read_lock_irqsave(&(pdrvctl->mr_lock), ulflags); + HandleWrite32(pdrvctl, SE_INT_CLR, 2); + HandleRead32(pdrvctl, SE_REG_RQRP1, &ulReadPtr); + read_unlock_irqrestore(&(pdrvctl->mr_lock), ulflags); + iChannel = 1; + } + } else + continue; + ulCurrReadPtr = pdrvctl->ulCurrReadPtr[iChannel]; + while (1) { + if (ulCurrReadPtr != ulReadPtr) { + pCurBD = &((SE_BASIC_BD *)(pdrvctl->ulBDMemBase[iChannel]))[ulCurrReadPtr]; + if ((pCurBD->ucRetCode == 0x0f) || ((pCurBD->ucFlag & 0x8) != 0x8)) { + continue; + } else { + if (pdrvctl->ulInputPtr[iChannel][ulCurrReadPtr] == pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr]) { + if (pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr]) { + len = (*(pdrvctl->pusOutlen[iChannel][ulCurrReadPtr])) >= pdrvctl->usInlen[iChannel][ulCurrReadPtr] ? + (*(pdrvctl->pusOutlen[iChannel][ulCurrReadPtr])):pdrvctl->usInlen[iChannel][ulCurrReadPtr]; + dma_unmap_single( + pdrvctl->pdev, + (unsigned long)(pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr]), + len, + DMA_BIDIRECTIONAL + ); + pCurBD->ulOutputLPtr = 0; + pCurBD->ulOutputHPtr = 0; + pCurBD->ulInputHPtr = 0; + pCurBD->ulInputLPtr = 0; + pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr] = 0; + } + } else { + if (pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr]) { + dma_unmap_single( + pdrvctl->pdev, + (unsigned long)(pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr]), + *(pdrvctl->pusOutlen[iChannel][ulCurrReadPtr]), DMA_FROM_DEVICE + ); + smp_wmb(); + pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr] = 0; + } + if (pdrvctl->ulInputPtr[iChannel][ulCurrReadPtr]) { + dma_unmap_single( + pdrvctl->pdev, + (unsigned long)(pdrvctl->ulInputPtr[iChannel][ulCurrReadPtr]), + pdrvctl->usInlen[iChannel][ulCurrReadPtr], + DMA_TO_DEVICE + ); + pdrvctl->ulInputPtr[iChannel][ulCurrReadPtr] = 0; + } + } + ucMyRetCode = pCurBD->ucRetCode; + memcpy(pdrvctl->pucRetCode[iChannel][ulCurrReadPtr], &ucMyRetCode, 1); + if (pCurBD->ucRetCode != SE_OK) + pr_info("\nstatus %x\n", pCurBD->ucRetCode); +#ifdef CONFIG_MIPS + atomic_sub(((*(pdrvctl->pusOutlen[iChannel][ulCurrReadPtr])) + SE_FILL_LEN), &g_sendtotallen); +#endif + if ((pdrvctl->ikernel)[iChannel][ulCurrReadPtr] != 0) { + if (pdrvctl->pcallback[iChannel][ulCurrReadPtr]) { + INT_MESSAGE *intmessage = NULL; + unsigned long ulflags1; + + intmessage = (INT_MESSAGE *)kmalloc(sizeof(INT_MESSAGE), GFP_ATOMIC); + if (!intmessage) + return IRQ_HANDLED; + intmessage->pcallback = pdrvctl->pcallback[iChannel][ulCurrReadPtr]; + intmessage->pParma = pdrvctl->pParma[iChannel][ulCurrReadPtr]; + spin_lock_irqsave(&g_reclistlock, ulflags1); + wst_Pushback_Que(&g_RecQueueContainer, intmessage); + spin_unlock_irqrestore(&g_reclistlock, ulflags1); + queue_work(g_workrecqueue, &g_recwork); + } + } else { + complete(pdrvctl->stsemphore[iChannel][ulCurrReadPtr]); + } + ulCurrReadPtr = ((ulCurrReadPtr + 1)&(SE_BDQUEUE_LEN - 1)); + pdrvctl->ulCurrReadPtr[iChannel] = ulCurrReadPtr; + pdrvctl->ulCurrBdReadPtr[iChannel] = ulCurrReadPtr; + if (pdrvctl->sema.count <= 0) + up(&(pdrvctl->sema)); + } + } else + + break; + } + } + return IRQ_HANDLED; +} + +static int se_userrelease(struct inode *inode, struct file *file) +{ + return SE_OK; +} + +ssize_t se_kernelwrite( + unsigned char *pInPtr, + unsigned short usInlen, + unsigned char *pOutPtr, + unsigned short *pusOutlen, + unsigned char ucFlag, + unsigned char *pucRetCode, + PSECallBackfn pcallback, + void *pParma + ) +{ + int iret; + SECHIPDRV_CTRL *pdrvctl; + int iChannel; + unsigned char ucOpCode; + SWCommuData CommuData; + + pdrvctl = g_psechipDrvCtrl; + + switch (ucFlag) { + case WST_GO_CHANNEL2: + { + CommuData.pucInbuf = pInPtr; + CommuData.pucOutbuf = pOutPtr; + CommuData.usFlags = 0; + CommuData.usInputLen = usInlen; + CommuData.usOutputLen = *pusOutlen; + CommuData.usReserve = 0; + if (down_interruptible(&g_lowsema) == -EINTR) + return -EINTR; + iret = wst_low_channel_userwrite_op(pdrvctl, &CommuData, 1); + up(&g_lowsema); + return iret; + } + case WST_GO_CHANNEL0: + if (pcallback == NULL) + return WST_SE_PARAM_ERROR; + if (usInlen == 0) + return -EINVAL; + ucFlag = 0; + if (usInlen != 0) { + if (usInlen > DMA_BUFSIZE) + return -EINVAL; + ucFlag = INPUT_VALID; + if (*pusOutlen) + ucFlag |= OUTPUT_VALID; + } + iChannel = 0; + ucOpCode = 0x0; + break; + case WST_GO_CHANNEL1: + if (pcallback == NULL) + return WST_SE_PARAM_ERROR; + if (usInlen == 0) { + return -EINVAL; + } + ucFlag = 0; + if (usInlen != 0) { + if (usInlen > DMA_BUFSIZE) + return -EINVAL; + ucFlag = INPUT_VALID; + if (*pusOutlen) + ucFlag |= OUTPUT_VALID; + } + iChannel = 1; + ucOpCode = 0x0; + break; + default: + return -EINVAL; + } + iret = se_hardtrans( + pdrvctl, + pInPtr, + usInlen, + pOutPtr, + pusOutlen, + iChannel, + ucFlag, + ucOpCode, + pucRetCode, + pcallback, + pParma, + 1, + NULL + ); + if (iret == -1) + return -EIO; + + return SE_OK; +} +EXPORT_SYMBOL(se_kernelwrite); + +static long se_userioctl(struct file *filp, u_int cmd, u_long arg) +{ + long iret = SE_OK; + SECHIPDRV_CTRL *pdrvctl = g_psechipDrvCtrl; + unsigned long ulvalue; + + HandleRead64(pdrvctl, 0x120, &ulvalue); + pr_info("read reg value is 0x%lx in offset 120\n", ulvalue); + HandleRead64(pdrvctl, 0x118, &ulvalue); + pr_info("read reg value is 0x%lx in offset 118\n", ulvalue); + + return iret; +} + + +static const struct file_operations SE_fops = { + .owner = THIS_MODULE, + .write = se_userwrite, + .open = se_useropen, + .release = se_userrelease, + .unlocked_ioctl = se_userioctl, + .compat_ioctl = se_userioctl +}; + +int se_chip_load(void) +{ + int iRes = SE_OK; + + if (g_isechip_Major >= 0) + return WST_SE_HAS_OPEN; + g_psechipDrvCtrl = NULL; + iRes = se_init_dma_buf(DMA_BUFSIZE, CTL_DMABUFNUM); + if (iRes != SE_OK) + return WST_SE_ERROR_MALLOC; + iRes = register_chrdev(0, CRYNAME, &SE_fops); + if (iRes < 0) + goto EXIT; + + g_isechip_Major = iRes; + iRes = 0; + g_psecclass = class_create(CRYNAME); + if (IS_ERR(g_psecclass)) { + iRes = PTR_ERR(g_psecclass); + goto EXIT; + } + g_psecdev = device_create(g_psecclass, NULL, MKDEV(g_isechip_Major, 0), NULL, CRYNAME); + if (IS_ERR(g_psecdev)) { + iRes = PTR_ERR(g_psecdev); + goto EXIT; + } + iRes = wst_init(); + if (iRes != SE_OK) + goto EXIT; + + sema_init(&g_lowsema, 1); + sema_init(&g_lowirqsema, 0); + atomic_set(&g_sendtotallen, 0); + g_pCacheInBuf = (unsigned char *)__get_free_page(GFP_DMA); + if (IS_ERR(g_pCacheInBuf)) { + iRes = PTR_ERR(g_pCacheInBuf); + goto EXIT; + } + g_pCacheOutBuf = (unsigned char *)__get_free_page(GFP_DMA); + if (IS_ERR(g_pCacheOutBuf)) { + iRes = PTR_ERR(g_pCacheOutBuf); + goto EXIT; + } + + g_worksendqueue = alloc_workqueue("seworksendqueue", + WQ_MEM_RECLAIM|__WQ_ORDERED|WQ_UNBOUND, 1); + if (IS_ERR(g_worksendqueue)) { + iRes = PTR_ERR(g_worksendqueue); + goto EXIT; + } + g_workrecqueue = alloc_workqueue("seworkrecqueue", WQ_MEM_RECLAIM|__WQ_ORDERED, 0); + if (IS_ERR(g_workrecqueue)) { + iRes = PTR_ERR(g_workrecqueue); + goto EXIT; + } + INIT_WORK(&g_recwork, globalmem_do_rec_op); + INIT_WORK(&g_sendwork, globalmem_do_send_op); + pr_info("this driver version is %s\n", DRIVER_VERSION); + + return SE_OK; +EXIT: + se_del_dma_buf(); + if (g_pCacheInBuf) { + + free_page((unsigned long)g_pCacheInBuf); + g_pCacheInBuf = NULL; + } + if (g_pCacheOutBuf) { + + free_page((unsigned long)g_pCacheOutBuf); + g_pCacheOutBuf = NULL; + } + if (g_worksendqueue) { + destroy_workqueue(g_worksendqueue); + g_worksendqueue = NULL; + } + if (g_workrecqueue) { + destroy_workqueue(g_workrecqueue); + g_workrecqueue = NULL; + } + wst_clear(); + if (g_psecdev) { + device_unregister(g_psecdev); + g_psecdev = NULL; + } + if (g_psecclass) { + class_destroy(g_psecclass); + g_psecclass = NULL; + } + if (g_isechip_Major >= 0) { + unregister_chrdev(g_isechip_Major, CRYNAME); + g_isechip_Major = -1; + } + return iRes; +} + +void se_chip_unload(void) +{ + SECHIPDRV_CTRL *pdrvctl = NULL; + + pdrvctl = g_psechipDrvCtrl; + + up(&pdrvctl->sema); + if (g_pCacheInBuf) { + + free_page((unsigned long)g_pCacheInBuf); + g_pCacheInBuf = NULL; + } + if (g_pCacheOutBuf) { + + free_page((unsigned long)g_pCacheOutBuf); + g_pCacheOutBuf = NULL; + } + if (g_worksendqueue) { + cancel_work_sync(&g_sendwork); + destroy_workqueue(g_worksendqueue); + g_worksendqueue = NULL; + } + if (g_workrecqueue) { + cancel_work_sync(&g_recwork); + destroy_workqueue(g_workrecqueue); + g_workrecqueue = NULL; + } + wst_clear(); + if (g_psecdev) { + device_destroy(g_psecclass, MKDEV(g_isechip_Major, 0)); + g_psecdev = NULL; + } + if (g_psecclass) { + class_destroy(g_psecclass); + g_psecclass = NULL; + } + if (g_isechip_Major >= 0) { + unregister_chrdev(g_isechip_Major, CRYNAME); + g_isechip_Major = -1; + } + se_del_dma_buf(); +} + +static int loongson_cryp_get_irq(struct platform_device *pdev, char *pat) +{ + int i; + struct resource *res = pdev->resource; + + for (i = 0; i < pdev->num_resources; i++) { + if (strcmp(res[i].name, pat) == 0) + return res[i].start; + } + return -1; + +} +static int loongson_cryp_probe(struct platform_device *pdev) +{ + int i; + + if (ACPI_COMPANION(&pdev->dev)) { + se_irq[0].irq = platform_get_irq(pdev, 1); + se_irq[1].irq = platform_get_irq(pdev, 0); + } else { + for (i = 0; i < pdev->num_resources; i++) { + se_irq[i].irq = loongson_cryp_get_irq(pdev, + se_irq[i].pat); + if (se_irq[i].irq < 0) { + pr_warn("ERROR:sedriver get irq failed\n"); + return -1; + } + } + } + + return se_chip_load(); +} +static int loongson_cryp_remove(struct platform_device *pdev) +{ + se_chip_unload(); + return 0; +} +static int loongson_cryp_suspend(struct platform_device *pdev, pm_message_t state) +{ + g_suspend = 1; + cancel_work_sync(&g_recwork); + cancel_work_sync(&g_sendwork); + flush_work(&g_recwork); + flush_work(&g_sendwork); + se_chip_unload(); + return 0; +} + +static int loongson_cryp_resume(struct platform_device *pdev) +{ + int i; + + g_suspend = 0; + g_worksendqueue = NULL; + g_workrecqueue = NULL; + g_isechip_Major = -1; + g_pCacheInBuf = NULL; + g_pCacheOutBuf = NULL; + g_iUseIntr = 1; + spin_lock_init(&g_reclistlock); + spin_lock_init(&g_sendlistlock); + spin_lock_init(&g_getdmabuflock); + + for (i = 0; i < pdev->num_resources; i++) { + se_irq[i].irq = loongson_cryp_get_irq(pdev, se_irq[i].pat); + + if (se_irq[i].irq < 0) { + pr_warn("ERROR:sedriver get irq failed\n"); + return -1; + } + } + se_chip_load(); + return 0; +} + +static const struct acpi_device_id loongson_cryp_acpi_match[] = { + {"LOON0003"}, + {} +}; +MODULE_DEVICE_TABLE(acpi, loongson_cryp_acpi_match); + +static struct platform_driver loongson_cryp_driver = { + .probe = loongson_cryp_probe, + .remove = loongson_cryp_remove, + .suspend = loongson_cryp_suspend, + .resume = loongson_cryp_resume, + .driver = { + .name = "loongson3_crypto", + .acpi_match_table = ACPI_PTR(loongson_cryp_acpi_match), + }, +}; + +static int __init initmodule(void) +{ + return platform_driver_register(&loongson_cryp_driver); +} + +static void __exit exitmodule(void) +{ + platform_driver_unregister(&loongson_cryp_driver); +} + +module_init(initmodule); +module_exit(exitmodule); + +MODULE_ALIAS("platform:loongson3_crypto"); +MODULE_AUTHOR("dcm"); +MODULE_DESCRIPTION("se encryption chip driver Co westone"); +MODULE_VERSION(DRIVER_VERSION); +MODULE_LICENSE("GPL"); diff --git a/drivers/crypto/sedriver/wst_se_echip_driver.h b/drivers/crypto/sedriver/wst_se_echip_driver.h new file mode 100644 index 000000000000..3e562e55faac --- /dev/null +++ b/drivers/crypto/sedriver/wst_se_echip_driver.h @@ -0,0 +1,184 @@ +#ifndef _WST_SE_ECHIP_DRIVER_H +#define _WST_SE_ECHIP_DRIVER_H +#include "wst_se_ktrans.h" + +#define CRYNAME "wst-se" + +#define SWBUFNUM 512 +#define SWCHANNELNUM 2 +#define CTL_DMABUFNUM 512 + +#define DMA_MASK 0xffffffff +#define SE_DMA_CONTROL_RESET 0x80000000 +#define SE_DMA_CONTROL_SET 0x00000000 + +#define SE_BASEERR 1000 + +#define SE_MAX_SEND_LEN (3*2048) +#define SE_FILL_LEN 48 +#define SE_BD_LENGTH sizeof(SE_BASIC_BD) +#define SE_BDQUEUE_LEN SWBUFNUM +#define DMA0_CTRL_CHANNEL_ENABLE 1 +#define DMA0_CTRL_CHANNEL_DISABLE 0xfffffffe +#define DMA1_CTRL_CHANNEL_ENABLE 2 +#define DMA1_CTRL_CHANNEL_DISABLE 0xfffffffd + +#define SE_REG_RESET 0 +#define SE_REG_STS 0x08 +#define SE_INT_CTRL 0x10 +#define SE_REG_MSK 0x18 +#define SE_INT_CLR 0x20 + +#define SE_LREG_BQBA0 0x100 +#define SE_HREG_BQBA0 0x108 +#define SE_REG_BQS0 0x110 +#define SE_REG_BQWP0 0x118 +#define SE_REG_RQRP0 0x120 + +#define SE_LREG_BQBA1 0x128 +#define SE_HREG_BQBA1 0x130 +#define SE_REG_BQS1 0x138 +#define SE_REG_BQWP1 0x140 +#define SE_REG_RQRP1 0x148 + +#define SE_WRITE_REG1 0x200 +#define SE_WRITE_REG2 0x208 +#define SE_WRITE_REG3 0x210 +#define SE_LOWREG_STS 0x240 +#define SE_LOWINT_CLEAR 0x248 +#define SE_LOWREG_INQ 0x1600 +#define SE_LOWREG_SR 0x1608 +#define INPUT_VALID 0x4 +#define OUTPUT_VALID 0x8 +#define SE_LOWINT_CLR 0x228 +#define INT_STAT_DMA0_PACK_DONE 1 +#define INT_STAT_DMA1_PACK_DONE 2 +#define INT_STAT_DMA_MASK (INT_STAT_DMA0_PACK_DONE|INT_STAT_DMA1_PACK_DONE) + +typedef struct tagSEdrvctl { + + unsigned long ulMemBase; + struct device *pdev; + struct device dev; + unsigned int ulCurrBdReadPtr[SWCHANNELNUM]; + unsigned int ulCurrBdWritePtr[SWCHANNELNUM]; + unsigned int ulCurrReadPtr[SWCHANNELNUM]; + unsigned int ulCurrWritePtr[SWCHANNELNUM]; + PSECallBackfn pcallback[SWCHANNELNUM][SWBUFNUM]; + void *pParma[SWCHANNELNUM][SWBUFNUM]; + struct completion *stsemphore[SWCHANNELNUM][SWBUFNUM]; + int ikernel[SWCHANNELNUM][SWBUFNUM]; + unsigned long ulBDMemBasePhy[SWCHANNELNUM]; + unsigned long ulBDMemBase[SWCHANNELNUM]; + unsigned short *pusOutlen[SWCHANNELNUM][SWBUFNUM]; + unsigned short usInlen[SWCHANNELNUM][SWBUFNUM]; + unsigned long *ulOutputPtr[SWCHANNELNUM][SWBUFNUM]; + unsigned long *ulInputPtr[SWCHANNELNUM][SWBUFNUM]; + unsigned char *pucRetCode[SWCHANNELNUM][SWBUFNUM]; + rwlock_t mr_lock; + rwlock_t mr_lowlock; + spinlock_t readlock; + struct semaphore sema; + int iIrq; + int ilowIrq; +} SECHIPDRV_CTRL; + +typedef struct tagSEBasicBD { + + unsigned int ucOpCode:4, + ucFlag:4, + ucRetCode:8, + ucInCtxLength:8, + ucOutCtxLength:8; + unsigned int usInputLength:16, + usOutputLength:16; + unsigned int ulCtxLPtr; + unsigned int ulCtxHPtr; + unsigned int ulInputLPtr; + unsigned int ulInputHPtr; + unsigned int ulOutputLPtr; + unsigned int ulOutputHPtr; + +} SE_BASIC_BD; + +#define SW_CONT_BUF_SIZE 0x100 +#define DMA_BUFSIZE 0x1000 + +#define PAGE_NUM (DMA_BUFSIZE/PAGE_SIZE+1) + +typedef struct _SW_GET_STAT { + unsigned long TXD; + unsigned long RXD; +} SW_GET_STAT, *PSW_GET_STAT; + +DEFINE_SPINLOCK(g_writelock); + +#define HandleRead32(handle, addr, pData) \ + do { \ + smp_mb(); \ + *(pData) = readl((void *)(handle->ulMemBase + addr)); \ + } while (0) + +#define HandleWrite32(handle, addr, value)\ + do { \ + writel(value, (void *)(handle->ulMemBase + addr)); \ + smp_mb(); \ + } while (0) + +#define HandleRead64(handle, addr, pData) \ + do { \ + smp_mb(); \ + *(pData) = readq((void *)(handle->ulMemBase + addr)); \ + } while (0) + +#define HandleWrite64(handle, addr, value)\ + do { \ + writeq(value, (void *)(handle->ulMemBase + addr)); \ + smp_mb(); \ + } while (0) + + +#define SPRINTF sprintf + +#define HIULONG(w) ((unsigned int)((((unsigned long long)w) >> 32) & 0x00000000ffffffff)) +#define LOULONG(w) ((unsigned int)((unsigned long long)w) & 0x00000000ffffffff) + +#ifdef DEBUG_DRIVER + #define TRACEMSG(fmt, args...) printk(KERN_DEBUG "msg: " fmt, ##args) +#else + #define TRACEMSG(fmt, args...) +#endif + +#ifdef DEBUG_DRIVER_ERROR + #define TRACEERR(fmt, args...) printk(KERN_DEBUG "err: " fmt, ##args) +#else + #define TRACEERR(fmt, args...) +#endif + +#define HIBYTE(w) ((unsigned char)(((unsigned short)(w) >> 8) & 0xFF)) +#define LOBYTE(w) ((unsigned char)(w)) + +typedef struct ST_SEND_PACKAGE { + struct list_head list; + SECHIPDRV_CTRL *pdrvctl; + unsigned char *pInPtr; + unsigned short usInlen; + unsigned char *pOutPtr; + unsigned short *pusOutlen; + int iChannel; + unsigned char ucFlag; + unsigned char ucOpCode; + unsigned char *pucRetCode; + PSECallBackfn pcallback; + void *pParma; + int iKernel; + struct completion *mycomplete; + unsigned long ulendtime; +} SEND_PACKAGE; + +typedef struct ST_INT_MESSAGE { + struct list_head list; + PSECallBackfn pcallback; + void *pParma; +} INT_MESSAGE; +#endif diff --git a/drivers/crypto/sedriver/wst_se_ktrans.h b/drivers/crypto/sedriver/wst_se_ktrans.h new file mode 100644 index 000000000000..da6c4b8f2824 --- /dev/null +++ b/drivers/crypto/sedriver/wst_se_ktrans.h @@ -0,0 +1,17 @@ +#ifndef _WST_SE_KTRANS_H +#define _WST_SE_KTRANS_H + +#include "wst_se_common_type.h" +#include "wst_se_define.h" + + +typedef struct tagSWCOMMUDATA { + unsigned short usFlags; + unsigned short usInputLen; + unsigned short usOutputLen; + unsigned short usReserve; + unsigned char *pucInbuf; + unsigned char *pucOutbuf; +} SWCommuData; + +#endif -- 2.33.0

2 1

[OLK-6.6 0/9] migration: adapt to new migration configuration
by Longfang Liu 14 Apr '25

14 Apr '25

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Longfang Liu (9): hisi_acc_vfio_pci: fix XQE dma address error hisi_acc_vfio_pci: add eq and aeq interruption restore hisi_acc_vfio_pci: bugfix cache write-back issue hisi_acc_vfio_pci: bugfix the problem of uninstalling driver hisi_acc_vfio_pci: bugfix live migration function without VF device driver hisi_acc_vfio_pci: update function return values. migration: update BAR space size migration: qm updates BAR configuration migration: adapt to new migration configuration drivers/crypto/hisilicon/qm.c | 29 ++ .../vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 312 +++++++++++++----- .../vfio/pci/hisilicon/hisi_acc_vfio_pci.h | 21 +- 3 files changed, 272 insertions(+), 90 deletions(-) -- 2.43.0

1 9

[PATCH OLK-6.6] regulator: check that dummy regulator has been probed before using it
by Huang Xiaojia 14 Apr '25

14 Apr '25

From: Christian Eggers <ceggers(a)arri.de> stable inclusion from stable-v6.6.85 commit 998b1aae22dca87da392ea35f089406cbef6032d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBZH67 CVE: CVE-2025-22008 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2c7a50bec4958f1d1c84d19cde518d0e96a676fd upstream. Due to asynchronous driver probing there is a chance that the dummy regulator hasn't already been probed when first accessing it. Cc: stable(a)vger.kernel.org Signed-off-by: Christian Eggers <ceggers(a)arri.de> Link: https://patch.msgid.link/20250313103051.32430-3-ceggers@arri.de Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- drivers/regulator/core.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c index c96bf095695f..9e435a332057 100644 --- a/drivers/regulator/core.c +++ b/drivers/regulator/core.c @@ -2084,6 +2084,10 @@ static int regulator_resolve_supply(struct regulator_dev *rdev) if (have_full_constraints()) { r = dummy_regulator_rdev; + if (!r) { + ret = -EPROBE_DEFER; + goto out; + } get_device(&r->dev); } else { dev_err(dev, "Failed to resolve %s-supply for %s\n", @@ -2101,6 +2105,10 @@ static int regulator_resolve_supply(struct regulator_dev *rdev) goto out; } r = dummy_regulator_rdev; + if (!r) { + ret = -EPROBE_DEFER; + goto out; + } get_device(&r->dev); } @@ -2209,8 +2217,10 @@ struct regulator *_regulator_get(struct device *dev, const char *id, * enabled, even if it isn't hooked up, and just * provide a dummy. */ - dev_warn(dev, "supply %s not found, using dummy regulator\n", id); rdev = dummy_regulator_rdev; + if (!rdev) + return ERR_PTR(-EPROBE_DEFER); + dev_warn(dev, "supply %s not found, using dummy regulator\n", id); get_device(&rdev->dev); break; -- 2.34.1

2 1

[PATCH OLK-6.6] KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state
by Huang Xiaojia 14 Apr '25

14 Apr '25

From: Mark Rutland <mark.rutland(a)arm.com> stable inclusion from stable-v6.12.21 commit 79e140bba70bcacc5fe15bf8c0b958793fd7d56f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBZH7N CVE: CVE-2025-22013 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fbc7e61195e23f744814e78524b73b59faa54ab4 ] There are several problems with the way hyp code lazily saves the host's FPSIMD/SVE state, including: * Host SVE being discarded unexpectedly due to inconsistent configuration of TIF_SVE and CPACR_ELx.ZEN. This has been seen to result in QEMU crashes where SVE is used by memmove(), as reported by Eric Auger: https://issues.redhat.com/browse/RHEL-68997 * Host SVE state is discarded *after* modification by ptrace, which was an unintentional ptrace ABI change introduced with lazy discarding of SVE state. * The host FPMR value can be discarded when running a non-protected VM, where FPMR support is not exposed to a VM, and that VM uses FPSIMD/SVE. In these cases the hyp code does not save the host's FPMR before unbinding the host's FPSIMD/SVE/SME state, leaving a stale value in memory. Avoid these by eagerly saving and "flushing" the host's FPSIMD/SVE/SME state when loading a vCPU such that KVM does not need to save any of the host's FPSIMD/SVE/SME state. For clarity, fpsimd_kvm_prepare() is removed and the necessary call to fpsimd_save_and_flush_cpu_state() is placed in kvm_arch_vcpu_load_fp(). As 'fpsimd_state' and 'fpmr_ptr' should not be used, they are set to NULL; all uses of these will be removed in subsequent patches. Historical problems go back at least as far as v5.17, e.g. erroneous assumptions about TIF_SVE being clear in commit: 8383741ab2e773a9 ("KVM: arm64: Get rid of host SVE tracking/saving") ... and so this eager save+flush probably needs to be backported to ALL stable trees. Fixes: 93ae6b01bafee8fa ("KVM: arm64: Discard any SVE state when entering KVM guests") Fixes: 8c845e2731041f0f ("arm64/sve: Leave SVE enabled on syscall if we don't context switch") Fixes: ef3be86021c3bdf3 ("KVM: arm64: Add save/restore support for FPMR") Reported-by: Eric Auger <eauger(a)redhat.com> Reported-by: Wilco Dijkstra <wilco.dijkstra(a)arm.com> Reviewed-by: Mark Brown <broonie(a)kernel.org> Tested-by: Mark Brown <broonie(a)kernel.org> Tested-by: Eric Auger <eric.auger(a)redhat.com> Acked-by: Will Deacon <will(a)kernel.org> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: Florian Weimer <fweimer(a)redhat.com> Cc: Fuad Tabba <tabba(a)google.com> Cc: Jeremy Linton <jeremy.linton(a)arm.com> Cc: Marc Zyngier <maz(a)kernel.org> Cc: Oliver Upton <oliver.upton(a)linux.dev> Cc: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Reviewed-by: Oliver Upton <oliver.upton(a)linux.dev> Link: https://lore.kernel.org/r/20250210195226.1215254-2-mark.rutland@arm.com Signed-off-by: Marc Zyngier <maz(a)kernel.org> [ Mark: Handle vcpu/host flag conflict ] Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- arch/arm64/kernel/fpsimd.c | 25 ------------------------- arch/arm64/kvm/fpsimd.c | 33 +++++++++------------------------ 2 files changed, 9 insertions(+), 49 deletions(-) diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c index 0137d987631e..bd4f6c6ee0f3 100644 --- a/arch/arm64/kernel/fpsimd.c +++ b/arch/arm64/kernel/fpsimd.c @@ -1707,31 +1707,6 @@ void fpsimd_signal_preserve_current_state(void) sve_to_fpsimd(current); } -/* - * Called by KVM when entering the guest. - */ -void fpsimd_kvm_prepare(void) -{ - if (!system_supports_sve()) - return; - - /* - * KVM does not save host SVE state since we can only enter - * the guest from a syscall so the ABI means that only the - * non-saved SVE state needs to be saved. If we have left - * SVE enabled for performance reasons then update the task - * state to be FPSIMD only. - */ - get_cpu_fpsimd_context(); - - if (test_and_clear_thread_flag(TIF_SVE)) { - sve_to_fpsimd(current); - current->thread.fp_type = FP_STATE_FPSIMD; - } - - put_cpu_fpsimd_context(); -} - /* * Associate current's FPSIMD context with this cpu * The caller must have ownership of the cpu FPSIMD context before calling diff --git a/arch/arm64/kvm/fpsimd.c b/arch/arm64/kvm/fpsimd.c index 4f51293db173..9c444a277a17 100644 --- a/arch/arm64/kvm/fpsimd.c +++ b/arch/arm64/kvm/fpsimd.c @@ -77,15 +77,17 @@ void kvm_arch_vcpu_load_fp(struct kvm_vcpu *vcpu) if (!system_supports_fpsimd()) return; - fpsimd_kvm_prepare(); - /* - * We will check TIF_FOREIGN_FPSTATE just before entering the - * guest in kvm_arch_vcpu_ctxflush_fp() and override this to - * FP_STATE_FREE if the flag set. + * Ensure that any host FPSIMD/SVE/SME state is saved and unbound such + * that the host kernel is responsible for restoring this state upon + * return to userspace, and the hyp code doesn't need to save anything. + * + * When the host may use SME, fpsimd_save_and_flush_cpu_state() ensures + * that PSTATE.{SM,ZA} == {0,0}. */ - *host_data_ptr(fp_owner) = FP_STATE_HOST_OWNED; - *host_data_ptr(fpsimd_state) = kern_hyp_va(&current->thread.uw.fpsimd_state); + fpsimd_save_and_flush_cpu_state(); + *host_data_ptr(fp_owner) = FP_STATE_FREE; + *host_data_ptr(fpsimd_state) = NULL; vcpu_clear_flag(vcpu, HOST_SVE_ENABLED); if (read_sysreg(cpacr_el1) & CPACR_EL1_ZEN_EL0EN) @@ -95,23 +97,6 @@ void kvm_arch_vcpu_load_fp(struct kvm_vcpu *vcpu) vcpu_clear_flag(vcpu, HOST_SME_ENABLED); if (read_sysreg(cpacr_el1) & CPACR_EL1_SMEN_EL0EN) vcpu_set_flag(vcpu, HOST_SME_ENABLED); - - /* - * If PSTATE.SM is enabled then save any pending FP - * state and disable PSTATE.SM. If we leave PSTATE.SM - * enabled and the guest does not enable SME via - * CPACR_EL1.SMEN then operations that should be valid - * may generate SME traps from EL1 to EL1 which we - * can't intercept and which would confuse the guest. - * - * Do the same for PSTATE.ZA in the case where there - * is state in the registers which has not already - * been saved, this is very unlikely to happen. - */ - if (read_sysreg_s(SYS_SVCR) & (SVCR_SM_MASK | SVCR_ZA_MASK)) { - *host_data_ptr(fp_owner) = FP_STATE_FREE; - fpsimd_save_and_flush_cpu_state(); - } } } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
by Cui GaoSheng 14 Apr '25

14 Apr '25

From: Zheyu Ma <zheyuma97(a)gmail.com> stable inclusion from stable-v4.19.247 commit ba08cbc5b53e151d0acf1930fb526fc65b7f3e65 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP74I CVE: CVE-2022-49307 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 689ca31c542687709ba21ec2195c1fbce34fd029 ] When the driver fails at alloc_hdlcdev(), and then we remove the driver module, we will get the following splat: [ 25.065966] general protection fault, probably for non-canonical address 0xdffffc0000000182: 0000 [#1] PREEMPT SMP KASAN PTI [ 25.066914] KASAN: null-ptr-deref in range [0x0000000000000c10-0x0000000000000c17] [ 25.069262] RIP: 0010:detach_hdlc_protocol+0x2a/0x3e0 [ 25.077709] Call Trace: [ 25.077924] <TASK> [ 25.078108] unregister_hdlc_device+0x16/0x30 [ 25.078481] slgt_cleanup+0x157/0x9f0 [synclink_gt] Fix this by checking whether the 'info->netdev' is a null pointer first. Reviewed-by: Jiri Slaby <jirislaby(a)kernel.org> Signed-off-by: Zheyu Ma <zheyuma97(a)gmail.com> Link: https://lore.kernel.org/r/20220410114814.3920474-1-zheyuma97@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/tty/synclink_gt.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c index b88ecf102764..5d971ae3f5e5 100644 --- a/drivers/tty/synclink_gt.c +++ b/drivers/tty/synclink_gt.c @@ -1808,6 +1808,8 @@ static int hdlcdev_init(struct slgt_info *info) */ static void hdlcdev_exit(struct slgt_info *info) { + if (!info->netdev) + return; unregister_hdlc_device(info->netdev); free_netdev(info->netdev); info->netdev = NULL; -- 2.34.1

2 1

[PATCH OLK-6.6 00/14] yt6801: Add Motorcomm yt6801 PCIe driver
by Frank Sae 14 Apr '25

14 Apr '25

This series includes adding Motorcomm YT6801 Gigabit ethernet driver and adding yt6801 ethernet driver entry in MAINTAINERS file. YT6801 integrates a YT8531S phy. Frank Sae (14): yt6801: Add support for a pci table in this module yt6801: Implement mdio register yt6801: Implement pci_driver shutdown yt6801: Implement the fxgmac_init function yt6801: Implement the .ndo_open function yt6801: Implement the fxgmac_start function net:phy:motorcomm: Add PHY_INTERFACE_MODE_INTERNAL to support YT6801 yt6801: Implement the fxgmac_hw_init function yt6801: Implement the poll functions yt6801: Implement .ndo_start_xmit function yt6801: Implement some net_device_ops function yt6801: Implement pci_driver suspend and resume yt6801: Add makefile and Kconfig yt6801: Update the Makefile, Kconfig and maintainer for yt6801 MAINTAINERS | 7 + arch/arm64/configs/openeuler_defconfig | 4 +- arch/loongarch/configs/loongson3_defconfig | 3 + arch/powerpc/configs/openeuler_defconfig | 4 +- arch/riscv/configs/openeuler_defconfig | 4 +- arch/x86/configs/openeuler_defconfig | 4 +- drivers/net/ethernet/Kconfig | 1 + drivers/net/ethernet/Makefile | 1 + drivers/net/ethernet/motorcomm/Kconfig | 27 + drivers/net/ethernet/motorcomm/Makefile | 6 + .../net/ethernet/motorcomm/yt6801/Makefile | 8 + .../ethernet/motorcomm/yt6801/yt6801_desc.c | 565 +++ .../ethernet/motorcomm/yt6801/yt6801_desc.h | 35 + .../ethernet/motorcomm/yt6801/yt6801_main.c | 3020 +++++++++++++++++ .../ethernet/motorcomm/yt6801/yt6801_type.h | 957 ++++++ drivers/net/phy/motorcomm.c | 6 + 16 files changed, 4648 insertions(+), 4 deletions(-) create mode 100644 drivers/net/ethernet/motorcomm/Kconfig create mode 100644 drivers/net/ethernet/motorcomm/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.h create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_type.h -- 2.34.1

1 14

[PATCH openEuler-1.0-LTS] tty: goldfish: Use tty_port_destroy() to destroy port
by Gu Bowen 14 Apr '25

14 Apr '25

From: Wang Weiyang <wangweiyang2(a)huawei.com> stable inclusion from stable-v4.19.247 commit 326192b99c903a2193d820c30ed936cc2402382c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6XS CVE: CVE-2022-49399 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 507b05063d1b7a1fcb9f7d7c47586fc4f3508f98 ] In goldfish_tty_probe(), the port initialized through tty_port_init() should be destroyed in error paths.In goldfish_tty_remove(), qtty->port also should be destroyed or else might leak resources. Fix the above by calling tty_port_destroy(). Fixes: 666b7793d4bf ("goldfish: tty driver") Reviewed-by: Jiri Slaby <jirislaby(a)kernel.org> Signed-off-by: Wang Weiyang <wangweiyang2(a)huawei.com> Link: https://lore.kernel.org/r/20220328115844.86032-1-wangweiyang2@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/tty/goldfish.c [Context conflicts due to commit 1b4acdcf01e0 ("tty: goldfish: Fix free_irq() on remove") has merged.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/tty/goldfish.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c index 48ea55beaf43..d6e82eb61fc2 100644 --- a/drivers/tty/goldfish.c +++ b/drivers/tty/goldfish.c @@ -407,6 +407,7 @@ static int goldfish_tty_probe(struct platform_device *pdev) err_tty_register_device_failed: free_irq(irq, qtty); err_dec_line_count: + tty_port_destroy(&qtty->port); goldfish_tty_current_line_count--; if (goldfish_tty_current_line_count == 0) goldfish_tty_delete_driver(); @@ -428,6 +429,7 @@ static int goldfish_tty_remove(struct platform_device *pdev) iounmap(qtty->base); qtty->base = NULL; free_irq(qtty->irq, qtty); + tty_port_destroy(&qtty->port); goldfish_tty_current_line_count--; if (goldfish_tty_current_line_count == 0) goldfish_tty_delete_driver(); -- 2.25.1

2 1

[PATCH OLK-5.10] HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
by Pu Lehui 14 Apr '25

14 Apr '25

From: Zhang Lixu <lixu.zhang(a)intel.com> stable inclusion from stable-v5.10.235 commit d3faae7f42181865c799d88c5054176f38ae4625 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY43Y CVE: CVE-2025-21928 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 07583a0010696a17fb0942e0b499a62785c5fc9f ] The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtp_hid_remove() function. The function currently frees the `driver_data` directly within the loop that destroys the HID devices, which can lead to accessing freed memory. Specifically, `hid_destroy_device()` uses `driver_data` when it calls `hid_ishtp_set_feature()` to power off the sensor, so freeing `driver_data` beforehand can result in accessing invalid memory. This patch resolves the issue by storing the `driver_data` in a temporary variable before calling `hid_destroy_device()`, and then freeing the `driver_data` after the device is destroyed. Fixes: 0b28cb4bcb17 ("HID: intel-ish-hid: ISH HID client driver") Signed-off-by: Zhang Lixu <lixu.zhang(a)intel.com> Acked-by: Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/hid/intel-ish-hid/ishtp-hid.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/hid/intel-ish-hid/ishtp-hid.c b/drivers/hid/intel-ish-hid/ishtp-hid.c index b8aae69ad15d..ef5236855771 100644 --- a/drivers/hid/intel-ish-hid/ishtp-hid.c +++ b/drivers/hid/intel-ish-hid/ishtp-hid.c @@ -263,12 +263,14 @@ int ishtp_hid_probe(unsigned int cur_hid_dev, */ void ishtp_hid_remove(struct ishtp_cl_data *client_data) { + void *data; int i; for (i = 0; i < client_data->num_hid_devices; ++i) { if (client_data->hid_sensor_hubs[i]) { - kfree(client_data->hid_sensor_hubs[i]->driver_data); + data = client_data->hid_sensor_hubs[i]->driver_data; hid_destroy_device(client_data->hid_sensor_hubs[i]); + kfree(data); client_data->hid_sensor_hubs[i] = NULL; } } -- 2.34.1

2 1

[openeuler:OLK-5.10 2860/2860] mm/damon/core-test.h:284:9: sparse: sparse: incompatible types in comparison expression (different signedness):
by kernel test robot 12 Apr '25

12 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 8cf05d37849321b8bb9b74e099fa5bb6164d4f56 commit: 83b931be40b2829e20f38356509d8706ea6b6238 [2860/2860] mm/damon/core-test: test damon_set_regions config: x86_64-randconfig-121-20250412 (https://download.01.org/0day-ci/archive/20250412/202504121904.5u9UZZmR-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250412/202504121904.5u9UZZmR-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504121904.5u9UZZmR-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/damon/core.c: note: in included file: >> mm/damon/core-test.h:284:9: sparse: sparse: incompatible types in comparison expression (different signedness): mm/damon/core-test.h:284:9: sparse: unsigned int * mm/damon/core-test.h:284:9: sparse: int * vim +284 mm/damon/core-test.h 269 270 static void damon_test_set_regions(struct kunit *test) 271 { 272 struct damon_target *t = damon_new_target(); 273 struct damon_region *r1 = damon_new_region(4, 16); 274 struct damon_region *r2 = damon_new_region(24, 32); 275 struct damon_addr_range range = {.start = 8, .end = 28}; 276 unsigned long expects[] = {8, 16, 16, 24, 24, 28}; 277 int expect_idx = 0; 278 struct damon_region *r; 279 280 damon_add_region(r1, t); 281 damon_add_region(r2, t); 282 damon_set_regions(t, &range, 1); 283 > 284 KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 3); 285 damon_for_each_region(r, t) { 286 KUNIT_EXPECT_EQ(test, r->ar.start, expects[expect_idx++]); 287 KUNIT_EXPECT_EQ(test, r->ar.end, expects[expect_idx++]); 288 } 289 damon_destroy_target(t); 290 } 291 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION a8f711b494f352fee7d319f77d87d63916854c6e
by kernel test robot 12 Apr '25

12 Apr '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: a8f711b494f352fee7d319f77d87d63916854c6e !15827 perf stat: Enable iostat mode for HiSilicon PCIe PMU Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503141744.6L1UQKTr-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503151158.xNxBbX1r-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503182233.88LCSaAj-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503200858.XSvAPfQM-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503201027.i8HE43EJ-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503220823.mG13Rroz-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503220924.Uw2cwpZV-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503290855.eVbc4pVd-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202504012026.kzT6d2HZ-lkp@intel.com aarch64-linux-ld: Unexpected GOT/PLT entries detected! aarch64-linux-ld: Unexpected run-time procedure linkages detected! arch/arm64/kvm/virtcca_cvm.c:819:5: warning: no previous prototype for function 'virtcca_get_tmi_version' [-Wmissing-prototypes] arch/loongarch/mm/cache.c:69:29: warning: variable 'way_size' set but not used [-Wunused-but-set-variable] drivers/coda/coda_pci.c:228: warning: Excess function parameter 'pdev' description in 'virtcca_pci_get_rom_size' drivers/coda/coda_pci.c:228: warning: Function parameter or member 'p' not described in 'virtcca_pci_get_rom_size' drivers/gpu/drm/sti/sti_dvo.c:531:21: error: implicit declaration of function 'devm_ioremap' [-Werror=implicit-function-declaration] drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1026:28: error: 'DCB_CAP_DCBX_VER_IEEE' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_dcb.c:103:26: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:18: error: storage size of 'pfc' isn't known drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:9: error: variable 'pfc' has initializer but incomplete type drivers/net/ethernet/huawei/hinic/hinic_dcb.c:117:26: error: invalid application of 'sizeof' to incomplete type 'struct ieee_pfc' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1432:7: error: 'DCB_NUMTCS_ATTR_PG' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1519:14: error: variable 'hinic_dcbnl_ops' has initializer but incomplete type drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1522:3: error: 'const struct dcbnl_rtnl_ops' has no member named 'ieee_setets' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1524:3: error: 'const struct dcbnl_rtnl_ops' has no member named 'ieee_setpfc' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1528:3: error: 'const struct dcbnl_rtnl_ops' has no member named 'setstate' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1530:3: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpgtccfgtx' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1531:3: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpgbwgcfgtx' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1532:3: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpgtccfgrx' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1535:3: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpgbwgcfgtx' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1536:3: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpgtccfgrx' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1538:3: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpfccfg' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1539:3: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpfccfg' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1541:3: error: 'const struct dcbnl_rtnl_ops' has no member named 'getcap' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1542:3: error: 'const struct dcbnl_rtnl_ops' has no member named 'getnumtcs' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1543:3: error: 'const struct dcbnl_rtnl_ops' has no member named 'setnumtcs' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1545:3: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpfcstate' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1549:3: error: 'const struct dcbnl_rtnl_ops' has no member named 'setdcbx' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:244:22: error: 'DCB_CAP_DCBX_HOST' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_dcb.c:244:42: error: 'DCB_CAP_DCBX_VER_CEE' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_dcb.c:475:14: error: 'DCB_ATTR_VALUE_UNDEFINED' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_dcb.c:698:7: error: 'DCB_CAP_ATTR_PG_TCS' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_dcb.c:707:7: error: 'DCB_CAP_ATTR_BCN' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_main.c:2291:19: error: 'struct net_device' has no member named 'dcbnl_ops' drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:19: error: field 'hinic_ieee_ets_default' has incomplete type drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:211:19: error: field 'hinic_ieee_ets' has incomplete type drivers/scsi/linkdata/ps3stor/./linux/ps3_base.c:545:5: error: no previous prototype for 'ps3_pci_init' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_base.c:899:5: error: no previous prototype for 'ps3_pci_init_complete' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_base.c:945:6: error: no previous prototype for 'ps3_pci_init_complete_exit' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_cli.c:108:9: error: function 'ps3stor_cli_printf' might be a candidate for 'gnu_printf' format attribute [-Werror=suggest-attribute=format] drivers/scsi/linkdata/ps3stor/./linux/ps3_cli_debug.c:1059:5: error: no previous prototype for 'ps3_dump_context_show' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_dump.c:159:5: error: no previous prototype for 'ps3_dump_file_write' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_dump.c:200:5: error: no previous prototype for 'ps3_dump_file_close' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_dump.c:28:5: error: no previous prototype for 'ps3_dump_local_time' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_dump.c:50:5: error: no previous prototype for 'ps3_dump_filename_build' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_dump.c:76:5: error: no previous prototype for 'ps3_dump_file_open' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_cmd_complete.c:131:6: error: no previous prototype for 'ps3_trigger_irq_poll' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_cmd_complete.c:243:5: error: no previous prototype for 'ps3_resp_status_convert' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_cmd_statistics.c:403:6: error: no previous prototype for 'ps3_io_recv_ok_stat_inc' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_cmd_statistics.c:85:6: error: no previous prototype for 'ps3_cmd_stat_content_clear' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_debug.c:883:5: error: no previous prototype for 'ps3_dump_dir_length' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_device_manager.c:1581:5: error: no previous prototype for 'ps3_scsi_private_init_pd' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_device_manager.c:1663:5: error: no previous prototype for 'ps3_scsi_private_init_vd' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_device_manager_sas.c:1632:5: error: no previous prototype for 'ps3_sas_expander_phys_refresh' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_instance_manager.c:669:60: error: 'snprintf' output may be truncated before the last format character [-Werror=format-truncation=] drivers/scsi/linkdata/ps3stor/ps3_ioc_adp.c:147:6: error: no previous prototype for 'ps3_ioc_resource_prepare_hba' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_ioc_adp.c:36:6: error: no previous prototype for 'ps3_ioc_resource_prepare_switch' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_ioc_adp.c:88:6: error: no previous prototype for 'ps3_ioc_resource_prepare_raid' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_ioc_manager.c:307:5: error: no previous prototype for 'ps3_hard_reset_to_ready' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_ioctl.c:785:6: error: no previous prototype for 'ps3_clean_mgr_cmd' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_irq.c:21:27: error: 'PS3_INTERRUPT_CMD_DISABLE_ALL_MASK' defined but not used [-Werror=unused-const-variable=] drivers/scsi/linkdata/ps3stor/ps3_irq.c:22:27: error: 'PS3_INTERRUPT_CMD_ENABLE_MSIX' defined but not used [-Werror=unused-const-variable=] drivers/scsi/linkdata/ps3stor/ps3_irq.c:23:27: error: 'PS3_INTERRUPT_MASK_DISABLE' defined but not used [-Werror=unused-const-variable=] drivers/scsi/linkdata/ps3stor/ps3_irq.c:24:27: error: 'PS3_INTERRUPT_STATUS_EXIST_IRQ' defined but not used [-Werror=unused-const-variable=] drivers/scsi/linkdata/ps3stor/ps3_irq.c:25:27: error: 'PS3_INTERRUPT_CLEAR_IRQ' defined but not used [-Werror=unused-const-variable=] drivers/scsi/linkdata/ps3stor/ps3_irq.c:27:27: error: 'PS3_SSD_IOPS_MSIX_VECTORS' defined but not used [-Werror=unused-const-variable=] drivers/scsi/linkdata/ps3stor/ps3_irq.c:28:27: error: 'PS3_HDD_IOPS_MSIX_VECTORS' defined but not used [-Werror=unused-const-variable=] drivers/scsi/linkdata/ps3stor/ps3_module_para.c:609:14: error: no previous prototype for 'ps3_cli_ver_query' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:1058:6: error: no previous prototype for 'ps3_qos_pd_waitq_ratio_update' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2019:15: error: no previous prototype for 'ps3_hba_qos_decision' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2040:6: error: no previous prototype for 'ps3_hba_qos_waitq_notify' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2100:6: error: no previous prototype for 'ps3_cmd_waitq_abort' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:211:1: error: no previous prototype for 'ps3_qos_cmd_waitq_get' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2463:6: error: no previous prototype for 'ps3_hba_qos_waitq_clear_all' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2827:6: error: no previous prototype for 'ps3_hba_qos_vd_init' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2936:6: error: no previous prototype for 'ps3_hba_qos_vd_reset' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3023:6: error: no previous prototype for 'ps3_hba_qos_waitq_poll' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3279:15: error: no previous prototype for 'ps3_raid_qos_decision' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3334:6: error: no previous prototype for 'ps3_qos_mgrq_resend' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:335:15: error: no previous prototype for 'ps3_qos_vd_cmdword_get' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3478:6: error: no previous prototype for 'ps3_raid_qos_waitq_notify' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:351:15: error: no previous prototype for 'ps3_qos_exclusive_cmdword_get' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:363:15: error: no previous prototype for 'ps3_qos_tg_decision' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3821:15: error: no previous prototype for 'ps3_raid_qos_waitq_abort' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:4022:6: error: no previous prototype for 'ps3_raid_qos_waitq_clear_all' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:4083:6: error: no previous prototype for 'ps3_raid_qos_waitq_poll' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:749:15: error: no previous prototype for 'ps3_qos_all_pd_rc_get' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:876:6: error: no previous prototype for 'ps3_pd_quota_waitq_clear_all' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:892:6: error: no previous prototype for 'ps3_pd_quota_waitq_clean' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:1173:5: error: no previous prototype for 'ps3_range_check_and_insert' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:1231:5: error: no previous prototype for 'ps3_r1x_hash_range_lock' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:1312:6: error: no previous prototype for 'ps3_r1x_hash_range_unlock' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:578:5: error: no previous prototype for 'ps3_r1x_hash_bit_check' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:678:6: error: no previous prototype for 'ps3_r1x_conflict_queue_hash_bit_lock' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:730:5: error: no previous prototype for 'ps3_r1x_hash_bit_lock' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:988:6: error: no previous prototype for 'ps3_r1x_hash_bit_unlock' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_rb_tree.c:154:6: error: no previous prototype for 'rbtDelNodeDo' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:204:6: error: no previous prototype for 'ps3_recovery_irq_queue_destroy' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:2700:6: error: no previous prototype for 'ps3_hard_recovery_state_finish' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:363:5: error: no previous prototype for 'ps3_recovery_state_transfer' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:72:30: error: no previous prototype for 'ps3_recovery_context_alloc' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:82:6: error: no previous prototype for 'ps3_recovery_context_free' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:88:6: error: no previous prototype for 'ps3_recovery_context_delete' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_sas_transport.c:407:5: error: no previous prototype for 'ps3_sas_update_phy_info' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_scsi_cmd_err.c:1110:5: error: no previous prototype for 'ps3_wait_for_outstanding_complete' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_scsi_cmd_err.c:876:6: error: no previous prototype for 'ps3_set_task_manager_busy' [-Werror=missing-prototypes] kismet: WARNING: unmet direct dependencies detected for ACPI_HOTPLUG_IGNORE_OSC when selected by X86 kismet: WARNING: unmet direct dependencies detected for CRYPTO_DRBG_CTR when selected by CRYPTO_DEV_HISI_TRNG kismet: WARNING: unmet direct dependencies detected for HALTPOLL_CPUIDLE when selected by ARM64 mm/mempolicy.c:3129:26: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] Unverified Error/Warning (likely false positive, kindly check if interested): mm/oom_kill.c: linux/nmi.h is included more than once. Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-virtcca_get_tmi_version | |-- drivers-coda-coda_pci.c:warning:Excess-function-parameter-pdev-description-in-virtcca_pci_get_rom_size | `-- drivers-coda-coda_pci.c:warning:Function-parameter-or-member-p-not-described-in-virtcca_pci_get_rom_size |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_DRBG_CTR-when-selected-by-CRYPTO_DEV_HISI_TRNG | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-HALTPOLL_CPUIDLE-when-selected-by-ARM64 |-- arm64-randconfig-001-20250411 | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_ATTR_VALUE_UNDEFINED-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_ATTR_BCN-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_ATTR_PG_TCS-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_DCBX_HOST-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_DCBX_VER_CEE-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_DCBX_VER_IEEE-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_NUMTCS_ATTR_PG-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getcap | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getnumtcs | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getpfccfg | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getpgbwgcfgtx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getpgtccfgrx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-ieee_setets | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-ieee_setpfc | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setdcbx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setnumtcs | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setpfccfg | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setpfcstate | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setpgbwgcfgtx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setpgtccfgrx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setpgtccfgtx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setstate | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:invalid-application-of-sizeof-to-incomplete-type-struct-ieee_ets | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:invalid-application-of-sizeof-to-incomplete-type-struct-ieee_pfc | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:storage-size-of-pfc-isn-t-known | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:variable-hinic_dcbnl_ops-has-initializer-but-incomplete-type | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:variable-pfc-has-initializer-but-incomplete-type | |-- drivers-net-ethernet-huawei-hinic-hinic_main.c:error:struct-net_device-has-no-member-named-dcbnl_ops | |-- drivers-net-ethernet-huawei-hinic-hinic_nic_dev.h:error:field-hinic_ieee_ets-has-incomplete-type | `-- drivers-net-ethernet-huawei-hinic-hinic_nic_dev.h:error:field-hinic_ieee_ets_default-has-incomplete-type |-- arm64-randconfig-002-20250411 | |-- aarch64-linux-ld:Unexpected-GOT-PLT-entries-detected | `-- aarch64-linux-ld:Unexpected-run-time-procedure-linkages-detected |-- loongarch-allmodconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-ps3_pci_init | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-ps3_pci_init_complete | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-ps3_pci_init_complete_exit | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli.c:error:function-ps3stor_cli_printf-might-be-a-candidate-for-gnu_printf-format-attribute | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-ps3_dump_context_show | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_file_close | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_file_open | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_file_write | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_filename_build | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_local_time | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-ps3_resp_status_convert | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-ps3_trigger_irq_poll | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-ps3_cmd_stat_content_clear | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-ps3_io_recv_ok_stat_inc | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-ps3_dump_dir_length | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-ps3_scsi_private_init_pd | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-ps3_scsi_private_init_vd | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-ps3_sas_expander_phys_refresh | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.c:error:snprintf-output-may-be-truncated-before-the-last-format-character | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-ps3_ioc_resource_prepare_hba | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-ps3_ioc_resource_prepare_raid | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-ps3_ioc_resource_prepare_switch | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-ps3_hard_reset_to_ready | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-ps3_clean_mgr_cmd | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_HDD_IOPS_MSIX_VECTORS-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_CLEAR_IRQ-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_CMD_DISABLE_ALL_MASK-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_CMD_ENABLE_MSIX-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_MASK_DISABLE-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_STATUS_EXIST_IRQ-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_SSD_IOPS_MSIX_VECTORS-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-ps3_cli_ver_query | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_cmd_waitq_abort | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_decision | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_vd_init | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_vd_reset | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_waitq_clear_all | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_waitq_notify | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_waitq_poll | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_pd_quota_waitq_clean | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_pd_quota_waitq_clear_all | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_all_pd_rc_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_cmd_waitq_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_exclusive_cmdword_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_mgrq_resend | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_pd_waitq_ratio_update | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_tg_decision | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_vd_cmdword_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_decision | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_abort | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_clear_all | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_notify | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_poll | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_conflict_queue_hash_bit_lock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_bit_check | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_bit_lock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_bit_unlock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_range_lock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_range_unlock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_range_check_and_insert | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-rbtDelNodeDo | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_hard_recovery_state_finish | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_context_alloc | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_context_delete | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_context_free | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_irq_queue_destroy | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_state_transfer | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-ps3_sas_update_phy_info | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-ps3_set_task_manager_busy | `-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-ps3_wait_for_outstanding_complete |-- loongarch-allnoconfig | `-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used |-- loongarch-allyesconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-ps3_pci_init | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-ps3_pci_init_complete | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-ps3_pci_init_complete_exit | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli.c:error:function-ps3stor_cli_printf-might-be-a-candidate-for-gnu_printf-format-attribute | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-ps3_dump_context_show | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_file_close | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_file_open | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_file_write | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_filename_build | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_local_time | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-ps3_resp_status_convert | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-ps3_trigger_irq_poll | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-ps3_cmd_stat_content_clear | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-ps3_io_recv_ok_stat_inc | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-ps3_dump_dir_length | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-ps3_scsi_private_init_pd | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-ps3_scsi_private_init_vd | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-ps3_sas_expander_phys_refresh | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.c:error:snprintf-output-may-be-truncated-before-the-last-format-character | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-ps3_ioc_resource_prepare_hba | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-ps3_ioc_resource_prepare_raid | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-ps3_ioc_resource_prepare_switch | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-ps3_hard_reset_to_ready | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-ps3_clean_mgr_cmd | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_HDD_IOPS_MSIX_VECTORS-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_CLEAR_IRQ-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_CMD_DISABLE_ALL_MASK-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_CMD_ENABLE_MSIX-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_MASK_DISABLE-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_STATUS_EXIST_IRQ-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_SSD_IOPS_MSIX_VECTORS-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-ps3_cli_ver_query | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_cmd_waitq_abort | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_decision | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_vd_init | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_vd_reset | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_waitq_clear_all | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_waitq_notify | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_waitq_poll | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_pd_quota_waitq_clean | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_pd_quota_waitq_clear_all | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_all_pd_rc_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_cmd_waitq_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_exclusive_cmdword_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_mgrq_resend | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_pd_waitq_ratio_update | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_tg_decision | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_vd_cmdword_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_decision | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_abort | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_clear_all | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_notify | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_poll | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_conflict_queue_hash_bit_lock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_bit_check | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_bit_lock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_bit_unlock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_range_lock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_range_unlock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_range_check_and_insert | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-rbtDelNodeDo | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_hard_recovery_state_finish | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_context_alloc | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_context_delete | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_context_free | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_irq_queue_destroy | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_state_transfer | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-ps3_sas_update_phy_info | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-ps3_set_task_manager_busy | `-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-ps3_wait_for_outstanding_complete |-- loongarch-defconfig | `-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used |-- loongarch-randconfig-002-20250411 | `-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used |-- loongarch-randconfig-r062-20250412 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-ps3_pci_init | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-ps3_pci_init_complete | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-ps3_pci_init_complete_exit | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli.c:error:function-ps3stor_cli_printf-might-be-a-candidate-for-gnu_printf-format-attribute | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-ps3_dump_context_show | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_file_close | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_file_open | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_file_write | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_filename_build | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_local_time | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-ps3_resp_status_convert | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-ps3_trigger_irq_poll | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-ps3_cmd_stat_content_clear | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-ps3_io_recv_ok_stat_inc | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-ps3_dump_dir_length | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-ps3_scsi_private_init_pd | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-ps3_scsi_private_init_vd | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-ps3_sas_expander_phys_refresh | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.c:error:snprintf-output-may-be-truncated-before-the-last-format-character | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-ps3_ioc_resource_prepare_hba | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-ps3_ioc_resource_prepare_raid | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-ps3_ioc_resource_prepare_switch | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-ps3_hard_reset_to_ready | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-ps3_clean_mgr_cmd | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_HDD_IOPS_MSIX_VECTORS-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_CLEAR_IRQ-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_CMD_DISABLE_ALL_MASK-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_CMD_ENABLE_MSIX-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_MASK_DISABLE-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_STATUS_EXIST_IRQ-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_SSD_IOPS_MSIX_VECTORS-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-ps3_cli_ver_query | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_cmd_waitq_abort | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_decision | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_vd_init | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_vd_reset | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_waitq_clear_all | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_waitq_notify | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_waitq_poll | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_pd_quota_waitq_clean | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_pd_quota_waitq_clear_all | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_all_pd_rc_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_cmd_waitq_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_exclusive_cmdword_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_mgrq_resend | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_pd_waitq_ratio_update | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_tg_decision | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_vd_cmdword_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_decision | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_abort | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_clear_all | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_notify | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_poll | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_conflict_queue_hash_bit_lock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_bit_check | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_bit_lock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_bit_unlock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_range_lock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_range_unlock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_range_check_and_insert | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-rbtDelNodeDo | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_hard_recovery_state_finish | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_context_alloc | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_context_delete | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_context_free | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_irq_queue_destroy | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_state_transfer | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-ps3_sas_update_phy_info | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-ps3_set_task_manager_busy | `-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-ps3_wait_for_outstanding_complete |-- x86_64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-ACPI_HOTPLUG_IGNORE_OSC-when-selected-by-X86 | `-- mm-oom_kill.c:linux-nmi.h-is-included-more-than-once. |-- x86_64-buildonly-randconfig-006-20250411 | `-- drivers-gpu-drm-sti-sti_dvo.c:error:implicit-declaration-of-function-devm_ioremap `-- x86_64-defconfig `-- mm-mempolicy.c:warning:writing-byte-into-a-region-of-size elapsed time: 1443m configs tested: 21 configs skipped: 122 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250411 gcc-9.5.0 arm64 randconfig-002-20250411 gcc-9.5.0 arm64 randconfig-003-20250411 clang-21 arm64 randconfig-004-20250411 clang-21 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch defconfig gcc-14.2.0 loongarch randconfig-001-20250411 gcc-14.2.0 loongarch randconfig-002-20250411 gcc-14.2.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250411 gcc-11 x86_64 buildonly-randconfig-002-20250411 gcc-11 x86_64 buildonly-randconfig-003-20250411 clang-20 x86_64 buildonly-randconfig-004-20250411 gcc-12 x86_64 buildonly-randconfig-005-20250411 clang-20 x86_64 buildonly-randconfig-006-20250411 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 8cf05d37849321b8bb9b74e099fa5bb6164d4f56
by kernel test robot 12 Apr '25

12 Apr '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 8cf05d37849321b8bb9b74e099fa5bb6164d4f56 !15828 mt76: fix use-after-free by removing a non-RCU wcid pointer Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503171920.f4jVchcy-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503181406.E4pR441t-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503220351.uj1q69QX-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503220607.nbhzXKry-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202504120007.4O7NSSul-lkp@intel.com drivers/scsi/linkdata/ps3stor/./linux/ps3_driver_log.c:41:19: error: unused function 'time_for_log' [-Werror,-Wunused-function] drivers/scsi/linkdata/ps3stor/./linux/ps3_driver_log.c:65:19: error: unused function 'time_for_file_name' [-Werror,-Wunused-function] drivers/scsi/linkdata/ps3stor/ps3_irq.c:22:27: error: unused variable 'PS3_INTERRUPT_CMD_DISABLE_ALL_MASK' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:23:27: error: unused variable 'PS3_INTERRUPT_CMD_ENABLE_MSIX' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:24:27: error: unused variable 'PS3_INTERRUPT_MASK_DISABLE' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:25:27: error: unused variable 'PS3_INTERRUPT_STATUS_EXIST_IRQ' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:26:27: error: unused variable 'PS3_INTERRUPT_CLEAR_IRQ' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:28:27: error: unused variable 'PS3_SSD_IOPS_MSIX_VECTORS' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:29:27: error: unused variable 'PS3_HDD_IOPS_MSIX_VECTORS' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3024:6: error: no previous prototype for function 'ps3_hba_qos_waitq_poll' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3280:15: error: no previous prototype for function 'ps3_raid_qos_decision' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3335:6: error: no previous prototype for function 'ps3_qos_mgrq_resend' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3479:6: error: no previous prototype for function 'ps3_raid_qos_waitq_notify' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3822:15: error: no previous prototype for function 'ps3_raid_qos_waitq_abort' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_scsih.c:1959:1: error: unused function 'ps3_scsih_dev_id_get' [-Werror,-Wunused-function] kismet: WARNING: unmet direct dependencies detected for CPPC_CPUFREQ_SYSFS_INTERFACE when selected by CPU_FREQ_GOV_SEEP ld.lld: error: version script assignment of 'LINUX_2.6' to symbol '__vdso_sgx_enter_enclave' failed: symbol not defined llvm-objcopy: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory llvm-objdump: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory Unverified Error/Warning (likely false positive, kindly check if interested): drivers/block/rnbd/rnbd-srv-sysfs.c:56 rnbd_srv_create_dev_sysfs() warn: missing error code 'ret' drivers/gpu/drm/amd/amdgpu/dce_v10_0.o: warning: objtool: dce_v10_0_bandwidth_update() falls through to next function dce_v10_0_vblank_get_counter() drivers/gpu/drm/amd/amdgpu/dce_v11_0.o: warning: objtool: dce_v11_0_bandwidth_update() falls through to next function dce_v11_0_vblank_get_counter() drivers/gpu/drm/amd/amdgpu/dce_v6_0.o: warning: objtool: dce_v6_0_program_watermarks() falls through to next function dce_v6_0_latency_watermark() drivers/gpu/drm/radeon/cik.o: warning: objtool: dce8_bandwidth_update() falls through to next function cik_get_gpu_clock_counter() drivers/gpu/drm/radeon/evergreen.o: warning: objtool: evergreen_program_watermarks() falls through to next function evergreen_mc_wait_for_idle() drivers/gpu/drm/radeon/si.o: warning: objtool: dce6_program_watermarks() falls through to next function si_fence_ring_emit() drivers/gpu/drm/vmwgfx/vmwgfx_fb.o: warning: objtool: vmw_deferred_io() falls through to next function asan.module_ctor() drivers/media/test-drivers/vivid/vivid-kthread-cap.o: warning: objtool: vivid_thread_vid_cap_tick() falls through to next function plane_vaddr() drivers/media/tuners/e4000.o: warning: objtool: e4000_set_params() falls through to next function e4000_standby() drivers/nvdimm/namespace_devs.o: warning: objtool: size_store() falls through to next function nd_namespace_label_update() drivers/video/fbdev/hyperv_fb.o: warning: objtool: synthvid_deferred_io() falls through to next function hvfb_pci_stub_probe() fs/btrfs/free-space-cache.o: warning: objtool: add_bytes_to_bitmap() falls through to next function recalculate_thresholds() fs/btrfs/free-space-cache.o: warning: objtool: btrfs_alloc_from_cluster() falls through to next function btrfs_find_space_cluster() fs/btrfs/free-space-cache.o: warning: objtool: setup_cluster_bitmap() falls through to next function btrfs_init_free_cluster() fs/btrfs/free-space-cache.o: warning: objtool: steal_from_bitmap() falls through to next function link_free_space() fs/btrfs/free-space-tree.o: warning: objtool: modify_free_space_bitmap() falls through to next function free_space_test_bit() fs/btrfs/free-space-tree.o: warning: objtool: update_free_space_extent_count() falls through to next function add_new_free_space_info() mm/memcontrol.c:8106 uncharge_page() error: uninitialized symbol 'objcg'. mm/vmscan.o: warning: objtool: do_shrink_slab() falls through to next function allow_direct_reclaim() sound/soc/fsl/fsl_easrc.o: warning: objtool: fsl_easrc_runtime_resume() falls through to next function asan.module_ctor() Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-CPPC_CPUFREQ_SYSFS_INTERFACE-when-selected-by-CPU_FREQ_GOV_SEEP |-- x86_64-allnoconfig | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_file_name-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_log-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_HDD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CLEAR_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_DISABLE_ALL_MASK-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_ENABLE_MSIX-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_MASK_DISABLE-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_STATUS_EXIST_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_SSD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_mgrq_resend-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_notify-Werror-Wmissing-prototypes | `-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:error:unused-function-ps3_scsih_dev_id_get-Werror-Wunused-function |-- x86_64-buildonly-randconfig-005-20250411 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-101-20250412 | |-- drivers-gpu-drm-amd-amdgpu-dce_v10_0.o:warning:objtool:dce_v10_0_bandwidth_update-falls-through-to-next-function-dce_v10_0_vblank_get_counter() | |-- drivers-gpu-drm-amd-amdgpu-dce_v11_0.o:warning:objtool:dce_v11_0_bandwidth_update-falls-through-to-next-function-dce_v11_0_vblank_get_counter() | |-- drivers-gpu-drm-amd-amdgpu-dce_v6_0.o:warning:objtool:dce_v6_0_program_watermarks-falls-through-to-next-function-dce_v6_0_latency_watermark() | |-- drivers-gpu-drm-radeon-cik.o:warning:objtool:dce8_bandwidth_update-falls-through-to-next-function-cik_get_gpu_clock_counter() | |-- drivers-gpu-drm-radeon-evergreen.o:warning:objtool:evergreen_program_watermarks-falls-through-to-next-function-evergreen_mc_wait_for_idle() | |-- drivers-gpu-drm-radeon-si.o:warning:objtool:dce6_program_watermarks-falls-through-to-next-function-si_fence_ring_emit() | |-- drivers-gpu-drm-vmwgfx-vmwgfx_fb.o:warning:objtool:vmw_deferred_io-falls-through-to-next-function-asanmodule_ctor() | |-- drivers-media-test-drivers-vivid-vivid-kthread-cap.o:warning:objtool:vivid_thread_vid_cap_tick-falls-through-to-next-function-plane_vaddr() | |-- drivers-media-tuners-e4000.o:warning:objtool:e4000_set_params-falls-through-to-next-function-e4000_standby() | |-- drivers-nvdimm-namespace_devs.o:warning:objtool:size_store-falls-through-to-next-function-nd_namespace_label_update() | |-- drivers-video-fbdev-hyperv_fb.o:warning:objtool:synthvid_deferred_io-falls-through-to-next-function-hvfb_pci_stub_probe() | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:setup_cluster_bitmap-falls-through-to-next-function-btrfs_init_free_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- sound-soc-fsl-fsl_easrc.o:warning:objtool:fsl_easrc_runtime_resume-falls-through-to-next-function-asanmodule_ctor() |-- x86_64-randconfig-104-20250412 | |-- drivers-gpu-drm-amd-amdgpu-dce_v10_0.o:warning:objtool:dce_v10_0_bandwidth_update-falls-through-to-next-function-dce_v10_0_vblank_get_counter() | |-- drivers-gpu-drm-amd-amdgpu-dce_v11_0.o:warning:objtool:dce_v11_0_bandwidth_update-falls-through-to-next-function-dce_v11_0_vblank_get_counter() | |-- drivers-gpu-drm-amd-amdgpu-dce_v6_0.o:warning:objtool:dce_v6_0_program_watermarks-falls-through-to-next-function-dce_v6_0_latency_watermark() | |-- drivers-media-test-drivers-vivid-vivid-kthread-cap.o:warning:objtool:vivid_thread_vid_cap_tick-falls-through-to-next-function-plane_vaddr() | |-- drivers-media-tuners-e4000.o:warning:objtool:e4000_set_params-falls-through-to-next-function-e4000_standby() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-121-20250412 | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | `-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx |-- x86_64-randconfig-122-20250412 | |-- drivers-nvdimm-namespace_devs.o:warning:objtool:size_store-falls-through-to-next-function-nd_namespace_label_update() | |-- mm-vmscan.o:warning:objtool:do_shrink_slab-falls-through-to-next-function-allow_direct_reclaim() | `-- sound-soc-fsl-fsl_easrc.o:warning:objtool:fsl_easrc_runtime_resume-falls-through-to-next-function-asanmodule_ctor() |-- x86_64-randconfig-123-20250412 | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | `-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx |-- x86_64-randconfig-161-20250411 | |-- drivers-block-rnbd-rnbd-srv-sysfs.c-rnbd_srv_create_dev_sysfs()-warn:missing-error-code-ret | `-- drivers-net-ethernet-netswift-ngbe-ngbe_main.c-ngbe_io_error_detected()-warn:inconsistent-indenting `-- x86_64-randconfig-161-20250412 `-- mm-memcontrol.c-uncharge_page()-error:uninitialized-symbol-objcg-. elapsed time: 1445m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250411 gcc-9.5.0 arm64 randconfig-002-20250411 gcc-9.5.0 arm64 randconfig-003-20250411 clang-21 arm64 randconfig-004-20250411 clang-21 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250411 gcc-11 x86_64 buildonly-randconfig-002-20250411 gcc-11 x86_64 buildonly-randconfig-003-20250411 clang-20 x86_64 buildonly-randconfig-004-20250411 gcc-12 x86_64 buildonly-randconfig-005-20250411 clang-20 x86_64 buildonly-randconfig-006-20250411 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/2] block: fix bugs in blk_register_queue()
by Zheng Qixing 12 Apr '25

12 Apr '25

Patch 2 aims to fix bug caused in patch 1. Zheng Qixing (2): block: fix resource leak in elevator registration error path block: fix lock ordering in blk_register_queue() error path block/blk-sysfs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[PATCH OLK-6.6 0/7] ext4: Some zeroing fixes
by Baokun Li 12 Apr '25

12 Apr '25

Baokun Li (2): ext4: goto right label 'out_mmap_sem' in ext4_setattr() iomap: do not interrupt IOMAP_ZERO Brian Foster (1): mm: zero range of eof folio exposed by inode size extension Matthew Wilcox (Oracle) (1): mm: convert pagecache_isize_extended to use a folio Yongjian Sun (2): ext4: do not always order data when partial zeroing out a block ext4: fix potential memory exposure issues during truncate in iomap mode. Zhang Yi (1): jbd2: fix off-by-one while erasing journal fs/ext4/inode.c | 130 ++++++++++++++++++++++++++++++----------- fs/iomap/buffered-io.c | 7 ++- fs/jbd2/journal.c | 15 ++--- mm/truncate.c | 51 ++++++++++------ 4 files changed, 141 insertions(+), 62 deletions(-) -- 2.46.1

2 8

[openeuler:OLK-5.10 2858/2858] drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6835 ngbe_io_error_detected() warn: inconsistent indenting
by kernel test robot 12 Apr '25

12 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 8cf05d37849321b8bb9b74e099fa5bb6164d4f56 commit: a5961b4bc6ce09a70902686ecc848a47493a9251 [2858/2858] openeuler: net: ngbe: add ngbe module support config: x86_64-randconfig-161-20250411 (https://download.01.org/0day-ci/archive/20250412/202504120007.4O7NSSul-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504120007.4O7NSSul-lkp@intel.com/ New smatch warnings: drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6835 ngbe_io_error_detected() warn: inconsistent indenting Old smatch warnings: drivers/net/ethernet/netswift/ngbe/ngbe_main.c:1850 ngbe_request_msix_irqs() warn: 'entry->vector' from request_irq() not released on lines: 1850. drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3931 ngbe_setup_all_rx_resources() warn: inconsistent indenting drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5084 ngbe_reset_subtask() warn: inconsistent indenting drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5313 ngbe_tso() warn: inconsistent indenting vim +6835 drivers/net/ethernet/netswift/ngbe/ngbe_main.c 6819 6820 /** 6821 * ngbe_io_error_detected - called when PCI error is detected 6822 * @pdev: Pointer to PCI device 6823 * @state: The current pci connection state 6824 * 6825 * This function is called after a PCI bus error affecting 6826 * this device has been detected. 6827 */ 6828 static pci_ers_result_t ngbe_io_error_detected(struct pci_dev *pdev, 6829 pci_channel_state_t state) 6830 { 6831 struct ngbe_adapter *adapter = pci_get_drvdata(pdev); 6832 struct net_device *netdev = adapter->netdev; 6833 6834 #ifdef CONFIG_PCI_IOV > 6835 struct ngbe_hw *hw = &adapter->hw; 6836 struct pci_dev *bdev, *vfdev; 6837 u32 dw0, dw1, dw2, dw3; 6838 int vf, pos; 6839 u16 req_id, pf_func; 6840 6841 if (adapter->num_vfs == 0) 6842 goto skip_bad_vf_detection; 6843 6844 bdev = pdev->bus->self; 6845 while (bdev && (pci_pcie_type(bdev) != PCI_EXP_TYPE_ROOT_PORT)) 6846 bdev = bdev->bus->self; 6847 6848 if (!bdev) 6849 goto skip_bad_vf_detection; 6850 6851 pos = pci_find_ext_capability(bdev, PCI_EXT_CAP_ID_ERR); 6852 if (!pos) 6853 goto skip_bad_vf_detection; 6854 6855 dw0 = ngbe_read_pci_cfg_dword(hw, pos + PCI_ERR_HEADER_LOG); 6856 dw1 = ngbe_read_pci_cfg_dword(hw, 6857 pos + PCI_ERR_HEADER_LOG + 4); 6858 dw2 = ngbe_read_pci_cfg_dword(hw, 6859 pos + PCI_ERR_HEADER_LOG + 8); 6860 dw3 = ngbe_read_pci_cfg_dword(hw, 6861 pos + PCI_ERR_HEADER_LOG + 12); 6862 if (NGBE_REMOVED(hw->hw_addr)) 6863 goto skip_bad_vf_detection; 6864 6865 req_id = dw1 >> 16; 6866 /* if bit 7 of the requestor ID is set then it's a VF */ 6867 if (!(req_id & 0x0080)) 6868 goto skip_bad_vf_detection; 6869 6870 pf_func = req_id & 0x01; 6871 if ((pf_func & 1) == (pdev->devfn & 1)) { 6872 vf = (req_id & 0x7F) >> 1; 6873 e_dev_err("VF %d has caused a PCIe error\n", vf); 6874 e_dev_err("TLP: dw0: %8.8x\tdw1: %8.8x\tdw2: %8.8x\tdw3: %8.8x\n", 6875 dw0, dw1, dw2, dw3); 6876 6877 /* Find the pci device of the offending VF */ 6878 vfdev = pci_get_device(PCI_VENDOR_ID_TRUSTNETIC, 6879 NGBE_VF_DEVICE_ID, NULL); 6880 while (vfdev) { 6881 if (vfdev->devfn == (req_id & 0xFF)) 6882 break; 6883 vfdev = pci_get_device(PCI_VENDOR_ID_TRUSTNETIC, 6884 NGBE_VF_DEVICE_ID, vfdev); 6885 } 6886 /* There's a slim chance the VF could have been hot 6887 * plugged, so if it is no longer present we don't need 6888 * to issue the VFLR.Just clean up the AER in that case. 6889 */ 6890 if (vfdev) { 6891 ngbe_issue_vf_flr(adapter, vfdev); 6892 /* Free device reference count */ 6893 pci_dev_put(vfdev); 6894 } 6895 6896 pci_aer_clear_nonfatal_status(pdev); 6897 } 6898 6899 /* Even though the error may have occurred on the other port 6900 * we still need to increment the vf error reference count for 6901 * both ports because the I/O resume function will be called 6902 * for both of them. 6903 */ 6904 adapter->vferr_refcount++; 6905 6906 return PCI_ERS_RESULT_RECOVERED; 6907 6908 skip_bad_vf_detection: 6909 #endif /* CONFIG_PCI_IOV */ 6910 6911 if (!test_bit(__NGBE_SERVICE_INITED, &adapter->state)) 6912 return PCI_ERS_RESULT_DISCONNECT; 6913 6914 rtnl_lock(); 6915 netif_device_detach(netdev); 6916 6917 if (state == pci_channel_io_perm_failure) { 6918 rtnl_unlock(); 6919 return PCI_ERS_RESULT_DISCONNECT; 6920 } 6921 6922 if (netif_running(netdev)) 6923 ngbe_close(netdev); 6924 6925 if (!test_and_set_bit(__NGBE_DISABLED, &adapter->state)) 6926 pci_disable_device(pdev); 6927 rtnl_unlock(); 6928 6929 /* Request a slot reset. */ 6930 return PCI_ERS_RESULT_NEED_RESET; 6931 } 6932 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION ac44c6a4925e0772513c3597d420e5705faf482b
by kernel test robot 11 Apr '25

11 Apr '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: ac44c6a4925e0772513c3597d420e5705faf482b !15664 CVE-2025-21858 Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503201721.gZeymcpc-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503251400.xG2WACIP-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503271858.j6vJ9Bhc-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503281620.pNXaYE13-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202504110241.8SiMchEQ-lkp@intel.com https://lore.kernel.org/oe-kbuild/202503150349.Roa6uXS0-lkp@intel.com https://lore.kernel.org/oe-kbuild/202504081102.ziLuPC5Y-lkp@intel.com arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x162: unsupported intra-function call arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1b2: unsupported intra-function call arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1c2: unsupported intra-function call arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1d1: unsupported intra-function call arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1d2: unsupported intra-function call arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1e1: unsupported intra-function call arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1e2: unsupported intra-function call arch/x86/entry/entry_64.o: warning: objtool: If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE. block/blk-mq-debugfs-zoned.o: warning: objtool: missing symbol for section .text block/blk-zoned.o: warning: objtool: missing symbol for section .text drivers/dma/pl330.c:2598:15: warning: 'dst' may be used uninitialized in this function [-Wmaybe-uninitialized] drivers/dma/pl330.c:2598:22: warning: 'dst' may be used uninitialized in this function [-Wmaybe-uninitialized] drivers/dma/pl330.c:2599:15: warning: 'src' may be used uninitialized in this function [-Wmaybe-uninitialized] drivers/dma/pl330.c:2599:22: warning: 'src' may be used uninitialized in this function [-Wmaybe-uninitialized] drivers/gpu/drm/ttm/ttm_object.c:60: error: Cannot parse struct or union! drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: warning: objtool: missing symbol for section .text.unlikely. drivers/pinctrl/core.c:1338: error: Cannot parse struct or union! include/asm-generic/io.h:742:19: warning: 'reg' may be used uninitialized in this function [-Wmaybe-uninitialized] include/linux/filter.h:332:4: warning: cast between incompatible function types from 'int (* const)(struct bpf_map *, void *)' to 'u64 (*)(u64, u64, u64, u64, u64)' {aka 'long long unsigned int (*)(long long unsigned int, long long unsigned int, long long unsigned int, long long unsigned int, long long unsigned int)'} [-Wcast-function-type] include/linux/filter.h:332:4: warning: cast between incompatible function types from 'int (* const)(struct bpf_map *, void *, void *, u64)' {aka 'int (* const)(struct bpf_map *, void *, void *, long long unsigned int)'} to 'u64 (*)(u64, u64, u64, u64, u64)' {aka 'long long unsigned int (*)(long long unsigned int, long long unsigned int, long long unsigned int, long long unsigned int, long long unsigned int)'} [-Wcast-function-type] include/linux/filter.h:332:4: warning: cast between incompatible function types from 'void * (* const)(struct bpf_map *, void *)' to 'u64 (*)(u64, u64, u64, u64, u64)' {aka 'long long unsigned int (*)(long long unsigned int, long long unsigned int, long long unsigned int, long long unsigned int, long long unsigned int)'} [-Wcast-function-type] init/Kconfig:34: syntax error kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace' mm/early_ioremap.o: warning: objtool: missing symbol for section .text mm/page_ext.o: warning: objtool: missing symbol for section .init.text Unverified Error/Warning (likely false positive, kindly check if interested): ./samples/mic/mpssd/mpssd.c: 40 linux/version.h not needed. /kbuild/src/headers/Makefile:626: include/config/auto.conf.cmd: No such file or directory block/blk-throttle.c:2377:1-7: preceding lock on line 2269 drivers/gpu/drm/i915/i915_gem.o: warning: objtool: i915_gem_fault() falls through to next function i915_gem_object_ggtt_pin() drivers/gpu/drm/i915/intel_display.o: warning: objtool: _intel_compute_tile_offset() falls through to next function skl_format_to_fourcc() drivers/gpu/drm/i915/intel_display.o: warning: objtool: skl_plane_stride() falls through to next function skl_plane_ctl() drivers/gpu/drm/i915/vlv_dsi_pll.o: warning: objtool: bxt_dsi_pll_enable() falls through to next function bxt_dsi_reset_clocks() drivers/net/ethernet/intel/e1000/e1000_main.o: warning: objtool: e1000_watchdog() falls through to next function e1000_82547_tx_fifo_stall_task() mm/kasan/kasan_init.c:220: warning: Function parameter or member 'shadow_end' not described in 'kasan_populate_zero_shadow' mm/kasan/kasan_init.c:220: warning: Function parameter or member 'shadow_start' not described in 'kasan_populate_zero_shadow' Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-001-20250410 | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow | `-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow |-- arm64-randconfig-002-20250410 | `-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- arm64-randconfig-003-20250410 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-004-20250410 | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized-in-this-function | |-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized-in-this-function | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-lo | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-void-u64)-aka-int-(-const)(struct-bpf_map-void-void-long-long-unsigned-int)-to-u64-(-)(u64 | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-void-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-l | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow | `-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow |-- arm64-randconfig-055-20250411 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-r054-20250411 | |-- block-blk-throttle.c:preceding-lock-on-line | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized-in-this-function | |-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized-in-this-function | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | `-- include-asm-generic-io.h:warning:reg-may-be-used-uninitialized-in-this-function |-- arm64-randconfig-r062-20250411 | `-- init-Kconfig:syntax-error |-- x86_64-allnoconfig | |-- Makefile:include-config-auto.conf.cmd:No-such-file-or-directory | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration | `-- samples-mic-mpssd-mpssd.c:linux-version.h-not-needed. |-- x86_64-allyesconfig | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow | `-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type |-- x86_64-buildonly-randconfig-001-20250410 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20250410 | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow | `-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow |-- x86_64-buildonly-randconfig-003-20250410 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- kernel-trace-trace_output.o:warning:objtool:missing-symbol-for-section-.init.text | |-- mm-early_ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20250410 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- block-blk-mq-debugfs-zoned.o:warning:objtool:missing-symbol-for-section-.text | |-- block-blk-zoned.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- kernel-trace-trace_output.o:warning:objtool:missing-symbol-for-section-.init.text | `-- mm-page_ext.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-005-20250410 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-net-ethernet-netswift-ngbe-ngbe_hw.o:warning:objtool:missing-symbol-for-section-.text.unlikely. | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20250410 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | `-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type |-- x86_64-defconfig | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | `-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized-in-this-function |-- x86_64-randconfig-101-20250411 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-i915-i915_gem.o:warning:objtool:i915_gem_fault-falls-through-to-next-function-i915_gem_object_ggtt_pin() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:_intel_compute_tile_offset-falls-through-to-next-function-skl_format_to_fourcc() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:skl_plane_stride-falls-through-to-next-function-skl_plane_ctl() | |-- drivers-gpu-drm-i915-vlv_dsi_pll.o:warning:objtool:bxt_dsi_pll_enable-falls-through-to-next-function-bxt_dsi_reset_clocks() | |-- drivers-gpu-drm-radeon-evergreen_cs.o:warning:objtool:evergreen_surface_check-falls-through-to-next-function-evergreen_cs_track_validate_htile() | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-102-20250411 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-103-20250411 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | `-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- x86_64-randconfig-104-20250411 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow | `-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow `-- x86_64-randconfig-161-20250411 |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union |-- drivers-md-raid5.o:warning:objtool:raid5_compute_sector-falls-through-to-next-function-raid5_compute_blocknr() |-- drivers-media-tuners-fc2580.o:warning:objtool:fc2580_set_params-falls-through-to-next-function-fc2580_standby() |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace |-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_end-not-described-in-kasan_populate_zero_shadow `-- mm-kasan-kasan_init.c:warning:Function-parameter-or-member-shadow_start-not-described-in-kasan_populate_zero_shadow elapsed time: 1454m configs tested: 16 configs skipped: 133 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250410 gcc-14.2.0 arm64 randconfig-002-20250410 gcc-10.5.0 arm64 randconfig-003-20250410 gcc-6.5.0 arm64 randconfig-004-20250410 gcc-8.5.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250410 clang-20 x86_64 buildonly-randconfig-002-20250410 gcc-12 x86_64 buildonly-randconfig-003-20250410 clang-20 x86_64 buildonly-randconfig-004-20250410 clang-20 x86_64 buildonly-randconfig-005-20250410 clang-20 x86_64 buildonly-randconfig-006-20250410 clang-20 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 00/18] General updates of HiSilicon PMU drivers
by Yushan Wang 11 Apr '25

11 Apr '25

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IC0GTV ---------------------------------------------------------------------- General updates of HiSilicon PMU drivers. Junhao He (8): drivers/perf: hisi: Fix incorrect variable name "hha_pmu" in DDRC PMU driver drivers/perf: hisi: Delete redundant blank line of DDRC PMU drivers/perf: hisi: Simplify the probe process for each DDRC version drivers/perf: hisi: Add support for HiSilicon DDRC v3 PMU driver drivers/perf: hisi: Use ACPI driver_data to retrieve SLLC PMU information drivers/perf: hisi: Add support for HiSilicon SLLC v3 PMU driver drivers/perf: hisi: Relax the event number check of v2 PMUs drivers/perf: hisi: Add support for HiSilicon MN PMU driver Yicong Yang (10): drivers/perf: hisi: Define a symbol namespace for HiSilicon Uncore PMUs drivers/perf: hisi: Don't update the associated_cpus on CPU offline drivers/perf: hisi: Migrate to one online CPU if no associated one online drivers/perf: hisi: Refactor the detection of associated CPUs drivers/perf: hisi: Extract topology information to a separate structure drivers/perf: hisi: Add a common function to retrieve topology from firmware drivers/perf: hisi: Provide a generic implementation of cpumask/identifier drivers/perf: hisi: Export associated CPUs of each PMU through sysfs drivers/perf: hisi: Support PMUs with no interrupt drivers/perf: hisi: Add support for HiSilicon NoC PMU Documentation/admin-guide/perf/hisi-pmu.rst | 16 +- drivers/perf/hisilicon/Makefile | 3 +- drivers/perf/hisilicon/hisi_uncore_cpa_pmu.c | 42 +- drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c | 283 +++++-------- drivers/perf/hisilicon/hisi_uncore_hha_pmu.c | 54 +-- drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c | 44 +- drivers/perf/hisilicon/hisi_uncore_mn_pmu.c | 355 ++++++++++++++++ drivers/perf/hisilicon/hisi_uncore_noc_pmu.c | 392 ++++++++++++++++++ drivers/perf/hisilicon/hisi_uncore_pa_pmu.c | 55 +-- drivers/perf/hisilicon/hisi_uncore_pmu.c | 166 ++++++-- drivers/perf/hisilicon/hisi_uncore_pmu.h | 51 ++- drivers/perf/hisilicon/hisi_uncore_sllc_pmu.c | 251 +++++++---- drivers/perf/hisilicon/hisi_uncore_uc_pmu.c | 45 +- 13 files changed, 1260 insertions(+), 497 deletions(-) create mode 100644 drivers/perf/hisilicon/hisi_uncore_mn_pmu.c create mode 100644 drivers/perf/hisilicon/hisi_uncore_noc_pmu.c -- 2.33.0

2 19

[PATCH OLK-5.10 0/2] CVE-2025-21858
by Zhang Changzhong 11 Apr '25

11 Apr '25

Kuniyuki Iwashima (2): geneve: Fix use-after-free in geneve_find_dev(). geneve: Suppress list corruption splat in geneve_destroy_tunnels(). drivers/net/geneve.c | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) -- 2.9.5

2 3

[PATCH OLK-6.6 00/14] yt6801: Add Motorcomm yt6801 PCIe driver
by Frank Sae 11 Apr '25

11 Apr '25

This series includes adding Motorcomm YT6801 Gigabit ethernet driver and adding yt6801 ethernet driver entry in MAINTAINERS file. YT6801 integrates a YT8531S phy. Frank Sae (14): yt6801: Add support for a pci table in this module yt6801: Implement mdio register yt6801: Implement pci_driver shutdown yt6801: Implement the fxgmac_init function yt6801: Implement the .ndo_open function yt6801: Implement the fxgmac_start function net:phy:motorcomm: Add PHY_INTERFACE_MODE_INTERNAL to support YT6801 yt6801: Implement the fxgmac_hw_init function yt6801: Implement the poll functions yt6801: Implement .ndo_start_xmit function yt6801: Implement some net_device_ops function yt6801: Implement pci_driver suspend and resume yt6801: Add makefile and Kconfig yt6801: Update the Makefile, Kconfig and maintainer for yt6801 MAINTAINERS | 7 + arch/arm64/configs/openeuler_defconfig | 4 +- arch/loongarch/configs/loongson3_defconfig | 3 + arch/powerpc/configs/openeuler_defconfig | 4 +- arch/riscv/configs/openeuler_defconfig | 4 +- arch/x86/configs/openeuler_defconfig | 4 +- drivers/net/ethernet/Kconfig | 1 + drivers/net/ethernet/Makefile | 1 + drivers/net/ethernet/motorcomm/Kconfig | 27 + drivers/net/ethernet/motorcomm/Makefile | 6 + .../net/ethernet/motorcomm/yt6801/Makefile | 8 + .../ethernet/motorcomm/yt6801/yt6801_desc.c | 565 +++ .../ethernet/motorcomm/yt6801/yt6801_desc.h | 35 + .../ethernet/motorcomm/yt6801/yt6801_main.c | 3020 +++++++++++++++++ .../ethernet/motorcomm/yt6801/yt6801_type.h | 957 ++++++ drivers/net/phy/motorcomm.c | 6 + 16 files changed, 4648 insertions(+), 4 deletions(-) create mode 100644 drivers/net/ethernet/motorcomm/Kconfig create mode 100644 drivers/net/ethernet/motorcomm/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.h create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_type.h -- 2.34.1

1 14

[openeuler:OLK-6.6 2117/2117] kernel/sched/fair.c:8988:1: sparse: sparse: symbol 'qos_smt_expell_switch' was not declared. Should it be static?
by kernel test robot 11 Apr '25

11 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 62b846e657553d00552c1c71b6ecc26017eb1a9a commit: a62d532da0b51fe39f726c4c08f3debc8b3bc5d7 [2117/2117] sched/fair: Add cmdline nosmtexpell config: loongarch-randconfig-r121-20250411 (https://download.01.org/0day-ci/archive/20250411/202504111549.QczZh25x-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250411/202504111549.QczZh25x-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504111549.QczZh25x-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/sched/fair.c:7727:9: sparse: got int [noderef] __percpu * kernel/sched/fair.c:7727:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:7727:9: sparse: expected void *ptr kernel/sched/fair.c:7727:9: sparse: got int [noderef] __percpu * kernel/sched/fair.c:7727:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:7727:9: sparse: expected void *ptr kernel/sched/fair.c:7727:9: sparse: got int [noderef] __percpu * kernel/sched/fair.c:1284:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_entity const *se @@ got struct sched_entity [noderef] __rcu * @@ kernel/sched/fair.c:1284:34: sparse: expected struct sched_entity const *se kernel/sched/fair.c:1284:34: sparse: got struct sched_entity [noderef] __rcu * kernel/sched/fair.c:13325:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:13325:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:13325:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:5162:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:5162:25: sparse: struct sparsemask [noderef] __rcu * kernel/sched/fair.c:5162:25: sparse: struct sparsemask * kernel/sched/fair.c:5179:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:5179:25: sparse: struct sparsemask [noderef] __rcu * kernel/sched/fair.c:5179:25: sparse: struct sparsemask * kernel/sched/fair.c:13681:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:13681:25: sparse: struct sparsemask [noderef] __rcu * kernel/sched/fair.c:13681:25: sparse: struct sparsemask * kernel/sched/fair.c:6038:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:6038:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:6038:22: sparse: struct task_struct * kernel/sched/fair.c:6780:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:6780:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:6780:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:7531:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7531:32: sparse: expected void *ptr kernel/sched/fair.c:7531:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7531:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7531:32: sparse: expected void *ptr kernel/sched/fair.c:7531:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7531:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7531:32: sparse: expected void *ptr kernel/sched/fair.c:7531:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7531:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7531:32: sparse: expected void *ptr kernel/sched/fair.c:7531:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7634:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7634:16: sparse: expected void *ptr kernel/sched/fair.c:7634:16: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7634:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7634:16: sparse: expected void *ptr kernel/sched/fair.c:7634:16: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7634:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7634:16: sparse: expected void *ptr kernel/sched/fair.c:7634:16: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7634:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7634:16: sparse: expected void *ptr kernel/sched/fair.c:7634:16: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:8139:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:8139:32: sparse: expected void *ptr kernel/sched/fair.c:8139:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:8139:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:8139:32: sparse: expected void *ptr kernel/sched/fair.c:8139:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:8139:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:8139:32: sparse: expected void *ptr kernel/sched/fair.c:8139:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:8139:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:8139:32: sparse: expected void *ptr kernel/sched/fair.c:8139:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:8163:20: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:8163:20: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:8163:20: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8478:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:8478:9: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/fair.c:8478:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8590:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8590:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8590:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:8910:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8910:16: sparse: expected void *ptr kernel/sched/fair.c:8910:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8910:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8910:16: sparse: expected void *ptr kernel/sched/fair.c:8910:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8910:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8910:16: sparse: expected void *ptr kernel/sched/fair.c:8910:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8910:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8910:16: sparse: expected void *ptr kernel/sched/fair.c:8910:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8936:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:8936:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:8936:22: sparse: struct task_struct * kernel/sched/fair.c:8972:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8972:13: sparse: expected void *ptr kernel/sched/fair.c:8972:13: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8972:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8972:13: sparse: expected void *ptr kernel/sched/fair.c:8972:13: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8972:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8972:13: sparse: expected void *ptr kernel/sched/fair.c:8972:13: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8972:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8972:13: sparse: expected void *ptr kernel/sched/fair.c:8972:13: sparse: got int [noderef] __percpu * >> kernel/sched/fair.c:8988:1: sparse: sparse: symbol 'qos_smt_expell_switch' was not declared. Should it be static? kernel/sched/fair.c:9122:51: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct task_struct *sibling_p @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:9122:51: sparse: expected struct task_struct *sibling_p kernel/sched/fair.c:9122:51: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:9127:30: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:9127:30: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:9127:30: sparse: struct task_struct * kernel/sched/fair.c:9205:48: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct task_struct *p @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:9454:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:10525:40: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *child @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:11162:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:11162:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:11162:22: sparse: struct task_struct * kernel/sched/fair.c:12603:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12603:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12603:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:12187:36: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:12187:36: sparse: expected void *ptr kernel/sched/fair.c:12187:36: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:12187:36: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:12187:36: sparse: expected void *ptr kernel/sched/fair.c:12187:36: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:12187:36: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:12187:36: sparse: expected void *ptr kernel/sched/fair.c:12187:36: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:12187:36: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:12187:36: sparse: expected void *ptr kernel/sched/fair.c:12187:36: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:12260:44: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *sd_parent @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12260:44: sparse: expected struct sched_domain *sd_parent kernel/sched/fair.c:12260:44: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:12264:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:12264:32: sparse: expected void *ptr kernel/sched/fair.c:12264:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:12264:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:12264:32: sparse: expected void *ptr kernel/sched/fair.c:12264:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:12264:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:12264:32: sparse: expected void *ptr kernel/sched/fair.c:12264:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:12264:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:12264:32: sparse: expected void *ptr kernel/sched/fair.c:12264:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:12699:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12699:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12699:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c: note: in included file: kernel/sched/sched.h:2182:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2182:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2182:25: sparse: struct task_struct * kernel/sched/sched.h:2346:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2346:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2346:9: sparse: struct task_struct * kernel/sched/sched.h:2346:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2346:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2346:9: sparse: struct task_struct * kernel/sched/sched.h:2182:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2182:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2182:25: sparse: struct task_struct * kernel/sched/sched.h:2182:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2182:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2182:25: sparse: struct task_struct * vim +/qos_smt_expell_switch +8988 kernel/sched/fair.c 8986 8987 #ifdef CONFIG_QOS_SCHED_SMT_EXPELLER > 8988 DEFINE_STATIC_KEY_TRUE(qos_smt_expell_switch); 8989 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] proc: fix UAF in proc_get_inode()
by Yongjian Sun 11 Apr '25

11 Apr '25

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v6.14-rc6 commit 654b33ada4ab5e926cd9c570196fefa7bec7c1df category: bugfix bugzilla: 190521 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix race between rmmod and /proc/XXX's inode instantiation. The bug is that pde->proc_ops don't belong to /proc, it belongs to a module, therefore dereferencing it after /proc entry has been registered is a bug unless use_pde/unuse_pde() pair has been used. use_pde/unuse_pde can be avoided (2 atomic ops!) because pde->proc_ops never changes so information necessary for inode instantiation can be saved _before_ proc_register() in PDE itself and used later, avoiding pde->proc_ops->... dereference. rmmod lookup sys_delete_module proc_lookup_de pde_get(de); proc_get_inode(dir->i_sb, de); mod->exit() proc_remove remove_proc_subtree proc_entry_rundown(de); free_module(mod); if (S_ISREG(inode->i_mode)) if (de->proc_ops->proc_read_iter) --> As module is already freed, will trigger UAF BUG: unable to handle page fault for address: fffffbfff80a702b PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:proc_get_inode+0x302/0x6e0 RSP: 0018:ffff88811c837998 EFLAGS: 00010a06 RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007 RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158 RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20 R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0 R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001 FS: 00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> proc_lookup_de+0x11f/0x2e0 __lookup_slow+0x188/0x350 walk_component+0x2ab/0x4f0 path_lookupat+0x120/0x660 filename_lookup+0x1ce/0x560 vfs_statx+0xac/0x150 __do_sys_newstat+0x96/0x110 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e [adobriyan(a)gmail.com: don't do 2 atomic ops on the common path] Link: https://lkml.kernel.org/r/3d25ded0-1739-447e-812b-e34da7990dcf@p183 Fixes: 778f3dd5a13c ("Fix procfs compat_ioctl regression") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Signed-off-by: Alexey Dobriyan <adobriyan(a)gmail.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: David S. Miller <davem(a)davemloft.net> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akipm(a)linux-foundation.org> Conflicts: fs/proc/internal.h [ef1d61781bc67 not applied] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/proc/generic.c | 10 +++++++++- fs/proc/inode.c | 6 +++--- fs/proc/internal.h | 14 ++++++++++++++ include/linux/proc_fs.h | 7 +++++-- 4 files changed, 31 insertions(+), 6 deletions(-) diff --git a/fs/proc/generic.c b/fs/proc/generic.c index 5898761698c2..7b6d9c77b425 100644 --- a/fs/proc/generic.c +++ b/fs/proc/generic.c @@ -563,10 +563,16 @@ struct proc_dir_entry *proc_create_reg(const char *name, umode_t mode, return p; } -static inline void pde_set_flags(struct proc_dir_entry *pde) +static void pde_set_flags(struct proc_dir_entry *pde) { if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT) pde->flags |= PROC_ENTRY_PERMANENT; + if (pde->proc_ops->proc_read_iter) + pde->flags |= PROC_ENTRY_proc_read_iter; +#ifdef CONFIG_COMPAT + if (pde->proc_ops->proc_compat_ioctl) + pde->flags |= PROC_ENTRY_proc_compat_ioctl; +#endif } struct proc_dir_entry *proc_create_data(const char *name, umode_t mode, @@ -630,6 +636,7 @@ struct proc_dir_entry *proc_create_seq_private(const char *name, umode_t mode, p->proc_ops = &proc_seq_ops; p->seq_ops = ops; p->state_size = state_size; + pde_set_flags(p); return proc_register(parent, p); } EXPORT_SYMBOL(proc_create_seq_private); @@ -660,6 +667,7 @@ struct proc_dir_entry *proc_create_single_data(const char *name, umode_t mode, return NULL; p->proc_ops = &proc_single_ops; p->single_show = show; + pde_set_flags(p); return proc_register(parent, p); } EXPORT_SYMBOL(proc_create_single_data); diff --git a/fs/proc/inode.c b/fs/proc/inode.c index bde6b6f69852..ba35ffc426ea 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -684,13 +684,13 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) if (S_ISREG(inode->i_mode)) { inode->i_op = de->proc_iops; - if (de->proc_ops->proc_read_iter) + if (pde_has_proc_read_iter(de)) inode->i_fop = &proc_iter_file_ops; else inode->i_fop = &proc_reg_file_ops; #ifdef CONFIG_COMPAT - if (de->proc_ops->proc_compat_ioctl) { - if (de->proc_ops->proc_read_iter) + if (pde_has_proc_compat_ioctl(de)) { + if (pde_has_proc_read_iter(de)) inode->i_fop = &proc_iter_file_ops_compat; else inode->i_fop = &proc_reg_file_ops_compat; diff --git a/fs/proc/internal.h b/fs/proc/internal.h index 104945bbeb9f..c75d0db70a85 100644 --- a/fs/proc/internal.h +++ b/fs/proc/internal.h @@ -79,6 +79,20 @@ static inline bool pde_is_permanent(const struct proc_dir_entry *pde) return pde->flags & PROC_ENTRY_PERMANENT; } +static inline bool pde_has_proc_read_iter(const struct proc_dir_entry *pde) +{ + return pde->flags & PROC_ENTRY_proc_read_iter; +} + +static inline bool pde_has_proc_compat_ioctl(const struct proc_dir_entry *pde) +{ +#ifdef CONFIG_COMPAT + return pde->flags & PROC_ENTRY_proc_compat_ioctl; +#else + return false; +#endif +} + extern struct kmem_cache *proc_dir_entry_cache; void pde_free(struct proc_dir_entry *pde); diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h index 8c892730a1f1..9f8e0072b30f 100644 --- a/include/linux/proc_fs.h +++ b/include/linux/proc_fs.h @@ -20,10 +20,13 @@ enum { * If in doubt, ignore this flag. */ #ifdef MODULE - PROC_ENTRY_PERMANENT = 0U, + PROC_ENTRY_PERMANENT = 0U, #else - PROC_ENTRY_PERMANENT = 1U << 0, + PROC_ENTRY_PERMANENT = 1U << 0, #endif + + PROC_ENTRY_proc_read_iter = 1U << 1, + PROC_ENTRY_proc_compat_ioctl = 1U << 2, }; struct proc_ops { -- 2.39.2

2 1

[PATCH OLK-6.6 v7 0/7] Add support for IPIv
by Jinqian Yang 11 Apr '25

11 Apr '25

Patch#1 Allocate VM table and save vpeid in it Patch#2 avoid sending multi-SGIs in IPIV Patch#3 Set base address of vm table and targe ITS when vpe schedule and deschedule Patch#4 Register ipiv exception interrupt Patch#5 Add interface KVM_CAP_ARM_IPIV_MODE Patch#6 Probe and configure IPIV capacity on HIP12 Patch#7 Use KABI_EXTEND to perform kabi repair for IPIV Jinqian Yang (2): KVM: arm64: avoid sending multi-SGIs in IPIV kabi: Use KABI_EXTEND to perform kabi repair for IPIV Xiang Chen (5): kvm: hisi_virt: Allocate VM table and save vpeid in it irqchip: gicv3-its: Set base address of vm table and targe ITS when vpe schedule and deschedule kvm: hisi_virt: Register ipiv exception interrupt kvm: arm64: Add interface KVM_CAP_ARM_IPIV_MODE kvm: hisi_virt: Probe and configure IPIV capacity on HIP12 .../admin-guide/kernel-parameters.txt | 3 + arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/include/asm/sysreg.h | 3 + arch/arm64/kvm/arm.c | 16 ++++ arch/arm64/kvm/hisilicon/hisi_virt.c | 38 ++++++++ arch/arm64/kvm/hisilicon/hisi_virt.h | 11 +++ arch/arm64/kvm/sys_regs.c | 30 ++++-- arch/arm64/kvm/vgic/vgic-init.c | 44 ++++++++- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 + drivers/irqchip/irq-gic-v3-its.c | 93 ++++++++++++++++++- drivers/irqchip/irq-gic-v3.c | 33 +++++++ include/linux/irqchip/arm-gic-v3.h | 24 +++++ include/linux/irqchip/arm-gic-v4.h | 2 + include/uapi/linux/kvm.h | 2 + 14 files changed, 288 insertions(+), 14 deletions(-) -- 2.33.0

3 9

[openeuler:OLK-6.6 2117/2117] kernel/sched/fair.c:9005:51: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 11 Apr '25

11 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 62b846e657553d00552c1c71b6ecc26017eb1a9a commit: c52c17a85f1fa9cde2bcb15359096634cfd9eb7c [2117/2117] sched: Add tracepoint for qos smt expeller config: loongarch-randconfig-r121-20250411 (https://download.01.org/0day-ci/archive/20250411/202504111253.jKd4DxgW-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250411/202504111253.jKd4DxgW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504111253.jKd4DxgW-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/sched/fair.c:7685:9: sparse: got int [noderef] __percpu * kernel/sched/fair.c:7685:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:7685:9: sparse: expected void *ptr kernel/sched/fair.c:7685:9: sparse: got int [noderef] __percpu * kernel/sched/fair.c:7685:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:7685:9: sparse: expected void *ptr kernel/sched/fair.c:7685:9: sparse: got int [noderef] __percpu * kernel/sched/fair.c:1283:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_entity const *se @@ got struct sched_entity [noderef] __rcu * @@ kernel/sched/fair.c:1283:34: sparse: expected struct sched_entity const *se kernel/sched/fair.c:1283:34: sparse: got struct sched_entity [noderef] __rcu * kernel/sched/fair.c:13203:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:13203:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:13203:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:5161:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:5161:25: sparse: struct sparsemask [noderef] __rcu * kernel/sched/fair.c:5161:25: sparse: struct sparsemask * kernel/sched/fair.c:5178:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:5178:25: sparse: struct sparsemask [noderef] __rcu * kernel/sched/fair.c:5178:25: sparse: struct sparsemask * kernel/sched/fair.c:13559:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:13559:25: sparse: struct sparsemask [noderef] __rcu * kernel/sched/fair.c:13559:25: sparse: struct sparsemask * kernel/sched/fair.c:6012:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:6012:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:6012:22: sparse: struct task_struct * kernel/sched/fair.c:6754:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:6754:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:6754:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:7489:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7489:32: sparse: expected void *ptr kernel/sched/fair.c:7489:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7489:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7489:32: sparse: expected void *ptr kernel/sched/fair.c:7489:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7489:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7489:32: sparse: expected void *ptr kernel/sched/fair.c:7489:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7489:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7489:32: sparse: expected void *ptr kernel/sched/fair.c:7489:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7592:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7592:16: sparse: expected void *ptr kernel/sched/fair.c:7592:16: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7592:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7592:16: sparse: expected void *ptr kernel/sched/fair.c:7592:16: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7592:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7592:16: sparse: expected void *ptr kernel/sched/fair.c:7592:16: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7592:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7592:16: sparse: expected void *ptr kernel/sched/fair.c:7592:16: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:8097:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:8097:32: sparse: expected void *ptr kernel/sched/fair.c:8097:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:8097:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:8097:32: sparse: expected void *ptr kernel/sched/fair.c:8097:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:8097:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:8097:32: sparse: expected void *ptr kernel/sched/fair.c:8097:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:8097:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:8097:32: sparse: expected void *ptr kernel/sched/fair.c:8097:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:8121:20: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:8121:20: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:8121:20: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8436:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:8436:9: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/fair.c:8436:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8548:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8548:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8548:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:8774:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:8774:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:8774:22: sparse: struct task_struct * kernel/sched/fair.c:8839:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8839:16: sparse: expected void *ptr kernel/sched/fair.c:8839:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8839:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8839:16: sparse: expected void *ptr kernel/sched/fair.c:8839:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8839:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8839:16: sparse: expected void *ptr kernel/sched/fair.c:8839:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8839:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8839:16: sparse: expected void *ptr kernel/sched/fair.c:8839:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8896:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8896:13: sparse: expected void *ptr kernel/sched/fair.c:8896:13: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8896:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8896:13: sparse: expected void *ptr kernel/sched/fair.c:8896:13: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8896:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8896:13: sparse: expected void *ptr kernel/sched/fair.c:8896:13: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8896:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8896:13: sparse: expected void *ptr kernel/sched/fair.c:8896:13: sparse: got int [noderef] __percpu * >> kernel/sched/fair.c:9005:51: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct task_struct *sibling_p @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:9005:51: sparse: expected struct task_struct *sibling_p kernel/sched/fair.c:9005:51: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:9010:30: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:9010:30: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:9010:30: sparse: struct task_struct * kernel/sched/fair.c:9084:48: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct task_struct *p @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:9332:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:10403:40: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *child @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:11040:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:11040:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:11040:22: sparse: struct task_struct * kernel/sched/fair.c:12481:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12481:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12481:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:12065:36: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:12065:36: sparse: expected void *ptr kernel/sched/fair.c:12065:36: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:12065:36: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:12065:36: sparse: expected void *ptr kernel/sched/fair.c:12065:36: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:12065:36: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:12065:36: sparse: expected void *ptr kernel/sched/fair.c:12065:36: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:12065:36: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:12065:36: sparse: expected void *ptr kernel/sched/fair.c:12065:36: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:12138:44: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *sd_parent @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12138:44: sparse: expected struct sched_domain *sd_parent kernel/sched/fair.c:12138:44: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:12142:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:12142:32: sparse: expected void *ptr kernel/sched/fair.c:12142:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:12142:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:12142:32: sparse: expected void *ptr kernel/sched/fair.c:12142:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:12142:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:12142:32: sparse: expected void *ptr kernel/sched/fair.c:12142:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:12142:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:12142:32: sparse: expected void *ptr kernel/sched/fair.c:12142:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:12577:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12577:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12577:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c: note: in included file: kernel/sched/sched.h:2174:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2174:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2174:25: sparse: struct task_struct * kernel/sched/sched.h:2338:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2338:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2338:9: sparse: struct task_struct * kernel/sched/sched.h:2338:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2338:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2338:9: sparse: struct task_struct * kernel/sched/sched.h:2174:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2174:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2174:25: sparse: struct task_struct * kernel/sched/sched.h:2174:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2174:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2174:25: sparse: struct task_struct * vim +9005 kernel/sched/fair.c 8984 8985 static bool _qos_smt_check_need_resched(int this_cpu, struct rq *rq) 8986 { 8987 int cpu; 8988 8989 if (!sched_smt_active()) 8990 return false; 8991 8992 for_each_cpu(cpu, cpu_smt_mask(this_cpu)) { 8993 if (cpu == this_cpu) 8994 continue; 8995 8996 /* 8997 * There are two cases rely on the set need_resched to drive away 8998 * offline task： 8999 * a) The qos_smt_status of siblings cpu is online, the task of curr cpu is offline; 9000 * b) The qos_smt_status of siblings cpu is offline, the task of curr cpu is idle, 9001 * and current cpu only has SCHED_IDLE tasks enqueued. 9002 */ 9003 if (per_cpu(qos_smt_status, cpu) == QOS_LEVEL_ONLINE && 9004 task_group(current)->qos_level < QOS_LEVEL_ONLINE) { > 9005 trace_sched_qos_smt_expel(cpu_curr(cpu), per_cpu(qos_smt_status, cpu)); 9006 return true; 9007 } 9008 9009 if (per_cpu(qos_smt_status, cpu) == QOS_LEVEL_OFFLINE && 9010 rq->curr == rq->idle && sched_idle_cpu(this_cpu)) { 9011 trace_sched_qos_smt_expel(cpu_curr(cpu), per_cpu(qos_smt_status, cpu)); 9012 return true; 9013 } 9014 } 9015 9016 return false; 9017 } 9018 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 62b846e657553d00552c1c71b6ecc26017eb1a9a
by kernel test robot 11 Apr '25

11 Apr '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 62b846e657553d00552c1c71b6ecc26017eb1a9a !15611 Minimize xa_node allocation during xarry split Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503151158.xNxBbX1r-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503182233.88LCSaAj-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503200858.XSvAPfQM-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503201027.i8HE43EJ-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503220823.mG13Rroz-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503220924.Uw2cwpZV-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503231106.ZSS1yt6E-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503231154.d6j01UpO-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503280313.olFyEFIT-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503290855.eVbc4pVd-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202504012026.kzT6d2HZ-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202504101403.RKyoTq9Z-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202504101645.mRh7GNFb-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202504110226.FM6zQ8DE-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202504110741.FCO7H6rm-lkp@intel.com https://lore.kernel.org/oe-kbuild/202503271832.WycjTkRa-lkp@intel.com aarch64-linux-ld: Unexpected GOT/PLT entries detected! aarch64-linux-ld: Unexpected run-time procedure linkages detected! arch/arm64/kvm/virtcca_cvm.c:819:5: warning: no previous prototype for function 'virtcca_get_tmi_version' [-Wmissing-prototypes] arch/loongarch/mm/cache.c:69:29: warning: variable 'way_size' set but not used [-Wunused-but-set-variable] clang: warning: -Wl,-soname=linux-ilp32-vdso.so.1: 'linker' input unused [-Wunused-command-line-argument] drivers/coda/coda_pci.c:228: warning: Excess function parameter 'pdev' description in 'virtcca_pci_get_rom_size' drivers/coda/coda_pci.c:228: warning: Function parameter or member 'p' not described in 'virtcca_pci_get_rom_size' drivers/scsi/linkdata/ps3stor/./linux/ps3_base.c:545:5: error: no previous prototype for 'ps3_pci_init' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_base.c:899:5: error: no previous prototype for 'ps3_pci_init_complete' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_base.c:945:6: error: no previous prototype for 'ps3_pci_init_complete_exit' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_cli.c:108:9: error: function 'ps3stor_cli_printf' might be a candidate for 'gnu_printf' format attribute [-Werror=suggest-attribute=format] drivers/scsi/linkdata/ps3stor/./linux/ps3_cli_debug.c:1059:5: error: no previous prototype for 'ps3_dump_context_show' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_dump.c:159:5: error: no previous prototype for 'ps3_dump_file_write' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_dump.c:200:5: error: no previous prototype for 'ps3_dump_file_close' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_dump.c:28:5: error: no previous prototype for 'ps3_dump_local_time' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_dump.c:50:5: error: no previous prototype for 'ps3_dump_filename_build' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_dump.c:76:5: error: no previous prototype for 'ps3_dump_file_open' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_cmd_complete.c:131:6: error: no previous prototype for 'ps3_trigger_irq_poll' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_cmd_complete.c:243:5: error: no previous prototype for 'ps3_resp_status_convert' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_cmd_statistics.c:403:6: error: no previous prototype for 'ps3_io_recv_ok_stat_inc' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_cmd_statistics.c:85:6: error: no previous prototype for 'ps3_cmd_stat_content_clear' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_debug.c:883:5: error: no previous prototype for 'ps3_dump_dir_length' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_device_manager.c:1581:5: error: no previous prototype for 'ps3_scsi_private_init_pd' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_device_manager.c:1663:5: error: no previous prototype for 'ps3_scsi_private_init_vd' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_device_manager_sas.c:1632:5: error: no previous prototype for 'ps3_sas_expander_phys_refresh' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_instance_manager.c:669:60: error: 'snprintf' output may be truncated before the last format character [-Werror=format-truncation=] drivers/scsi/linkdata/ps3stor/ps3_ioc_adp.c:147:6: error: no previous prototype for 'ps3_ioc_resource_prepare_hba' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_ioc_adp.c:36:6: error: no previous prototype for 'ps3_ioc_resource_prepare_switch' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_ioc_adp.c:88:6: error: no previous prototype for 'ps3_ioc_resource_prepare_raid' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_ioc_manager.c:307:5: error: no previous prototype for 'ps3_hard_reset_to_ready' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_ioctl.c:785:6: error: no previous prototype for 'ps3_clean_mgr_cmd' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_irq.c:21:27: error: 'PS3_INTERRUPT_CMD_DISABLE_ALL_MASK' defined but not used [-Werror=unused-const-variable=] drivers/scsi/linkdata/ps3stor/ps3_irq.c:22:27: error: 'PS3_INTERRUPT_CMD_ENABLE_MSIX' defined but not used [-Werror=unused-const-variable=] drivers/scsi/linkdata/ps3stor/ps3_irq.c:23:27: error: 'PS3_INTERRUPT_MASK_DISABLE' defined but not used [-Werror=unused-const-variable=] drivers/scsi/linkdata/ps3stor/ps3_irq.c:24:27: error: 'PS3_INTERRUPT_STATUS_EXIST_IRQ' defined but not used [-Werror=unused-const-variable=] drivers/scsi/linkdata/ps3stor/ps3_irq.c:25:27: error: 'PS3_INTERRUPT_CLEAR_IRQ' defined but not used [-Werror=unused-const-variable=] drivers/scsi/linkdata/ps3stor/ps3_irq.c:27:27: error: 'PS3_SSD_IOPS_MSIX_VECTORS' defined but not used [-Werror=unused-const-variable=] drivers/scsi/linkdata/ps3stor/ps3_irq.c:28:27: error: 'PS3_HDD_IOPS_MSIX_VECTORS' defined but not used [-Werror=unused-const-variable=] drivers/scsi/linkdata/ps3stor/ps3_module_para.c:609:14: error: no previous prototype for 'ps3_cli_ver_query' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:1058:6: error: no previous prototype for 'ps3_qos_pd_waitq_ratio_update' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2019:15: error: no previous prototype for 'ps3_hba_qos_decision' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2040:6: error: no previous prototype for 'ps3_hba_qos_waitq_notify' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2100:6: error: no previous prototype for 'ps3_cmd_waitq_abort' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:211:1: error: no previous prototype for 'ps3_qos_cmd_waitq_get' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2463:6: error: no previous prototype for 'ps3_hba_qos_waitq_clear_all' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2827:6: error: no previous prototype for 'ps3_hba_qos_vd_init' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2936:6: error: no previous prototype for 'ps3_hba_qos_vd_reset' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3023:6: error: no previous prototype for 'ps3_hba_qos_waitq_poll' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3279:15: error: no previous prototype for 'ps3_raid_qos_decision' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3334:6: error: no previous prototype for 'ps3_qos_mgrq_resend' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:335:15: error: no previous prototype for 'ps3_qos_vd_cmdword_get' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3478:6: error: no previous prototype for 'ps3_raid_qos_waitq_notify' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:351:15: error: no previous prototype for 'ps3_qos_exclusive_cmdword_get' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:363:15: error: no previous prototype for 'ps3_qos_tg_decision' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3821:15: error: no previous prototype for 'ps3_raid_qos_waitq_abort' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:4022:6: error: no previous prototype for 'ps3_raid_qos_waitq_clear_all' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:4083:6: error: no previous prototype for 'ps3_raid_qos_waitq_poll' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:749:15: error: no previous prototype for 'ps3_qos_all_pd_rc_get' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:876:6: error: no previous prototype for 'ps3_pd_quota_waitq_clear_all' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:892:6: error: no previous prototype for 'ps3_pd_quota_waitq_clean' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:1173:5: error: no previous prototype for 'ps3_range_check_and_insert' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:1231:5: error: no previous prototype for 'ps3_r1x_hash_range_lock' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:1312:6: error: no previous prototype for 'ps3_r1x_hash_range_unlock' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:578:5: error: no previous prototype for 'ps3_r1x_hash_bit_check' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:678:6: error: no previous prototype for 'ps3_r1x_conflict_queue_hash_bit_lock' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:730:5: error: no previous prototype for 'ps3_r1x_hash_bit_lock' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:988:6: error: no previous prototype for 'ps3_r1x_hash_bit_unlock' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_rb_tree.c:154:6: error: no previous prototype for 'rbtDelNodeDo' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:204:6: error: no previous prototype for 'ps3_recovery_irq_queue_destroy' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:2700:6: error: no previous prototype for 'ps3_hard_recovery_state_finish' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:363:5: error: no previous prototype for 'ps3_recovery_state_transfer' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:72:30: error: no previous prototype for 'ps3_recovery_context_alloc' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:82:6: error: no previous prototype for 'ps3_recovery_context_free' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:88:6: error: no previous prototype for 'ps3_recovery_context_delete' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_sas_transport.c:407:5: error: no previous prototype for 'ps3_sas_update_phy_info' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_scsi_cmd_err.c:1110:5: error: no previous prototype for 'ps3_wait_for_outstanding_complete' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_scsi_cmd_err.c:876:6: error: no previous prototype for 'ps3_set_task_manager_busy' [-Werror=missing-prototypes] error: unknown target ABI 'ilp32' kismet: WARNING: unmet direct dependencies detected for ACPI_HOTPLUG_IGNORE_OSC when selected by X86 kismet: WARNING: unmet direct dependencies detected for CRYPTO_DRBG_CTR when selected by CRYPTO_DEV_HISI_TRNG kismet: WARNING: unmet direct dependencies detected for HALTPOLL_CPUIDLE when selected by ARM64 mm/mempolicy.c:3129:26: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] Unverified Error/Warning (likely false positive, kindly check if interested): drivers/hid/hid-thrustmaster.c:178 thrustmaster_interrupts() warn: possible memory leak of 'send_buf' mm/kasan/kasan_test.c:1186 rcu_uaf_reclaim() error: dereferencing freed memory 'fp' (line 1185) mm/oom_kill.c: linux/nmi.h is included more than once. Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-virtcca_get_tmi_version | |-- drivers-coda-coda_pci.c:warning:Excess-function-parameter-pdev-description-in-virtcca_pci_get_rom_size | `-- drivers-coda-coda_pci.c:warning:Function-parameter-or-member-p-not-described-in-virtcca_pci_get_rom_size |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_DRBG_CTR-when-selected-by-CRYPTO_DEV_HISI_TRNG | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-HALTPOLL_CPUIDLE-when-selected-by-ARM64 |-- arm64-randconfig-004-20250410 | |-- aarch64-linux-ld:Unexpected-GOT-PLT-entries-detected | `-- aarch64-linux-ld:Unexpected-run-time-procedure-linkages-detected |-- arm64-randconfig-r054-20250411 | |-- clang:warning:Wl-soname-linux-ilp32-vdso.so.:linker-input-unused | `-- error:unknown-target-ABI-ilp32 |-- loongarch-allmodconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-ps3_pci_init | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-ps3_pci_init_complete | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-ps3_pci_init_complete_exit | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli.c:error:function-ps3stor_cli_printf-might-be-a-candidate-for-gnu_printf-format-attribute | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-ps3_dump_context_show | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_file_close | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_file_open | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_file_write | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_filename_build | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_local_time | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-ps3_resp_status_convert | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-ps3_trigger_irq_poll | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-ps3_cmd_stat_content_clear | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-ps3_io_recv_ok_stat_inc | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-ps3_dump_dir_length | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-ps3_scsi_private_init_pd | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-ps3_scsi_private_init_vd | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-ps3_sas_expander_phys_refresh | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.c:error:snprintf-output-may-be-truncated-before-the-last-format-character | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-ps3_ioc_resource_prepare_hba | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-ps3_ioc_resource_prepare_raid | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-ps3_ioc_resource_prepare_switch | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-ps3_hard_reset_to_ready | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-ps3_clean_mgr_cmd | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_HDD_IOPS_MSIX_VECTORS-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_CLEAR_IRQ-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_CMD_DISABLE_ALL_MASK-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_CMD_ENABLE_MSIX-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_MASK_DISABLE-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_STATUS_EXIST_IRQ-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_SSD_IOPS_MSIX_VECTORS-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-ps3_cli_ver_query | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_cmd_waitq_abort | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_decision | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_vd_init | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_vd_reset | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_waitq_clear_all | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_waitq_notify | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_waitq_poll | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_pd_quota_waitq_clean | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_pd_quota_waitq_clear_all | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_all_pd_rc_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_cmd_waitq_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_exclusive_cmdword_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_mgrq_resend | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_pd_waitq_ratio_update | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_tg_decision | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_vd_cmdword_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_decision | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_abort | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_clear_all | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_notify | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_poll | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_conflict_queue_hash_bit_lock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_bit_check | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_bit_lock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_bit_unlock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_range_lock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_range_unlock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_range_check_and_insert | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-rbtDelNodeDo | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_hard_recovery_state_finish | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_context_alloc | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_context_delete | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_context_free | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_irq_queue_destroy | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_state_transfer | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-ps3_sas_update_phy_info | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-ps3_set_task_manager_busy | `-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-ps3_wait_for_outstanding_complete |-- loongarch-allnoconfig | `-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used |-- loongarch-allyesconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-ps3_pci_init | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-ps3_pci_init_complete | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-ps3_pci_init_complete_exit | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli.c:error:function-ps3stor_cli_printf-might-be-a-candidate-for-gnu_printf-format-attribute | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-ps3_dump_context_show | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_file_close | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_file_open | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_file_write | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_filename_build | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_local_time | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-ps3_resp_status_convert | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-ps3_trigger_irq_poll | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-ps3_cmd_stat_content_clear | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-ps3_io_recv_ok_stat_inc | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-ps3_dump_dir_length | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-ps3_scsi_private_init_pd | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-ps3_scsi_private_init_vd | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-ps3_sas_expander_phys_refresh | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.c:error:snprintf-output-may-be-truncated-before-the-last-format-character | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-ps3_ioc_resource_prepare_hba | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-ps3_ioc_resource_prepare_raid | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-ps3_ioc_resource_prepare_switch | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-ps3_hard_reset_to_ready | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-ps3_clean_mgr_cmd | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_HDD_IOPS_MSIX_VECTORS-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_CLEAR_IRQ-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_CMD_DISABLE_ALL_MASK-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_CMD_ENABLE_MSIX-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_MASK_DISABLE-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_STATUS_EXIST_IRQ-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_SSD_IOPS_MSIX_VECTORS-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-ps3_cli_ver_query | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_cmd_waitq_abort | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_decision | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_vd_init | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_vd_reset | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_waitq_clear_all | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_waitq_notify | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_waitq_poll | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_pd_quota_waitq_clean | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_pd_quota_waitq_clear_all | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_all_pd_rc_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_cmd_waitq_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_exclusive_cmdword_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_mgrq_resend | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_pd_waitq_ratio_update | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_tg_decision | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_vd_cmdword_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_decision | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_abort | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_clear_all | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_notify | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_poll | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_conflict_queue_hash_bit_lock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_bit_check | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_bit_lock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_bit_unlock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_range_lock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_range_unlock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_range_check_and_insert | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-rbtDelNodeDo | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_hard_recovery_state_finish | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_context_alloc | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_context_delete | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_context_free | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_irq_queue_destroy | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_state_transfer | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-ps3_sas_update_phy_info | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-ps3_set_task_manager_busy | `-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-ps3_wait_for_outstanding_complete |-- loongarch-defconfig | `-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used |-- loongarch-randconfig-001-20250410 | `-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used |-- loongarch-randconfig-002-20250410 | `-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used |-- loongarch-randconfig-r121-20250411 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | |-- kernel-sched-fair.c:sparse:sparse:symbol-sysctl_sched_prio_load_balance_enabled-was-not-declared.-Should-it-be-static | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-show_mem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-int-noderef-__percpu |-- loongarch-randconfig-r132-20250411 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | |-- drivers-iommu-loongarch_iommu.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-volatile-noderef-__iomem-addr-got-void-confbase | |-- include-linux-if_caqm.h:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-caqm_hdr_info-got-restricted-__be16-usertype-h_caqm_info | |-- include-linux-if_caqm.h:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-got-restricted-__be16-usertype | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-show_mem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-int-noderef-__percpu |-- x86_64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-ACPI_HOTPLUG_IGNORE_OSC-when-selected-by-X86 | `-- mm-oom_kill.c:linux-nmi.h-is-included-more-than-once. |-- x86_64-defconfig | `-- mm-mempolicy.c:warning:writing-byte-into-a-region-of-size |-- x86_64-randconfig-161-20250411 | |-- drivers-hid-hid-thrustmaster.c-thrustmaster_interrupts()-warn:possible-memory-leak-of-send_buf | `-- mm-kasan-kasan_test.c-rcu_uaf_reclaim()-error:dereferencing-freed-memory-fp-(line-) `-- x86_64-randconfig-r113-20250410 |-- drivers-crypto-montage-tsse-tsse_dev_drv.c:sparse:sparse:symbol-dev_attr_tsse_image_load-was-not-declared.-Should-it-be-static |-- drivers-crypto-montage-tsse-tsse_ipc.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-got-unsigned-char-usertype-assigned-device_msg_d |-- drivers-crypto-montage-tsse-tsse_ipc_drv.c:sparse:sparse:cast-from-restricted-__le32 |-- drivers-crypto-montage-tsse-tsse_ipc_drv.c:sparse:sparse:cast-removes-address-space-__iomem-of-expression |-- drivers-crypto-montage-tsse-tsse_ipc_drv.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-got-unsigned-char-usertype |-- drivers-crypto-montage-tsse-tsse_ipc_drv.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-msg-got-void-noderef-__iomem-d2h_msg |-- drivers-crypto-montage-tsse-tsse_ipc_drv.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-volatile-noderef-__iomem-got-unsigned-char-usertype-addr |-- drivers-crypto-montage-tsse-tsse_ipc_hash.c:sparse:sparse:symbol-service_handle_table-was-not-declared.-Should-it-be-static `-- drivers-crypto-montage-tsse-tsse_ipc_hash.c:sparse:sparse:symbol-service_info_table-was-not-declared.-Should-it-be-static elapsed time: 1461m configs tested: 21 configs skipped: 123 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250410 clang-21 arm64 randconfig-002-20250410 clang-21 arm64 randconfig-003-20250410 gcc-6.5.0 arm64 randconfig-004-20250410 gcc-8.5.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch defconfig gcc-14.2.0 loongarch randconfig-001-20250410 gcc-12.4.0 loongarch randconfig-002-20250410 gcc-12.4.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250410 clang-20 x86_64 buildonly-randconfig-002-20250410 gcc-12 x86_64 buildonly-randconfig-003-20250410 clang-20 x86_64 buildonly-randconfig-004-20250410 clang-20 x86_64 buildonly-randconfig-005-20250410 clang-20 x86_64 buildonly-randconfig-006-20250410 clang-20 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/5] Support SMT control on arm64
by Yushan Wang 11 Apr '25

11 Apr '25

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBZQQR ---------------------------------------------------------------------- The core CPU control framework supports runtime SMT control which is not yet supported on arm64. Besides the general vulnerabilities concerns we want this runtime control on our arm64 server for: - better single CPU performance in some cases - saving overall power consumption This patchset implements it in the following aspects: - Provides a default topology_is_primary_thread() - support retrieve SMT thread number on OF based system - support retrieve SMT thread number on ACPI based system - select HOTPLUG_SMT for arm64 Tests has been done on our ACPI based arm64 server and on ACPI/OF based QEMU VMs. Yicong Yang (5): Revert "arm64: Kconfig: Enable HOTPLUG_SMT" cpu/SMT: Provide a default topology_is_primary_thread() arch_topology: Support SMT control for OF based system arm64: topology: Support SMT control on ACPI based system arm64: Kconfig: Enable HOTPLUG_SMT arch/arm64/Kconfig | 2 +- arch/arm64/configs/openeuler_defconfig | 1 - arch/arm64/kernel/topology.c | 67 +++++++++++++++++++------- arch/powerpc/include/asm/topology.h | 1 + arch/x86/include/asm/topology.h | 3 +- drivers/base/arch_topology.c | 61 +++++++---------------- include/linux/arch_topology.h | 14 ------ include/linux/topology.h | 24 +++++++++ 8 files changed, 94 insertions(+), 79 deletions(-) -- 2.33.0

2 6

[PATCH openEuler-1.0-LTS] proc: fix UAF in proc_get_inode()
by Yongjian Sun 11 Apr '25

11 Apr '25

mainline inclusion from mainline-v6.12-rc3 commit 654b33ada4ab5e926cd9c570196fefa7bec7c1df category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYOFS CVE: CVE-2025-21999 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix race between rmmod and /proc/XXX's inode instantiation. The bug is that pde->proc_ops don't belong to /proc, it belongs to a module, therefore dereferencing it after /proc entry has been registered is a bug unless use_pde/unuse_pde() pair has been used. use_pde/unuse_pde can be avoided (2 atomic ops!) because pde->proc_ops never changes so information necessary for inode instantiation can be saved _before_ proc_register() in PDE itself and used later, avoiding pde->proc_ops->... dereference. rmmod lookup sys_delete_module proc_lookup_de pde_get(de); proc_get_inode(dir->i_sb, de); mod->exit() proc_remove remove_proc_subtree proc_entry_rundown(de); free_module(mod); if (S_ISREG(inode->i_mode)) if (de->proc_ops->proc_read_iter) --> As module is already freed, will trigger UAF BUG: unable to handle page fault for address: fffffbfff80a702b PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:proc_get_inode+0x302/0x6e0 RSP: 0018:ffff88811c837998 EFLAGS: 00010a06 RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007 RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158 RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20 R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0 R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001 FS: 00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> proc_lookup_de+0x11f/0x2e0 __lookup_slow+0x188/0x350 walk_component+0x2ab/0x4f0 path_lookupat+0x120/0x660 filename_lookup+0x1ce/0x560 vfs_statx+0xac/0x150 __do_sys_newstat+0x96/0x110 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e [adobriyan(a)gmail.com: don't do 2 atomic ops on the common path] Link: https://lkml.kernel.org/r/3d25ded0-1739-447e-812b-e34da7990dcf@p183 Fixes: 778f3dd5a13c ("Fix procfs compat_ioctl regression") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Signed-off-by: Alexey Dobriyan <adobriyan(a)gmail.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: David S. Miller <davem(a)davemloft.net> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/proc/inode.c fs/proc/generic.c fs/proc/internal.h include/linux/proc_fs.h [The pre-patch d919b33dafb3 ("proc: faster open/read/close with "permanent" files") is not imported.] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/proc/inode.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/proc/inode.c b/fs/proc/inode.c index 31bf3bb8ddae..7d225a2b8b2a 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -462,6 +462,14 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) make_empty_dir_inode(inode); return inode; } + + if (!use_pde(de)) { + PROC_I(inode)->pde = NULL; + pde_put(de); + iput(inode); + return NULL; + } + if (de->mode) { inode->i_mode = de->mode; inode->i_uid = de->uid; @@ -486,6 +494,7 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) inode->i_fop = de->proc_fops; } } + unuse_pde(de); } else pde_put(de); return inode; -- 2.39.2

2 1

[PATCH OLK-6.6 00/14] yt6801: Add Motorcomm yt6801 PCIe driver
by Frank Sae 11 Apr '25

11 Apr '25

This series includes adding Motorcomm YT6801 Gigabit ethernet driver and adding yt6801 ethernet driver entry in MAINTAINERS file. YT6801 integrates a YT8531S phy. Frank Sae (14): yt6801: Add support for a pci table in this module yt6801: Implement mdio register yt6801: Implement pci_driver shutdown yt6801: Implement the fxgmac_init function yt6801: Implement the .ndo_open function yt6801: Implement the fxgmac_start function net:phy:motorcomm: Add PHY_INTERFACE_MODE_INTERNAL to support YT6801 yt6801: Implement the fxgmac_hw_init function yt6801: Implement the poll functions yt6801: Implement .ndo_start_xmit function yt6801: Implement some net_device_ops function yt6801: Implement pci_driver suspend and resume yt6801: Add makefile and Kconfig yt6801: Update the Makefile, Kconfig and maintainer for yt6801 MAINTAINERS | 8 + arch/arm64/configs/openeuler_defconfig | 4 +- arch/powerpc/configs/openeuler_defconfig | 4 +- arch/riscv/configs/openeuler_defconfig | 4 +- arch/x86/configs/openeuler_defconfig | 4 +- drivers/net/ethernet/Kconfig | 1 + drivers/net/ethernet/Makefile | 1 + drivers/net/ethernet/motorcomm/Kconfig | 27 + drivers/net/ethernet/motorcomm/Makefile | 6 + .../net/ethernet/motorcomm/yt6801/Makefile | 8 + .../ethernet/motorcomm/yt6801/yt6801_desc.c | 565 +++ .../ethernet/motorcomm/yt6801/yt6801_desc.h | 35 + .../ethernet/motorcomm/yt6801/yt6801_main.c | 3020 +++++++++++++++++ .../ethernet/motorcomm/yt6801/yt6801_type.h | 957 ++++++ drivers/net/phy/motorcomm.c | 6 + 15 files changed, 4646 insertions(+), 4 deletions(-) create mode 100644 drivers/net/ethernet/motorcomm/Kconfig create mode 100644 drivers/net/ethernet/motorcomm/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.h create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_type.h -- 2.34.1

2 15

[openeuler:OLK-6.6 2117/2117] kernel/sched/fair.c:151:14: sparse: sparse: symbol 'sysctl_sched_prio_load_balance_enabled' was not declared. Should it be static?
by kernel test robot 11 Apr '25

11 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 62b846e657553d00552c1c71b6ecc26017eb1a9a commit: 89bf80a4d6d5ba852b9042480e0be23c2c4a628c [2117/2117] sched: Introduce priority load balance for qos scheduler config: loongarch-randconfig-r121-20250411 (https://download.01.org/0day-ci/archive/20250411/202504110741.FCO7H6rm-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250411/202504110741.FCO7H6rm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504110741.FCO7H6rm-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/sched/fair.c:143:14: sparse: sparse: symbol 'sysctl_overload_detect_period' was not declared. Should it be static? kernel/sched/fair.c:144:14: sparse: sparse: symbol 'sysctl_offline_wait_interval' was not declared. Should it be static? >> kernel/sched/fair.c:151:14: sparse: sparse: symbol 'sysctl_sched_prio_load_balance_enabled' was not declared. Should it be static? kernel/sched/fair.c:7578:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ kernel/sched/fair.c:7578:9: sparse: expected void *ptr kernel/sched/fair.c:7578:9: sparse: got unsigned int [noderef] __percpu * kernel/sched/fair.c:7578:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ kernel/sched/fair.c:7578:9: sparse: expected void *ptr kernel/sched/fair.c:7578:9: sparse: got unsigned int [noderef] __percpu * kernel/sched/fair.c:7578:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ kernel/sched/fair.c:7578:9: sparse: expected void *ptr kernel/sched/fair.c:7578:9: sparse: got unsigned int [noderef] __percpu * kernel/sched/fair.c:7578:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ kernel/sched/fair.c:7578:9: sparse: expected void *ptr kernel/sched/fair.c:7578:9: sparse: got unsigned int [noderef] __percpu * kernel/sched/fair.c:7578:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:7578:9: sparse: expected void *ptr kernel/sched/fair.c:7578:9: sparse: got int [noderef] __percpu * kernel/sched/fair.c:7578:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:7578:9: sparse: expected void *ptr kernel/sched/fair.c:7578:9: sparse: got int [noderef] __percpu * kernel/sched/fair.c:7578:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:7578:9: sparse: expected void *ptr kernel/sched/fair.c:7578:9: sparse: got int [noderef] __percpu * kernel/sched/fair.c:7578:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:7578:9: sparse: expected void *ptr kernel/sched/fair.c:7578:9: sparse: got int [noderef] __percpu * kernel/sched/fair.c:1271:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_entity const *se @@ got struct sched_entity [noderef] __rcu * @@ kernel/sched/fair.c:1271:34: sparse: expected struct sched_entity const *se kernel/sched/fair.c:1271:34: sparse: got struct sched_entity [noderef] __rcu * kernel/sched/fair.c:12846:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12846:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12846:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:5925:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:5925:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:5925:22: sparse: struct task_struct * kernel/sched/fair.c:6667:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:6667:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:6667:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:7396:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7396:32: sparse: expected void *ptr kernel/sched/fair.c:7396:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7396:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7396:32: sparse: expected void *ptr kernel/sched/fair.c:7396:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7396:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7396:32: sparse: expected void *ptr kernel/sched/fair.c:7396:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7396:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7396:32: sparse: expected void *ptr kernel/sched/fair.c:7396:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7499:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7499:16: sparse: expected void *ptr kernel/sched/fair.c:7499:16: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7499:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7499:16: sparse: expected void *ptr kernel/sched/fair.c:7499:16: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7499:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7499:16: sparse: expected void *ptr kernel/sched/fair.c:7499:16: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7499:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7499:16: sparse: expected void *ptr kernel/sched/fair.c:7499:16: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7974:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7974:32: sparse: expected void *ptr kernel/sched/fair.c:7974:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7974:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7974:32: sparse: expected void *ptr kernel/sched/fair.c:7974:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7974:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7974:32: sparse: expected void *ptr kernel/sched/fair.c:7974:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7974:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7974:32: sparse: expected void *ptr kernel/sched/fair.c:7974:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7998:20: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:7998:20: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:7998:20: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8310:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:8310:9: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/fair.c:8310:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8421:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8421:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8421:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:8641:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:8641:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:8641:22: sparse: struct task_struct * kernel/sched/fair.c:8706:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8706:16: sparse: expected void *ptr kernel/sched/fair.c:8706:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8706:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8706:16: sparse: expected void *ptr kernel/sched/fair.c:8706:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8706:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8706:16: sparse: expected void *ptr kernel/sched/fair.c:8706:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8706:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8706:16: sparse: expected void *ptr kernel/sched/fair.c:8706:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8763:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8763:13: sparse: expected void *ptr kernel/sched/fair.c:8763:13: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8763:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ vim +/sysctl_sched_prio_load_balance_enabled +151 kernel/sched/fair.c 149 150 #ifdef CONFIG_QOS_SCHED_PRIO_LB > 151 unsigned int sysctl_sched_prio_load_balance_enabled; 152 #endif 153 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2117/2117] drivers/iommu/loongarch_iommu.c:1292:22: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 11 Apr '25

11 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 62b846e657553d00552c1c71b6ecc26017eb1a9a commit: 72fe4978ee346c10869113410da1b61710dd8d8f [2117/2117] LoongArch: add iommu support config: loongarch-randconfig-r132-20250411 (https://download.01.org/0day-ci/archive/20250411/202504110226.FM6zQ8DE-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250411/202504110226.FM6zQ8DE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504110226.FM6zQ8DE-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/iommu/loongarch_iommu.c:108:9: sparse: sparse: symbol 'la_iommu_last_bdf' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:112:5: sparse: sparse: symbol 'loongarch_iommu_disable' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:130:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:130:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:130:15: sparse: got void * drivers/iommu/loongarch_iommu.c:132:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:132:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:132:9: sparse: got void * drivers/iommu/loongarch_iommu.c:135:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:135:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:135:15: sparse: got void * drivers/iommu/loongarch_iommu.c:137:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:137:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:137:9: sparse: got void * drivers/iommu/loongarch_iommu.c:150:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:150:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:150:15: sparse: got void * drivers/iommu/loongarch_iommu.c:152:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:152:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:152:9: sparse: got void * drivers/iommu/loongarch_iommu.c:155:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:155:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:155:15: sparse: got void * drivers/iommu/loongarch_iommu.c:157:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:157:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:157:9: sparse: got void * drivers/iommu/loongarch_iommu.c:160:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:160:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:160:15: sparse: got void * drivers/iommu/loongarch_iommu.c:162:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:162:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:162:9: sparse: got void * drivers/iommu/loongarch_iommu.c:190:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:190:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:190:15: sparse: got void * drivers/iommu/loongarch_iommu.c:193:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:193:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:193:9: sparse: got void * drivers/iommu/loongarch_iommu.c:196:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:196:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:196:15: sparse: got void * drivers/iommu/loongarch_iommu.c:199:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:199:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:199:9: sparse: got void * drivers/iommu/loongarch_iommu.c:206:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:206:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:206:15: sparse: got void * drivers/iommu/loongarch_iommu.c:306:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:306:17: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:306:17: sparse: got void * drivers/iommu/loongarch_iommu.c:310:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:310:17: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:310:17: sparse: got void * drivers/iommu/loongarch_iommu.c:312:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:312:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:312:23: sparse: got void * drivers/iommu/loongarch_iommu.c:314:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:314:17: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:314:17: sparse: got void * drivers/iommu/loongarch_iommu.c:322:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:322:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:322:23: sparse: got void * drivers/iommu/loongarch_iommu.c:325:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:325:17: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:325:17: sparse: got void * drivers/iommu/loongarch_iommu.c:327:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:327:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:327:23: sparse: got void * drivers/iommu/loongarch_iommu.c:329:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:329:17: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:329:17: sparse: got void * drivers/iommu/loongarch_iommu.c:349:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:349:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:349:15: sparse: got void * drivers/iommu/loongarch_iommu.c:352:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:352:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:352:9: sparse: got void * drivers/iommu/loongarch_iommu.c:610:6: sparse: sparse: symbol 'domain_deattach_iommu' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:651:28: sparse: sparse: symbol 'lookup_rlooptable' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:662:24: sparse: sparse: symbol 'find_iommu_by_dev' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:721:21: sparse: sparse: symbol 'la_iommu_probe_device' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:752:19: sparse: sparse: symbol 'get_iommu_info_from_dom' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:794:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:794:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:794:9: sparse: got void * drivers/iommu/loongarch_iommu.c:795:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:795:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:795:9: sparse: got void * drivers/iommu/loongarch_iommu.c:796:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:796:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:796:9: sparse: got void * drivers/iommu/loongarch_iommu.c:1178:24: sparse: sparse: symbol 'la_iommu_ops' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:1197:24: sparse: sparse: symbol 'loongarch_get_iommu_by_devid' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:1215:6: sparse: sparse: symbol 'check_device_compat' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:1259:25: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *confbase @@ got void [noderef] __iomem * @@ drivers/iommu/loongarch_iommu.c:1259:25: sparse: expected void *confbase drivers/iommu/loongarch_iommu.c:1259:25: sparse: got void [noderef] __iomem * >> drivers/iommu/loongarch_iommu.c:1292:22: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void *confbase @@ drivers/iommu/loongarch_iommu.c:1292:22: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:1292:22: sparse: got void *confbase drivers/iommu/loongarch_iommu.c:1319:30: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void *confbase @@ drivers/iommu/loongarch_iommu.c:1319:30: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:1319:30: sparse: got void *confbase drivers/iommu/loongarch_iommu.c:1344:28: sparse: sparse: symbol 'create_rlookup_entry' was not declared. Should it be static? vim +1292 drivers/iommu/loongarch_iommu.c 1223 1224 static int loongarch_iommu_probe(struct pci_dev *pdev, 1225 const struct pci_device_id *ent) 1226 { 1227 int ret = 1; 1228 int bitmap_sz = 0; 1229 int tmp; 1230 bool compat = false; 1231 struct loongarch_iommu *iommu = NULL; 1232 resource_size_t base, size; 1233 1234 iommu = loongarch_get_iommu_by_devid(pdev); 1235 if (iommu == NULL) { 1236 pci_info(pdev, "%s can't find iommu\n", __func__); 1237 return -ENODEV; 1238 } 1239 1240 compat = check_device_compat(pdev); 1241 if (!compat) { 1242 pci_info(pdev, 1243 "%s The iommu driver is not compatible with this device\n", 1244 __func__); 1245 return -ENODEV; 1246 } 1247 1248 iommu->pdev = pdev; 1249 base = pci_resource_start(pdev, 0); 1250 size = pci_resource_len(pdev, 0); 1251 if (!request_mem_region(base, size, "loongarch_iommu")) { 1252 pci_err(pdev, 1253 "%d can't reserve mmio registers base %llx size %llx\n", 1254 __LINE__, base, size); 1255 return -ENOMEM; 1256 } 1257 iommu->confbase_phy = base; 1258 iommu->conf_size = size; 1259 iommu->confbase = ioremap(base, size); 1260 if (iommu->confbase == NULL) { 1261 pci_info(pdev, "%s iommu pci dev bar0 is NULL\n", __func__); 1262 return ret; 1263 } 1264 1265 pr_info("iommu confbase %llx pgtsize %llx\n", 1266 (u64)iommu->confbase, size); 1267 tmp = MAX_DOMAIN_ID / 8; 1268 bitmap_sz = (MAX_DOMAIN_ID % 8) ? (tmp + 1) : tmp; 1269 iommu->domain_bitmap = bitmap_zalloc(bitmap_sz, GFP_KERNEL); 1270 if (iommu->domain_bitmap == NULL) { 1271 pr_err("LA-IOMMU: domain bitmap alloc err bitmap_sz:%d\n", 1272 bitmap_sz); 1273 goto out_err; 1274 } 1275 1276 tmp = MAX_ATTACHED_DEV_ID / 8; 1277 bitmap_sz = (MAX_ATTACHED_DEV_ID % 8) ? (tmp + 1) : tmp; 1278 iommu->devtable_bitmap = bitmap_zalloc(bitmap_sz, GFP_KERNEL); 1279 if (iommu->devtable_bitmap == NULL) { 1280 pr_err("LA-IOMMU: devtable bitmap alloc err bitmap_sz:%d\n", 1281 bitmap_sz); 1282 goto out_err_1; 1283 } 1284 1285 ret = iommu_device_sysfs_add(&iommu->iommu_dev, &pdev->dev, 1286 NULL, "ivhd-%#x", iommu->devid); 1287 iommu_device_register(&iommu->iommu_dev, &la_iommu_ops, NULL); 1288 return 0; 1289 1290 out_err_1: 1291 iommu->pdev = NULL; > 1292 iounmap(iommu->confbase); 1293 iommu->confbase = NULL; 1294 release_mem_region(iommu->confbase_phy, iommu->conf_size); 1295 iommu->confbase_phy = 0; 1296 iommu->conf_size = 0; 1297 kfree(iommu->domain_bitmap); 1298 iommu->domain_bitmap = NULL; 1299 out_err: 1300 return ret; 1301 } 1302 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1578/1578] drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: warning: objtool: missing symbol for section .text.unlikely.
by kernel test robot 11 Apr '25

11 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ac44c6a4925e0772513c3597d420e5705faf482b commit: 206f9c11a8c8b0197da5a26859d96d2ed65f5757 [1578/1578] net: ngbe: Add Netswift Giga NIC driver config: x86_64-buildonly-randconfig-005-20250410 (https://download.01.org/0day-ci/archive/20250411/202504110241.8SiMchEQ-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250411/202504110241.8SiMchEQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504110241.8SiMchEQ-lkp@intel.com/ All warnings (new ones prefixed by >>): | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2542:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2542 | u32 flash_read_dword(struct ngbe_hw *hw, u32 addr) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2551:4: warning: no previous prototype for function 'flash_write_dword' [-Wmissing-prototypes] 2551 | u8 flash_write_dword(struct ngbe_hw *hw, u32 addr, u32 dword) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2551:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2551 | u8 flash_write_dword(struct ngbe_hw *hw, u32 addr, u32 dword) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2567:5: warning: no previous prototype for function 'ngbe_flash_write_cab' [-Wmissing-prototypes] 2567 | int ngbe_flash_write_cab(struct ngbe_hw *hw, u32 addr, u32 value, u16 lan_id) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2567:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2567 | int ngbe_flash_write_cab(struct ngbe_hw *hw, u32 addr, u32 value, u16 lan_id) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2593:5: warning: no previous prototype for function 'ngbe_flash_read_cab' [-Wmissing-prototypes] 2593 | int ngbe_flash_read_cab(struct ngbe_hw *hw, u32 addr, u16 lan_id) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2593:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2593 | int ngbe_flash_read_cab(struct ngbe_hw *hw, u32 addr, u16 lan_id) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2628:5: warning: no previous prototype for function 'ngbe_flash_write_unlock' [-Wmissing-prototypes] 2628 | int ngbe_flash_write_unlock(struct ngbe_hw *hw) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2628:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2628 | int ngbe_flash_write_unlock(struct ngbe_hw *hw) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2651:5: warning: no previous prototype for function 'ngbe_flash_write_lock' [-Wmissing-prototypes] 2651 | int ngbe_flash_write_lock(struct ngbe_hw *hw) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2651:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2651 | int ngbe_flash_write_lock(struct ngbe_hw *hw) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3498:5: warning: no previous prototype for function 'ngbe_get_copper_link_capabilities' [-Wmissing-prototypes] 3498 | s32 ngbe_get_copper_link_capabilities(struct ngbe_hw *hw, | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3498:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3498 | s32 ngbe_get_copper_link_capabilities(struct ngbe_hw *hw, | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3647:5: warning: no previous prototype for function 'ngbe_reset_misc' [-Wmissing-prototypes] 3647 | int ngbe_reset_misc(struct ngbe_hw *hw) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3647:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3647 | int ngbe_reset_misc(struct ngbe_hw *hw) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4124:5: warning: no previous prototype for function 'ngbe_read_ee_hostif_data' [-Wmissing-prototypes] 4124 | s32 ngbe_read_ee_hostif_data(struct ngbe_hw *hw, u16 offset, | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4124:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 4124 | s32 ngbe_read_ee_hostif_data(struct ngbe_hw *hw, u16 offset, | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4339:5: warning: no previous prototype for function 'ngbe_read_ee_hostif_data32' [-Wmissing-prototypes] 4339 | s32 ngbe_read_ee_hostif_data32(struct ngbe_hw *hw, u16 offset, | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4339:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 4339 | s32 ngbe_read_ee_hostif_data32(struct ngbe_hw *hw, u16 offset, | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4405:5: warning: no previous prototype for function 'ngbe_write_ee_hostif_data' [-Wmissing-prototypes] 4405 | s32 ngbe_write_ee_hostif_data(struct ngbe_hw *hw, u16 offset, | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4405:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 4405 | s32 ngbe_write_ee_hostif_data(struct ngbe_hw *hw, u16 offset, | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4466:5: warning: no previous prototype for function 'ngbe_write_ee_hostif_data32' [-Wmissing-prototypes] 4466 | s32 ngbe_write_ee_hostif_data32(struct ngbe_hw *hw, u16 offset, | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4466:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 4466 | s32 ngbe_write_ee_hostif_data32(struct ngbe_hw *hw, u16 offset, | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2883:17: warning: unused variable 'ngbe_emc_temp_data' [-Wunused-const-variable] 2883 | STATIC const u8 ngbe_emc_temp_data[4] = { | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2890:17: warning: unused variable 'ngbe_emc_therm_limit' [-Wunused-const-variable] 2890 | STATIC const u8 ngbe_emc_therm_limit[4] = { | ^~~~~~~~~~~~~~~~~~~~ 26 warnings generated. drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:657: warning: Function parameter or member 'pools' not described in 'ngbe_set_rar' drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:657: warning: Excess function parameter 'vmdq' description in 'ngbe_set_rar' drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:817: warning: Function parameter or member 'vmdq' not described in 'ngbe_add_uc_addr' drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:961: warning: Function parameter or member 'mc_addr' not described in 'ngbe_set_mta' drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:961: warning: Excess function parameter 'hash_value' description in 'ngbe_set_mta' drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:1616: warning: Function parameter or member 'pool' not described in 'ngbe_set_vmdq' drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:1616: warning: Excess function parameter 'vmdq' description in 'ngbe_set_vmdq' drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2904: warning: bad line: (8.1542E-08)N^3 + (-1.6743E-11)N^4 drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2911: warning: Excess function parameter 'data' description in 'ngbe_get_thermal_sensor_data' drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3632: warning: Function parameter or member 'need_restart_AN' not described in 'ngbe_setup_copper_link' drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3632: warning: Excess function parameter 'autoneg_wait_to_complete' description in 'ngbe_setup_copper_link' >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: warning: objtool: missing symbol for section .text.unlikely. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] iommu/arm-smmu-v3: Fix the extra atc tlb flush
by Zhang Zekun 10 Apr '25

10 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBZUQU ------------------------------------------- The tlb invalidation code for smmu pagetable prefetch problem might cause a extra tlb invalidation for atc. Introduce a new interface to avoid this. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 18 ++++++++++-------- drivers/iommu/io-pgtable-arm.c | 3 ++- include/linux/io-pgtable.h | 7 +++++++ 3 files changed, 19 insertions(+), 9 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index cedc1eda7250..9358d42b07c7 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -2281,6 +2281,16 @@ static void arm_smmu_tlb_inv_range_domain(unsigned long iova, size_t size, arm_smmu_atc_inv_domain(smmu_domain, 0, iova, size); } +#ifdef CONFIG_HISILICON_ERRATUM_162100602 +void arm_smmu_tlb_flush_hisilicon_errata(void *cookie, unsigned long iova, size_t granule) +{ + struct arm_smmu_domain *smmu_domain = cookie; + + if (smmu_domain->smmu->options & ARM_SMMU_OPT_SYNC_BATCH) + arm_smmu_tlb_inv_range_domain(iova, granule, granule, true, cookie); +} +#endif + void arm_smmu_tlb_inv_range_asid(unsigned long iova, size_t size, int asid, size_t granule, bool leaf, struct arm_smmu_domain *smmu_domain) @@ -2310,14 +2320,6 @@ static void arm_smmu_tlb_inv_page_nosync(struct iommu_iotlb_gather *gather, static void arm_smmu_tlb_inv_walk(unsigned long iova, size_t size, size_t granule, void *cookie) { -#ifdef CONFIG_HISILICON_ERRATUM_162100602 - struct arm_smmu_domain *smmu_domain = cookie; - - if (!size && smmu_domain->smmu->options & ARM_SMMU_OPT_SYNC_BATCH) { - arm_smmu_tlb_inv_range_domain(iova, granule, granule, true, cookie); - return; - } -#endif arm_smmu_tlb_inv_range_domain(iova, size, granule, false, cookie); } diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c index dc80f2661ff7..a2f11d9db262 100644 --- a/drivers/iommu/io-pgtable-arm.c +++ b/drivers/iommu/io-pgtable-arm.c @@ -366,7 +366,8 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova, __arm_lpae_free_pages(cptep, tblsz, cfg); #ifdef CONFIG_HISILICON_ERRATUM_162100602 if (lvl <= 2) - io_pgtable_tlb_flush_walk(&data->iop, iova, 0, ARM_LPAE_GRANULE(data)); + arm_smmu_tlb_flush_hisilicon_errata(data->iop.cookie, + iova, ARM_LPAE_GRANULE(data)); #endif } else if (!cfg->coherent_walk && !(pte & ARM_LPAE_PTE_SW_SYNC)) { __arm_lpae_sync_pte(ptep, cfg); diff --git a/include/linux/io-pgtable.h b/include/linux/io-pgtable.h index 27b994e42ec4..03b574ef6d14 100644 --- a/include/linux/io-pgtable.h +++ b/include/linux/io-pgtable.h @@ -267,4 +267,11 @@ extern struct io_pgtable_init_fns io_pgtable_arm_64_lpae_s2_init_fns; extern struct io_pgtable_init_fns io_pgtable_arm_v7s_init_fns; extern struct io_pgtable_init_fns io_pgtable_arm_mali_lpae_init_fns; +#ifdef CONFIG_HISILICON_ERRATUM_162100602 +void arm_smmu_tlb_flush_hisilicon_errata(void *cookie, unsigned long iova, size_t granule); +#else +static inline void arm_smmu_tlb_flush_hisilicon_errata(void *cookie, + unsigned long iova, size_t granule) {} +#endif + #endif /* __IO_PGTABLE_H */ -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] ASoC: rt5645: Fix errorenous cleanup order
by Zhao Yipeng 10 Apr '25

10 Apr '25

From: Lin Ma <linma(a)zju.edu.cn> stable inclusion from stable-v4.19.247 commit 0941150100173d4eaf3fe08ff4b16740e7c3026f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6HY CVE: CVE-2022-49493 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- ASoC: rt5645: Fix errorenous cleanup order [ Upstream commit 2def44d3aec59e38d2701c568d65540783f90f2f ] There is a logic error when removing rt5645 device as the function rt5645_i2c_remove() first cancel the &rt5645->jack_detect_work and delete the &rt5645->btn_check_timer latter. However, since the timer handler rt5645_btn_check_callback() will re-queue the jack_detect_work, this cleanup order is buggy. That is, once the del_timer_sync in rt5645_i2c_remove is concurrently run with the rt5645_btn_check_callback, the canceled jack_detect_work will be rescheduled again, leading to possible use-after-free. This patch fix the issue by placing the del_timer_sync function before the cancel_delayed_work_sync. Signed-off-by: Lin Ma <linma(a)zju.edu.cn> Link: https://lore.kernel.org/r/20220516092035.28283-1-linma@zju.edu.cn Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Yipeng <zhaoyipeng5(a)huawei.com> --- sound/soc/codecs/rt5645.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c index 7e3b47eeea04..3fcce5996c2c 100644 --- a/sound/soc/codecs/rt5645.c +++ b/sound/soc/codecs/rt5645.c @@ -4091,9 +4091,14 @@ static int rt5645_i2c_remove(struct i2c_client *i2c) if (i2c->irq) free_irq(i2c->irq, rt5645); + /* + * Since the rt5645_btn_check_callback() can queue jack_detect_work, + * the timer need to be delted first + */ + del_timer_sync(&rt5645->btn_check_timer); + cancel_delayed_work_sync(&rt5645->jack_detect_work); cancel_delayed_work_sync(&rt5645->rcclock_work); - del_timer_sync(&rt5645->btn_check_timer); regulator_bulk_disable(ARRAY_SIZE(rt5645->supplies), rt5645->supplies); -- 2.34.1

2 1

openEuler Kernel SIG双周例会
by openEuler conference 10 Apr '25

10 Apr '25

您好！ Kernel 邀请您参加 2025-04-18 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容：由于4.11日全天openEuler ODD 2025线下活动，原定4.11日下午开始的Kernel SIG双周例会推迟至4.18日下午。议题详见会议看板，并可继续申报。会议链接：https://meeting.huaweicloud.com:36443/#/j/987901819 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2025-04-18 14:00, The subject of the conference is openEuler Kernel SIG双周例会 Summary: 由于4.11日全天openEuler ODD 2025线下活动，原定4.11日下午开始的Kernel SIG双周例会推迟至4.18日下午。议题详见会议看板，并可继续申报。 You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/987901819 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[openeuler:OLK-6.6 2116/2116] drivers/crypto/montage/tsse/tsse_ipc_hash.c:14:1: sparse: sparse: symbol 'service_info_table' was not declared. Should it be static?
by kernel test robot 10 Apr '25

10 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 62b846e657553d00552c1c71b6ecc26017eb1a9a commit: 914854f2adb6988ac3b6521088ec96833d6743e2 [2116/2116] driver: crypto - update support for Mont-TSSE Driver config: x86_64-randconfig-r113-20250410 (https://download.01.org/0day-ci/archive/20250410/202504101645.mRh7GNFb-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) rustc: rustc 1.73.0 (cc66ad468 2023-10-03) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250410/202504101645.mRh7GNFb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504101645.mRh7GNFb-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/crypto/montage/tsse/tsse_ipc_hash.c:14:1: sparse: sparse: symbol 'service_info_table' was not declared. Should it be static? >> drivers/crypto/montage/tsse/tsse_ipc_hash.c:15:1: sparse: sparse: symbol 'service_handle_table' was not declared. Should it be static? -- >> drivers/crypto/montage/tsse/tsse_ipc_drv.c:22:41: sparse: sparse: cast removes address space '__iomem' of expression drivers/crypto/montage/tsse/tsse_ipc_drv.c:42:33: sparse: sparse: cast removes address space '__iomem' of expression >> drivers/crypto/montage/tsse/tsse_ipc_drv.c:42:46: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const volatile [noderef] __iomem * @@ got unsigned char [usertype] * @@ drivers/crypto/montage/tsse/tsse_ipc_drv.c:42:46: sparse: expected void const volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_ipc_drv.c:42:46: sparse: got unsigned char [usertype] * drivers/crypto/montage/tsse/tsse_ipc_drv.c:108:16: sparse: sparse: cast removes address space '__iomem' of expression >> drivers/crypto/montage/tsse/tsse_ipc_drv.c:120:21: sparse: sparse: cast from restricted __le32 >> drivers/crypto/montage/tsse/tsse_ipc_drv.c:124:60: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void *msg @@ got void [noderef] __iomem *d2h_msg @@ drivers/crypto/montage/tsse/tsse_ipc_drv.c:124:60: sparse: expected void *msg drivers/crypto/montage/tsse/tsse_ipc_drv.c:124:60: sparse: got void [noderef] __iomem *d2h_msg >> drivers/crypto/montage/tsse/tsse_ipc_drv.c:136:21: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got unsigned char [usertype] *addr @@ drivers/crypto/montage/tsse/tsse_ipc_drv.c:136:21: sparse: expected void volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_ipc_drv.c:136:21: sparse: got unsigned char [usertype] *addr vim +/service_info_table +14 drivers/crypto/montage/tsse/tsse_ipc_hash.c 13 > 14 DEFINE_HASHTABLE(service_info_table, SERVICE_TABLE_BUCKET_BITS); > 15 DEFINE_HASHTABLE(service_handle_table, SERVICE_TABLE_BUCKET_BITS); 16 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[Cancel] openEuler Kernel SIG双周例会
by openEuler conference 10 Apr '25

10 Apr '25

Sorry! The WeLink meeting will be held at 2025-04-11 14:00 scheduled by Kernel SIG has been cancelled.

1 0

[PATCH OLK-5.10] mt76: fix use-after-free by removing a non-RCU wcid pointer
by Yi Yang 10 Apr '25

10 Apr '25

From: Felix Fietkau <nbd(a)nbd.name> mainline inclusion from mainline-v5.19-rc1 commit 51fb1278aa57ae0fc54adaa786e1965362bed4fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP450 CVE: CVE-2022-49328 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes an issue caught by KASAN about use-after-free in mt76_txq_schedule by protecting mtxq->wcid with rcu_lock between mt76_txq_schedule and sta_info_[alloc, free]. [18853.876689] ================================================================== [18853.876751] BUG: KASAN: use-after-free in mt76_txq_schedule+0x204/0xaf8 [mt76] [18853.876773] Read of size 8 at addr ffffffaf989a2138 by task mt76-tx phy0/883 [18853.876786] [18853.876810] CPU: 5 PID: 883 Comm: mt76-tx phy0 Not tainted 5.10.100-fix-510-56778d365941-kasan #5 0b01fbbcf41a530f52043508fec2e31a4215 [18853.876840] Call trace: [18853.876861] dump_backtrace+0x0/0x3ec [18853.876878] show_stack+0x20/0x2c [18853.876899] dump_stack+0x11c/0x1ac [18853.876918] print_address_description+0x74/0x514 [18853.876934] kasan_report+0x134/0x174 [18853.876948] __asan_report_load8_noabort+0x44/0x50 [18853.876976] mt76_txq_schedule+0x204/0xaf8 [mt76 074e03e4640e97fe7405ee1fab547b81c4fa45d2] [18853.877002] mt76_txq_schedule_all+0x2c/0x48 [mt76 074e03e4640e97fe7405ee1fab547b81c4fa45d2] [18853.877030] mt7921_tx_worker+0xa0/0x1cc [mt7921_common f0875ebac9d7b4754e1010549e7db50fbd90a047] [18853.877054] __mt76_worker_fn+0x190/0x22c [mt76 074e03e4640e97fe7405ee1fab547b81c4fa45d2] [18853.877071] kthread+0x2f8/0x3b8 [18853.877087] ret_from_fork+0x10/0x30 [18853.877098] [18853.877112] Allocated by task 941: [18853.877131] kasan_save_stack+0x38/0x68 [18853.877147] __kasan_kmalloc+0xd4/0xfc [18853.877163] kasan_kmalloc+0x10/0x1c [18853.877177] __kmalloc+0x264/0x3c4 [18853.877294] sta_info_alloc+0x460/0xf88 [mac80211] [18853.877410] ieee80211_prep_connection+0x204/0x1ee0 [mac80211] [18853.877523] ieee80211_mgd_auth+0x6c4/0xa4c [mac80211] [18853.877635] ieee80211_auth+0x20/0x2c [mac80211] [18853.877733] rdev_auth+0x7c/0x438 [cfg80211] [18853.877826] cfg80211_mlme_auth+0x26c/0x390 [cfg80211] [18853.877919] nl80211_authenticate+0x6d4/0x904 [cfg80211] [18853.877938] genl_rcv_msg+0x748/0x93c [18853.877954] netlink_rcv_skb+0x160/0x2a8 [18853.877969] genl_rcv+0x3c/0x54 [18853.877985] netlink_unicast_kernel+0x104/0x1ec [18853.877999] netlink_unicast+0x178/0x268 [18853.878015] netlink_sendmsg+0x3cc/0x5f0 [18853.878030] sock_sendmsg+0xb4/0xd8 [18853.878043] ____sys_sendmsg+0x2f8/0x53c [18853.878058] ___sys_sendmsg+0xe8/0x150 [18853.878071] __sys_sendmsg+0xc4/0x1f4 [18853.878087] __arm64_compat_sys_sendmsg+0x88/0x9c [18853.878101] el0_svc_common+0x1b4/0x390 [18853.878115] do_el0_svc_compat+0x8c/0xdc [18853.878131] el0_svc_compat+0x10/0x1c [18853.878146] el0_sync_compat_handler+0xa8/0xcc [18853.878161] el0_sync_compat+0x188/0x1c0 [18853.878171] [18853.878183] Freed by task 10927: [18853.878200] kasan_save_stack+0x38/0x68 [18853.878215] kasan_set_track+0x28/0x3c [18853.878228] kasan_set_free_info+0x24/0x48 [18853.878244] __kasan_slab_free+0x11c/0x154 [18853.878259] kasan_slab_free+0x14/0x24 [18853.878273] slab_free_freelist_hook+0xac/0x1b0 [18853.878287] kfree+0x104/0x390 [18853.878402] sta_info_free+0x198/0x210 [mac80211] [18853.878515] __sta_info_destroy_part2+0x230/0x2d4 [mac80211] [18853.878628] __sta_info_flush+0x300/0x37c [mac80211] [18853.878740] ieee80211_set_disassoc+0x2cc/0xa7c [mac80211] [18853.878851] ieee80211_mgd_deauth+0x4a4/0x10a0 [mac80211] [18853.878962] ieee80211_deauth+0x20/0x2c [mac80211] [18853.879057] rdev_deauth+0x7c/0x438 [cfg80211] [18853.879150] cfg80211_mlme_deauth+0x274/0x414 [cfg80211] [18853.879243] cfg80211_mlme_down+0xe4/0x118 [cfg80211] [18853.879335] cfg80211_disconnect+0x218/0x2d8 [cfg80211] [18853.879427] __cfg80211_leave+0x17c/0x240 [cfg80211] [18853.879519] cfg80211_leave+0x3c/0x58 [cfg80211] [18853.879611] wiphy_suspend+0xdc/0x200 [cfg80211] [18853.879628] dpm_run_callback+0x58/0x408 [18853.879642] __device_suspend+0x4cc/0x864 [18853.879658] async_suspend+0x34/0xf4 [18853.879673] async_run_entry_fn+0xe0/0x37c [18853.879689] process_one_work+0x508/0xb98 [18853.879702] worker_thread+0x7f4/0xcd4 [18853.879717] kthread+0x2f8/0x3b8 [18853.879731] ret_from_fork+0x10/0x30 [18853.879741] [18853.879757] The buggy address belongs to the object at ffffffaf989a2000 [18853.879757] which belongs to the cache kmalloc-8k of size 8192 [18853.879774] The buggy address is located 312 bytes inside of [18853.879774] 8192-byte region [ffffffaf989a2000, ffffffaf989a4000) [18853.879787] The buggy address belongs to the page: [18853.879807] page:000000004bda2a59 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1d89a0 [18853.879823] head:000000004bda2a59 order:3 compound_mapcount:0 compound_pincount:0 [18853.879839] flags: 0x8000000000010200(slab|head) [18853.879857] raw: 8000000000010200 ffffffffbc89e208 ffffffffb7fb5208 ffffffaec000cc80 [18853.879873] raw: 0000000000000000 0000000000010001 00000001ffffffff 0000000000000000 [18853.879885] page dumped because: kasan: bad access detected [18853.879896] [18853.879907] Memory state around the buggy address: [18853.879922] ffffffaf989a2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [18853.879935] ffffffaf989a2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [18853.879948] >ffffffaf989a2100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [18853.879961] ^ [18853.879973] ffffffaf989a2180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [18853.879986] ffffffaf989a2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [18853.879998] ================================================================== Cc: stable(a)vger.kernel.org Reported-by: Sean Wang <sean.wang(a)mediatek.com> Signed-off-by: Felix Fietkau <nbd(a)nbd.name> Conflicts: drivers/net/wireless/mediatek/mt76/mt7615/main.c [commit d0e274af2f2e ("mt76: mt76_connac: create mcu library") was not merged] drivers/net/wireless/mediatek/mt76/mt76x02_util.c [commit 0335c034e726 ("wifi: mt76: fix race condition related to checking tx queue fill status") was not merged] drivers/net/wireless/mediatek/mt76/mt7915/main.c [commit 8aa2c6f4714e ("mt76: mt7915: support 32 station interfaces") was not merged] drivers/net/wireless/mediatek/mt76/tx.c [commit 57b8b57516c5 ("mt76: check return value of mt76_txq_send_burst in mt76_txq_schedule_list") was not merged] drivers/net/wireless/mediatek/mt76/mt7921/main.c [commit e0f9fdda81bd ("mt76: mt7921: add ieee80211_ops") was not merged] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/net/wireless/mediatek/mt76/mac80211.c | 2 +- drivers/net/wireless/mediatek/mt76/mt76.h | 2 +- drivers/net/wireless/mediatek/mt76/mt7603/main.c | 2 +- drivers/net/wireless/mediatek/mt76/mt7615/main.c | 2 +- drivers/net/wireless/mediatek/mt76/mt76x02_util.c | 4 +++- drivers/net/wireless/mediatek/mt76/mt7915/main.c | 2 +- drivers/net/wireless/mediatek/mt76/tx.c | 9 ++++----- 7 files changed, 12 insertions(+), 11 deletions(-) diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c index dc1191aa0443..dc1351f2a04c 100644 --- a/drivers/net/wireless/mediatek/mt76/mac80211.c +++ b/drivers/net/wireless/mediatek/mt76/mac80211.c @@ -987,7 +987,7 @@ mt76_sta_add(struct mt76_dev *dev, struct ieee80211_vif *vif, continue; mtxq = (struct mt76_txq *)sta->txq[i]->drv_priv; - mtxq->wcid = wcid; + mtxq->wcid = wcid->idx; } ewma_signal_init(&wcid->rssi); diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h index 16e65020a242..3cb1a2b8aa84 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76.h +++ b/drivers/net/wireless/mediatek/mt76/mt76.h @@ -226,7 +226,7 @@ struct mt76_wcid { }; struct mt76_txq { - struct mt76_wcid *wcid; + u16 wcid; u16 agg_ssn; bool send_bar; diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/main.c b/drivers/net/wireless/mediatek/mt76/mt7603/main.c index bdff89cc3105..a5b472af93d3 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7603/main.c +++ b/drivers/net/wireless/mediatek/mt76/mt7603/main.c @@ -74,7 +74,7 @@ mt7603_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif) mt7603_wtbl_init(dev, idx, mvif->idx, bc_addr); mtxq = (struct mt76_txq *)vif->txq->drv_priv; - mtxq->wcid = &mvif->sta.wcid; + mtxq->wcid = idx; rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid); out: diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/main.c b/drivers/net/wireless/mediatek/mt76/mt7615/main.c index defa207f53d6..4fe51a0c8ac9 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7615/main.c +++ b/drivers/net/wireless/mediatek/mt76/mt7615/main.c @@ -204,7 +204,7 @@ static int mt7615_add_interface(struct ieee80211_hw *hw, rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid); if (vif->txq) { mtxq = (struct mt76_txq *)vif->txq->drv_priv; - mtxq->wcid = &mvif->sta.wcid; + mtxq->wcid = idx; } ret = mt7615_mcu_add_dev_info(dev, vif, true); diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_util.c b/drivers/net/wireless/mediatek/mt76/mt76x02_util.c index 0f191bd28417..1996a69109fa 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76x02_util.c +++ b/drivers/net/wireless/mediatek/mt76/mt76x02_util.c @@ -293,7 +293,8 @@ mt76x02_vif_init(struct mt76x02_dev *dev, struct ieee80211_vif *vif, mvif->group_wcid.idx = MT_VIF_WCID(idx); mvif->group_wcid.hw_key_idx = -1; mtxq = (struct mt76_txq *)vif->txq->drv_priv; - mtxq->wcid = &mvif->group_wcid; + rcu_assign_pointer(dev->mt76.wcid[MT_VIF_WCID(idx)], &mvif->group_wcid); + mtxq->wcid = MT_VIF_WCID(idx); } int @@ -346,6 +347,7 @@ void mt76x02_remove_interface(struct ieee80211_hw *hw, struct mt76x02_vif *mvif = (struct mt76x02_vif *)vif->drv_priv; dev->mphy.vif_mask &= ~BIT(mvif->idx); + rcu_assign_pointer(dev->mt76.wcid[mvif->group_wcid.idx], NULL); } EXPORT_SYMBOL_GPL(mt76x02_remove_interface); diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c index e78d3efa3fdf..d3d0085f070a 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c @@ -168,7 +168,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw, rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid); if (vif->txq) { mtxq = (struct mt76_txq *)vif->txq->drv_priv; - mtxq->wcid = &mvif->sta.wcid; + mtxq->wcid = idx; } out: diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c index 073c29eb2ed8..974105d7503d 100644 --- a/drivers/net/wireless/mediatek/mt76/tx.c +++ b/drivers/net/wireless/mediatek/mt76/tx.c @@ -382,12 +382,11 @@ EXPORT_SYMBOL_GPL(mt76_release_buffered_frames); static int mt76_txq_send_burst(struct mt76_phy *phy, struct mt76_queue *q, - struct mt76_txq *mtxq) + struct mt76_txq *mtxq, struct mt76_wcid *wcid) { struct mt76_dev *dev = phy->dev; struct ieee80211_txq *txq = mtxq_to_txq(mtxq); enum mt76_txq_id qid = mt76_txq_get_qid(txq); - struct mt76_wcid *wcid = mtxq->wcid; struct ieee80211_tx_info *info; struct sk_buff *skb; int n_frames = 1; @@ -471,8 +470,8 @@ mt76_txq_schedule_list(struct mt76_phy *phy, enum mt76_txq_id qid) break; mtxq = (struct mt76_txq *)txq->drv_priv; - wcid = mtxq->wcid; - if (wcid && test_bit(MT_WCID_FLAG_PS, &wcid->flags)) + wcid = rcu_dereference(dev->wcid[mtxq->wcid]); + if (!wcid || test_bit(MT_WCID_FLAG_PS, &wcid->flags)) continue; if (mtxq->send_bar && mtxq->aggr) { @@ -488,7 +487,7 @@ mt76_txq_schedule_list(struct mt76_phy *phy, enum mt76_txq_id qid) spin_lock_bh(&q->lock); } - ret += mt76_txq_send_burst(phy, q, mtxq); + ret += mt76_txq_send_burst(phy, q, mtxq, wcid); ieee80211_return_txq(phy->hw, txq, false); } spin_unlock_bh(&q->lock); -- 2.25.1

2 1

[PATCH OLK-6.6] perf stat: Enable iostat mode for HiSilicon PCIe PMU
by Yushan Wang 10 Apr '25

10 Apr '25

From: Yicong Yang <yangyicong(a)hisilicon.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IC02AC ---------------------------------------------------------------------- Some HiSilicon platforms provide PCIe PMU devices for monitoring the bandwidth and latency of PCIe traffic. With the support of PCIe PMU we can enable the perf iostat mode. The HiSilicon PCIe PMU can support measuring the bandwidth of certain TLP types and of certian root port. Totally 6 metrics are provided in the unit of MB: - Inbound MWR: The memory write TLPs from the devices downstream the root port - Inbound MRD: The memory read TLPs from the devices downstream the root port - Inbound CPL: The completion TLPs from the devices downstream the root port - Outbound MWR: The memory write TLPs from the CPU to the downstream devices - Outbound MRD: The memory read TLPs from the CPU to the downstream devices - Outbound CPL: The completions TLPs from the CPU to the downstream devices Since the PMU measure the throughput with unit of DWords. So we need the calculate the actually bandwidth like: Count * 4B / 1024 / 1024 / Time_elapsed (MB) Some of the display of the `perf iostat` will be like: [root@localhost tmp]# ./perf iostat list hisi_pcie8_core2<0000:aa:00.0> hisi_pcie0_core2<0000:40:00.0> hisi_pcie10_core2<0000:d5:00.0> hisi_pcie8_core1<0000:95:04.0> hisi_pcie8_core1<0000:95:00.0> hisi_pcie2_core2<0000:5f:00.0> hisi_pcie0_core1<0000:16:00.0> hisi_pcie0_core1<0000:16:04.0> [root@localhost tmp]# ./perf iostat --timeout 10000 Performance counter stats for 'system wide': port Inbound MWR(MB) Inbound MRD(MB) Inbound CPL(MB) Outbound MWR(MB) Outbound MRD(MB) Outbound CPL(MB) 0000:aa:00.0 0 0 0 0 0 0 0000:40:00.0 0 0 0 0 0 0 0000:d5:00.0 0 0 0 0 0 0 0000:95:04.0 9 81 0 1 0 2497 0000:95:00.0 0 0 0 0 0 0 0000:5f:00.0 0 0 0 0 0 0 0000:16:00.0 0 0 0 0 0 0 0000:16:04.0 5658 2 0 2 0 17 10.006795510 seconds time elapsed [root@localhost tmp]# ./perf iostat 0000:95:04.0 -- iperf -c 192.100.100.1 -t 30 ------------------------------------------------------------ Client connecting to 192.100.100.1, TCP port 5001 TCP window size: 1.79 MByte (default) ------------------------------------------------------------ [ 3] local 192.100.100.2 port 57130 connected with 192.100.100.1 port 5001 [ ID] Interval Transfer Bandwidth [ 3] 0.0-30.0 sec 32.9 GBytes 9.41 Gbits/sec Performance counter stats for 'system wide': port Inbound MWR(MB) Inbound MRD(MB) Inbound CPL(MB) Outbound MWR(MB) Outbound MRD(MB) Outbound CPL(MB) 0000:95:04.0 4 41 0 1 0 1259 30.060558310 seconds time elapsed 0.060853000 seconds user 3.758800000 seconds sys More information of the HiSilicon PCIe PMU can be found at Documentation/admin-guide/perf/hisi-pcie-pmu.rst. Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Signed-off-by: Yushan Wang <wangyushan12(a)huawei.com> Signed-off-by: Qizhi Zhang <zhangqizhi3(a)h-partners.com> --- tools/perf/arch/arm64/util/Build | 1 + tools/perf/arch/arm64/util/hisi-iostat.c | 431 +++++++++++++++++++++++ 2 files changed, 432 insertions(+) create mode 100644 tools/perf/arch/arm64/util/hisi-iostat.c diff --git a/tools/perf/arch/arm64/util/Build b/tools/perf/arch/arm64/util/Build index 78ef7115be3d..4e8dabf98b29 100644 --- a/tools/perf/arch/arm64/util/Build +++ b/tools/perf/arch/arm64/util/Build @@ -3,6 +3,7 @@ perf-y += machine.o perf-y += perf_regs.o perf-y += tsc.o perf-y += pmu.o +perf-y += hisi-iostat.o perf-$(CONFIG_LIBTRACEEVENT) += kvm-stat.o perf-$(CONFIG_DWARF) += dwarf-regs.o perf-$(CONFIG_LOCAL_LIBUNWIND) += unwind-libunwind.o diff --git a/tools/perf/arch/arm64/util/hisi-iostat.c b/tools/perf/arch/arm64/util/hisi-iostat.c new file mode 100644 index 000000000000..96684cc00464 --- /dev/null +++ b/tools/perf/arch/arm64/util/hisi-iostat.c @@ -0,0 +1,431 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * perf iostat support for HiSilicon PCIe PMU. + * Partly derived from tools/perf/arch/x86/util/iostat.c. + * + * Copyright (c) 2024 HiSilicon Technologies Co., Ltd. + * Author: Yicong Yang <yangyicong(a)hisilicon.com> + */ + +#include <api/fs/fs.h> +#include <linux/err.h> +#include <linux/zalloc.h> +#include <linux/limits.h> +#include <dirent.h> +#include <stdio.h> +#include <errno.h> +#include <stdlib.h> + +#include "util/counts.h" +#include "util/cpumap.h" +#include "util/debug.h" +#include "util/iostat.h" +#include "util/pmu.h" + +#define PCI_DEFAULT_DOMAIN 0 +#define PCI_DEVICE_NAME_PATTERN "%04x:%02hhx:%02hhx.%hhu" +#define PCI_ROOT_BUS_DEVICES_PATH "bus/pci/devices" + +static const char *hisi_iostat_metrics[] = { + "Inbound MWR(MB)", + "Inbound MRD(MB)", + "Inbound CPL(MB)", + "Outbound MWR(MB)", + "Outbound MRD(MB)", + "Outbound CPL(MB)", +}; + +static const char *hisi_iostat_cmd_template[] = { + /* Inbound Memory Write */ + "hisi_pcie%hu_core%hu/event=0x0104,port=0x%hx/", + /* Inbound Memory Read */ + "hisi_pcie%hu_core%hu/event=0x0804,port=0x%hx/", + /* Inbound Memory Completion */ + "hisi_pcie%hu_core%hu/event=0x2004,port=0x%hx/", + /* Outbound Memory Write */ + "hisi_pcie%hu_core%hu/event=0x0105,port=0x%hx/", + /* Outbound Memory Read */ + "hisi_pcie%hu_core%hu/event=0x0405,port=0x%hx/", + /* Outbound Memory Completion */ + "hisi_pcie%hu_core%hu/event=0x1005,port=0x%hx/", +}; + +struct hisi_pcie_root_port { + struct list_head list; + /* Is this Root Port selected for monitoring */ + bool selected; + /* IDs to locate the PMU */ + u16 sicl_id; + u16 core_id; + /* Filter mask for this Root Port */ + u16 mask; + /* PCIe Root Port's <domain>:<bus>:<device>.<function> */ + u32 domain; + u8 bus; + u8 dev; + u8 fn; +}; + +LIST_HEAD(hisi_pcie_root_ports_list); +static int hisi_pcie_root_ports_num; + +static void hisi_pcie_init_root_port_mask(struct hisi_pcie_root_port *rp) +{ + rp->mask = BIT(rp->dev << 1); +} + +/* + * Select specific Root Port to monitor. Return 0 if successfully find the + * Root Port, Otherwise -EINVAL. + */ +static int hisi_pcie_root_ports_select_one(u32 domain, u8 bus, u8 dev, u8 fn) +{ + struct hisi_pcie_root_port *rp; + + list_for_each_entry(rp, &hisi_pcie_root_ports_list, list) + if (domain == rp->domain && bus == rp->bus && + dev == rp->dev && fn == rp->fn) { + rp->selected = true; + return 0; + } + + return -EINVAL; +} + +static void hisi_pcie_root_ports_select_all(void) +{ + struct hisi_pcie_root_port *rp; + + list_for_each_entry(rp, &hisi_pcie_root_ports_list, list) + rp->selected = true; +} + +static void hisi_pcie_root_ports_add(u16 sicl_id, u16 core_id, u8 target_bus) +{ + const char *sysfs = sysfs__mountpoint(); + struct hisi_pcie_root_port *rp; + struct dirent *dent; + char path[PATH_MAX]; + u8 bus, dev, fn; + u32 domain; + DIR *dir; + int ret; + + snprintf(path, PATH_MAX, "%s/%s", sysfs, PCI_ROOT_BUS_DEVICES_PATH); + dir = opendir(path); + if (!dir) + return; + + /* Scan the PCI root bus to find the match root port on @target_bus */ + while ((dent = readdir(dir))) { + ret = sscanf(dent->d_name, PCI_DEVICE_NAME_PATTERN, + &domain, &bus, &dev, &fn); + if (ret != 4 || bus != target_bus) + continue; + + rp = zalloc(sizeof(*rp)); + if (!rp) + continue; + + rp->selected = false; + rp->sicl_id = sicl_id; + rp->core_id = core_id; + rp->domain = domain; + rp->bus = bus; + rp->dev = dev; + rp->fn = fn; + + hisi_pcie_init_root_port_mask(rp); + + list_add(&rp->list, &hisi_pcie_root_ports_list); + hisi_pcie_root_ports_num++; + + pr_debug3("Found root port %s\n", dent->d_name); + } + + closedir(dir); +} + +/* Scan the PMUs and build the mapping of the Root Ports to the PMU */ +static int hisi_pcie_root_ports_init(void) +{ + char event_source[PATH_MAX], bus_path[PATH_MAX]; + unsigned long long bus; + u16 sicl_id, core_id; + struct dirent *dent; + DIR *dir; + + perf_pmu__event_source_devices_scnprintf(event_source, sizeof(event_source)); + dir = opendir(event_source); + if (!dir) + return -ENOENT; + + while ((dent = readdir(dir))) { + /* + * This HiSilicon PCIe PMU will be named as: + * hisi_pcie<sicl_id>_core<core_id> + */ + if ((sscanf(dent->d_name, "hisi_pcie%hu_core%hu", &sicl_id, &core_id)) != 2) + continue; + + /* + * Driver will export the root port it can monitor through + * the "bus" sysfs attribute. + */ + scnprintf(bus_path, sizeof(bus_path), "%s/hisi_pcie%hu_core%hu/bus", + event_source, sicl_id, core_id); + + /* + * Per PCIe spec the bus should be 8bit, use unsigned long long + * for the convience of the library function. + */ + if (filename__read_ull(bus_path, &bus)) + continue; + + pr_debug3("Found pmu %s bus 0x%llx\n", dent->d_name, bus); + + hisi_pcie_root_ports_add(sicl_id, core_id, (u8)bus); + } + + closedir(dir); + return hisi_pcie_root_ports_num > 0 ? 0 : -ENOENT; +} + +static void hisi_pcie_root_ports_free(void) +{ + struct hisi_pcie_root_port *rp, *tmp; + + if (hisi_pcie_root_ports_num == 0) + return; + + list_for_each_entry_safe(rp, tmp, &hisi_pcie_root_ports_list, list) { + list_del(&rp->list); + zfree(&rp); + hisi_pcie_root_ports_num--; + } +} + +static int hisi_iostat_add_events(struct evlist *evl) +{ + struct hisi_pcie_root_port *rp; + struct evsel *evsel; + unsigned int i, j; + char *iostat_cmd; + int pos = 0; + int ret; + + if (!hisi_pcie_root_ports_num) + return -ENOENT; + + iostat_cmd = zalloc(PATH_MAX); + if (!iostat_cmd) + return -ENOMEM; + + list_for_each_entry(rp, &hisi_pcie_root_ports_list, list) { + if (!rp->selected) + continue; + + iostat_cmd[pos++] = '{'; + for (j = 0; j < ARRAY_SIZE(hisi_iostat_cmd_template); j++) { + pos += snprintf(iostat_cmd + pos, ARG_MAX - pos - 1, + hisi_iostat_cmd_template[j], + rp->sicl_id, rp->core_id, rp->mask); + + if (j == ARRAY_SIZE(hisi_iostat_cmd_template) - 1) + iostat_cmd[pos++] = '}'; + else + iostat_cmd[pos++] = ','; + } + + ret = parse_event(evl, iostat_cmd); + if (ret) + break; + + i = 0; + evlist__for_each_entry_reverse(evl, evsel) { + if (i == ARRAY_SIZE(hisi_iostat_cmd_template)) + break; + + evsel->priv = rp; + i++; + } + + memset(iostat_cmd, 0, PATH_MAX); + pos = 0; + } + + zfree(&iostat_cmd); + return ret; +} + +int iostat_prepare(struct evlist *evlist, + struct perf_stat_config *config) +{ + if (evlist->core.nr_entries > 0) { + pr_warning("The -e and -M options are not supported." + "All chosen events/metrics will be dropped\n"); + evlist__delete(evlist); + evlist = evlist__new(); + if (!evlist) + return -ENOMEM; + } + + config->metric_only = true; + config->aggr_mode = AGGR_GLOBAL; + + return hisi_iostat_add_events(evlist); +} + +static int hisi_pcie_root_ports_list_filter(const char *str) +{ + char *tok, *tmp, *copy = NULL; + u8 bus, dev, fn; + u32 domain; + int ret; + + copy = strdup(str); + if (!copy) + return -ENOMEM; + + for (tok = strtok_r(copy, ",", &tmp); tok; tok = strtok_r(NULL, ",", &tmp)) { + ret = sscanf(tok, PCI_DEVICE_NAME_PATTERN, &domain, &bus, &dev, &fn); + if (ret != 4) { + ret = -EINVAL; + break; + } + + ret = hisi_pcie_root_ports_select_one(domain, bus, dev, fn); + if (ret) + break; + } + + zfree(&copy); + return ret; +} + +int iostat_parse(const struct option *opt, const char *str, int unset __maybe_unused) +{ + struct perf_stat_config *config = (struct perf_stat_config *)opt->data; + int ret; + + ret = hisi_pcie_root_ports_init(); + if (!ret) { + config->iostat_run = true; + + if (!str) { + iostat_mode = IOSTAT_RUN; + hisi_pcie_root_ports_select_all(); + } else if (!strcmp(str, "list")) { + iostat_mode = IOSTAT_LIST; + hisi_pcie_root_ports_select_all(); + } else { + iostat_mode = IOSTAT_RUN; + ret = hisi_pcie_root_ports_list_filter(str); + } + } + + return ret; +} + +static void hisi_pcie_root_port_show(FILE *output, + const struct hisi_pcie_root_port * const rp) +{ + if (output && rp) + fprintf(output, "hisi_pcie%hu_core%hu<" PCI_DEVICE_NAME_PATTERN ">\n", + rp->sicl_id, rp->core_id, rp->domain, rp->bus, rp->dev, rp->fn); +} + +void iostat_list(struct evlist *evlist __maybe_unused, struct perf_stat_config *config) +{ + struct hisi_pcie_root_port *rp = NULL; + struct evsel *evsel; + + evlist__for_each_entry(evlist, evsel) { + if (rp != evsel->priv) { + hisi_pcie_root_port_show(config->output, evsel->priv); + rp = evsel->priv; + } + } +} + +void iostat_release(struct evlist *evlist) +{ + struct evsel *evsel; + + evlist__for_each_entry(evlist, evsel) + evsel->priv = NULL; + + hisi_pcie_root_ports_free(); +} + +void iostat_print_header_prefix(struct perf_stat_config *config) +{ + if (config->csv_output) + fputs("port,", config->output); + else if (config->interval) + fprintf(config->output, "# time port "); + else + fprintf(config->output, " port "); +} + +void iostat_print_metric(struct perf_stat_config *config, struct evsel *evsel, + struct perf_stat_output_ctx *out) +{ + const char *iostat_metric = hisi_iostat_metrics[evsel->core.idx % ARRAY_SIZE(hisi_iostat_metrics)]; + struct perf_counts_values *count; + double iostat_value; + + /* We're using AGGR_GLOBAL so there's only one aggr counts aggr[0]. */ + count = &evsel->stats->aggr[0].counts; + + /* The counts has been scaled, we can use it directly. */ + iostat_value = (double)count->val; + + /* + * Display two digits after decimal point for better accuracy if the + * value is non-zero. + */ + out->print_metric(config, out->ctx, NULL, + iostat_value > 0 ? "%8.2f" : "%8.0f", + iostat_metric, iostat_value / (256 * 1024)); +} + +void iostat_prefix(struct evlist *evlist, struct perf_stat_config *config, + char *prefix, struct timespec *ts) +{ + struct hisi_pcie_root_port *rp = evlist->selected->priv; + + if (rp) { + if (ts) + sprintf(prefix, "%6lu.%09lu%s" PCI_DEVICE_NAME_PATTERN "%s", + ts->tv_sec, ts->tv_nsec, config->csv_sep, + rp->domain, rp->bus, rp->dev, rp->fn, + config->csv_sep); + else + sprintf(prefix, PCI_DEVICE_NAME_PATTERN "%s", + rp->domain, rp->bus, rp->dev, rp->fn, + config->csv_sep); + } +} + +void iostat_print_counters(struct evlist *evlist, struct perf_stat_config *config, + struct timespec *ts, char *prefix, + iostat_print_counter_t print_cnt_cb, void *arg) +{ + struct evsel *counter = evlist__first(evlist); + void *perf_device; + + evlist__set_selected(evlist, counter); + iostat_prefix(evlist, config, prefix, ts); + fprintf(config->output, "%s", prefix); + evlist__for_each_entry(evlist, counter) { + perf_device = evlist->selected->priv; + if (perf_device && perf_device != counter->priv) { + evlist__set_selected(evlist, counter); + iostat_prefix(evlist, config, prefix, ts); + fprintf(config->output, "\n%s", prefix); + } + print_cnt_cb(config, counter, arg); + } + fputc('\n', config->output); +} -- 2.33.0

2 1

[openeuler:openEuler-1.0-LTS 1575/1575] mm/hugetlb.c:1370:6: sparse: sparse: symbol 'free_huge_page_to_dhugetlb_pool' was not declared. Should it be static?
by kernel test robot 10 Apr '25

10 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: db05731a881772a1e8f532c2541b334d822596f2 commit: 0bc0d0d57edacd59ebe38d05ad9c4b2bc185aa51 [1575/1575] dhugetlb: backport dynamic hugetlb feature config: arm64-randconfig-r122-20250410 (https://download.01.org/0day-ci/archive/20250410/202504101655.g80FSsl7-lkp@…) compiler: aarch64-linux-gcc (GCC) 10.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250410/202504101655.g80FSsl7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504101655.g80FSsl7-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/hugetlb.c:1370:6: sparse: sparse: symbol 'free_huge_page_to_dhugetlb_pool' was not declared. Should it be static? mm/hugetlb.c:2018:20: sparse: sparse: context imbalance in 'gather_surplus_pages' - unexpected unlock mm/hugetlb.c:5168:17: sparse: sparse: context imbalance in 'hugetlb_cow' - unexpected unlock mm/hugetlb.c:5881:25: sparse: sparse: context imbalance in 'follow_hugetlb_page' - different lock contexts for basic block mm/hugetlb.c:1370:6: warning: no previous prototype for 'free_huge_page_to_dhugetlb_pool' [-Wmissing-prototypes] 1370 | void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/free_huge_page_to_dhugetlb_pool +1370 mm/hugetlb.c 1324 1325 #ifdef CONFIG_DYNAMIC_HUGETLB 1326 static void free_huge_page_to_dhugetlb_pool(struct page *page, 1327 bool restore_reserve) 1328 { 1329 struct hstate *h = page_hstate(page); 1330 struct dhugetlb_pool *hpool; 1331 1332 hpool = get_dhugetlb_pool_from_dhugetlb_pagelist(page); 1333 if (unlikely(!hpool)) { 1334 pr_err("dhugetlb: free error: get hpool failed\n"); 1335 return; 1336 } 1337 1338 spin_lock(&hpool->lock); 1339 ClearPagePool(page); 1340 set_compound_page_dtor(page, NULL_COMPOUND_DTOR); 1341 if (!hstate_is_gigantic(h)) { 1342 list_add(&page->lru, &hpool->dhugetlb_2M_freelists); 1343 hpool->free_reserved_2M++; 1344 hpool->used_2M--; 1345 if (restore_reserve) { 1346 hpool->mmap_reserved_2M++; 1347 trace_dhugetlb_acct_memory(hpool, 1348 hpool->mmap_reserved_2M, 1349 DHUGETLB_RESV_2M); 1350 } 1351 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_2M, 1352 DHUGETLB_FREE_2M); 1353 } else { 1354 list_add(&page->lru, &hpool->dhugetlb_1G_freelists); 1355 hpool->free_reserved_1G++; 1356 hpool->used_1G--; 1357 if (restore_reserve) { 1358 hpool->mmap_reserved_1G++; 1359 trace_dhugetlb_acct_memory(hpool, 1360 hpool->mmap_reserved_1G, 1361 DHUGETLB_RESV_1G); 1362 } 1363 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_1G, 1364 DHUGETLB_FREE_1G); 1365 } 1366 spin_unlock(&hpool->lock); 1367 dhugetlb_pool_put(hpool); 1368 } 1369 #else > 1370 void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) 1371 { 1372 } 1373 #endif 1374 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH] perf stat: Enable iostat mode for HiSilicon PCIe PMU
by Yushan Wang 10 Apr '25

10 Apr '25

From: Yicong Yang <yangyicong(a)hisilicon.com> Some HiSilicon platforms provide PCIe PMU devices for monitoring the bandwidth and latency of PCIe traffic. With the support of PCIe PMU we can enable the perf iostat mode. The HiSilicon PCIe PMU can support measuring the bandwidth of certain TLP types and of certian root port. Totally 6 metrics are provided in the unit of MB: - Inbound MWR: The memory write TLPs from the devices downstream the root port - Inbound MRD: The memory read TLPs from the devices downstream the root port - Inbound CPL: The completion TLPs from the devices downstream the root port - Outbound MWR: The memory write TLPs from the CPU to the downstream devices - Outbound MRD: The memory read TLPs from the CPU to the downstream devices - Outbound CPL: The completions TLPs from the CPU to the downstream devices Since the PMU measure the throughput with unit of DWords. So we need the calculate the actually bandwidth like: Count * 4B / 1024 / 1024 / Time_elapsed (MB) Some of the display of the `perf iostat` will be like: [root@localhost tmp]# ./perf iostat list hisi_pcie8_core2<0000:aa:00.0> hisi_pcie0_core2<0000:40:00.0> hisi_pcie10_core2<0000:d5:00.0> hisi_pcie8_core1<0000:95:04.0> hisi_pcie8_core1<0000:95:00.0> hisi_pcie2_core2<0000:5f:00.0> hisi_pcie0_core1<0000:16:00.0> hisi_pcie0_core1<0000:16:04.0> [root@localhost tmp]# ./perf iostat --timeout 10000 Performance counter stats for 'system wide': port Inbound MWR(MB) Inbound MRD(MB) Inbound CPL(MB) Outbound MWR(MB) Outbound MRD(MB) Outbound CPL(MB) 0000:aa:00.0 0 0 0 0 0 0 0000:40:00.0 0 0 0 0 0 0 0000:d5:00.0 0 0 0 0 0 0 0000:95:04.0 9 81 0 1 0 2497 0000:95:00.0 0 0 0 0 0 0 0000:5f:00.0 0 0 0 0 0 0 0000:16:00.0 0 0 0 0 0 0 0000:16:04.0 5658 2 0 2 0 17 10.006795510 seconds time elapsed [root@localhost tmp]# ./perf iostat 0000:95:04.0 -- iperf -c 192.100.100.1 -t 30 ------------------------------------------------------------ Client connecting to 192.100.100.1, TCP port 5001 TCP window size: 1.79 MByte (default) ------------------------------------------------------------ [ 3] local 192.100.100.2 port 57130 connected with 192.100.100.1 port 5001 [ ID] Interval Transfer Bandwidth [ 3] 0.0-30.0 sec 32.9 GBytes 9.41 Gbits/sec Performance counter stats for 'system wide': port Inbound MWR(MB) Inbound MRD(MB) Inbound CPL(MB) Outbound MWR(MB) Outbound MRD(MB) Outbound CPL(MB) 0000:95:04.0 4 41 0 1 0 1259 30.060558310 seconds time elapsed 0.060853000 seconds user 3.758800000 seconds sys More information of the HiSilicon PCIe PMU can be found at Documentation/admin-guide/perf/hisi-pcie-pmu.rst. Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Signed-off-by: Yushan Wang <wangyushan12(a)huawei.com> --- tools/perf/arch/arm64/util/Build | 1 + tools/perf/arch/arm64/util/hisi-iostat.c | 451 +++++++++++++++++++++++ 2 files changed, 452 insertions(+) create mode 100644 tools/perf/arch/arm64/util/hisi-iostat.c diff --git a/tools/perf/arch/arm64/util/Build b/tools/perf/arch/arm64/util/Build index 78ef7115be3d..4e8dabf98b29 100644 --- a/tools/perf/arch/arm64/util/Build +++ b/tools/perf/arch/arm64/util/Build @@ -3,6 +3,7 @@ perf-y += machine.o perf-y += perf_regs.o perf-y += tsc.o perf-y += pmu.o +perf-y += hisi-iostat.o perf-$(CONFIG_LIBTRACEEVENT) += kvm-stat.o perf-$(CONFIG_DWARF) += dwarf-regs.o perf-$(CONFIG_LOCAL_LIBUNWIND) += unwind-libunwind.o diff --git a/tools/perf/arch/arm64/util/hisi-iostat.c b/tools/perf/arch/arm64/util/hisi-iostat.c new file mode 100644 index 000000000000..fc794ee7d8d4 --- /dev/null +++ b/tools/perf/arch/arm64/util/hisi-iostat.c @@ -0,0 +1,451 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * perf iostat support for HiSilicon PCIe PMU. + * Partly derived from tools/perf/arch/x86/util/iostat.c. + * + * Copyright (c) 2024 HiSilicon Technologies Co., Ltd. + * Author: Yicong Yang <yangyicong(a)hisilicon.com> + */ + +#include <api/fs/fs.h> +#include <linux/err.h> +#include <linux/zalloc.h> +#include <linux/limits.h> +#include <dirent.h> +#include <stdio.h> +#include <errno.h> +#include <stdlib.h> + +#include "util/counts.h" +#include "util/cpumap.h" +#include "util/debug.h" +#include "util/iostat.h" +#include "util/pmu.h" + +/* From include/uapi/linux/pci.h */ +#define PCI_SLOT(devfn) (((devfn) >> 3) & 0x1f) +#define PCI_DEVFN(slot, func) ((((slot) & 0x1f) << 3) | ((func) & 0x07)) + +#define PCI_DEFAULT_DOMAIN 0 +#define PCI_DEVICE_NAME_PATTERN "%04x:%02hhx:%02hhx.%hhu" +#define PCI_ROOT_BUS_DEVICES_PATH "bus/pci/devices" + +static const char *hisi_iostat_metrics[] = { + "Inbound MWR(MB)", + "Inbound MRD(MB)", + "Inbound CPL(MB)", + "Outbound MWR(MB)", + "Outbound MRD(MB)", + "Outbound CPL(MB)", +}; + +static const char *hisi_iostat_cmd_template[] = { + /* Inbound Memory Write */ + "hisi_pcie%hu_core%hu/event=0x0104,port=0x%hx/", + /* Inbound Memory Read */ + "hisi_pcie%hu_core%hu/event=0x0804,port=0x%hx/", + /* Inbound Memory Completion */ + "hisi_pcie%hu_core%hu/event=0x2004,port=0x%hx/", + /* Outbound Memory Write */ + "hisi_pcie%hu_core%hu/event=0x0105,port=0x%hx/", + /* Outbound Memory Read */ + "hisi_pcie%hu_core%hu/event=0x0405,port=0x%hx/", + /* Outbound Memory Completion */ + "hisi_pcie%hu_core%hu/event=0x1005,port=0x%hx/", +}; + +struct hisi_pcie_root_port { + struct list_head list; + /* Is this Root Port selected for monitoring */ + bool selected; + /* IDs to locate the PMU */ + u16 sicl_id; + u16 core_id; + /* Filter mask for this Root Port */ + u16 mask; + /* PCIe Root Port's <domain>:<bus>:<device>.<function> */ + u32 domain; + u8 bus; + u8 dev; + u8 fn; +}; + +LIST_HEAD(hisi_pcie_root_ports_list); +static int hisi_pcie_root_ports_num; + +static void hisi_pcie_init_root_port_mask(struct hisi_pcie_root_port *rp, u16 devbase) +{ + rp->mask = BIT((rp->dev - devbase) << 1); +} + +/* + * Select specific Root Port to monitor. Return 0 if successfully find the + * Root Port, Otherwise -EINVAL. + */ +static int hisi_pcie_root_ports_select_one(u32 domain, u8 bus, u8 dev, u8 fn) +{ + struct hisi_pcie_root_port *rp; + + list_for_each_entry(rp, &hisi_pcie_root_ports_list, list) + if (domain == rp->domain && bus == rp->bus && + dev == rp->dev && fn == rp->fn) { + rp->selected = true; + return 0; + } + + return -EINVAL; +} + +static void hisi_pcie_root_ports_select_all(void) +{ + struct hisi_pcie_root_port *rp; + + list_for_each_entry(rp, &hisi_pcie_root_ports_list, list) + rp->selected = true; +} + +static void hisi_pcie_root_ports_add(u16 sicl_id, u16 core_id, u8 target_bus, + u16 bdf_min, u16 bdf_max) +{ + const char *sysfs = sysfs__mountpoint(); + struct hisi_pcie_root_port *rp; + struct dirent *dent; + char path[PATH_MAX]; + u8 bus, dev, fn; + u32 domain; + DIR *dir; + u16 bdf; + int ret; + + snprintf(path, PATH_MAX, "%s/%s", sysfs, PCI_ROOT_BUS_DEVICES_PATH); + dir = opendir(path); + if (!dir) + return; + + /* Scan the PCI root bus to find the match root port on @target_bus */ + while ((dent = readdir(dir))) { + ret = sscanf(dent->d_name, PCI_DEVICE_NAME_PATTERN, + &domain, &bus, &dev, &fn); + if (ret != 4 || bus != target_bus) + continue; + + bdf = (bus << 8) | PCI_DEVFN(dev, fn); + if (bdf < bdf_min || bdf > bdf_max) + continue; + + rp = zalloc(sizeof(*rp)); + if (!rp) + continue; + + rp->selected = false; + rp->sicl_id = sicl_id; + rp->core_id = core_id; + rp->domain = domain; + rp->bus = bus; + rp->dev = dev; + rp->fn = fn; + + hisi_pcie_init_root_port_mask(rp, PCI_SLOT(bdf_min)); + + list_add(&rp->list, &hisi_pcie_root_ports_list); + hisi_pcie_root_ports_num++; + + pr_debug3("Found root port %s\n", dent->d_name); + } + + closedir(dir); +} + +/* Scan the PMUs and build the mapping of the Root Ports to the PMU */ +static int hisi_pcie_root_ports_init(void) +{ + char event_source[PATH_MAX], bus_path[PATH_MAX]; + unsigned long long bus, bdf_max, bdf_min; + u16 sicl_id, core_id; + struct dirent *dent; + DIR *dir; + + perf_pmu__event_source_devices_scnprintf(event_source, sizeof(event_source)); + dir = opendir(event_source); + if (!dir) + return -ENOENT; + + while ((dent = readdir(dir))) { + /* + * This HiSilicon PCIe PMU will be named as: + * hisi_pcie<sicl_id>_core<core_id> + */ + if ((sscanf(dent->d_name, "hisi_pcie%hu_core%hu", &sicl_id, &core_id)) != 2) + continue; + + /* + * Driver will export the root port it can monitor through + * the "bus" sysfs attribute. + */ + scnprintf(bus_path, sizeof(bus_path), "%s/hisi_pcie%hu_core%hu/bus", + event_source, sicl_id, core_id); + + /* + * Per PCIe spec the bus should be 8bit, use unsigned long long + * for the convience of the library function. + */ + if (filename__read_ull(bus_path, &bus)) + continue; + + scnprintf(bus_path, sizeof(bus_path), "%s/hisi_pcie%hu_core%hu/bdf_max", + event_source, sicl_id, core_id); + if (filename__read_xll(bus_path, &bdf_max)) + bdf_max = -1; + + scnprintf(bus_path, sizeof(bus_path), "%s/hisi_pcie%hu_core%hu/bdf_min", + event_source, sicl_id, core_id); + if (filename__read_xll(bus_path, &bdf_min)) + bdf_min = 0; + + pr_debug3("Found pmu %s bus 0x%llx\n", dent->d_name, bus); + + hisi_pcie_root_ports_add(sicl_id, core_id, (u8)bus, (u16)bdf_min, (u16)bdf_max); + } + + closedir(dir); + return hisi_pcie_root_ports_num > 0 ? 0 : -ENOENT; +} + +static void hisi_pcie_root_ports_free(void) +{ + struct hisi_pcie_root_port *rp, *tmp; + + if (hisi_pcie_root_ports_num == 0) + return; + + list_for_each_entry_safe(rp, tmp, &hisi_pcie_root_ports_list, list) { + list_del(&rp->list); + zfree(&rp); + hisi_pcie_root_ports_num--; + } +} + +static int hisi_iostat_add_events(struct evlist *evl) +{ + struct hisi_pcie_root_port *rp; + struct evsel *evsel; + unsigned int i, j; + char *iostat_cmd; + int pos = 0; + int ret; + + if (!hisi_pcie_root_ports_num) + return -ENOENT; + + iostat_cmd = zalloc(PATH_MAX); + if (!iostat_cmd) + return -ENOMEM; + + list_for_each_entry(rp, &hisi_pcie_root_ports_list, list) { + if (!rp->selected) + continue; + + iostat_cmd[pos++] = '{'; + for (j = 0; j < ARRAY_SIZE(hisi_iostat_cmd_template); j++) { + pos += snprintf(iostat_cmd + pos, ARG_MAX - pos - 1, + hisi_iostat_cmd_template[j], + rp->sicl_id, rp->core_id, rp->mask); + + if (j == ARRAY_SIZE(hisi_iostat_cmd_template) - 1) + iostat_cmd[pos++] = '}'; + else + iostat_cmd[pos++] = ','; + } + + ret = parse_event(evl, iostat_cmd); + if (ret) + break; + + i = 0; + evlist__for_each_entry_reverse(evl, evsel) { + if (i == ARRAY_SIZE(hisi_iostat_cmd_template)) + break; + + evsel->priv = rp; + i++; + } + + memset(iostat_cmd, 0, PATH_MAX); + pos = 0; + } + + zfree(&iostat_cmd); + return ret; +} + +int iostat_prepare(struct evlist *evlist, + struct perf_stat_config *config) +{ + if (evlist->core.nr_entries > 0) { + pr_warning("The -e and -M options are not supported." + "All chosen events/metrics will be dropped\n"); + evlist__delete(evlist); + evlist = evlist__new(); + if (!evlist) + return -ENOMEM; + } + + config->metric_only = true; + config->aggr_mode = AGGR_GLOBAL; + + return hisi_iostat_add_events(evlist); +} + +static int hisi_pcie_root_ports_list_filter(const char *str) +{ + char *tok, *tmp, *copy = NULL; + u8 bus, dev, fn; + u32 domain; + int ret; + + copy = strdup(str); + if (!copy) + return -ENOMEM; + + for (tok = strtok_r(copy, ",", &tmp); tok; tok = strtok_r(NULL, ",", &tmp)) { + ret = sscanf(tok, PCI_DEVICE_NAME_PATTERN, &domain, &bus, &dev, &fn); + if (ret != 4) { + ret = -EINVAL; + break; + } + + ret = hisi_pcie_root_ports_select_one(domain, bus, dev, fn); + if (ret) + break; + } + + zfree(&copy); + return ret; +} + +int iostat_parse(const struct option *opt, const char *str, int unset __maybe_unused) +{ + struct perf_stat_config *config = (struct perf_stat_config *)opt->data; + int ret; + + ret = hisi_pcie_root_ports_init(); + if (!ret) { + config->iostat_run = true; + + if (!str) { + iostat_mode = IOSTAT_RUN; + hisi_pcie_root_ports_select_all(); + } else if (!strcmp(str, "list")) { + iostat_mode = IOSTAT_LIST; + hisi_pcie_root_ports_select_all(); + } else { + iostat_mode = IOSTAT_RUN; + ret = hisi_pcie_root_ports_list_filter(str); + } + } + + return ret; +} + +static void hisi_pcie_root_port_show(FILE *output, + const struct hisi_pcie_root_port * const rp) +{ + if (output && rp) + fprintf(output, "hisi_pcie%hu_core%hu<" PCI_DEVICE_NAME_PATTERN ">\n", + rp->sicl_id, rp->core_id, rp->domain, rp->bus, rp->dev, rp->fn); +} + +void iostat_list(struct evlist *evlist __maybe_unused, struct perf_stat_config *config) +{ + struct hisi_pcie_root_port *rp = NULL; + struct evsel *evsel; + + evlist__for_each_entry(evlist, evsel) { + if (rp != evsel->priv) { + hisi_pcie_root_port_show(config->output, evsel->priv); + rp = evsel->priv; + } + } +} + +void iostat_release(struct evlist *evlist) +{ + struct evsel *evsel; + + evlist__for_each_entry(evlist, evsel) + evsel->priv = NULL; + + hisi_pcie_root_ports_free(); +} + +void iostat_print_header_prefix(struct perf_stat_config *config) +{ + if (config->csv_output) + fputs("port,", config->output); + else if (config->interval) + fprintf(config->output, "# time port "); + else + fprintf(config->output, " port "); +} + +void iostat_print_metric(struct perf_stat_config *config, struct evsel *evsel, + struct perf_stat_output_ctx *out) +{ + const char *iostat_metric = hisi_iostat_metrics[evsel->core.idx % ARRAY_SIZE(hisi_iostat_metrics)]; + struct perf_counts_values *count; + double iostat_value; + + /* We're using AGGR_GLOBAL so there's only one aggr counts aggr[0]. */ + count = &evsel->stats->aggr[0].counts; + + /* The counts has been scaled, we can use it directly. */ + iostat_value = (double)count->val; + + /* + * Display two digits after decimal point for better accuracy if the + * value is non-zero. + */ + out->print_metric(config, out->ctx, NULL, + iostat_value > 0 ? "%8.2f" : "%8.0f", + iostat_metric, iostat_value / (256 * 1024)); +} + +void iostat_prefix(struct evlist *evlist, struct perf_stat_config *config, + char *prefix, struct timespec *ts) +{ + struct hisi_pcie_root_port *rp = evlist->selected->priv; + + if (rp) { + if (ts) + sprintf(prefix, "%6lu.%09lu%s" PCI_DEVICE_NAME_PATTERN "%s", + ts->tv_sec, ts->tv_nsec, config->csv_sep, + rp->domain, rp->bus, rp->dev, rp->fn, + config->csv_sep); + else + sprintf(prefix, PCI_DEVICE_NAME_PATTERN "%s", + rp->domain, rp->bus, rp->dev, rp->fn, + config->csv_sep); + } +} + +void iostat_print_counters(struct evlist *evlist, struct perf_stat_config *config, + struct timespec *ts, char *prefix, + iostat_print_counter_t print_cnt_cb, void *arg) +{ + struct evsel *counter = evlist__first(evlist); + void *perf_device; + + evlist__set_selected(evlist, counter); + iostat_prefix(evlist, config, prefix, ts); + fprintf(config->output, "%s", prefix); + evlist__for_each_entry(evlist, counter) { + perf_device = evlist->selected->priv; + if (perf_device && perf_device != counter->priv) { + evlist__set_selected(evlist, counter); + iostat_prefix(evlist, config, prefix, ts); + fprintf(config->output, "\n%s", prefix); + } + print_cnt_cb(config, counter, arg); + } + fputc('\n', config->output); +} -- 2.33.0

1 0

[openeuler:OLK-6.6 2116/2116] drivers/crypto/montage/tsse/tsse_ipc.c:49:47: sparse: sparse: incorrect type in argument 2 (different address spaces)
by kernel test robot 10 Apr '25

10 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 62b846e657553d00552c1c71b6ecc26017eb1a9a commit: 7795623241fe9eb57352a09b27d06b5d4ff07071 [2116/2116] add firmware update function for Mont-TSSE config: x86_64-randconfig-r113-20250410 (https://download.01.org/0day-ci/archive/20250410/202504101403.RKyoTq9Z-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250410/202504101403.RKyoTq9Z-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504101403.RKyoTq9Z-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/crypto/montage/tsse/tsse_ipc.c:27:40: sparse: sparse: cast removes address space '__iomem' of expression drivers/crypto/montage/tsse/tsse_ipc.c:48:28: sparse: sparse: cast removes address space '__iomem' of expression >> drivers/crypto/montage/tsse/tsse_ipc.c:49:47: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const volatile [noderef] __iomem * @@ got unsigned char [usertype] *[assigned] device_msg_data @@ drivers/crypto/montage/tsse/tsse_ipc.c:49:47: sparse: expected void const volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_ipc.c:49:47: sparse: got unsigned char [usertype] *[assigned] device_msg_data drivers/crypto/montage/tsse/tsse_ipc.c:122:16: sparse: sparse: cast removes address space '__iomem' of expression drivers/crypto/montage/tsse/tsse_ipc.c:124:21: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got unsigned char [usertype] *[assigned] h2d @@ drivers/crypto/montage/tsse/tsse_ipc.c:124:21: sparse: expected void volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_ipc.c:124:21: sparse: got unsigned char [usertype] *[assigned] h2d drivers/crypto/montage/tsse/tsse_ipc.c:125:25: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got unsigned char [usertype] * @@ drivers/crypto/montage/tsse/tsse_ipc.c:125:25: sparse: expected void volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_ipc.c:125:25: sparse: got unsigned char [usertype] * -- >> drivers/crypto/montage/tsse/tsse_dev_drv.c:148:1: sparse: sparse: symbol 'dev_attr_tsse_image_load' was not declared. Should it be static? vim +49 drivers/crypto/montage/tsse/tsse_ipc.c 16 17 /** 18 * Create ipc_msg and read message from BAR. 19 * Return the pointer to ipc_msg, the caller is responsible for free it. 20 */ 21 static struct ipc_msg *get_msginf(void __iomem *d2h) 22 { 23 uint32_t u_len = 0; 24 struct ipc_msg *msg = NULL; 25 26 uint8_t *device_msg_data = NULL; > 27 struct ipc_header *ipc_info = (struct ipc_header *)d2h; 28 29 // The memory layout in d2h should at least contains: 30 // ipc_header, msg_info and fw_load (message body) 31 if (ipc_info->i_len < sizeof(struct ipc_header) + 32 sizeof(struct msg_info) + sizeof(struct fw_load)) { 33 pr_info("%s(): msg format error\n", __func__); 34 return NULL; 35 } 36 u_len = ipc_info->i_len - sizeof(struct ipc_header); 37 msg = (struct ipc_msg *)(kzalloc(sizeof(struct ipc_msg) + u_len, 38 GFP_ATOMIC)); 39 if (!msg) { 40 pr_info("%s(): ipc_msg kzalloc failed\n", __func__); 41 return NULL; 42 } 43 44 msg->header.inst_id = ipc_info->inst_id; 45 msg->header.tgid = ipc_info->tgid; 46 msg->header.i_len = ipc_info->i_len; 47 48 device_msg_data = (uint8_t *)(d2h + sizeof(struct ipc_header)); > 49 memcpy_fromio((uint8_t *)msg->i_data, device_msg_data, u_len); 50 51 return msg; 52 } 53 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2116/2116] drivers/crypto/montage/tsse/tsse_fw_service.c:40:16: sparse: sparse: cast removes address space '__iomem' of expression
by kernel test robot 10 Apr '25

10 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f38765261337382b0302ed7d139c110e0fbe3f71 commit: 811debd4ea52033d7393d4a7de2be11f71c70348 [2116/2116] add support for Mont-TSSE Driver config: x86_64-randconfig-r113-20250410 (https://download.01.org/0day-ci/archive/20250410/202504101225.8jbFE2Ak-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250410/202504101225.8jbFE2Ak-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504101225.8jbFE2Ak-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/crypto/montage/tsse/tsse_fw_service.c:40:16: sparse: sparse: cast removes address space '__iomem' of expression drivers/crypto/montage/tsse/tsse_fw_service.c:41:21: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got unsigned char [usertype] *[assigned] h2d @@ drivers/crypto/montage/tsse/tsse_fw_service.c:41:21: sparse: expected void volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_fw_service.c:41:21: sparse: got unsigned char [usertype] *[assigned] h2d >> drivers/crypto/montage/tsse/tsse_fw_service.c:42:25: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got unsigned char [usertype] * @@ drivers/crypto/montage/tsse/tsse_fw_service.c:42:25: sparse: expected void volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_fw_service.c:42:25: sparse: got unsigned char [usertype] * drivers/crypto/montage/tsse/tsse_fw_service.c:26:5: sparse: sparse: symbol 'fw_send_msg' was not declared. Should it be static? drivers/crypto/montage/tsse/tsse_fw_service.c:51:6: sparse: sparse: symbol 'fw_free' was not declared. Should it be static? drivers/crypto/montage/tsse/tsse_fw_service.c:141:22: sparse: sparse: cast removes address space '__iomem' of expression drivers/crypto/montage/tsse/tsse_fw_service.c:141:22: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got unsigned char [usertype] * @@ drivers/crypto/montage/tsse/tsse_fw_service.c:141:22: sparse: expected void volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_fw_service.c:141:22: sparse: got unsigned char [usertype] * -- >> drivers/crypto/montage/tsse/tsse_ipc.c:22:40: sparse: sparse: cast removes address space '__iomem' of expression drivers/crypto/montage/tsse/tsse_ipc.c:17:17: sparse: sparse: symbol 'get_msginf' was not declared. Should it be static? drivers/crypto/montage/tsse/tsse_ipc.c:47:21: sparse: sparse: cast removes address space '__iomem' of expression drivers/crypto/montage/tsse/tsse_ipc.c:48:36: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const volatile [noderef] __iomem * @@ got unsigned int [usertype] *[assigned] msg_data @@ drivers/crypto/montage/tsse/tsse_ipc.c:48:36: sparse: expected void const volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_ipc.c:48:36: sparse: got unsigned int [usertype] *[assigned] msg_data drivers/crypto/montage/tsse/tsse_ipc.c:41:6: sparse: sparse: symbol 'ipc_recieve_msg' was not declared. Should it be static? drivers/crypto/montage/tsse/tsse_ipc.c:53:5: sparse: sparse: symbol 'msg_rout' was not declared. Should it be static? drivers/crypto/montage/tsse/tsse_ipc.c:107:16: sparse: sparse: cast removes address space '__iomem' of expression drivers/crypto/montage/tsse/tsse_ipc.c:108:21: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got unsigned char [usertype] *[assigned] h2d @@ drivers/crypto/montage/tsse/tsse_ipc.c:108:21: sparse: expected void volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_ipc.c:108:21: sparse: got unsigned char [usertype] *[assigned] h2d drivers/crypto/montage/tsse/tsse_ipc.c:109:25: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got unsigned char [usertype] * @@ drivers/crypto/montage/tsse/tsse_ipc.c:109:25: sparse: expected void volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_ipc.c:109:25: sparse: got unsigned char [usertype] * drivers/crypto/montage/tsse/tsse_ipc.c:103:6: sparse: sparse: symbol 'ipc_send_msg' was not declared. Should it be static? drivers/crypto/montage/tsse/tsse_ipc.c:115:6: sparse: sparse: symbol 'ipc_hw_init' was not declared. Should it be static? drivers/crypto/montage/tsse/tsse_ipc.c:153:16: sparse: sparse: cast removes address space '__iomem' of expression drivers/crypto/montage/tsse/tsse_ipc.c:155:21: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got unsigned char [usertype] *[assigned] h2d @@ drivers/crypto/montage/tsse/tsse_ipc.c:155:21: sparse: expected void volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_ipc.c:155:21: sparse: got unsigned char [usertype] *[assigned] h2d drivers/crypto/montage/tsse/tsse_ipc.c:156:25: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got unsigned char [usertype] * @@ drivers/crypto/montage/tsse/tsse_ipc.c:156:25: sparse: expected void volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_ipc.c:156:25: sparse: got unsigned char [usertype] * drivers/crypto/montage/tsse/tsse_ipc.c:122:5: sparse: sparse: symbol 'ipc_init_msg' was not declared. Should it be static? -- >> drivers/crypto/montage/tsse/tsse_vuart.c:61:28: sparse: sparse: cast to restricted __le32 >> drivers/crypto/montage/tsse/tsse_vuart.c:73:15: sparse: sparse: incorrect type in assignment (different base types) @@ expected int value @@ got restricted __le32 [usertype] @@ drivers/crypto/montage/tsse/tsse_vuart.c:73:15: sparse: expected int value drivers/crypto/montage/tsse/tsse_vuart.c:73:15: sparse: got restricted __le32 [usertype] vim +/__iomem +40 drivers/crypto/montage/tsse/tsse_fw_service.c 25 26 int fw_send_msg(struct tsse_ipc *tsseipc, struct ipc_msg *msg) 27 { 28 u8 *h2d; 29 u32 int_reg; 30 u32 rc; 31 32 mutex_lock(&tsseipc->list_lock); 33 34 int_reg = readl(tsseipc->virt_addr + HOST2MAIN_INTR_SET_OFFSET); 35 if ((int_reg & IPC_REGISTER_INT_SET) != 0) { 36 rc = -1; 37 mutex_unlock(&tsseipc->list_lock); 38 return rc; 39 } > 40 h2d = (u8 *)(tsseipc->virt_addr + HOST2MAIN_IPC_OFFSET); 41 memcpy_toio(h2d, msg, sizeof(struct ipc_header)); > 42 memcpy_toio(h2d + sizeof(struct ipc_header), (u32 *)msg->i_data, 43 msg->header.i_len - sizeof(struct ipc_header)); 44 writel(0x1, tsseipc->virt_addr + HOST2MAIN_INTR_SET_OFFSET); 45 46 dev_info(tsseipc->dev, "notify device to get firmware\n"); 47 mutex_unlock(&tsseipc->list_lock); 48 return 0; 49 } 50 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()
by Yi Yang 10 Apr '25

10 Apr '25

From: Maurizio Lombardi <mlombard(a)redhat.com> mainline inclusion from mainline-v6.14-rc6 commit ad95bab0cd28ed77c2c0d0b6e76e03e031391064 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY43W CVE: CVE-2025-21927 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nvme_tcp_recv_pdu() doesn't check the validity of the header length. When header digests are enabled, a target might send a packet with an invalid header length (e.g. 255), causing nvme_tcp_verify_hdgst() to access memory outside the allocated area and cause memory corruptions by overwriting it with the calculated digest. Fix this by rejecting packets with an unexpected header length. Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver") Signed-off-by: Maurizio Lombardi <mlombard(a)redhat.com> Reviewed-by: Sagi Grimberg <sagi(a)grimberg.me> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/tcp.c [Confilcts dues to no backport of 363895767fbf("nvme-tcp: sanitize TLS key handling") and 84e009042d0f("nvme-tcp: add basic support for the C2HTermReq PDU")] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/nvme/host/tcp.c | 32 +++++++++++++++++++++++++++++--- 1 file changed, 29 insertions(+), 3 deletions(-) diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c index be04c5f3856d..6076c0d2d97a 100644 --- a/drivers/nvme/host/tcp.c +++ b/drivers/nvme/host/tcp.c @@ -189,6 +189,19 @@ static inline int nvme_tcp_queue_id(struct nvme_tcp_queue *queue) return queue - queue->ctrl->queues; } +static inline bool nvme_tcp_recv_pdu_supported(enum nvme_tcp_pdu_type type) +{ + switch (type) { + case nvme_tcp_c2h_term: + case nvme_tcp_c2h_data: + case nvme_tcp_r2t: + case nvme_tcp_rsp: + return true; + default: + return false; + } +} + static inline struct blk_mq_tags *nvme_tcp_tagset(struct nvme_tcp_queue *queue) { u32 queue_idx = nvme_tcp_queue_id(queue); @@ -728,6 +741,16 @@ static int nvme_tcp_recv_pdu(struct nvme_tcp_queue *queue, struct sk_buff *skb, return 0; hdr = queue->pdu; + if (unlikely(hdr->hlen != sizeof(struct nvme_tcp_rsp_pdu))) { + if (!nvme_tcp_recv_pdu_supported(hdr->type)) + goto unsupported_pdu; + + dev_err(queue->ctrl->ctrl.device, + "pdu type %d has unexpected header length (%d)\n", + hdr->type, hdr->hlen); + return -EPROTO; + } + if (queue->hdr_digest) { ret = nvme_tcp_verify_hdgst(queue, queue->pdu, hdr->hlen); if (unlikely(ret)) @@ -751,10 +774,13 @@ static int nvme_tcp_recv_pdu(struct nvme_tcp_queue *queue, struct sk_buff *skb, nvme_tcp_init_recv_ctx(queue); return nvme_tcp_handle_r2t(queue, (void *)queue->pdu); default: - dev_err(queue->ctrl->ctrl.device, - "unsupported pdu type (%d)\n", hdr->type); - return -EINVAL; + goto unsupported_pdu; } + +unsupported_pdu: + dev_err(queue->ctrl->ctrl.device, + "unsupported pdu type (%d)\n", hdr->type); + return -EINVAL; } static inline void nvme_tcp_end_request(struct request *rq, u16 status) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/3] Fix CVE-2023-52973 for openEuler-1.0-LTS
by Yi Yang 10 Apr '25

10 Apr '25

CVE-2023-52973 and later patches. George Kennedy (2): vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF vc_screen: modify vcs_size() handling in vcs_read() Thomas Weißschuh (1): vc_screen: don't clobber return value in vcs_read drivers/tty/vt/vc_screen.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 00/14] yt6801: Add Motorcomm yt6801 PCIe driver
by Frank Sae 10 Apr '25

10 Apr '25

This series includes adding Motorcomm YT6801 Gigabit ethernet driver and adding yt6801 ethernet driver entry in MAINTAINERS file. YT6801 integrates a YT8531S phy. Frank Sae (14): yt6801: Add support for a pci table in this module yt6801: Implement mdio register yt6801: Implement pci_driver shutdown yt6801: Implement the fxgmac_init function yt6801: Implement the .ndo_open function yt6801: Implement the fxgmac_start function net:phy:motorcomm: Add PHY_INTERFACE_MODE_INTERNAL to support YT6801 yt6801: Implement the fxgmac_hw_init function yt6801: Implement the poll functions yt6801: Implement .ndo_start_xmit function yt6801: Implement some net_device_ops function yt6801: Implement pci_driver suspend and resume yt6801: Add makefile and Kconfig yt6801: Update the Makefile, Kconfig and maintainer for yt6801 MAINTAINERS | 8 + arch/arm64/configs/openeuler_defconfig | 4 +- arch/powerpc/configs/openeuler_defconfig | 4 +- arch/riscv/configs/openeuler_defconfig | 4 +- arch/x86/configs/openeuler_defconfig | 4 +- drivers/net/ethernet/Kconfig | 1 + drivers/net/ethernet/Makefile | 1 + drivers/net/ethernet/motorcomm/Kconfig | 27 + drivers/net/ethernet/motorcomm/Makefile | 6 + .../net/ethernet/motorcomm/yt6801/Makefile | 8 + .../ethernet/motorcomm/yt6801/yt6801_desc.c | 565 ++++ .../ethernet/motorcomm/yt6801/yt6801_desc.h | 35 + .../ethernet/motorcomm/yt6801/yt6801_main.c | 3006 +++++++++++++++++ .../ethernet/motorcomm/yt6801/yt6801_type.h | 956 ++++++ drivers/net/phy/motorcomm.c | 6 + 15 files changed, 4631 insertions(+), 4 deletions(-) create mode 100644 drivers/net/ethernet/motorcomm/Kconfig create mode 100644 drivers/net/ethernet/motorcomm/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.h create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_type.h -- 2.34.1

2 15

[openeuler:openEuler-1.0-LTS 1571/1571] block/blk-lib.o: warning: objtool: __blkdev_issue_discard()+0x146: unreachable instruction
by kernel test robot 10 Apr '25

10 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 332043630ae1e3b726dde819c6cb60a99afb2ad6 commit: dadc407ba9ceb5887da2bd4e4eedcf332bf47151 [1571/1571] block: check queue's limits.discard_granularity in __blkdev_issue_discard() config: x86_64-buildonly-randconfig-006-20250408 (https://download.01.org/0day-ci/archive/20250410/202504100333.uIAnI5Io-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250410/202504100333.uIAnI5Io-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504100333.uIAnI5Io-lkp@intel.com/ All warnings (new ones prefixed by >>): >> block/blk-lib.o: warning: objtool: __blkdev_issue_discard()+0x146: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1571/1571] mm/mincore.o: warning: objtool: mincore_pte_range()+0x154: unreachable instruction
by kernel test robot 09 Apr '25

09 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 332043630ae1e3b726dde819c6cb60a99afb2ad6 commit: 274fe639155078e031602764bfad9217e57d8160 [1571/1571] Revert "Change mincore() to count "mapped" pages rather than "cached" pages" config: x86_64-buildonly-randconfig-006-20250408 (https://download.01.org/0day-ci/archive/20250409/202504092107.ks7cBbF1-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250409/202504092107.ks7cBbF1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504092107.ks7cBbF1-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/mincore.o: warning: objtool: mincore_pte_range()+0x154: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] LoongArch: Set hugetlb mmap base address aligned with pmd size
by Zeng Heng 09 Apr '25

09 Apr '25

From: Bibo Mao <maobibo(a)loongson.cn> mainline inclusion from mainline-v6.14-rc6 commit 3109d5ff484b7bc7b955f166974c6776d91f247b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY44L CVE: CVE-2025-21949 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- With ltp test case "testcases/bin/hugefork02", there is a dmesg error report message such as: kernel BUG at mm/hugetlb.c:5550! Oops - BUG[#1]: CPU: 0 UID: 0 PID: 1517 Comm: hugefork02 Not tainted 6.14.0-rc2+ #241 Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022 pc 90000000004eaf1c ra 9000000000485538 tp 900000010edbc000 sp 900000010edbf940 a0 900000010edbfb00 a1 9000000108d20280 a2 00007fffe9474000 a3 00007ffff3474000 a4 0000000000000000 a5 0000000000000003 a6 00000000003cadd3 a7 0000000000000000 t0 0000000001ffffff t1 0000000001474000 t2 900000010ecd7900 t3 00007fffe9474000 t4 00007fffe9474000 t5 0000000000000040 t6 900000010edbfb00 t7 0000000000000001 t8 0000000000000005 u0 90000000004849d0 s9 900000010edbfa00 s0 9000000108d20280 s1 00007fffe9474000 s2 0000000002000000 s3 9000000108d20280 s4 9000000002b38b10 s5 900000010edbfb00 s6 00007ffff3474000 s7 0000000000000406 s8 900000010edbfa08 ra: 9000000000485538 unmap_vmas+0x130/0x218 ERA: 90000000004eaf1c __unmap_hugepage_range+0x6f4/0x7d0 PRMD: 00000004 (PPLV0 +PIE -PWE) EUEN: 00000007 (+FPE +SXE +ASXE -BTE) ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7) ESTAT: 000c0000 [BRK] (IS= ECode=12 EsubCode=0) PRID: 0014c010 (Loongson-64bit, Loongson-3A5000) Process hugefork02 (pid: 1517, threadinfo=00000000a670eaf4, task=000000007a95fc64) Call Trace: [<90000000004eaf1c>] __unmap_hugepage_range+0x6f4/0x7d0 [<9000000000485534>] unmap_vmas+0x12c/0x218 [<9000000000494068>] exit_mmap+0xe0/0x308 [<900000000025fdc4>] mmput+0x74/0x180 [<900000000026a284>] do_exit+0x294/0x898 [<900000000026aa30>] do_group_exit+0x30/0x98 [<900000000027bed4>] get_signal+0x83c/0x868 [<90000000002457b4>] arch_do_signal_or_restart+0x54/0xfa0 [<90000000015795e8>] irqentry_exit_to_user_mode+0xb8/0x138 [<90000000002572d0>] tlb_do_page_fault_1+0x114/0x1b4 The problem is that base address allocated from hugetlbfs is not aligned with pmd size. Here add a checking for hugetlbfs and align base address with pmd size. After this patch the test case "testcases/bin/hugefork02" passes to run. This is similar to the commit 7f24cbc9c4d42db8a3c8484d1 ("mm/mmap: teach generic_get_unmapped_area{_topdown} to handle hugetlb mappings"). Cc: stable(a)vger.kernel.org # 6.13+ Signed-off-by: Bibo Mao <maobibo(a)loongson.cn> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Conflicts: arch/loongarch/mm/mmap.c [Fix context conflict.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/loongarch/mm/mmap.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/loongarch/mm/mmap.c b/arch/loongarch/mm/mmap.c index a9630a81b38a..01c20564f4b6 100644 --- a/arch/loongarch/mm/mmap.c +++ b/arch/loongarch/mm/mmap.c @@ -3,6 +3,7 @@ * Copyright (C) 2020-2022 Loongson Technology Corporation Limited */ #include <linux/export.h> +#include <linux/hugetlb.h> #include <linux/io.h> #include <linux/memblock.h> #include <linux/mm.h> @@ -62,8 +63,11 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp, } info.length = len; - info.align_mask = do_color_align ? (PAGE_MASK & SHM_ALIGN_MASK) : 0; info.align_offset = pgoff << PAGE_SHIFT; + if (filp && is_file_hugepages(filp)) + info.align_mask = huge_page_mask_align(filp); + else + info.align_mask = do_color_align ? (PAGE_MASK & SHM_ALIGN_MASK) : 0; if (dir == DOWN) { info.flags = VM_UNMAPPED_AREA_TOPDOWN; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] io_uring: prevent opcode speculation
by Long Li 09 Apr '25

09 Apr '25

From: Pavel Begunkov <asml.silence(a)gmail.com> mainline inclusion from mainline-v6.10-rc2 commit 1e988c3fe1264708f4f92109203ac5b1d65de50b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSVZU CVE: CVE-2025-21863 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- sqe->opcode is used for different tables, make sure we santitise it against speculations. Cc: stable(a)vger.kernel.org Fixes: d3656344fea03 ("io_uring: add lookup table for various opcode needs") Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Reviewed-by: Li Zetao <lizetao1(a)huawei.com> Link: https://lore.kernel.org/r/7eddbf31c8ca0a3947f8ed98271acc2b4349c016.17395684… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: io_uring/io_uring.c fs/io_uring.c [Context conflict] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/io_uring.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/io_uring.c b/fs/io_uring.c index 96255b816d71..470d50c0b4c3 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -6390,6 +6390,8 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, if (unlikely(sqe_flags & ~SQE_VALID_FLAGS)) return -EINVAL; + req->opcode = array_index_nospec(req->opcode, IORING_OP_LAST); + if ((sqe_flags & IOSQE_BUFFER_SELECT) && !io_op_defs[req->opcode].buffer_select) return -EOPNOTSUPP; -- 2.39.2

2 1

openEuler Kernel SIG双周例会
by openEuler conference 09 Apr '25

09 Apr '25

您好！ Kernel 邀请您参加 2025-04-11 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复此邮件申报，或者直接填报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/960387240 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2025-04-11 14:00, The subject of the conference is openEuler Kernel SIG双周例会 Summary: 1. 进展update 2. 议题征集中（新增议题可回复此邮件申报，或者直接填报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/960387240 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-6.6 00/17] fs/resctrl: Introduce the resctrl_feat_type
by Zeng Heng 09 Apr '25

09 Apr '25

Zeng Heng (17): arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait() arm64/mpam: fix impossible condition in get_cpumask_from_cache_id() arm64/mpam: fix impossible condition in resctrl_arch_rmid_read() arm64/mpam: Optimize CSU/MBWU monitor multiplexing fs/resctrl: Determine whether the MBM monitors require overflow checking arm64/mpam: Set the cpbm width of msc class with the minimum arm64/mpam: Correct the judgment condition of the CMAX feature fs/resctrl: Fix kmemleak caused by closid_init() fs/resctrl: Introduce the resctrl_feat_type fs/resctrl: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add CMAX feature arm64/mpam: Add PBM feature arm64/mpam: Add limit feature arm64/mpam: Fix allocated cache size information fs/resctrl: Fix configuration to wrong control group when CDP is enabled arm64/mpam: Add debugging information about CDP monitor value arch/x86/include/asm/resctrl.h | 29 ++ arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 39 +-- drivers/platform/mpam/mpam_devices.c | 101 +++++-- drivers/platform/mpam/mpam_internal.h | 25 +- drivers/platform/mpam/mpam_resctrl.c | 347 +++++++++++++++++----- fs/resctrl/ctrlmondata.c | 141 ++++++++- fs/resctrl/monitor.c | 5 +- fs/resctrl/rdtgroup.c | 135 +++++---- include/linux/arm_mpam.h | 7 + include/linux/resctrl.h | 17 +- include/linux/resctrl_types.h | 10 + 11 files changed, 661 insertions(+), 195 deletions(-) -- 2.25.1

2 18

[PATCH OLK-6.6 00/17] fs/resctrl: Introduce the resctrl_feat_type
by Zeng Heng 09 Apr '25

09 Apr '25

Zeng Heng (17): arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait() arm64/mpam: fix impossible condition in get_cpumask_from_cache_id() arm64/mpam: fix impossible condition in resctrl_arch_rmid_read() arm64/mpam: Optimize CSU/MBWU monitor multiplexing fs/resctrl: Determine whether the MBM monitors require overflow checking arm64/mpam: Set the cpbm width of msc class with the minimum arm64/mpam: Correct the judgment condition of the CMAX feature fs/resctrl: Fix kmemleak caused by closid_init() fs/resctrl: Introduce the resctrl_feat_type fs/resctrl: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add CMAX feature arm64/mpam: Add PBM feature arm64/mpam: Add limit feature arm64/mpam: Fix allocated cache size information fs/resctrl: Fix configuration to wrong control group when CDP is enabled arm64/mpam: Add debugging information about CDP monitor value arch/x86/include/asm/resctrl.h | 29 ++ arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 39 +-- drivers/platform/mpam/mpam_devices.c | 101 +++++-- drivers/platform/mpam/mpam_internal.h | 25 +- drivers/platform/mpam/mpam_resctrl.c | 347 +++++++++++++++++----- fs/resctrl/ctrlmondata.c | 141 ++++++++- fs/resctrl/monitor.c | 5 +- fs/resctrl/rdtgroup.c | 135 +++++---- include/linux/arm_mpam.h | 7 + include/linux/resctrl.h | 17 +- include/linux/resctrl_types.h | 10 + 11 files changed, 661 insertions(+), 195 deletions(-) -- 2.25.1

2 18

[openeuler:openEuler-1.0-LTS 1571/1571] drivers/usb/typec/tps6598x.o: warning: objtool: tps6598x_probe()+0x1ed: can't find switch jump table
by kernel test robot 09 Apr '25

09 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bf266d800949a86365ca698efe637ca1256d1706 commit: 10379cc2b54aefd096d8f00b7e3bd25b3dc6632d [1571/1571] drivers/usb/typec/tps6598x.c: fix portinfo width config: x86_64-buildonly-randconfig-002-20250408 (https://download.01.org/0day-ci/archive/20250409/202504090456.GrQ4Fosx-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250409/202504090456.GrQ4Fosx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504090456.GrQ4Fosx-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/usb/typec/tps6598x.o: warning: objtool: tps6598x_probe()+0x1ed: can't find switch jump table -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1546/1546] net/netfilter/nft_chain_filter.o: warning: objtool: missing symbol for section .text
by kernel test robot 09 Apr '25

09 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bf266d800949a86365ca698efe637ca1256d1706 commit: d209df3e7f7002d9099fdb0f6df0f972b4386a63 [1546/1546] netfilter: nf_tables: fix register ordering config: x86_64-buildonly-randconfig-006-20250401 (https://download.01.org/0day-ci/archive/20250409/202504090250.JNCrFcpX-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250409/202504090250.JNCrFcpX-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504090250.JNCrFcpX-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/netfilter/nft_chain_filter.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] dm raid: fix accesses beyond end of raid member array
by Yuan Can 08 Apr '25

08 Apr '25

From: Heinz Mauelshagen <heinzm(a)redhat.com> stable inclusion from stable-v4.19.251 commit df1a5ab0dd0775f2ea101c71f2addbc4c0ea0f85 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP60S CVE: CVE-2022-49674 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 332bd0778775d0cf105c4b9e03e460b590749916 upstream. On dm-raid table load (using raid_ctr), dm-raid allocates an array rs->devs[rs->raid_disks] for the raid device members. rs->raid_disks is defined by the number of raid metadata and image tupples passed into the target's constructor. In the case of RAID layout changes being requested, that number can be different from the current number of members for existing raid sets as defined in their superblocks. Example RAID layout changes include: - raid1 legs being added/removed - raid4/5/6/10 number of stripes changed (stripe reshaping) - takeover to higher raid level (e.g. raid5 -> raid6) When accessing array members, rs->raid_disks must be used in control loops instead of the potentially larger value in rs->md.raid_disks. Otherwise it will cause memory access beyond the end of the rs->devs array. Fix this by changing code that is prone to out-of-bounds access. Also fix validate_raid_redundancy() to validate all devices that are added. Also, use braces to help clean up raid_iterate_devices(). The out-of-bounds memory accesses was discovered using KASAN. This commit was verified to pass all LVM2 RAID tests (with KASAN enabled). Cc: stable(a)vger.kernel.org Signed-off-by: Heinz Mauelshagen <heinzm(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/md/dm-raid.c | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c index cb34dbf8bf31..9a5d65d2223b 100644 --- a/drivers/md/dm-raid.c +++ b/drivers/md/dm-raid.c @@ -998,12 +998,13 @@ static int validate_region_size(struct raid_set *rs, unsigned long region_size) static int validate_raid_redundancy(struct raid_set *rs) { unsigned int i, rebuild_cnt = 0; - unsigned int rebuilds_per_group = 0, copies; + unsigned int rebuilds_per_group = 0, copies, raid_disks; unsigned int group_size, last_group_start; - for (i = 0; i < rs->md.raid_disks; i++) - if (!test_bit(In_sync, &rs->dev[i].rdev.flags) || - !rs->dev[i].rdev.sb_page) + for (i = 0; i < rs->raid_disks; i++) + if (!test_bit(FirstUse, &rs->dev[i].rdev.flags) && + ((!test_bit(In_sync, &rs->dev[i].rdev.flags) || + !rs->dev[i].rdev.sb_page))) rebuild_cnt++; switch (rs->md.level) { @@ -1043,8 +1044,9 @@ static int validate_raid_redundancy(struct raid_set *rs) * A A B B C * C D D E E */ + raid_disks = min(rs->raid_disks, rs->md.raid_disks); if (__is_raid10_near(rs->md.new_layout)) { - for (i = 0; i < rs->md.raid_disks; i++) { + for (i = 0; i < raid_disks; i++) { if (!(i % copies)) rebuilds_per_group = 0; if ((!rs->dev[i].rdev.sb_page || @@ -1067,10 +1069,10 @@ static int validate_raid_redundancy(struct raid_set *rs) * results in the need to treat the last (potentially larger) * set differently. */ - group_size = (rs->md.raid_disks / copies); - last_group_start = (rs->md.raid_disks / group_size) - 1; + group_size = (raid_disks / copies); + last_group_start = (raid_disks / group_size) - 1; last_group_start *= group_size; - for (i = 0; i < rs->md.raid_disks; i++) { + for (i = 0; i < raid_disks; i++) { if (!(i % copies) && !(i > last_group_start)) rebuilds_per_group = 0; if ((!rs->dev[i].rdev.sb_page || @@ -1585,7 +1587,7 @@ static sector_t __rdev_sectors(struct raid_set *rs) { int i; - for (i = 0; i < rs->md.raid_disks; i++) { + for (i = 0; i < rs->raid_disks; i++) { struct md_rdev *rdev = &rs->dev[i].rdev; if (!test_bit(Journal, &rdev->flags) && @@ -3748,13 +3750,13 @@ static int raid_iterate_devices(struct dm_target *ti, unsigned int i; int r = 0; - for (i = 0; !r && i < rs->md.raid_disks; i++) - if (rs->dev[i].data_dev) - r = fn(ti, - rs->dev[i].data_dev, - 0, /* No offset on data devs */ - rs->md.dev_sectors, - data); + for (i = 0; !r && i < rs->raid_disks; i++) { + if (rs->dev[i].data_dev) { + r = fn(ti, rs->dev[i].data_dev, + 0, /* No offset on data devs */ + rs->md.dev_sectors, data); + } + } return r; } -- 2.22.0

2 1

[PATCH OLK-6.6] ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()
by Ye Bin 08 Apr '25

08 Apr '25

From: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> stable inclusion from stable-v6.6.80 commit 2b3878baf90918a361a3dfd3513025100b1b40b6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSW0Q CVE: CVE-2025-21847 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d8d99c3b5c485f339864aeaa29f76269cc0ea975 upstream. The nullity of sps->cstream should be checked similarly as it is done in sof_set_stream_data_offset() function. Assuming that it is not NULL if sps->stream is NULL is incorrect and can lead to NULL pointer dereference. Fixes: 090349a9feba ("ASoC: SOF: Add support for compress API for stream data/offset") Cc: stable(a)vger.kernel.org Reported-by: Curtis Malainey <cujomalainey(a)chromium.org> Closes: https://github.com/thesofproject/linux/pull/5214 Signed-off-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Reviewed-by: Daniel Baluta <daniel.baluta(a)nxp.com> Reviewed-by: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Reviewed-by: Bard Liao <yung-chuan.liao(a)linux.intel.com> Reviewed-by: Curtis Malainey <cujomalainey(a)chromium.org> Link: https://patch.msgid.link/20250205135232.19762-2-peter.ujfalusi@linux.intel.… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- sound/soc/sof/stream-ipc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sound/soc/sof/stream-ipc.c b/sound/soc/sof/stream-ipc.c index 216b454f6b94..3edcb0ea3848 100644 --- a/sound/soc/sof/stream-ipc.c +++ b/sound/soc/sof/stream-ipc.c @@ -43,7 +43,7 @@ int sof_ipc_msg_data(struct snd_sof_dev *sdev, return -ESTRPIPE; posn_offset = stream->posn_offset; - } else { + } else if (sps->cstream) { struct sof_compr_stream *sstream = sps->cstream->runtime->private_data; @@ -51,6 +51,10 @@ int sof_ipc_msg_data(struct snd_sof_dev *sdev, return -ESTRPIPE; posn_offset = sstream->posn_offset; + + } else { + dev_err(sdev->dev, "%s: No stream opened\n", __func__); + return -EINVAL; } snd_sof_dsp_mailbox_read(sdev, posn_offset, p, sz); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
by Ye Bin 08 Apr '25

08 Apr '25

From: Minsuk Kang <linuxlovemin(a)yonsei.ac.kr> mainline inclusion from mainline-v6.2-rc1 commit 4920ab131b2dbae7464b72bdcac465d070254209 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVYB CVE: CVE-2022-49740 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This patch fixes slab-out-of-bounds reads in brcmfmac that occur in brcmf_construct_chaninfo() and brcmf_enable_bw40_2g() when the count value of channel specifications provided by the device is greater than the length of 'list->element[]', decided by the size of the 'list' allocated with kzalloc(). The patch adds checks that make the functions free the buffer and return -EINVAL if that is the case. Note that the negative return is handled by the caller, brcmf_setup_wiphybands() or brcmf_cfg80211_attach(). Found by a modified version of syzkaller. Crash Report from brcmf_construct_chaninfo(): ================================================================== BUG: KASAN: slab-out-of-bounds in brcmf_setup_wiphybands+0x1238/0x1430 Read of size 4 at addr ffff888115f24600 by task kworker/0:2/1896 CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G W O 5.14.0+ #132 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Workqueue: usb_hub_wq hub_event Call Trace: dump_stack_lvl+0x57/0x7d print_address_description.constprop.0.cold+0x93/0x334 kasan_report.cold+0x83/0xdf brcmf_setup_wiphybands+0x1238/0x1430 brcmf_cfg80211_attach+0x2118/0x3fd0 brcmf_attach+0x389/0xd40 brcmf_usb_probe+0x12de/0x1690 usb_probe_interface+0x25f/0x710 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_set_configuration+0x984/0x1770 usb_generic_driver_probe+0x69/0x90 usb_probe_device+0x9c/0x220 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_new_device.cold+0x463/0xf66 hub_event+0x10d5/0x3330 process_one_work+0x873/0x13e0 worker_thread+0x8b/0xd10 kthread+0x379/0x450 ret_from_fork+0x1f/0x30 Allocated by task 1896: kasan_save_stack+0x1b/0x40 __kasan_kmalloc+0x7c/0x90 kmem_cache_alloc_trace+0x19e/0x330 brcmf_setup_wiphybands+0x290/0x1430 brcmf_cfg80211_attach+0x2118/0x3fd0 brcmf_attach+0x389/0xd40 brcmf_usb_probe+0x12de/0x1690 usb_probe_interface+0x25f/0x710 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_set_configuration+0x984/0x1770 usb_generic_driver_probe+0x69/0x90 usb_probe_device+0x9c/0x220 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_new_device.cold+0x463/0xf66 hub_event+0x10d5/0x3330 process_one_work+0x873/0x13e0 worker_thread+0x8b/0xd10 kthread+0x379/0x450 ret_from_fork+0x1f/0x30 The buggy address belongs to the object at ffff888115f24000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1536 bytes inside of 2048-byte region [ffff888115f24000, ffff888115f24800) Memory state around the buggy address: ffff888115f24500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888115f24580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888115f24600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888115f24680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888115f24700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== Crash Report from brcmf_enable_bw40_2g(): ================================================================== BUG: KASAN: slab-out-of-bounds in brcmf_cfg80211_attach+0x3d11/0x3fd0 Read of size 4 at addr ffff888103787600 by task kworker/0:2/1896 CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G W O 5.14.0+ #132 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Workqueue: usb_hub_wq hub_event Call Trace: dump_stack_lvl+0x57/0x7d print_address_description.constprop.0.cold+0x93/0x334 kasan_report.cold+0x83/0xdf brcmf_cfg80211_attach+0x3d11/0x3fd0 brcmf_attach+0x389/0xd40 brcmf_usb_probe+0x12de/0x1690 usb_probe_interface+0x25f/0x710 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_set_configuration+0x984/0x1770 usb_generic_driver_probe+0x69/0x90 usb_probe_device+0x9c/0x220 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_new_device.cold+0x463/0xf66 hub_event+0x10d5/0x3330 process_one_work+0x873/0x13e0 worker_thread+0x8b/0xd10 kthread+0x379/0x450 ret_from_fork+0x1f/0x30 Allocated by task 1896: kasan_save_stack+0x1b/0x40 __kasan_kmalloc+0x7c/0x90 kmem_cache_alloc_trace+0x19e/0x330 brcmf_cfg80211_attach+0x3302/0x3fd0 brcmf_attach+0x389/0xd40 brcmf_usb_probe+0x12de/0x1690 usb_probe_interface+0x25f/0x710 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_set_configuration+0x984/0x1770 usb_generic_driver_probe+0x69/0x90 usb_probe_device+0x9c/0x220 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_new_device.cold+0x463/0xf66 hub_event+0x10d5/0x3330 process_one_work+0x873/0x13e0 worker_thread+0x8b/0xd10 kthread+0x379/0x450 ret_from_fork+0x1f/0x30 The buggy address belongs to the object at ffff888103787000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1536 bytes inside of 2048-byte region [ffff888103787000, ffff888103787800) Memory state around the buggy address: ffff888103787500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888103787580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888103787600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888103787680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888103787700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== Reported-by: Dokyung Song <dokyungs(a)yonsei.ac.kr> Reported-by: Jisoo Jang <jisoo.jang(a)yonsei.ac.kr> Reported-by: Minsuk Kang <linuxlovemin(a)yonsei.ac.kr> Reviewed-by: Arend van Spriel <arend.vanspriel(a)broadcom.com> Signed-off-by: Minsuk Kang <linuxlovemin(a)yonsei.ac.kr> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://lore.kernel.org/r/20221116142952.518241-1-linuxlovemin@yonsei.ac.kr Conflicts: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c [Fix context diff and change brcmf_err() to print error info] Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c index 8f2cc54836cc..e6ff4c64738e 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -96,6 +96,9 @@ #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \ (sizeof(struct brcmf_assoc_params_le) - sizeof(u16)) +#define BRCMF_MAX_CHANSPEC_LIST \ + (BRCMF_DCMD_MEDLEN / sizeof(__le32) - 1) + static bool check_vif_up(struct brcmf_cfg80211_vif *vif) { if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) { @@ -5961,6 +5964,13 @@ static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg, band->channels[i].flags = IEEE80211_CHAN_DISABLED; total = le32_to_cpu(list->count); + if (total > BRCMF_MAX_CHANSPEC_LIST) { + brcmf_err("Invalid count of channel Spec. (%u)\n", + total); + err = -EINVAL; + goto fail_pbuf; + } + for (i = 0; i < total; i++) { ch.chspec = (u16)le32_to_cpu(list->element[i]); cfg->d11inf.decchspec(&ch); @@ -6094,6 +6104,13 @@ static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg) band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ]; list = (struct brcmf_chanspec_list *)pbuf; num_chan = le32_to_cpu(list->count); + if (num_chan > BRCMF_MAX_CHANSPEC_LIST) { + brcmf_err("Invalid count of channel Spec. (%u)\n", + num_chan); + kfree(pbuf); + return -EINVAL; + } + for (i = 0; i < num_chan; i++) { ch.chspec = (u16)le32_to_cpu(list->element[i]); cfg->d11inf.decchspec(&ch); -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] fix CVE-2025-21883
by Ye Bin 08 Apr '25

08 Apr '25

Marcin Szycik (1): ice: Fix deinitializing VF in error path Paul Greenwalt (2): ice: Add E830 device IDs, MAC type and registers ice: add E830 HW VF mailbox message limit support drivers/net/ethernet/intel/ice/ice.h | 1 + drivers/net/ethernet/intel/ice/ice_common.c | 71 ++++++++++++------- drivers/net/ethernet/intel/ice/ice_devids.h | 10 ++- .../net/ethernet/intel/ice/ice_ethtool_fdir.c | 24 ++++--- .../net/ethernet/intel/ice/ice_hw_autogen.h | 55 ++++++++++---- drivers/net/ethernet/intel/ice/ice_lib.c | 3 + drivers/net/ethernet/intel/ice/ice_main.c | 37 ++++++---- drivers/net/ethernet/intel/ice/ice_sriov.c | 4 +- drivers/net/ethernet/intel/ice/ice_type.h | 3 +- drivers/net/ethernet/intel/ice/ice_vf_lib.c | 34 ++++++++- .../ethernet/intel/ice/ice_vf_lib_private.h | 1 + drivers/net/ethernet/intel/ice/ice_vf_mbx.c | 32 +++++++++ drivers/net/ethernet/intel/ice/ice_vf_mbx.h | 9 +++ drivers/net/ethernet/intel/ice/ice_virtchnl.c | 8 ++- .../ethernet/intel/ice/ice_virtchnl_fdir.c | 29 +++++--- 15 files changed, 245 insertions(+), 76 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6] rapidio: add check for rio_add_net() in rio_scan_alloc_net()
by Zeng Heng 08 Apr '25

08 Apr '25

From: Haoxiang Li <haoxiang_li2024(a)163.com> stable inclusion from stable-v6.6.83 commit e6411c3b9512dba09af7d014d474516828c89706 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY43D CVE: CVE-2025-21935 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e842f9a1edf306bf36fe2a4d847a0b0d458770de upstream. The return value of rio_add_net() should be checked. If it fails, put_device() should be called to free the memory and give up the reference initialized in rio_add_net(). Link: https://lkml.kernel.org/r/20250227041131.3680761-1-haoxiang_li2024@163.com Fixes: e6b585ca6e81 ("rapidio: move net allocation into core code") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Haoxiang Li <haoxiang_li2024(a)163.com> Cc: Alexandre Bounine <alex.bou9(a)gmail.com> Cc: Matt Porter <mporter(a)kernel.crashing.org> Cc: Dan Carpenter <dan.carpenter(a)linaro.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/rapidio/rio-scan.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c index fdcf742b2adb..c12941f71e2c 100644 --- a/drivers/rapidio/rio-scan.c +++ b/drivers/rapidio/rio-scan.c @@ -871,7 +871,10 @@ static struct rio_net *rio_scan_alloc_net(struct rio_mport *mport, dev_set_name(&net->dev, "rnet_%d", net->id); net->dev.parent = &mport->dev; net->dev.release = rio_scan_release_dev; - rio_add_net(net); + if (rio_add_net(net)) { + put_device(&net->dev); + net = NULL; + } } return net; -- 2.25.1

2 1

[PATCH OLK-5.10] rapidio: add check for rio_add_net() in rio_scan_alloc_net()
by Zeng Heng 08 Apr '25

08 Apr '25

From: Haoxiang Li <haoxiang_li2024(a)163.com> stable inclusion from stable-v5.10.235 commit 4f3509cfcc02e9d757f2714bb7dbbeec35de6fa7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY43D CVE: CVE-2025-21935 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e842f9a1edf306bf36fe2a4d847a0b0d458770de upstream. The return value of rio_add_net() should be checked. If it fails, put_device() should be called to free the memory and give up the reference initialized in rio_add_net(). Link: https://lkml.kernel.org/r/20250227041131.3680761-1-haoxiang_li2024@163.com Fixes: e6b585ca6e81 ("rapidio: move net allocation into core code") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Haoxiang Li <haoxiang_li2024(a)163.com> Cc: Alexandre Bounine <alex.bou9(a)gmail.com> Cc: Matt Porter <mporter(a)kernel.crashing.org> Cc: Dan Carpenter <dan.carpenter(a)linaro.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/rapidio/rio-scan.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c index fdcf742b2adb..c12941f71e2c 100644 --- a/drivers/rapidio/rio-scan.c +++ b/drivers/rapidio/rio-scan.c @@ -871,7 +871,10 @@ static struct rio_net *rio_scan_alloc_net(struct rio_mport *mport, dev_set_name(&net->dev, "rnet_%d", net->id); net->dev.parent = &mport->dev; net->dev.release = rio_scan_release_dev; - rio_add_net(net); + if (rio_add_net(net)) { + put_device(&net->dev); + net = NULL; + } } return net; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/3] CVE-2022-49647
by Chen Ridong 08 Apr '25

08 Apr '25

CVE-2022-49647 Chen Ridong (2): cgroup: fix kabi for css_set cgroup: disable cgroup.type Tejun Heo (1): cgroup: Use separate src/dst nodes when preloading css_sets for migration include/linux/cgroup-defs.h | 13 +++++++++++ kernel/cgroup/cgroup.c | 43 +++++++++++++++++++++++++------------ 2 files changed, 42 insertions(+), 14 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] drm/drm_vma_manager: Add drm_vma_node_allow_once()
by Yang Yingliang 08 Apr '25

08 Apr '25

From: Nirmoy Das <nirmoy.das(a)intel.com> mainline inclusion from mainline-v6.2-rc6 commit 899d3a3c19ac0e5da013ce34833dccb97d19b5e4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVX3 CVE: CVE-2023-53001 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently there is no easy way for a drm driver to safely check and allow drm_vma_offset_node for a drm file just once. Allow drm drivers to call non-refcounted version of drm_vma_node_allow() so that a driver doesn't need to keep track of each drm_vma_node_allow() to call subsequent drm_vma_node_revoke() to prevent memory leak. Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> Cc: Maxime Ripard <mripard(a)kernel.org> Cc: Thomas Zimmermann <tzimmermann(a)suse.de> Cc: David Airlie <airlied(a)gmail.com> Cc: Daniel Vetter <daniel(a)ffwll.ch> Cc: Tvrtko Ursulin <tvrtko.ursulin(a)linux.intel.com> Cc: Andi Shyti <andi.shyti(a)linux.intel.com> Suggested-by: Chris Wilson <chris.p.wilson(a)intel.com> Signed-off-by: Nirmoy Das <nirmoy.das(a)intel.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com> Reviewed-by: Andi Shyti <andi.shyti(a)linux.intel.com> Link: https://lore.kernel.org/r/20230117175236.22317-1-nirmoy.das@intel.com Signed-off-by: Maxime Ripard <maxime(a)cerno.tech> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/gpu/drm/drm_vma_manager.c | 76 ++++++++++++++++++++++--------- include/drm/drm_vma_manager.h | 1 + 2 files changed, 55 insertions(+), 22 deletions(-) diff --git a/drivers/gpu/drm/drm_vma_manager.c b/drivers/gpu/drm/drm_vma_manager.c index 4565319fa6b3..7f0dc56321ae 100644 --- a/drivers/gpu/drm/drm_vma_manager.c +++ b/drivers/gpu/drm/drm_vma_manager.c @@ -240,27 +240,8 @@ void drm_vma_offset_remove(struct drm_vma_offset_manager *mgr, } EXPORT_SYMBOL(drm_vma_offset_remove); -/** - * drm_vma_node_allow - Add open-file to list of allowed users - * @node: Node to modify - * @tag: Tag of file to remove - * - * Add @tag to the list of allowed open-files for this node. If @tag is - * already on this list, the ref-count is incremented. - * - * The list of allowed-users is preserved across drm_vma_offset_add() and - * drm_vma_offset_remove() calls. You may even call it if the node is currently - * not added to any offset-manager. - * - * You must remove all open-files the same number of times as you added them - * before destroying the node. Otherwise, you will leak memory. - * - * This is locked against concurrent access internally. - * - * RETURNS: - * 0 on success, negative error code on internal failure (out-of-mem) - */ -int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag) +static int vma_node_allow(struct drm_vma_offset_node *node, + struct drm_file *tag, bool ref_counted) { struct rb_node **iter; struct rb_node *parent = NULL; @@ -282,7 +263,8 @@ int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag) entry = rb_entry(*iter, struct drm_vma_offset_file, vm_rb); if (tag == entry->vm_tag) { - entry->vm_count++; + if (ref_counted) + entry->vm_count++; goto unlock; } else if (tag > entry->vm_tag) { iter = &(*iter)->rb_right; @@ -307,8 +289,58 @@ int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag) kfree(new); return ret; } + +/** + * drm_vma_node_allow - Add open-file to list of allowed users + * @node: Node to modify + * @tag: Tag of file to remove + * + * Add @tag to the list of allowed open-files for this node. If @tag is + * already on this list, the ref-count is incremented. + * + * The list of allowed-users is preserved across drm_vma_offset_add() and + * drm_vma_offset_remove() calls. You may even call it if the node is currently + * not added to any offset-manager. + * + * You must remove all open-files the same number of times as you added them + * before destroying the node. Otherwise, you will leak memory. + * + * This is locked against concurrent access internally. + * + * RETURNS: + * 0 on success, negative error code on internal failure (out-of-mem) + */ +int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag) +{ + return vma_node_allow(node, tag, true); +} EXPORT_SYMBOL(drm_vma_node_allow); +/** + * drm_vma_node_allow_once - Add open-file to list of allowed users + * @node: Node to modify + * @tag: Tag of file to remove + * + * Add @tag to the list of allowed open-files for this node. + * + * The list of allowed-users is preserved across drm_vma_offset_add() and + * drm_vma_offset_remove() calls. You may even call it if the node is currently + * not added to any offset-manager. + * + * This is not ref-counted unlike drm_vma_node_allow() hence drm_vma_node_revoke() + * should only be called once after this. + * + * This is locked against concurrent access internally. + * + * RETURNS: + * 0 on success, negative error code on internal failure (out-of-mem) + */ +int drm_vma_node_allow_once(struct drm_vma_offset_node *node, struct drm_file *tag) +{ + return vma_node_allow(node, tag, false); +} +EXPORT_SYMBOL(drm_vma_node_allow_once); + /** * drm_vma_node_revoke - Remove open-file from list of allowed users * @node: Node to modify diff --git a/include/drm/drm_vma_manager.h b/include/drm/drm_vma_manager.h index 76ac5e97a559..ed54bce9a005 100644 --- a/include/drm/drm_vma_manager.h +++ b/include/drm/drm_vma_manager.h @@ -74,6 +74,7 @@ void drm_vma_offset_remove(struct drm_vma_offset_manager *mgr, struct drm_vma_offset_node *node); int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag); +int drm_vma_node_allow_once(struct drm_vma_offset_node *node, struct drm_file *tag); void drm_vma_node_revoke(struct drm_vma_offset_node *node, struct drm_file *tag); bool drm_vma_node_is_allowed(struct drm_vma_offset_node *node, -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/3] CVE-2022-49647
by Chen Ridong 08 Apr '25

08 Apr '25

CVE-2022-49647 Chen Ridong (2): cgroup: fix kabi for css_set cgroup: disable cgroup.type Tejun Heo (1): cgroup: Use separate src/dst nodes when preloading css_sets for migration include/linux/cgroup-defs.h | 13 +++++++++++ kernel/cgroup/cgroup.c | 43 +++++++++++++++++++++++++------------ 2 files changed, 42 insertions(+), 14 deletions(-) -- 2.34.1

2 4

[openeuler:openEuler-1.0-LTS 1568/1568] drivers/spi/spi-phytium-plat.c:122:8: error: implicit declaration of function 'gpiod_count'
by kernel test robot 08 Apr '25

08 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3191c9e4e7c581bfe0a40ee198ffcbd5c3dea53e commit: e8483fcd43fc1dbb8d21bb7eacce804cbab6a7c6 [1568/1568] spi: add phytium spi support config: x86_64-randconfig-104-20250408 (https://download.01.org/0day-ci/archive/20250408/202504081227.W3mx0ZSS-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250408/202504081227.W3mx0ZSS-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504081227.W3mx0ZSS-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/spi/spi-phytium-plat.c:122:8: error: implicit declaration of function 'gpiod_count' [-Werror,-Wimplicit-function-declaration] 122 | n = gpiod_count(&pdev->dev, "cs"); | ^ drivers/spi/spi-phytium-plat.c:122:8: note: did you mean 'cpuid_count'? arch/x86/include/asm/processor.h:620:20: note: 'cpuid_count' declared here 620 | static inline void cpuid_count(unsigned int op, int count, | ^ >> drivers/spi/spi-phytium-plat.c:128:12: error: implicit declaration of function 'devm_gpiod_get_index_optional' [-Werror,-Wimplicit-function-declaration] 128 | gpiod = devm_gpiod_get_index_optional(&pdev->dev, | ^ >> drivers/spi/spi-phytium-plat.c:129:17: error: use of undeclared identifier 'GPIOD_OUT_LOW' 129 | "cs", i, GPIOD_OUT_LOW); | ^ >> drivers/spi/spi-phytium-plat.c:136:14: error: implicit declaration of function 'desc_to_gpio' [-Werror,-Wimplicit-function-declaration] 136 | cs_gpio = desc_to_gpio(gpiod); | ^ drivers/spi/spi-phytium-plat.c:136:14: note: did you mean 'irq_to_gpio'? include/linux/gpio.h:236:19: note: 'irq_to_gpio' declared here 236 | static inline int irq_to_gpio(unsigned irq) | ^ 4 errors generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for SPI_PHYTIUM Depends on [n]: SPI [=y] && SPI_MASTER [=y] && (ARCH_PHYTIUM || COMPILE_TEST [=n]) Selected by [m]: - SPI_PHYTIUM_PLAT [=m] && SPI [=y] && SPI_MASTER [=y] vim +/gpiod_count +122 drivers/spi/spi-phytium-plat.c 37 38 static int phytium_spi_probe(struct platform_device *pdev) 39 { 40 struct phytium_spi_clk *ftsc; 41 struct phytium_spi *fts; 42 struct resource *mem; 43 int ret; 44 int num_cs; 45 int cs_gpio; 46 int global_cs; 47 int i; 48 49 ftsc = devm_kzalloc(&pdev->dev, sizeof(struct phytium_spi_clk), 50 GFP_KERNEL); 51 if (!ftsc) 52 return -ENOMEM; 53 54 fts = &ftsc->fts; 55 56 mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); 57 if (!mem) { 58 dev_err(&pdev->dev, "no mem resource?\n"); 59 return -EINVAL; 60 } 61 62 fts->regs = devm_ioremap_resource(&pdev->dev, mem); 63 if (IS_ERR(fts->regs)) { 64 dev_err(&pdev->dev, "SPI region map failed\n"); 65 return PTR_ERR(fts->regs); 66 } 67 68 fts->irq = platform_get_irq(pdev, 0); 69 if (fts->irq < 0) { 70 dev_err(&pdev->dev, "no irq resource?\n"); 71 return fts->irq; /* -ENXIO */ 72 } 73 74 if (pdev->dev.of_node) { 75 ftsc->clk = devm_clk_get(&pdev->dev, NULL); 76 77 if (IS_ERR(ftsc->clk)) 78 return PTR_ERR(ftsc->clk); 79 ret = clk_prepare_enable(ftsc->clk); 80 if (ret) 81 return ret; 82 83 fts->max_freq = clk_get_rate(ftsc->clk); 84 } else if (has_acpi_companion(&pdev->dev)) { 85 fts->max_freq = 48000000; 86 } 87 88 fts->bus_num = pdev->id; 89 device_property_read_u32(&pdev->dev, 90 "reg-io-width", &fts->reg_io_width); 91 92 num_cs = 4; 93 94 device_property_read_u32(&pdev->dev, "num-cs", &num_cs); 95 96 fts->num_cs = num_cs; 97 98 if (pdev->dev.of_node) { 99 int i; 100 101 for (i = 0; i < fts->num_cs; i++) { 102 cs_gpio = of_get_named_gpio(pdev->dev.of_node, 103 "cs-gpios", i); 104 105 if (cs_gpio == -EPROBE_DEFER) { 106 ret = cs_gpio; 107 goto out; 108 } 109 110 if (gpio_is_valid(cs_gpio)) { 111 ret = devm_gpio_request(&pdev->dev, cs_gpio, 112 dev_name(&pdev->dev)); 113 if (ret) 114 goto out; 115 } 116 } 117 } else if (has_acpi_companion(&pdev->dev)) { 118 int n; 119 int *cs; 120 struct gpio_desc *gpiod; 121 > 122 n = gpiod_count(&pdev->dev, "cs"); 123 124 cs = devm_kcalloc(&pdev->dev, n, sizeof(int), GFP_KERNEL); 125 fts->cs = cs; 126 127 for (i = 0; i < n; i++) { > 128 gpiod = devm_gpiod_get_index_optional(&pdev->dev, > 129 "cs", i, GPIOD_OUT_LOW); 130 131 if (IS_ERR(gpiod)) { 132 ret = PTR_ERR(gpiod); 133 goto out; 134 } 135 > 136 cs_gpio = desc_to_gpio(gpiod); 137 cs[i] = cs_gpio; 138 } 139 } 140 141 device_property_read_u32(&pdev->dev, "global-cs", &global_cs); 142 fts->global_cs = global_cs; 143 144 ret = phytium_spi_add_host(&pdev->dev, fts); 145 if (ret) 146 goto out; 147 148 platform_set_drvdata(pdev, ftsc); 149 return 0; 150 151 out: 152 clk_disable_unprepare(ftsc->clk); 153 return ret; 154 } 155 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] RDMA/mlx5: Fix a WARN during dereg_mr for DM type
by Yi Yang 08 Apr '25

08 Apr '25

From: Yishai Hadas <yishaih(a)nvidia.com> mainline inclusion from mainline-v6.14-rc5 commit abc7b3f1f056d69a8f11d6dceecc0c9549ace770 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVSX CVE: CVE-2025-21888 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Memory regions (MR) of type DM (device memory) do not have an associated umem. In the __mlx5_ib_dereg_mr() -> mlx5_free_priv_descs() flow, the code incorrectly takes the wrong branch, attempting to call dma_unmap_single() on a DMA address that is not mapped. This results in a WARN [1], as shown below. The issue is resolved by properly accounting for the DM type and ensuring the correct branch is selected in mlx5_free_priv_descs(). [1] WARNING: CPU: 12 PID: 1346 at drivers/iommu/dma-iommu.c:1230 iommu_dma_unmap_page+0x79/0x90 Modules linked in: ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry ovelay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core fuse mlx5_core CPU: 12 UID: 0 PID: 1346 Comm: ibv_rc_pingpong Not tainted 6.12.0-rc7+ #1631 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:iommu_dma_unmap_page+0x79/0x90 Code: 2b 49 3b 29 72 26 49 3b 69 08 73 20 4d 89 f0 44 89 e9 4c 89 e2 48 89 ee 48 89 df 5b 5d 41 5c 41 5d 41 5e 41 5f e9 07 b8 88 ff <0f> 0b 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 66 0f 1f 44 00 RSP: 0018:ffffc90001913a10 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88810194b0a8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 RBP: ffff88810194b0a8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f537abdd740(0000) GS:ffff88885fb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f537aeb8000 CR3: 000000010c248001 CR4: 0000000000372eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __warn+0x84/0x190 ? iommu_dma_unmap_page+0x79/0x90 ? report_bug+0xf8/0x1c0 ? handle_bug+0x55/0x90 ? exc_invalid_op+0x13/0x60 ? asm_exc_invalid_op+0x16/0x20 ? iommu_dma_unmap_page+0x79/0x90 dma_unmap_page_attrs+0xe6/0x290 mlx5_free_priv_descs+0xb0/0xe0 [mlx5_ib] __mlx5_ib_dereg_mr+0x37e/0x520 [mlx5_ib] ? _raw_spin_unlock_irq+0x24/0x40 ? wait_for_completion+0xfe/0x130 ? rdma_restrack_put+0x63/0xe0 [ib_core] ib_dereg_mr_user+0x5f/0x120 [ib_core] ? lock_release+0xc6/0x280 destroy_hw_idr_uobject+0x1d/0x60 [ib_uverbs] uverbs_destroy_uobject+0x58/0x1d0 [ib_uverbs] uobj_destroy+0x3f/0x70 [ib_uverbs] ib_uverbs_cmd_verbs+0x3e4/0xbb0 [ib_uverbs] ? __pfx_uverbs_destroy_def_handler+0x10/0x10 [ib_uverbs] ? lock_acquire+0xc1/0x2f0 ? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs] ? ib_uverbs_ioctl+0x116/0x170 [ib_uverbs] ? lock_release+0xc6/0x280 ib_uverbs_ioctl+0xe7/0x170 [ib_uverbs] ? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs] __x64_sys_ioctl+0x1b0/0xa70 do_syscall_64+0x6b/0x140 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f537adaf17b Code: 0f 1e fa 48 8b 05 1d ad 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ed ac 0c 00 f7 d8 64 89 01 48 RSP: 002b:00007ffff218f0b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffff218f1d8 RCX: 00007f537adaf17b RDX: 00007ffff218f1c0 RSI: 00000000c0181b01 RDI: 0000000000000003 RBP: 00007ffff218f1a0 R08: 00007f537aa8d010 R09: 0000561ee2e4f270 R10: 00007f537aace3a8 R11: 0000000000000246 R12: 00007ffff218f190 R13: 000000000000001c R14: 0000561ee2e4d7c0 R15: 00007ffff218f450 </TASK> Fixes: f18ec4223117 ("RDMA/mlx5: Use a union inside mlx5_ib_mr") Signed-off-by: Yishai Hadas <yishaih(a)nvidia.com> Link: https://patch.msgid.link/2039c22cfc3df02378747ba4d623a558b53fc263.173858707… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/hw/mlx5/mr.c [Conflicts due to commits de8f847a5114 ("RDMA/mlx5: Add support for DMABUF MR registrations with Data-direct") not merged.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/infiniband/hw/mlx5/mr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c index 90d468b00256..5881d8e69aa4 100644 --- a/drivers/infiniband/hw/mlx5/mr.c +++ b/drivers/infiniband/hw/mlx5/mr.c @@ -1818,7 +1818,7 @@ mlx5_alloc_priv_descs(struct ib_device *device, static void mlx5_free_priv_descs(struct mlx5_ib_mr *mr) { - if (!mr->umem && mr->descs) { + if (!mr->umem && mr->ibmr.type != IB_MR_TYPE_DM && mr->descs) { struct ib_device *device = mr->ibmr.device; int size = mr->max_descs * mr->desc_size; struct mlx5_ib_dev *dev = to_mdev(device); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
by Tirui Yin 08 Apr '25

08 Apr '25

From: Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> mainline inclusion from mainline-v5.19-rc3 commit 928ea98252ad75118950941683893cf904541da9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP74W CVE: CVE-2022-49711 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In fsl_mc_bus_remove(), mc->root_mc_bus_dev->mc_io is passed to fsl_destroy_mc_io(). However, mc->root_mc_bus_dev is already freed in fsl_mc_device_remove(). Then reference to mc->root_mc_bus_dev->mc_io triggers KASAN use-after-free. To avoid the use-after-free, keep the reference to mc->root_mc_bus_dev->mc_io in a local variable and pass to fsl_destroy_mc_io(). This patch needs rework to apply to kernels older than v5.15. Fixes: f93627146f0e ("staging: fsl-mc: fix asymmetry in destroy of mc_io") Cc: stable(a)vger.kernel.org # v5.15+ Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> Link: https://lore.kernel.org/r/20220601105159.87752-1-shinichiro.kawasaki@wdc.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c index 5d8266c6571f..3512341c3038 100644 --- a/drivers/bus/fsl-mc/fsl-mc-bus.c +++ b/drivers/bus/fsl-mc/fsl-mc-bus.c @@ -878,14 +878,14 @@ static int fsl_mc_bus_probe(struct platform_device *pdev) static int fsl_mc_bus_remove(struct platform_device *pdev) { struct fsl_mc *mc = platform_get_drvdata(pdev); + struct fsl_mc_io *mc_io; if (!fsl_mc_is_root_dprc(&mc->root_mc_bus_dev->dev)) return -EINVAL; + mc_io = mc->root_mc_bus_dev->mc_io; fsl_mc_device_remove(mc->root_mc_bus_dev); - - fsl_destroy_mc_io(mc->root_mc_bus_dev->mc_io); - mc->root_mc_bus_dev->mc_io = NULL; + fsl_destroy_mc_io(mc_io); return 0; } -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
by Tirui Yin 08 Apr '25

08 Apr '25

From: Hui Wang <hui.wang(a)canonical.com> stable inclusion from stable-v4.19.272 commit 80ee99e52936b2c04cc37b17a14b2ae2f9d282ac category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVWT CVE: CVE-2022-49746 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1417f59ac0b02130ee56c0c50794b9b257be3d17 ] If the function sdma_load_context() fails, the sdma_desc will be freed, but the allocated desc->bd is forgot to be freed. We already met the sdma_load_context() failure case and the log as below: [ 450.699064] imx-sdma 30bd0000.dma-controller: Timeout waiting for CH0 ready ... In this case, the desc->bd will not be freed without this change. Signed-off-by: Hui Wang <hui.wang(a)canonical.com> Reviewed-by: Sascha Hauer <s.hauer(a)pengutronix.de> Link: https://lore.kernel.org/r/20221130090800.102035-1-hui.wang@canonical.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- drivers/dma/imx-sdma.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c index 3f5a01cb4ab4..b9e6d276df4c 100644 --- a/drivers/dma/imx-sdma.c +++ b/drivers/dma/imx-sdma.c @@ -1353,10 +1353,12 @@ static struct sdma_desc *sdma_transfer_init(struct sdma_channel *sdmac, sdma_config_ownership(sdmac, false, true, false); if (sdma_load_context(sdmac)) - goto err_desc_out; + goto err_bd_out; return desc; +err_bd_out: + sdma_free_bd(desc); err_desc_out: kfree(desc); err_out: -- 2.22.0

2 1

[openeuler:openEuler-1.0-LTS 1568/1568] kernel/uid16.o: warning: objtool: __x64_sys_getuid16.cold()+0x0: unreachable instruction
by kernel test robot 08 Apr '25

08 Apr '25

Hi Josh, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3191c9e4e7c581bfe0a40ee198ffcbd5c3dea53e commit: 56bc1719652e7a937bc9856f76f0c0fbf8ce1b23 [1568/1568] objtool: Support GCC 9 cold subfunction naming scheme config: x86_64-randconfig-103-20250408 (https://download.01.org/0day-ci/archive/20250408/202504081156.eLZp36Hb-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250408/202504081156.eLZp36Hb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504081156.eLZp36Hb-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/uid16.o: warning: objtool: __x64_sys_getuid16.cold()+0x0: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 08 Apr '25

08 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3191c9e4e7c581bfe0a40ee198ffcbd5c3dea53e commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250408/202504081127.rMMmKSGb-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504081127.rMMmKSGb-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1334/1334] kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace'
by kernel test robot 08 Apr '25

08 Apr '25

Hi Guilherme, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3191c9e4e7c581bfe0a40ee198ffcbd5c3dea53e commit: 190aae97bcddbed131a203f829257b168f5058ce [1334/1334] kernel/hung_task.c: introduce sysctl to print all traces when a hung task is detected config: x86_64-randconfig-103-20241218 (https://download.01.org/0day-ci/archive/20250408/202504081025.oeT4D3sO-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250408/202504081025.oeT4D3sO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504081025.oeT4D3sO-lkp@intel.com/ All errors (new ones prefixed by >>): >> kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace' 148 | if (sysctl_hung_task_all_cpu_backtrace) | ^ kernel/hung_task.c:235:5: warning: no previous prototype for function 'proc_dohung_task_timeout_secs' [-Wmissing-prototypes] 235 | int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, | ^ kernel/hung_task.c:235:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 235 | int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, | ^ | static 1 warning and 1 error generated. vim +/sysctl_hung_task_all_cpu_backtrace +148 kernel/hung_task.c 94 95 static void check_hung_task(struct task_struct *t, unsigned long timeout) 96 { 97 unsigned long switch_count = t->nvcsw + t->nivcsw; 98 99 /* 100 * Ensure the task is not frozen. 101 * Also, skip vfork and any other user process that freezer should skip. 102 */ 103 if (unlikely(t->flags & (PF_FROZEN | PF_FREEZER_SKIP))) 104 return; 105 106 /* 107 * When a freshly created task is scheduled once, changes its state to 108 * TASK_UNINTERRUPTIBLE without having ever been switched out once, it 109 * musn't be checked. 110 */ 111 if (unlikely(!switch_count)) 112 return; 113 114 if (switch_count != t->last_switch_count) { 115 t->last_switch_count = switch_count; 116 t->last_switch_time = jiffies; 117 return; 118 } 119 if (time_is_after_jiffies(t->last_switch_time + timeout * HZ)) 120 return; 121 122 trace_sched_process_hang(t); 123 124 if (sysctl_hung_task_panic) { 125 console_verbose(); 126 hung_task_show_lock = true; 127 hung_task_call_panic = true; 128 } 129 130 /* 131 * Ok, the task did not get scheduled for more than 2 minutes, 132 * complain: 133 */ 134 if (sysctl_hung_task_warnings) { 135 if (sysctl_hung_task_warnings > 0) 136 sysctl_hung_task_warnings--; 137 pr_err("INFO: task %s:%d blocked for more than %ld seconds.\n", 138 t->comm, t->pid, timeout); 139 pr_err(" %s %s %.*s\n", 140 print_tainted(), init_utsname()->release, 141 (int)strcspn(init_utsname()->version, " "), 142 init_utsname()->version); 143 pr_err("\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\"" 144 " disables this message.\n"); 145 sched_show_task(t); 146 hung_task_show_lock = true; 147 > 148 if (sysctl_hung_task_all_cpu_backtrace) 149 hung_task_show_all_bt = true; 150 } 151 152 touch_nmi_watchdog(); 153 } 154 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1418/1418] mm/hugetlb.c:1370:6: warning: no previous prototype for function 'free_huge_page_to_dhugetlb_pool'
by kernel test robot 08 Apr '25

08 Apr '25

Hi Liu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3191c9e4e7c581bfe0a40ee198ffcbd5c3dea53e commit: 0bc0d0d57edacd59ebe38d05ad9c4b2bc185aa51 [1418/1418] dhugetlb: backport dynamic hugetlb feature config: x86_64-buildonly-randconfig-003-20250207 (https://download.01.org/0day-ci/archive/20250408/202504081022.SWpK2BGS-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250408/202504081022.SWpK2BGS-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504081022.SWpK2BGS-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/hugetlb.c:1370:6: warning: no previous prototype for function 'free_huge_page_to_dhugetlb_pool' [-Wmissing-prototypes] 1370 | void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) | ^ mm/hugetlb.c:1370:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1370 | void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) | ^ | static In file included from mm/hugetlb.c:14: include/linux/mempolicy.h:329:13: warning: unused function '__do_mbind' [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ 2 warnings generated. vim +/free_huge_page_to_dhugetlb_pool +1370 mm/hugetlb.c 1324 1325 #ifdef CONFIG_DYNAMIC_HUGETLB 1326 static void free_huge_page_to_dhugetlb_pool(struct page *page, 1327 bool restore_reserve) 1328 { 1329 struct hstate *h = page_hstate(page); 1330 struct dhugetlb_pool *hpool; 1331 1332 hpool = get_dhugetlb_pool_from_dhugetlb_pagelist(page); 1333 if (unlikely(!hpool)) { 1334 pr_err("dhugetlb: free error: get hpool failed\n"); 1335 return; 1336 } 1337 1338 spin_lock(&hpool->lock); 1339 ClearPagePool(page); 1340 set_compound_page_dtor(page, NULL_COMPOUND_DTOR); 1341 if (!hstate_is_gigantic(h)) { 1342 list_add(&page->lru, &hpool->dhugetlb_2M_freelists); 1343 hpool->free_reserved_2M++; 1344 hpool->used_2M--; 1345 if (restore_reserve) { 1346 hpool->mmap_reserved_2M++; 1347 trace_dhugetlb_acct_memory(hpool, 1348 hpool->mmap_reserved_2M, 1349 DHUGETLB_RESV_2M); 1350 } 1351 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_2M, 1352 DHUGETLB_FREE_2M); 1353 } else { 1354 list_add(&page->lru, &hpool->dhugetlb_1G_freelists); 1355 hpool->free_reserved_1G++; 1356 hpool->used_1G--; 1357 if (restore_reserve) { 1358 hpool->mmap_reserved_1G++; 1359 trace_dhugetlb_acct_memory(hpool, 1360 hpool->mmap_reserved_1G, 1361 DHUGETLB_RESV_1G); 1362 } 1363 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_1G, 1364 DHUGETLB_FREE_1G); 1365 } 1366 spin_unlock(&hpool->lock); 1367 dhugetlb_pool_put(hpool); 1368 } 1369 #else > 1370 void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) 1371 { 1372 } 1373 #endif 1374 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1327/1327] mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled'
by kernel test robot 08 Apr '25

08 Apr '25

Hi liubo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3191c9e4e7c581bfe0a40ee198ffcbd5c3dea53e commit: 44983705e56ab22fda801d66e2a6bd0d1be7ca0b [1327/1327] etmem: add original kernel swap enabled options config: x86_64-buildonly-randconfig-005-20241216 (https://download.01.org/0day-ci/archive/20250408/202504080927.7eGn2cDH-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250408/202504080927.7eGn2cDH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504080927.7eGn2cDH-lkp@intel.com/ All errors (new ones prefixed by >>): mm/vmscan.c:2734:17: warning: variable 'node_lru_pages' set but not used [-Wunused-but-set-variable] 2734 | unsigned long node_lru_pages = 0; | ^ >> mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled' [-Werror,-Wimplicit-function-declaration] 3257 | if (sc != NULL && !kernel_swap_enabled()) | ^ mm/vmscan.c:3257:21: note: did you mean 'kernfs_ns_enabled'? include/linux/kernfs.h:309:20: note: 'kernfs_ns_enabled' declared here 309 | static inline bool kernfs_ns_enabled(struct kernfs_node *kn) | ^ 1 warning and 1 error generated. vim +/kernel_swap_enabled +3257 mm/vmscan.c 3250 3251 /* 3252 * Check if original kernel swap is enabled 3253 * turn off kernel swap,but leave page cache reclaim on 3254 */ 3255 static inline void kernel_swap_check(struct scan_control *sc) 3256 { > 3257 if (sc != NULL && !kernel_swap_enabled()) 3258 sc->may_swap = 0; 3259 } 3260 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] rapidio: add check for rio_add_net() in rio_scan_alloc_net()
by Zeng Heng 07 Apr '25

07 Apr '25

From: Haoxiang Li <haoxiang_li2024(a)163.com> stable inclusion from stable-v5.10.235 commit 4f3509cfcc02e9d757f2714bb7dbbeec35de6fa7 category: bugfix bugzilla: 189268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e842f9a1edf306bf36fe2a4d847a0b0d458770de upstream. The return value of rio_add_net() should be checked. If it fails, put_device() should be called to free the memory and give up the reference initialized in rio_add_net(). Link: https://lkml.kernel.org/r/20250227041131.3680761-1-haoxiang_li2024@163.com Fixes: e6b585ca6e81 ("rapidio: move net allocation into core code") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Haoxiang Li <haoxiang_li2024(a)163.com> Cc: Alexandre Bounine <alex.bou9(a)gmail.com> Cc: Matt Porter <mporter(a)kernel.crashing.org> Cc: Dan Carpenter <dan.carpenter(a)linaro.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/rapidio/rio-scan.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c index fdcf742b2adb..c12941f71e2c 100644 --- a/drivers/rapidio/rio-scan.c +++ b/drivers/rapidio/rio-scan.c @@ -871,7 +871,10 @@ static struct rio_net *rio_scan_alloc_net(struct rio_mport *mport, dev_set_name(&net->dev, "rnet_%d", net->id); net->dev.parent = &mport->dev; net->dev.release = rio_scan_release_dev; - rio_add_net(net); + if (rio_add_net(net)) { + put_device(&net->dev); + net = NULL; + } } return net; -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] vhost/vdpa: Provide new ioctls to user
by frenkjason 07 Apr '25

07 Apr '25

From: frankyj915 <yangjieyj.yang(a)huawei.com> Enable users to bind, unbind, attach, detach vDPA devices with iommufd. So multiple vDPA devices can share the same iommu/smmu table. frankyj915 (2): vhost/vdpa: Add support to bind, unbind, attach and detach iommufd vhost/vdpa: Add error handling when binding or attaching fails drivers/vhost/vdpa.c | 130 +++++++++++++++++++++++++++++++ include/uapi/linux/vhost.h | 28 +++++++ include/uapi/linux/vhost_types.h | 5 ++ tools/include/uapi/linux/vhost.h | 28 +++++++ 4 files changed, 191 insertions(+) -- 2.25.1

2 3

[PATCH OLK-5.10] hrtimers: Handle CPU state correctly on hotplug
by Zeng Heng 07 Apr '25

07 Apr '25

From: Koichiro Den <koichiro.den(a)canonical.com> stable inclusion from stable-v5.10.234 commit 14984139f1f2768883332965db566ef26db609e7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBLWTN CVE: CVE-2024-57951 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2f8dea1692eef2b7ba6a256246ed82c365fdc686 upstream. Consider a scenario where a CPU transitions from CPUHP_ONLINE to halfway through a CPU hotunplug down to CPUHP_HRTIMERS_PREPARE, and then back to CPUHP_ONLINE: Since hrtimers_prepare_cpu() does not run, cpu_base.hres_active remains set to 1 throughout. However, during a CPU unplug operation, the tick and the clockevents are shut down at CPUHP_AP_TICK_DYING. On return to the online state, for instance CFS incorrectly assumes that the hrtick is already active, and the chance of the clockevent device to transition to oneshot mode is also lost forever for the CPU, unless it goes back to a lower state than CPUHP_HRTIMERS_PREPARE once. This round-trip reveals another issue; cpu_base.online is not set to 1 after the transition, which appears as a WARN_ON_ONCE in enqueue_hrtimer(). Aside of that, the bulk of the per CPU state is not reset either, which means there are dangling pointers in the worst case. Address this by adding a corresponding startup() callback, which resets the stale per CPU state and sets the online flag. [ tglx: Make the new callback unconditionally available, remove the online modification in the prepare() callback and clear the remaining state in the starting callback instead of the prepare callback ] Fixes: 5c0930ccaad5 ("hrtimers: Push pending hrtimers away from outgoing CPU earlier") Signed-off-by: Koichiro Den <koichiro.den(a)canonical.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/20241220134421.3809834-1-koichiro.den@canonical… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: kernel/cpu.c [commit 1426c91277cc ("cpu/hotplug: Fix kabi breakage in enum cpuhp_state") removed CPUHP_AP_HRTIMERS_DYING to fix kabi changes] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- include/linux/hrtimer.h | 1 + kernel/cpu.c | 9 ++++++++- kernel/time/hrtimer.c | 11 ++++++++++- 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h index 9c4f4f15a056..04bdeba7b072 100644 --- a/include/linux/hrtimer.h +++ b/include/linux/hrtimer.h @@ -545,6 +545,7 @@ extern void __init hrtimers_init(void); extern void sysrq_timer_list_show(void); int hrtimers_prepare_cpu(unsigned int cpu); +int hrtimers_cpu_starting(unsigned int cpu); #ifdef CONFIG_HOTPLUG_CPU int hrtimers_cpu_dying(unsigned int cpu); #else diff --git a/kernel/cpu.c b/kernel/cpu.c index 137baebdeced..83e1bc2fafb1 100644 --- a/kernel/cpu.c +++ b/kernel/cpu.c @@ -1713,9 +1713,16 @@ static struct cpuhp_step cpuhp_hp_states[] = { * Please ensure that there are no other steps with teardown handler * between smpcfd:dying and cpu:teardown. */ + /* + * In the past, the implementation of CPUHP_AP_HRTIMERS_DYING is deleted because + * the Kabi is fixed. The teardown operation and teardown of CPUHP_AP_SMPCFD_DYING + * are combined into smpcfd_and_hrtimer_dying_cpu. The startup operation of + * CPUHP_AP_SMPCFD_DYING is empty. Therefore, the startup operation of + * hrtimers_cpu_starting is set to the startup operation of CPUHP_AP_SMPCFD_DYING. + */ [CPUHP_AP_SMPCFD_DYING] = { .name = "smpcfd:dying", - .startup.single = NULL, + .startup.single = hrtimers_cpu_starting, .teardown.single = smpcfd_and_hrtimer_dying_cpu, }, diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c index 31d481da509e..0831821d04c4 100644 --- a/kernel/time/hrtimer.c +++ b/kernel/time/hrtimer.c @@ -2136,6 +2136,15 @@ int hrtimers_prepare_cpu(unsigned int cpu) } cpu_base->cpu = cpu; + hrtimer_cpu_base_init_expiry_lock(cpu_base); + return 0; +} + +int hrtimers_cpu_starting(unsigned int cpu) +{ + struct hrtimer_cpu_base *cpu_base = this_cpu_ptr(&hrtimer_bases); + + /* Clear out any left over state from a CPU down operation */ cpu_base->active_bases = 0; cpu_base->hres_active = 0; cpu_base->hang_detected = 0; @@ -2144,7 +2153,6 @@ int hrtimers_prepare_cpu(unsigned int cpu) cpu_base->expires_next = KTIME_MAX; cpu_base->softirq_expires_next = KTIME_MAX; cpu_base->online = 1; - hrtimer_cpu_base_init_expiry_lock(cpu_base); return 0; } @@ -2222,6 +2230,7 @@ int hrtimers_cpu_dying(unsigned int dying_cpu) void __init hrtimers_init(void) { hrtimers_prepare_cpu(smp_processor_id()); + hrtimers_cpu_starting(smp_processor_id()); open_softirq(HRTIMER_SOFTIRQ, hrtimer_run_softirq); } -- 2.25.1

2 1

[PATCH OLK-6.6] rapidio: add check for rio_add_net() in rio_scan_alloc_net()
by Zeng Heng 07 Apr '25

07 Apr '25

From: Haoxiang Li <haoxiang_li2024(a)163.com> stable inclusion from stable-v6.6.83 commit e6411c3b9512dba09af7d014d474516828c89706 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBRSCC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e842f9a1edf306bf36fe2a4d847a0b0d458770de upstream. The return value of rio_add_net() should be checked. If it fails, put_device() should be called to free the memory and give up the reference initialized in rio_add_net(). Link: https://lkml.kernel.org/r/20250227041131.3680761-1-haoxiang_li2024@163.com Fixes: e6b585ca6e81 ("rapidio: move net allocation into core code") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Haoxiang Li <haoxiang_li2024(a)163.com> Cc: Alexandre Bounine <alex.bou9(a)gmail.com> Cc: Matt Porter <mporter(a)kernel.crashing.org> Cc: Dan Carpenter <dan.carpenter(a)linaro.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/rapidio/rio-scan.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c index fdcf742b2adb..c12941f71e2c 100644 --- a/drivers/rapidio/rio-scan.c +++ b/drivers/rapidio/rio-scan.c @@ -871,7 +871,10 @@ static struct rio_net *rio_scan_alloc_net(struct rio_mport *mport, dev_set_name(&net->dev, "rnet_%d", net->id); net->dev.parent = &mport->dev; net->dev.release = rio_scan_release_dev; - rio_add_net(net); + if (rio_add_net(net)) { + put_device(&net->dev); + net = NULL; + } } return net; -- 2.25.1

2 1

[PATCH OLK-6.6] [Backport] ksmbd: fix incorrect validation for num_aces field of smb_acl
by Yongjian Sun 07 Apr '25

07 Apr '25

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.12-rc3 commit 1b8b67f3c5e5169535e26efedd3e422172e2db64 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYED0 CVE: CVE-2025-21994 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- parse_dcal() validate num_aces to allocate posix_ace_state_array. if (num_aces > ULONG_MAX / sizeof(struct smb_ace *)) It is an incorrect validation that we can create an array of size ULONG_MAX. smb_acl has ->size field to calculate actual number of aces in request buffer size. Use this to check invalid num_aces. Reported-by: Igor Leite Ladessa <igor-ladessa(a)hotmail.com> Tested-by: Igor Leite Ladessa <igor-ladessa(a)hotmail.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/smb/server/smbacl.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c index da8ed72f335d..109036e2227c 100644 --- a/fs/smb/server/smbacl.c +++ b/fs/smb/server/smbacl.c @@ -398,7 +398,9 @@ static void parse_dacl(struct mnt_idmap *idmap, if (num_aces <= 0) return; - if (num_aces > ULONG_MAX / sizeof(struct smb_ace *)) + if (num_aces > (le16_to_cpu(pdacl->size) - sizeof(struct smb_acl)) / + (offsetof(struct smb_ace, sid) + + offsetof(struct smb_sid, sub_auth) + sizeof(__le16))) return; ret = init_acl_state(&acl_state, num_aces); @@ -432,6 +434,7 @@ static void parse_dacl(struct mnt_idmap *idmap, offsetof(struct smb_sid, sub_auth); if (end_of_acl - acl_base < acl_size || + ppace[i]->sid.num_subauth == 0 || ppace[i]->sid.num_subauth > SID_MAX_SUB_AUTHORITIES || (end_of_acl - acl_base < acl_size + sizeof(__le32) * ppace[i]->sid.num_subauth) || -- 2.39.2

2 5

[PATCH OLK-6.6 v2] bpf: Add tracepoints with null-able arguments
by Pu Lehui 07 Apr '25

07 Apr '25

From: Jiri Olsa <jolsa(a)kernel.org> mainline inclusion from mainline-v6.15-rc1 commit c83e2d970bae8616b94c40caa43d85f2f2c7d81e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY5DV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Some of the tracepoints slipped when we did the first scan, adding them now. Fixes: 838a10bd2ebf ("bpf: Augment raw_tp arguments with PTR_MAYBE_NULL") Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Link: https://lore.kernel.org/r/20250210175913.2893549-1-jolsa@kernel.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/btf.c | 99 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 99 insertions(+) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index bbc99401b4e7..39fc33e6368f 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -5997,6 +5997,8 @@ static const struct bpf_raw_tp_null_args raw_tp_null_args[] = { /* rxrpc */ { "rxrpc_recvdata", 0x1 }, { "rxrpc_resend", 0x10 }, + { "rxrpc_tq", 0x10 }, + { "rxrpc_client", 0x1 }, /* sunrpc */ { "xs_stream_read_data", 0x1 }, /* ... from xprt_cong_event event class */ @@ -6017,6 +6019,103 @@ static const struct bpf_raw_tp_null_args raw_tp_null_args[] = { { "mr_integ_alloc", 0x2000 }, /* bpf_testmod */ { "bpf_testmod_test_read", 0x0 }, + /* amdgpu */ + { "amdgpu_vm_bo_map", 0x1 }, + { "amdgpu_vm_bo_unmap", 0x1 }, + /* netfs */ + { "netfs_folioq", 0x1 }, + /* xfs from xfs_defer_pending_class */ + { "xfs_defer_create_intent", 0x1 }, + { "xfs_defer_cancel_list", 0x1 }, + { "xfs_defer_pending_finish", 0x1 }, + { "xfs_defer_pending_abort", 0x1 }, + { "xfs_defer_relog_intent", 0x1 }, + { "xfs_defer_isolate_paused", 0x1 }, + { "xfs_defer_item_pause", 0x1 }, + { "xfs_defer_item_unpause", 0x1 }, + /* xfs from xfs_defer_pending_item_class */ + { "xfs_defer_add_item", 0x1 }, + { "xfs_defer_cancel_item", 0x1 }, + { "xfs_defer_finish_item", 0x1 }, + /* xfs from xfs_icwalk_class */ + { "xfs_ioc_free_eofblocks", 0x10 }, + { "xfs_blockgc_free_space", 0x10 }, + /* xfs from xfs_btree_cur_class */ + { "xfs_btree_updkeys", 0x100 }, + { "xfs_btree_overlapped_query_range", 0x100 }, + /* xfs from xfs_imap_class*/ + { "xfs_map_blocks_found", 0x10000 }, + { "xfs_map_blocks_alloc", 0x10000 }, + { "xfs_iomap_alloc", 0x1000 }, + { "xfs_iomap_found", 0x1000 }, + /* xfs from xfs_fs_class */ + { "xfs_inodegc_flush", 0x1 }, + { "xfs_inodegc_push", 0x1 }, + { "xfs_inodegc_start", 0x1 }, + { "xfs_inodegc_stop", 0x1 }, + { "xfs_inodegc_queue", 0x1 }, + { "xfs_inodegc_throttle", 0x1 }, + { "xfs_fs_sync_fs", 0x1 }, + { "xfs_blockgc_start", 0x1 }, + { "xfs_blockgc_stop", 0x1 }, + { "xfs_blockgc_worker", 0x1 }, + { "xfs_blockgc_flush_all", 0x1 }, + /* xfs_scrub */ + { "xchk_nlinks_live_update", 0x10 }, + /* xfs_scrub from xchk_metapath_class */ + { "xchk_metapath_lookup", 0x100 }, + /* nfsd */ + { "nfsd_dirent", 0x1 }, + { "nfsd_file_acquire", 0x1001 }, + { "nfsd_file_insert_err", 0x1 }, + { "nfsd_file_cons_err", 0x1 }, + /* nfs4 */ + { "nfs4_setup_sequence", 0x1 }, + { "pnfs_update_layout", 0x10000 }, + { "nfs4_inode_callback_event", 0x200 }, + { "nfs4_inode_stateid_callback_event", 0x200 }, + /* nfs from pnfs_layout_event */ + { "pnfs_mds_fallback_pg_init_read", 0x10000 }, + { "pnfs_mds_fallback_pg_init_write", 0x10000 }, + { "pnfs_mds_fallback_pg_get_mirror_count", 0x10000 }, + { "pnfs_mds_fallback_read_done", 0x10000 }, + { "pnfs_mds_fallback_write_done", 0x10000 }, + { "pnfs_mds_fallback_read_pagelist", 0x10000 }, + { "pnfs_mds_fallback_write_pagelist", 0x10000 }, + /* coda */ + { "coda_dec_pic_run", 0x10 }, + { "coda_dec_pic_done", 0x10 }, + /* cfg80211 */ + { "cfg80211_scan_done", 0x11 }, + { "rdev_set_coalesce", 0x10 }, + { "cfg80211_report_wowlan_wakeup", 0x100 }, + { "cfg80211_inform_bss_frame", 0x100 }, + { "cfg80211_michael_mic_failure", 0x10000 }, + /* cfg80211 from wiphy_work_event */ + { "wiphy_work_queue", 0x10 }, + { "wiphy_work_run", 0x10 }, + { "wiphy_work_cancel", 0x10 }, + { "wiphy_work_flush", 0x10 }, + /* hugetlbfs */ + { "hugetlbfs_alloc_inode", 0x10 }, + /* spufs */ + { "spufs_context", 0x10 }, + /* kvm_hv */ + { "kvm_page_fault_enter", 0x100 }, + /* dpu */ + { "dpu_crtc_setup_mixer", 0x100 }, + /* binder */ + { "binder_transaction", 0x100 }, + /* bcachefs */ + { "btree_path_free", 0x100 }, + /* hfi1_tx */ + { "hfi1_sdma_progress", 0x1000 }, + /* iptfs */ + { "iptfs_ingress_postq_event", 0x1000 }, + /* neigh */ + { "neigh_update", 0x10 }, + /* snd_firewire_lib */ + { "amdtp_packet", 0x100 }, }; bool btf_ctx_access(int off, int size, enum bpf_access_type type, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
by Yuntao Liu 07 Apr '25

07 Apr '25

From: Artemii Karasev <karasev(a)ispras.ru> stable inclusion from stable-v4.19.273 commit 6e1f586ddec48d71016b81acf68ba9f49ca54db8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVYV CVE: CVE-2023-52988 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b9cee506da2b7920b5ea02ccd8e78a907d0ee7aa ] snd_hda_get_connections() can return a negative error code. It may lead to accessing 'conn' array at a negative index. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Artemii Karasev <karasev(a)ispras.ru> Fixes: 30b4503378c9 ("ALSA: hda - Expose secret DAC-AA connection of some VIA codecs") Link: https://lore.kernel.org/r/20230119082259.3634-1-karasev@ispras.ru Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- sound/pci/hda/patch_via.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c index 6b9617aee0e6..a6253e4f44bd 100644 --- a/sound/pci/hda/patch_via.c +++ b/sound/pci/hda/patch_via.c @@ -833,6 +833,9 @@ static int add_secret_dac_path(struct hda_codec *codec) return 0; nums = snd_hda_get_connections(codec, spec->gen.mixer_nid, conn, ARRAY_SIZE(conn) - 1); + if (nums < 0) + return nums; + for (i = 0; i < nums; i++) { if (get_wcaps_type(get_wcaps(codec, conn[i])) == AC_WID_AUD_OUT) return 0; -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] CVE-2025-21941
by Lin Yujun 07 Apr '25

07 Apr '25

Ma Ke (1): drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-5.10] Revert "arm64: mm: add mc support for __buffer_migrate_page"
by Wupeng Ma 07 Apr '25

07 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB0OV7 -------------------------------- This reverts commit 19e1c50695fc0ff8a34799ce4342b0e6f105d230. During our test, it is found that this will lead to NULL pointer dereference as follow: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 pc : __find_get_block_slow+0xbc/0x29c lr : __find_get_block_slow+0x50/0x29c Call trace: __find_get_block_slow+0xbc/0x29c __find_get_block+0xa8/0xd0 __getblk_gfp+0x30/0x84 ext4_getblk+0x90/0x244 [ext4] ext4_bread+0x1c/0x10c [ext4] __ext4_read_dirblock.part.0+0x48/0x32c [ext4] ext4_dx_find_entry+0xb0/0x220 [ext4] __ext4_find_entry+0x3f0/0x470 [ext4] ext4_lookup.part.0+0x5c/0x240 [ext4] ext4_lookup+0x2c/0x50 [ext4] lookup_open.isra.0+0x1d4/0x3c4 open_last_lookups+0x36c/0x3d0 path_openat+0x8c/0x1f0 do_filp_open+0x88/0x150 do_open_execat+0x78/0x1cc alloc_bprm+0x30/0x180 Revert this for a better solution. Fixes: 19e1c50695fc ("arm64: mm: add mc support for __buffer_migrate_page") Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- mm/migrate.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) diff --git a/mm/migrate.c b/mm/migrate.c index 0d79382f9697..cf8c05ea821e 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -820,7 +820,6 @@ static int __buffer_migrate_page(struct address_space *mapping, struct buffer_head *bh, *head; int rc; int expected_count; - bool copy_done = false; if (!page_has_buffers(page)) return migrate_page(mapping, newpage, page, mode); @@ -861,13 +860,7 @@ static int __buffer_migrate_page(struct address_space *mapping, } } - if (IS_ENABLED(CONFIG_ARM64) && IS_ENABLED(CONFIG_ARCH_HAS_COPY_MC) && - (mode != MIGRATE_SYNC_NO_COPY)) { - rc = migrate_page_mc_extra(mapping, newpage, page, mode, 0); - copy_done = true; - } else { - rc = migrate_page_move_mapping(mapping, newpage, page, 0); - } + rc = migrate_page_move_mapping(mapping, newpage, page, 0); if (rc != MIGRATEPAGE_SUCCESS) goto unlock_buffers; @@ -880,9 +873,6 @@ static int __buffer_migrate_page(struct address_space *mapping, } while (bh != head); - if (copy_done) - goto unlock_buffers; - if (mode != MIGRATE_SYNC_NO_COPY) migrate_page_copy(newpage, page); else -- 2.43.0

2 1

[PATCH OLK-6.6 0/1] CVE-2025-21892
by Lin Yujun 07 Apr '25

07 Apr '25

Yishai Hadas (1): RDMA/mlx5: Fix the recovery flow of the UMR QP drivers/infiniband/hw/mlx5/umr.c | 83 +++++++++++++++++++++----------- 1 file changed, 56 insertions(+), 27 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] CVE-2025-21877
by Lin Yujun 07 Apr '25

07 Apr '25

Nikita Zhandarovich (1): usbnet: gl620a: fix endpoint checking in genelink_bind() drivers/net/usb/gl620a.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] CVE-2025-21877
by Lin Yujun 07 Apr '25

07 Apr '25

Nikita Zhandarovich (1): usbnet: gl620a: fix endpoint checking in genelink_bind() drivers/net/usb/gl620a.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/3] fix CVE-2025-21976
by Xiangwei Li 07 Apr '25

07 Apr '25

Saurabh Sengar (2): fbdev: hyperv_fb: Simplify hvfb_putmem fbdev: hyperv_fb: Allow graceful removal of framebuffer Thomas Weißschuh (1): fbdev: Introduce devm_register_framebuffer() drivers/video/fbdev/core/fbmem.c | 30 ++++++++++++++++++++++++++++++ drivers/video/fbdev/hyperv_fb.c | 30 ++++++++++++++++++++---------- include/linux/fb.h | 1 + 3 files changed, 51 insertions(+), 10 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6] slimbus: messaging: Free transaction ID in delayed interrupt scenario
by Xiaomeng Zhang 07 Apr '25

07 Apr '25

From: Visweswara Tanuku <quic_vtanuku(a)quicinc.com> stable inclusion from stable-v6.6.83 commit faac8e894014e8167471a8e4a5eb35a8fefbb82a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY44F CVE: CVE-2025-21914 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dcb0d43ba8eb9517e70b1a0e4b0ae0ab657a0e5a upstream. In case of interrupt delay for any reason, slim_do_transfer() returns timeout error but the transaction ID (TID) is not freed. This results into invalid memory access inside qcom_slim_ngd_rx_msgq_cb() due to invalid TID. Fix the issue by freeing the TID in slim_do_transfer() before returning timeout error to avoid invalid memory access. Call trace: __memcpy_fromio+0x20/0x190 qcom_slim_ngd_rx_msgq_cb+0x130/0x290 [slim_qcom_ngd_ctrl] vchan_complete+0x2a0/0x4a0 tasklet_action_common+0x274/0x700 tasklet_action+0x28/0x3c _stext+0x188/0x620 run_ksoftirqd+0x34/0x74 smpboot_thread_fn+0x1d8/0x464 kthread+0x178/0x238 ret_from_fork+0x10/0x20 Code: aa0003e8 91000429 f100044a 3940002b (3800150b) ---[ end trace 0fe00bec2b975c99 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt. Fixes: afbdcc7c384b ("slimbus: Add messaging APIs to slimbus framework") Cc: stable <stable(a)kernel.org> Signed-off-by: Visweswara Tanuku <quic_vtanuku(a)quicinc.com> Link: https://lore.kernel.org/r/20250124125740.16897-1-quic_vtanuku@quicinc.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/slimbus/messaging.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c index 4ce0cb61e481..245e9c7f92cd 100644 --- a/drivers/slimbus/messaging.c +++ b/drivers/slimbus/messaging.c @@ -147,8 +147,9 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn) } ret = ctrl->xfer_msg(ctrl, txn); - - if (!ret && need_tid && !txn->msg->comp) { + if (ret == -ETIMEDOUT) { + slim_free_txn_tid(ctrl, txn); + } else if (!ret && need_tid && !txn->msg->comp) { unsigned long ms = txn->rl + HZ; timeout = wait_for_completion_timeout(txn->comp, -- 2.34.1

2 1

[PATCH OLK-6.6] wifi: cfg80211: regulatory: improve invalid hints checking
by Xiaomeng Zhang 07 Apr '25

07 Apr '25

From: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> stable inclusion from stable-v6.6.83 commit 35ef07112b61b06eb30683a6563c9f6378c02476 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYYFS CVE: CVE-2025-21910 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 59b348be7597c4a9903cb003c69e37df20c04a30 upstream. Syzbot keeps reporting an issue [1] that occurs when erroneous symbols sent from userspace get through into user_alpha2[] via regulatory_hint_user() call. Such invalid regulatory hints should be rejected. While a sanity check from commit 47caf685a685 ("cfg80211: regulatory: reject invalid hints") looks to be enough to deter these very cases, there is a way to get around it due to 2 reasons. 1) The way isalpha() works, symbols other than latin lower and upper letters may be used to determine a country/domain. For instance, greek letters will also be considered upper/lower letters and for such characters isalpha() will return true as well. However, ISO-3166-1 alpha2 codes should only hold latin characters. 2) While processing a user regulatory request, between reg_process_hint_user() and regulatory_hint_user() there happens to be a call to queue_regulatory_request() which modifies letters in request->alpha2[] with toupper(). This works fine for latin symbols, less so for weird letter characters from the second part of _ctype[]. Syzbot triggers a warning in is_user_regdom_saved() by first sending over an unexpected non-latin letter that gets malformed by toupper() into a character that ends up failing isalpha() check. Prevent this by enhancing is_an_alpha2() to ensure that incoming symbols are latin letters and nothing else. [1] Syzbot report: ------------[ cut here ]------------ Unexpected user alpha2: A� WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 is_user_regdom_saved net/wireless/reg.c:440 [inline] WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restore_alpha2 net/wireless/reg.c:3424 [inline] WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restore_regulatory_settings+0x3c0/0x1e50 net/wireless/reg.c:3516 Modules linked in: CPU: 1 UID: 0 PID: 964 Comm: kworker/1:2 Not tainted 6.12.0-rc5-syzkaller-00044-gc1e939a21eb1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: events_power_efficient crda_timeout_work RIP: 0010:is_user_regdom_saved net/wireless/reg.c:440 [inline] RIP: 0010:restore_alpha2 net/wireless/reg.c:3424 [inline] RIP: 0010:restore_regulatory_settings+0x3c0/0x1e50 net/wireless/reg.c:3516 ... Call Trace: <TASK> crda_timeout_work+0x27/0x50 net/wireless/reg.c:542 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Reported-by: syzbot+e10709ac3c44f3d4e800(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e10709ac3c44f3d4e800 Fixes: 09d989d179d0 ("cfg80211: add regulatory hint disconnect support") Cc: stable(a)kernel.org Signed-off-by: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> Link: https://patch.msgid.link/20250228134659.1577656-1-n.zhandarovich@fintech.ru Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- net/wireless/reg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/wireless/reg.c b/net/wireless/reg.c index 0317cf9da307..9e0366ea86f4 100644 --- a/net/wireless/reg.c +++ b/net/wireless/reg.c @@ -405,7 +405,8 @@ static bool is_an_alpha2(const char *alpha2) { if (!alpha2) return false; - return isalpha(alpha2[0]) && isalpha(alpha2[1]); + return isascii(alpha2[0]) && isalpha(alpha2[0]) && + isascii(alpha2[1]) && isalpha(alpha2[1]); } static bool alpha2_equal(const char *alpha2_x, const char *alpha2_y) -- 2.34.1

2 1

[PATCH OLK-6.6] i2c: npcm: disable interrupt enable bit before devm_request_irq
by Xiaomeng Zhang 07 Apr '25

07 Apr '25

From: Tyrone Ting <kfting(a)nuvoton.com> stable inclusion from stable-v6.6.81 commit 1b267e1b87d52b16e7dfcc7ab2ab760f6f8f9ca9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVUF CVE: CVE-2025-21878 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dd1998e243f5fa25d348a384ba0b6c84d980f2b2 upstream. The customer reports that there is a soft lockup issue related to the i2c driver. After checking, the i2c module was doing a tx transfer and the bmc machine reboots in the middle of the i2c transaction, the i2c module keeps the status without being reset. Due to such an i2c module status, the i2c irq handler keeps getting triggered since the i2c irq handler is registered in the kernel booting process after the bmc machine is doing a warm rebooting. The continuous triggering is stopped by the soft lockup watchdog timer. Disable the interrupt enable bit in the i2c module before calling devm_request_irq to fix this issue since the i2c relative status bit is read-only. Here is the soft lockup log. [ 28.176395] watchdog: BUG: soft lockup - CPU#0 stuck for 26s! [swapper/0:1] [ 28.183351] Modules linked in: [ 28.186407] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.15.120-yocto-s-dirty-bbebc78 #1 [ 28.201174] pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 28.208128] pc : __do_softirq+0xb0/0x368 [ 28.212055] lr : __do_softirq+0x70/0x368 [ 28.215972] sp : ffffff8035ebca00 [ 28.219278] x29: ffffff8035ebca00 x28: 0000000000000002 x27: ffffff80071a3780 [ 28.226412] x26: ffffffc008bdc000 x25: ffffffc008bcc640 x24: ffffffc008be50c0 [ 28.233546] x23: ffffffc00800200c x22: 0000000000000000 x21: 000000000000001b [ 28.240679] x20: 0000000000000000 x19: ffffff80001c3200 x18: ffffffffffffffff [ 28.247812] x17: ffffffc02d2e0000 x16: ffffff8035eb8b40 x15: 00001e8480000000 [ 28.254945] x14: 02c3647e37dbfcb6 x13: 02c364f2ab14200c x12: 0000000002c364f2 [ 28.262078] x11: 00000000fa83b2da x10: 000000000000b67e x9 : ffffffc008010250 [ 28.269211] x8 : 000000009d983d00 x7 : 7fffffffffffffff x6 : 0000036d74732434 [ 28.276344] x5 : 00ffffffffffffff x4 : 0000000000000015 x3 : 0000000000000198 [ 28.283476] x2 : ffffffc02d2e0000 x1 : 00000000000000e0 x0 : ffffffc008bdcb40 [ 28.290611] Call trace: [ 28.293052] __do_softirq+0xb0/0x368 [ 28.296625] __irq_exit_rcu+0xe0/0x100 [ 28.300374] irq_exit+0x14/0x20 [ 28.303513] handle_domain_irq+0x68/0x90 [ 28.307440] gic_handle_irq+0x78/0xb0 [ 28.311098] call_on_irq_stack+0x20/0x38 [ 28.315019] do_interrupt_handler+0x54/0x5c [ 28.319199] el1_interrupt+0x2c/0x4c [ 28.322777] el1h_64_irq_handler+0x14/0x20 [ 28.326872] el1h_64_irq+0x74/0x78 [ 28.330269] __setup_irq+0x454/0x780 [ 28.333841] request_threaded_irq+0xd0/0x1b4 [ 28.338107] devm_request_threaded_irq+0x84/0x100 [ 28.342809] npcm_i2c_probe_bus+0x188/0x3d0 [ 28.346990] platform_probe+0x6c/0xc4 [ 28.350653] really_probe+0xcc/0x45c [ 28.354227] __driver_probe_device+0x8c/0x160 [ 28.358578] driver_probe_device+0x44/0xe0 [ 28.362670] __driver_attach+0x124/0x1d0 [ 28.366589] bus_for_each_dev+0x7c/0xe0 [ 28.370426] driver_attach+0x28/0x30 [ 28.373997] bus_add_driver+0x124/0x240 [ 28.377830] driver_register+0x7c/0x124 [ 28.381662] __platform_driver_register+0x2c/0x34 [ 28.386362] npcm_i2c_init+0x3c/0x5c [ 28.389937] do_one_initcall+0x74/0x230 [ 28.393768] kernel_init_freeable+0x24c/0x2b4 [ 28.398126] kernel_init+0x28/0x130 [ 28.401614] ret_from_fork+0x10/0x20 [ 28.405189] Kernel panic - not syncing: softlockup: hung tasks [ 28.411011] SMP: stopping secondary CPUs [ 28.414933] Kernel Offset: disabled [ 28.418412] CPU features: 0x00000000,00000802 [ 28.427644] Rebooting in 20 seconds.. Fixes: 56a1485b102e ("i2c: npcm7xx: Add Nuvoton NPCM I2C controller driver") Signed-off-by: Tyrone Ting <kfting(a)nuvoton.com> Cc: <stable(a)vger.kernel.org> # v5.8+ Reviewed-by: Tali Perry <tali.perry1(a)gmail.com> Signed-off-by: Andi Shyti <andi.shyti(a)kernel.org> Link: https://lore.kernel.org/r/20250220040029.27596-2-kfting@nuvoton.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/i2c/busses/i2c-npcm7xx.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/i2c/busses/i2c-npcm7xx.c b/drivers/i2c/busses/i2c-npcm7xx.c index ae4bae63ad4f..91f508d50e7a 100644 --- a/drivers/i2c/busses/i2c-npcm7xx.c +++ b/drivers/i2c/busses/i2c-npcm7xx.c @@ -2333,6 +2333,13 @@ static int npcm_i2c_probe_bus(struct platform_device *pdev) if (irq < 0) return irq; + /* + * Disable the interrupt to avoid the interrupt handler being triggered + * incorrectly by the asynchronous interrupt status since the machine + * might do a warm reset during the last smbus/i2c transfer session. + */ + npcm_i2c_int_enable(bus, false); + ret = devm_request_irq(bus->dev, irq, npcm_i2c_bus_irq, 0, dev_name(bus->dev), bus); if (ret) -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers
by Xiaomeng Zhang 07 Apr '25

07 Apr '25

*** BLURB HERE *** Peter Ujfalusi (1): ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers Pierre-Louis Bossart (1): ASoC: SOF: topology: dynamically allocate and store DAI widget->private Ranjani Sridharan (1): ASoC: SOF: topology: Parse DAI type token for dspless mode sound/soc/sof/ipc4-topology.c | 13 +++++++++++-- sound/soc/sof/sof-audio.c | 8 +++----- sound/soc/sof/sof-audio.h | 1 + sound/soc/sof/topology.c | 25 ++++++++++++++++++++++--- 4 files changed, 37 insertions(+), 10 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 v2] HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
by Pu Lehui 07 Apr '25

07 Apr '25

From: Zhang Lixu <lixu.zhang(a)intel.com> stable inclusion from stable-v6.6.83 commit 560f4d1299342504a6ab8a47f575b5e6b8345ada category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY43Y CVE: CVE-2025-21928 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 07583a0010696a17fb0942e0b499a62785c5fc9f ] The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtp_hid_remove() function. The function currently frees the `driver_data` directly within the loop that destroys the HID devices, which can lead to accessing freed memory. Specifically, `hid_destroy_device()` uses `driver_data` when it calls `hid_ishtp_set_feature()` to power off the sensor, so freeing `driver_data` beforehand can result in accessing invalid memory. This patch resolves the issue by storing the `driver_data` in a temporary variable before calling `hid_destroy_device()`, and then freeing the `driver_data` after the device is destroyed. Fixes: 0b28cb4bcb17 ("HID: intel-ish-hid: ISH HID client driver") Signed-off-by: Zhang Lixu <lixu.zhang(a)intel.com> Acked-by: Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/hid/intel-ish-hid/ishtp-hid.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/hid/intel-ish-hid/ishtp-hid.c b/drivers/hid/intel-ish-hid/ishtp-hid.c index 00c6f0ebf356..be2c62fc8251 100644 --- a/drivers/hid/intel-ish-hid/ishtp-hid.c +++ b/drivers/hid/intel-ish-hid/ishtp-hid.c @@ -261,12 +261,14 @@ int ishtp_hid_probe(unsigned int cur_hid_dev, */ void ishtp_hid_remove(struct ishtp_cl_data *client_data) { + void *data; int i; for (i = 0; i < client_data->num_hid_devices; ++i) { if (client_data->hid_sensor_hubs[i]) { - kfree(client_data->hid_sensor_hubs[i]->driver_data); + data = client_data->hid_sensor_hubs[i]->driver_data; hid_destroy_device(client_data->hid_sensor_hubs[i]); + kfree(data); client_data->hid_sensor_hubs[i] = NULL; } } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] HID: betop: check shape of output reports
by Xiangwei Li 07 Apr '25

07 Apr '25

From: Pietro Borrello <borrello(a)diag.uniroma1.it> stable inclusion from stable-v4.19.272 commit 7317326f685824c7c29bd80841fd18041af6bb73 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVXF CVE: CVE-2023-53015 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit 3782c0d6edf658b71354a64d60aa7a296188fc90 ] betopff_init() only checks the total sum of the report counts for each report field to be at least 4, but hid_betopff_play() expects 4 report fields. A device advertising an output report with one field and 4 report counts would pass the check but crash the kernel with a NULL pointer dereference in hid_betopff_play(). Fixes: 52cd7785f3cd ("HID: betop: add drivers/hid/hid-betopff.c") Signed-off-by: Pietro Borrello <borrello(a)diag.uniroma1.it> Signed-off-by: Jiri Kosina <jkosina(a)suse.cz> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- drivers/hid/hid-betopff.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/drivers/hid/hid-betopff.c b/drivers/hid/hid-betopff.c index 9b60efe6ec44..ba386e5aa055 100644 --- a/drivers/hid/hid-betopff.c +++ b/drivers/hid/hid-betopff.c @@ -63,7 +63,6 @@ static int betopff_init(struct hid_device *hid) struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list; struct input_dev *dev; - int field_count = 0; int error; int i, j; @@ -89,19 +88,21 @@ static int betopff_init(struct hid_device *hid) * ----------------------------------------- * Do init them with default value. */ + if (report->maxfield < 4) { + hid_err(hid, "not enough fields in the report: %d\n", + report->maxfield); + return -ENODEV; + } for (i = 0; i < report->maxfield; i++) { + if (report->field[i]->report_count < 1) { + hid_err(hid, "no values in the field\n"); + return -ENODEV; + } for (j = 0; j < report->field[i]->report_count; j++) { report->field[i]->value[j] = 0x00; - field_count++; } } - if (field_count < 4) { - hid_err(hid, "not enough fields in the report: %d\n", - field_count); - return -ENODEV; - } - betopff = kzalloc(sizeof(*betopff), GFP_KERNEL); if (!betopff) return -ENOMEM; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] [Backport] drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
by Lin Ruifeng 07 Apr '25

07 Apr '25

From: Zhou Qingyang <zhou1615(a)umn.edu> stable inclusion from stable-v4.19.238 commit 2c729dec8c1e3e2892fde5ce8181553860914e74 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6X6 CVE: CVE-2022-49232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 588a70177df3b1777484267584ef38ab2ca899a2 ] In amdgpu_dm_connector_add_common_modes(), amdgpu_dm_create_common_mode() is assigned to mode and is passed to drm_mode_probed_add() directly after that. drm_mode_probed_add() passes &mode->head to list_add_tail(), and there is a dereference of it in list_add_tail() without recoveries, which could lead to NULL pointer dereference on failure of amdgpu_dm_create_common_mode(). Fix this by adding a NULL check of mode. This bug was found by a static analyzer. Builds with 'make allyesconfig' show no new warnings, and our static analyzer no longer warns about this code. Fixes: e7b07ceef2a6 ("drm/amd/display: Merge amdgpu_dm_types and amdgpu_dm") Signed-off-by: Zhou Qingyang <zhou1615(a)umn.edu> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 65fb64c8727f..58b66ca4f3bd 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -3595,6 +3595,9 @@ static void amdgpu_dm_connector_add_common_modes(struct drm_encoder *encoder, mode = amdgpu_dm_create_common_mode(encoder, common_modes[i].name, common_modes[i].w, common_modes[i].h); + if (!mode) + continue; + drm_mode_probed_add(connector, mode); amdgpu_dm_connector->num_modes++; } -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] [Backport] staging: rtl8712: fix uninit-value in r871xu_drv_init()
by Lin Ruifeng 07 Apr '25

07 Apr '25

From: Wang Cheng <wanngchenng(a)gmail.com> stable inclusion from stable-v4.19.247 commit a6535d00a9d54ce1c2a8d86a85001ffb6844f9b2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP5XN CVE: CVE-2022-49298 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0458e5428e5e959d201a40ffe71d762a79ecedc4 ] When 'tmpU1b' returns from r8712_read8(padapter, EE_9346CR) is 0, 'mac[6]' will not be initialized. BUG: KMSAN: uninit-value in r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541 r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541 usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396 really_probe+0x653/0x14b0 drivers/base/dd.c:596 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752 driver_probe_device drivers/base/dd.c:782 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:970 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1fff/0x26e0 drivers/base/core.c:3405 usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238 usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293 really_probe+0x653/0x14b0 drivers/base/dd.c:596 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752 driver_probe_device drivers/base/dd.c:782 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:970 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1fff/0x26e0 drivers/base/core.c:3405 usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2566 hub_port_connect drivers/usb/core/hub.c:5358 [inline] hub_port_connect_change drivers/usb/core/hub.c:5502 [inline] port_event drivers/usb/core/hub.c:5660 [inline] hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5742 process_one_work+0xdb6/0x1820 kernel/workqueue.c:2307 worker_thread+0x10b3/0x21e0 kernel/workqueue.c:2454 kthread+0x3c7/0x500 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 Local variable mac created at: r871xu_drv_init+0x1771/0x3070 drivers/staging/rtl8712/usb_intf.c:394 usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396 KMSAN: uninit-value in r871xu_drv_init https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00b… Reported-by: <syzbot+6f5ecd144854c0d8580b(a)syzkaller.appspotmail.com> Tested-by: <syzbot+6f5ecd144854c0d8580b(a)syzkaller.appspotmail.com> Reviewed-by: Dan Carpenter <dan.carpenter(a)oracle.com> Signed-off-by: Wang Cheng <wanngchenng(a)gmail.com> Link: https://lore.kernel.org/r/14c3886173dfa4597f0704547c414cfdbcd11d16.16526182… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/staging/rtl8712/usb_intf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c index 709d687180bf..c10d1cbad816 100644 --- a/drivers/staging/rtl8712/usb_intf.c +++ b/drivers/staging/rtl8712/usb_intf.c @@ -569,13 +569,13 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf, } else { AutoloadFail = false; } - if (((mac[0] == 0xff) && (mac[1] == 0xff) && + if ((!AutoloadFail) || + ((mac[0] == 0xff) && (mac[1] == 0xff) && (mac[2] == 0xff) && (mac[3] == 0xff) && (mac[4] == 0xff) && (mac[5] == 0xff)) || ((mac[0] == 0x00) && (mac[1] == 0x00) && (mac[2] == 0x00) && (mac[3] == 0x00) && - (mac[4] == 0x00) && (mac[5] == 0x00)) || - (!AutoloadFail)) { + (mac[4] == 0x00) && (mac[5] == 0x00))) { mac[0] = 0x00; mac[1] = 0xe0; mac[2] = 0x4c; -- 2.22.0

2 1

[PATCH OLK-6.6 v6 0/7] Add support for IPIv
by Jinqian Yang 05 Apr '25

05 Apr '25

Patch#1 Allocate VM table and save vpeid in it Patch#2 avoid sending multi-SGIs in IPIV Patch#3 Set base address of vm table and targe ITS when vpe schedule and deschedule Patch#4 Register ipiv exception interrupt Patch#5 Add interface KVM_CAP_ARM_IPIV_MODE Patch#6 Probe and configure IPIV capacity on HIP12 Patch#7 Use KABI_EXTEND to perform kabi repair for IPIV Jinqian Yang (2): KVM: arm64: avoid sending multi-SGIs in IPIV kabi: Use KABI_EXTEND to perform kabi repair for IPIV Xiang Chen (5): kvm: hisi_virt: Allocate VM table and save vpeid in it irqchip: gicv3-its: Set base address of vm table and targe ITS when vpe schedule and deschedule kvm: hisi_virt: Register ipiv exception interrupt kvm: arm64: Add interface KVM_CAP_ARM_IPIV_MODE kvm: hisi_virt: Probe and configure IPIV capacity on HIP12 .../admin-guide/kernel-parameters.txt | 3 + arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/include/asm/sysreg.h | 3 + arch/arm64/kvm/arm.c | 16 ++++ arch/arm64/kvm/hisilicon/hisi_virt.c | 35 +++++++ arch/arm64/kvm/hisilicon/hisi_virt.h | 11 +++ arch/arm64/kvm/sys_regs.c | 30 ++++-- arch/arm64/kvm/vgic/vgic-init.c | 44 ++++++++- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 + drivers/irqchip/irq-gic-v3-its.c | 94 ++++++++++++++++++- drivers/irqchip/irq-gic-v3.c | 33 +++++++ include/linux/irqchip/arm-gic-v3.h | 24 +++++ include/linux/irqchip/arm-gic-v4.h | 2 + include/uapi/linux/kvm.h | 2 + 14 files changed, 285 insertions(+), 15 deletions(-) -- 2.33.0

2 8

[PATCH OLK-6.6 v5 0/7] Add support for IPIv
by Jinqian Yang 05 Apr '25

05 Apr '25

Patch#1 Allocate VM table and save vpeid in it Patch#2 avoid sending multi-SGIs in IPIV Patch#3 Set base address of vm table and targe ITS when vpe schedule and deschedule Patch#4 Register ipiv exception interrupt Patch#5 Add interface KVM_CAP_ARM_IPIV_MODE Patch#6 Probe and configure IPIV capacity on HIP12 Patch#7 Use KABI_EXTEND to perform kabi repair for IPIV Jinqian Yang (2): KVM: arm64: avoid sending multi-SGIs in IPIV kabi: Use KABI_EXTEND to perform kabi repair for IPIV Xiang Chen (5): kvm: hisi_virt: Allocate VM table and save vpeid in it irqchip: gicv3-its: Set base address of vm table and targe ITS when vpe schedule and deschedule kvm: hisi_virt: Register ipiv exception interrupt kvm: arm64: Add interface KVM_CAP_ARM_IPIV_MODE kvm: hisi_virt: Probe and configure IPIV capacity on HIP12 .../admin-guide/kernel-parameters.txt | 3 + arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/kvm/arm.c | 16 ++++ arch/arm64/kvm/hisilicon/hisi_virt.c | 35 ++++++++ arch/arm64/kvm/hisilicon/hisi_virt.h | 11 +++ arch/arm64/kvm/sys_regs.c | 30 ++++--- arch/arm64/kvm/vgic/vgic-init.c | 44 ++++++++- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 + drivers/irqchip/irq-gic-v3-its.c | 89 ++++++++++++++++++- drivers/irqchip/irq-gic-v3.c | 33 +++++++ include/linux/irqchip/arm-gic-v3.h | 24 +++++ include/linux/irqchip/arm-gic-v4.h | 2 + include/uapi/linux/kvm.h | 2 + 13 files changed, 277 insertions(+), 15 deletions(-) -- 2.33.0

2 8

[PATCH OLK-6.6 v4 0/7] Add support for IPIv
by Jinqian Yang 05 Apr '25

05 Apr '25

Patch#1 Allocate VM table and save vpeid in it Patch#2 avoid sending multi-SGIs in IPIV Patch#3 Set base address of vm table and targe ITS when vpe schedule and deschedule Patch#4 Register ipiv exception interrupt Patch#5 Add interface KVM_CAP_ARM_IPIV_MODE Patch#6 Probe and configure IPIV capacity on HIP12 Patch#7 Use KABI_EXTEND to perform kabi repair for IPIV Jinqian Yang (2): KVM: arm64: avoid sending multi-SGIs in IPIV kabi: Use KABI_EXTEND to perform kabi repair for IPIV Xiang Chen (5): kvm: hisi_virt: Allocate VM table and save vpeid in it irqchip: gicv3-its: Set base address of vm table and targe ITS when vpe schedule and deschedule kvm: hisi_virt: Register ipiv exception interrupt kvm: arm64: Add interface KVM_CAP_ARM_IPIV_MODE kvm: hisi_virt: Probe and configure IPIV capacity on HIP12 .../admin-guide/kernel-parameters.txt | 3 + arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/include/asm/sysreg.h | 3 + arch/arm64/kvm/arm.c | 16 ++++ arch/arm64/kvm/hisilicon/hisi_virt.c | 35 ++++++++ arch/arm64/kvm/hisilicon/hisi_virt.h | 11 +++ arch/arm64/kvm/sys_regs.c | 30 ++++--- arch/arm64/kvm/vgic/vgic-init.c | 44 +++++++++- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 + drivers/irqchip/irq-gic-v3-its.c | 87 ++++++++++++++++++- drivers/irqchip/irq-gic-v3.c | 33 +++++++ include/linux/irqchip/arm-gic-v3.h | 24 +++++ include/linux/irqchip/arm-gic-v4.h | 2 + include/uapi/linux/kvm.h | 2 + 14 files changed, 278 insertions(+), 15 deletions(-) -- 2.33.0

2 8

[openeuler:OLK-5.10] BUILD REGRESSION db1a76ce61d485fc8f87f31ed44b37ab4e412a6d
by kernel test robot 04 Apr '25

04 Apr '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: db1a76ce61d485fc8f87f31ed44b37ab4e412a6d !15760 uprobes: Reject the shared zeropage in uprobe_write_opcode() Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503082314.gTnzWY6P-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503101424.uyjkGNSl-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503171920.f4jVchcy-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503220351.uj1q69QX-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503220607.nbhzXKry-lkp@intel.com block/bio.c:412: warning: Excess function parameter 'nr_iovecs' description in 'bio_alloc_bioset' block/bio.c:412: warning: Function parameter or member 'nr_iovecs_int' not described in 'bio_alloc_bioset' drivers/scsi/linkdata/ps3stor/./linux/ps3_driver_log.c:41:19: error: unused function 'time_for_log' [-Werror,-Wunused-function] drivers/scsi/linkdata/ps3stor/./linux/ps3_driver_log.c:65:19: error: unused function 'time_for_file_name' [-Werror,-Wunused-function] drivers/scsi/linkdata/ps3stor/ps3_irq.c:22:27: error: unused variable 'PS3_INTERRUPT_CMD_DISABLE_ALL_MASK' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:23:27: error: unused variable 'PS3_INTERRUPT_CMD_ENABLE_MSIX' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:24:27: error: unused variable 'PS3_INTERRUPT_MASK_DISABLE' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:25:27: error: unused variable 'PS3_INTERRUPT_STATUS_EXIST_IRQ' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:26:27: error: unused variable 'PS3_INTERRUPT_CLEAR_IRQ' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:28:27: error: unused variable 'PS3_SSD_IOPS_MSIX_VECTORS' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:29:27: error: unused variable 'PS3_HDD_IOPS_MSIX_VECTORS' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3024:6: error: no previous prototype for function 'ps3_hba_qos_waitq_poll' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3280:15: error: no previous prototype for function 'ps3_raid_qos_decision' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3335:6: error: no previous prototype for function 'ps3_qos_mgrq_resend' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3479:6: error: no previous prototype for function 'ps3_raid_qos_waitq_notify' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3822:15: error: no previous prototype for function 'ps3_raid_qos_waitq_abort' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_scsih.c:1959:1: error: unused function 'ps3_scsih_dev_id_get' [-Werror,-Wunused-function] kismet: WARNING: unmet direct dependencies detected for CPPC_CPUFREQ_SYSFS_INTERFACE when selected by CPU_FREQ_GOV_SEEP ld.lld: error: version script assignment of 'LINUX_2.6' to symbol '__vdso_sgx_enter_enclave' failed: symbol not defined llvm-objcopy: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory llvm-objdump: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory Unverified Error/Warning (likely false positive, kindly check if interested): drivers/gpu/drm/radeon/cik.o: warning: objtool: dce8_bandwidth_update() falls through to next function cik_get_gpu_clock_counter() drivers/gpu/drm/radeon/evergreen.o: warning: objtool: evergreen_program_watermarks() falls through to next function evergreen_mc_wait_for_idle() drivers/gpu/drm/radeon/si.o: warning: objtool: dce6_program_watermarks() falls through to next function si_fence_ring_emit() drivers/gpu/drm/vmwgfx/vmwgfx_fb.o: warning: objtool: vmw_deferred_io() falls through to next function asan.module_ctor() drivers/media/tuners/e4000.o: warning: objtool: e4000_set_params() falls through to next function e4000_standby() drivers/mtd/devices/mtd_dataflash.o: warning: objtool: dataflash_write() falls through to next function asan.module_ctor() drivers/nvdimm/namespace_devs.o: warning: objtool: size_store() falls through to next function nd_namespace_label_update() drivers/tty/vt/vt.o: warning: objtool: do_update_region() falls through to next function set_cursor() fs/btrfs/free-space-cache.o: warning: objtool: add_bytes_to_bitmap() falls through to next function recalculate_thresholds() fs/btrfs/free-space-cache.o: warning: objtool: bitmap_clear_bits() falls through to next function free_bitmap() fs/btrfs/free-space-cache.o: warning: objtool: btrfs_alloc_from_cluster() falls through to next function btrfs_find_space_cluster() fs/btrfs/free-space-cache.o: warning: objtool: setup_cluster_bitmap() falls through to next function btrfs_init_free_cluster() fs/btrfs/free-space-cache.o: warning: objtool: steal_from_bitmap() falls through to next function link_free_space() fs/btrfs/free-space-tree.o: warning: objtool: modify_free_space_bitmap() falls through to next function free_space_test_bit() fs/btrfs/free-space-tree.o: warning: objtool: update_free_space_extent_count() falls through to next function add_new_free_space_info() fs/ufs/ialloc.o: warning: objtool: ufs_new_inode() falls through to next function ufs2_init_inodes_chunk() fs/ufs/inode.o: warning: objtool: ufs_iget() falls through to next function ufs_set_inode_ops() mm/vmscan.o: warning: objtool: do_shrink_slab() falls through to next function allow_direct_reclaim() Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-CPPC_CPUFREQ_SYSFS_INTERFACE-when-selected-by-CPU_FREQ_GOV_SEEP |-- arm64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-allnoconfig | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_file_name-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_log-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_HDD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CLEAR_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_DISABLE_ALL_MASK-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_ENABLE_MSIX-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_MASK_DISABLE-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_STATUS_EXIST_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_SSD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_mgrq_resend-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_notify-Werror-Wmissing-prototypes | `-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:error:unused-function-ps3_scsih_dev_id_get-Werror-Wunused-function |-- x86_64-buildonly-randconfig-001-20250403 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-002-20250403 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-003-20250403 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-004-20250403 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-005-20250403 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-006-20250403 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-101-20250404 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-102-20250404 | |-- drivers-media-tuners-e4000.o:warning:objtool:e4000_set_params-falls-through-to-next-function-e4000_standby() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-103-20250404 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-gpu-drm-radeon-cik.o:warning:objtool:dce8_bandwidth_update-falls-through-to-next-function-cik_get_gpu_clock_counter() | |-- drivers-gpu-drm-radeon-evergreen.o:warning:objtool:evergreen_program_watermarks-falls-through-to-next-function-evergreen_mc_wait_for_idle() | |-- drivers-gpu-drm-radeon-si.o:warning:objtool:dce6_program_watermarks-falls-through-to-next-function-si_fence_ring_emit() | |-- drivers-gpu-drm-vmwgfx-vmwgfx_fb.o:warning:objtool:vmw_deferred_io-falls-through-to-next-function-asanmodule_ctor() | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:setup_cluster_bitmap-falls-through-to-next-function-btrfs_init_free_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- mm-vmscan.o:warning:objtool:do_shrink_slab-falls-through-to-next-function-allow_direct_reclaim() |-- x86_64-randconfig-104-20250404 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-121-20250404 | `-- mm-vmscan.o:warning:objtool:do_shrink_slab-falls-through-to-next-function-allow_direct_reclaim() |-- x86_64-randconfig-122-20250403 | `-- drivers-tty-vt-vt.o:warning:objtool:do_update_region-falls-through-to-next-function-set_cursor() |-- x86_64-randconfig-122-20250404 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-nvdimm-namespace_devs.o:warning:objtool:size_store-falls-through-to-next-function-nd_namespace_label_update() | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() | |-- fs-btrfs-free-space-cache.o:warning:objtool:bitmap_clear_bits-falls-through-to-next-function-free_bitmap() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:setup_cluster_bitmap-falls-through-to-next-function-btrfs_init_free_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-123-20250404 | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-161-20250404 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-gpu-drm-radeon-cik.o:warning:objtool:dce8_bandwidth_update-falls-through-to-next-function-cik_get_gpu_clock_counter() | |-- drivers-gpu-drm-radeon-evergreen.o:warning:objtool:evergreen_program_watermarks-falls-through-to-next-function-evergreen_mc_wait_for_idle() | |-- drivers-gpu-drm-radeon-si.o:warning:objtool:dce6_program_watermarks-falls-through-to-next-function-si_fence_ring_emit() | |-- drivers-gpu-drm-vmwgfx-vmwgfx_fb.o:warning:objtool:vmw_deferred_io-falls-through-to-next-function-asanmodule_ctor() | |-- drivers-nvdimm-namespace_devs.o:warning:objtool:size_store-falls-through-to-next-function-nd_namespace_label_update() | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() | |-- fs-btrfs-free-space-cache.o:warning:objtool:bitmap_clear_bits-falls-through-to-next-function-free_bitmap() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() | |-- fs-ufs-ialloc.o:warning:objtool:ufs_new_inode-falls-through-to-next-function-ufs2_init_inodes_chunk() | |-- fs-ufs-inode.o:warning:objtool:ufs_iget-falls-through-to-next-function-ufs_set_inode_ops() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- x86_64-randconfig-r064-20250404 |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- drivers-mtd-devices-mtd_dataflash.o:warning:objtool:dataflash_write-falls-through-to-next-function-asanmodule_ctor() |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory elapsed time: 1457m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250403 gcc-6.5.0 arm64 randconfig-002-20250403 clang-16 arm64 randconfig-003-20250403 clang-17 arm64 randconfig-004-20250403 clang-20 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250403 clang-20 x86_64 buildonly-randconfig-002-20250403 clang-20 x86_64 buildonly-randconfig-003-20250403 clang-20 x86_64 buildonly-randconfig-004-20250403 clang-20 x86_64 buildonly-randconfig-005-20250403 gcc-11 x86_64 buildonly-randconfig-006-20250403 clang-20 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 7b875ea720bc6e57bfde437f67d42230a63438f6
by kernel test robot 04 Apr '25

04 Apr '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 7b875ea720bc6e57bfde437f67d42230a63438f6 !15743 uprobes: Reject the shared zeropage in uprobe_write_opcode() Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503082212.OF8nZc9a-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503182233.88LCSaAj-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503200858.XSvAPfQM-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503201027.i8HE43EJ-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503220823.mG13Rroz-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503220924.Uw2cwpZV-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503231043.bCX9sPgT-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503231106.ZSS1yt6E-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503290855.eVbc4pVd-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202504012026.kzT6d2HZ-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202504041224.uqw8VTgL-lkp@intel.com arch/arm64/kvm/virtcca_cvm.c:819:5: warning: no previous prototype for function 'virtcca_get_tmi_version' [-Wmissing-prototypes] arch/loongarch/mm/cache.c:69:29: warning: variable 'way_size' set but not used [-Wunused-but-set-variable] drivers/coda/coda_pci.c:228: warning: Excess function parameter 'pdev' description in 'virtcca_pci_get_rom_size' drivers/coda/coda_pci.c:228: warning: Function parameter or member 'p' not described in 'virtcca_pci_get_rom_size' drivers/scsi/linkdata/ps3stor/./linux/ps3_base.c:545:5: error: no previous prototype for 'ps3_pci_init' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_base.c:899:5: error: no previous prototype for 'ps3_pci_init_complete' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_base.c:945:6: error: no previous prototype for 'ps3_pci_init_complete_exit' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_cli.c:108:9: error: function 'ps3stor_cli_printf' might be a candidate for 'gnu_printf' format attribute [-Werror=suggest-attribute=format] drivers/scsi/linkdata/ps3stor/./linux/ps3_cli_debug.c:1059:5: error: no previous prototype for 'ps3_dump_context_show' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_dump.c:159:5: error: no previous prototype for 'ps3_dump_file_write' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_dump.c:200:5: error: no previous prototype for 'ps3_dump_file_close' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_dump.c:28:5: error: no previous prototype for 'ps3_dump_local_time' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_dump.c:50:5: error: no previous prototype for 'ps3_dump_filename_build' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_dump.c:76:5: error: no previous prototype for 'ps3_dump_file_open' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_cmd_complete.c:131:6: error: no previous prototype for 'ps3_trigger_irq_poll' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_cmd_complete.c:243:5: error: no previous prototype for 'ps3_resp_status_convert' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_cmd_statistics.c:403:6: error: no previous prototype for 'ps3_io_recv_ok_stat_inc' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_cmd_statistics.c:85:6: error: no previous prototype for 'ps3_cmd_stat_content_clear' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_debug.c:883:5: error: no previous prototype for 'ps3_dump_dir_length' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_device_manager.c:1581:5: error: no previous prototype for 'ps3_scsi_private_init_pd' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_device_manager.c:1663:5: error: no previous prototype for 'ps3_scsi_private_init_vd' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_device_manager_sas.c:1632:5: error: no previous prototype for 'ps3_sas_expander_phys_refresh' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_instance_manager.c:669:60: error: 'snprintf' output may be truncated before the last format character [-Werror=format-truncation=] drivers/scsi/linkdata/ps3stor/ps3_ioc_adp.c:147:6: error: no previous prototype for 'ps3_ioc_resource_prepare_hba' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_ioc_adp.c:36:6: error: no previous prototype for 'ps3_ioc_resource_prepare_switch' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_ioc_adp.c:88:6: error: no previous prototype for 'ps3_ioc_resource_prepare_raid' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_ioc_manager.c:307:5: error: no previous prototype for 'ps3_hard_reset_to_ready' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_ioctl.c:785:6: error: no previous prototype for 'ps3_clean_mgr_cmd' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_irq.c:21:27: error: 'PS3_INTERRUPT_CMD_DISABLE_ALL_MASK' defined but not used [-Werror=unused-const-variable=] drivers/scsi/linkdata/ps3stor/ps3_irq.c:22:27: error: 'PS3_INTERRUPT_CMD_ENABLE_MSIX' defined but not used [-Werror=unused-const-variable=] drivers/scsi/linkdata/ps3stor/ps3_irq.c:23:27: error: 'PS3_INTERRUPT_MASK_DISABLE' defined but not used [-Werror=unused-const-variable=] drivers/scsi/linkdata/ps3stor/ps3_irq.c:24:27: error: 'PS3_INTERRUPT_STATUS_EXIST_IRQ' defined but not used [-Werror=unused-const-variable=] drivers/scsi/linkdata/ps3stor/ps3_irq.c:25:27: error: 'PS3_INTERRUPT_CLEAR_IRQ' defined but not used [-Werror=unused-const-variable=] drivers/scsi/linkdata/ps3stor/ps3_irq.c:27:27: error: 'PS3_SSD_IOPS_MSIX_VECTORS' defined but not used [-Werror=unused-const-variable=] drivers/scsi/linkdata/ps3stor/ps3_irq.c:28:27: error: 'PS3_HDD_IOPS_MSIX_VECTORS' defined but not used [-Werror=unused-const-variable=] drivers/scsi/linkdata/ps3stor/ps3_module_para.c:609:14: error: no previous prototype for 'ps3_cli_ver_query' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:1058:6: error: no previous prototype for 'ps3_qos_pd_waitq_ratio_update' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2019:15: error: no previous prototype for 'ps3_hba_qos_decision' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2040:6: error: no previous prototype for 'ps3_hba_qos_waitq_notify' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2100:6: error: no previous prototype for 'ps3_cmd_waitq_abort' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:211:1: error: no previous prototype for 'ps3_qos_cmd_waitq_get' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2463:6: error: no previous prototype for 'ps3_hba_qos_waitq_clear_all' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2827:6: error: no previous prototype for 'ps3_hba_qos_vd_init' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2936:6: error: no previous prototype for 'ps3_hba_qos_vd_reset' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3023:6: error: no previous prototype for 'ps3_hba_qos_waitq_poll' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3279:15: error: no previous prototype for 'ps3_raid_qos_decision' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3334:6: error: no previous prototype for 'ps3_qos_mgrq_resend' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:335:15: error: no previous prototype for 'ps3_qos_vd_cmdword_get' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3478:6: error: no previous prototype for 'ps3_raid_qos_waitq_notify' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:351:15: error: no previous prototype for 'ps3_qos_exclusive_cmdword_get' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:363:15: error: no previous prototype for 'ps3_qos_tg_decision' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3821:15: error: no previous prototype for 'ps3_raid_qos_waitq_abort' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:4022:6: error: no previous prototype for 'ps3_raid_qos_waitq_clear_all' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:4083:6: error: no previous prototype for 'ps3_raid_qos_waitq_poll' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:749:15: error: no previous prototype for 'ps3_qos_all_pd_rc_get' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:876:6: error: no previous prototype for 'ps3_pd_quota_waitq_clear_all' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:892:6: error: no previous prototype for 'ps3_pd_quota_waitq_clean' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:1173:5: error: no previous prototype for 'ps3_range_check_and_insert' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:1231:5: error: no previous prototype for 'ps3_r1x_hash_range_lock' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:1312:6: error: no previous prototype for 'ps3_r1x_hash_range_unlock' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:578:5: error: no previous prototype for 'ps3_r1x_hash_bit_check' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:678:6: error: no previous prototype for 'ps3_r1x_conflict_queue_hash_bit_lock' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:730:5: error: no previous prototype for 'ps3_r1x_hash_bit_lock' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:988:6: error: no previous prototype for 'ps3_r1x_hash_bit_unlock' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_rb_tree.c:154:6: error: no previous prototype for 'rbtDelNodeDo' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:204:6: error: no previous prototype for 'ps3_recovery_irq_queue_destroy' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:2700:6: error: no previous prototype for 'ps3_hard_recovery_state_finish' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:363:5: error: no previous prototype for 'ps3_recovery_state_transfer' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:72:30: error: no previous prototype for 'ps3_recovery_context_alloc' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:82:6: error: no previous prototype for 'ps3_recovery_context_free' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:88:6: error: no previous prototype for 'ps3_recovery_context_delete' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_sas_transport.c:407:5: error: no previous prototype for 'ps3_sas_update_phy_info' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_scsi_cmd_err.c:1110:5: error: no previous prototype for 'ps3_wait_for_outstanding_complete' [-Werror=missing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_scsi_cmd_err.c:876:6: error: no previous prototype for 'ps3_set_task_manager_busy' [-Werror=missing-prototypes] fs/ntfs/collate.o: warning: objtool: ntfs_collate+0x9c: can't find jump dest instruction at .text+0x3dc kismet: WARNING: unmet direct dependencies detected for ACPI_HOTPLUG_IGNORE_OSC when selected by X86 kismet: WARNING: unmet direct dependencies detected for CRYPTO_DRBG_CTR when selected by CRYPTO_DEV_HISI_TRNG kismet: WARNING: unmet direct dependencies detected for HALTPOLL_CPUIDLE when selected by ARM64 mm/memory.c:5300:17: warning: variable 'nr_pages' set but not used [-Wunused-but-set-variable] mm/memory.c:5300:24: warning: variable 'nr_pages' set but not used [-Wunused-but-set-variable] mm/mempolicy.c:3129:26: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-virtcca_get_tmi_version | |-- drivers-coda-coda_pci.c:warning:Excess-function-parameter-pdev-description-in-virtcca_pci_get_rom_size | |-- drivers-coda-coda_pci.c:warning:Function-parameter-or-member-p-not-described-in-virtcca_pci_get_rom_size | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_DRBG_CTR-when-selected-by-CRYPTO_DEV_HISI_TRNG | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-HALTPOLL_CPUIDLE-when-selected-by-ARM64 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-defconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-002-20250403 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-003-20250403 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-004-20250403 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allmodconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-ps3_pci_init | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-ps3_pci_init_complete | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-ps3_pci_init_complete_exit | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli.c:error:function-ps3stor_cli_printf-might-be-a-candidate-for-gnu_printf-format-attribute | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-ps3_dump_context_show | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_file_close | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_file_open | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_file_write | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_filename_build | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_local_time | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-ps3_resp_status_convert | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-ps3_trigger_irq_poll | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-ps3_cmd_stat_content_clear | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-ps3_io_recv_ok_stat_inc | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-ps3_dump_dir_length | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-ps3_scsi_private_init_pd | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-ps3_scsi_private_init_vd | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-ps3_sas_expander_phys_refresh | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.c:error:snprintf-output-may-be-truncated-before-the-last-format-character | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-ps3_ioc_resource_prepare_hba | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-ps3_ioc_resource_prepare_raid | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-ps3_ioc_resource_prepare_switch | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-ps3_hard_reset_to_ready | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-ps3_clean_mgr_cmd | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_HDD_IOPS_MSIX_VECTORS-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_CLEAR_IRQ-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_CMD_DISABLE_ALL_MASK-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_CMD_ENABLE_MSIX-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_MASK_DISABLE-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_STATUS_EXIST_IRQ-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_SSD_IOPS_MSIX_VECTORS-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-ps3_cli_ver_query | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_cmd_waitq_abort | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_decision | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_vd_init | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_vd_reset | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_waitq_clear_all | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_waitq_notify | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_waitq_poll | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_pd_quota_waitq_clean | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_pd_quota_waitq_clear_all | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_all_pd_rc_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_cmd_waitq_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_exclusive_cmdword_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_mgrq_resend | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_pd_waitq_ratio_update | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_tg_decision | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_vd_cmdword_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_decision | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_abort | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_clear_all | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_notify | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_poll | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_conflict_queue_hash_bit_lock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_bit_check | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_bit_lock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_bit_unlock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_range_lock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_range_unlock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_range_check_and_insert | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-rbtDelNodeDo | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_hard_recovery_state_finish | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_context_alloc | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_context_delete | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_context_free | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_irq_queue_destroy | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_state_transfer | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-ps3_sas_update_phy_info | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-ps3_set_task_manager_busy | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-ps3_wait_for_outstanding_complete | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allnoconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allyesconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-ps3_pci_init | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-ps3_pci_init_complete | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-ps3_pci_init_complete_exit | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli.c:error:function-ps3stor_cli_printf-might-be-a-candidate-for-gnu_printf-format-attribute | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-ps3_dump_context_show | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_file_close | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_file_open | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_file_write | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_filename_build | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-ps3_dump_local_time | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-ps3_resp_status_convert | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-ps3_trigger_irq_poll | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-ps3_cmd_stat_content_clear | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-ps3_io_recv_ok_stat_inc | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-ps3_dump_dir_length | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-ps3_scsi_private_init_pd | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-ps3_scsi_private_init_vd | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-ps3_sas_expander_phys_refresh | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.c:error:snprintf-output-may-be-truncated-before-the-last-format-character | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-ps3_ioc_resource_prepare_hba | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-ps3_ioc_resource_prepare_raid | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-ps3_ioc_resource_prepare_switch | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-ps3_hard_reset_to_ready | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-ps3_clean_mgr_cmd | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_HDD_IOPS_MSIX_VECTORS-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_CLEAR_IRQ-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_CMD_DISABLE_ALL_MASK-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_CMD_ENABLE_MSIX-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_MASK_DISABLE-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_INTERRUPT_STATUS_EXIST_IRQ-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:PS3_SSD_IOPS_MSIX_VECTORS-defined-but-not-used | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-ps3_cli_ver_query | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_cmd_waitq_abort | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_decision | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_vd_init | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_vd_reset | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_waitq_clear_all | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_waitq_notify | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_hba_qos_waitq_poll | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_pd_quota_waitq_clean | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_pd_quota_waitq_clear_all | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_all_pd_rc_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_cmd_waitq_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_exclusive_cmdword_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_mgrq_resend | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_pd_waitq_ratio_update | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_tg_decision | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_qos_vd_cmdword_get | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_decision | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_abort | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_clear_all | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_notify | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-ps3_raid_qos_waitq_poll | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_conflict_queue_hash_bit_lock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_bit_check | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_bit_lock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_bit_unlock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_range_lock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_r1x_hash_range_unlock | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-ps3_range_check_and_insert | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-rbtDelNodeDo | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_hard_recovery_state_finish | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_context_alloc | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_context_delete | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_context_free | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_irq_queue_destroy | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-ps3_recovery_state_transfer | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-ps3_sas_update_phy_info | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-ps3_set_task_manager_busy | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-ps3_wait_for_outstanding_complete | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-defconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-002-20250403 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-r064-20250404 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | |-- fs-ntfs-collate.o:warning:objtool:ntfs_collate:can-t-find-jump-dest-instruction-at-.text | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-ACPI_HOTPLUG_IGNORE_OSC-when-selected-by-X86 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allyesconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250403 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-002-20250403 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250403 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250403 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250403 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-006-20250403 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-defconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | `-- mm-mempolicy.c:warning:writing-byte-into-a-region-of-size |-- x86_64-randconfig-101-20250404 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-102-20250404 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-103-20250404 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-104-20250404 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-121-20250404 | |-- include-linux-userfaultfd_k.h:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-uffd_flags_t-usertype-flags-got-unsigned-int-enum-mfill_atomic_mode-mode | |-- include-linux-userfaultfd_k.h:sparse:sparse:restricted-uffd_flags_t-degrades-to-integer | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-122-20250404 | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-123-20250404 | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used `-- x86_64-randconfig-161-20250404 `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used elapsed time: 1461m configs tested: 21 configs skipped: 124 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250403 gcc-6.5.0 arm64 randconfig-002-20250403 clang-16 arm64 randconfig-003-20250403 clang-17 arm64 randconfig-004-20250403 clang-20 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch defconfig gcc-14.2.0 loongarch randconfig-001-20250403 gcc-12.4.0 loongarch randconfig-002-20250403 gcc-14.2.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250403 clang-20 x86_64 buildonly-randconfig-002-20250403 clang-20 x86_64 buildonly-randconfig-003-20250403 clang-20 x86_64 buildonly-randconfig-004-20250403 clang-20 x86_64 buildonly-randconfig-005-20250403 gcc-11 x86_64 buildonly-randconfig-006-20250403 clang-20 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 4701c39f7b7b92f57752591fa1faf794ab9d01b1
by kernel test robot 04 Apr '25

04 Apr '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 4701c39f7b7b92f57752591fa1faf794ab9d01b1 !15637 net_sched: sch_sfq: don't allow 1 packet limit Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503221848.AeSAEte6-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503251400.xG2WACIP-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503252231.BsBQmABZ-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503271858.j6vJ9Bhc-lkp@intel.com https://lore.kernel.org/oe-kbuild/202503150349.Roa6uXS0-lkp@intel.com arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x162: unsupported intra-function call arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1b1: unsupported intra-function call arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1c2: unsupported intra-function call arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1d2: unsupported intra-function call arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1e1: unsupported intra-function call arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1e2: unsupported intra-function call arch/x86/entry/entry_64.o: warning: objtool: If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE. drivers/gpu/drm/nouveau/include/nvkm/core/os.h:15:26: warning: 'reg' may be used uninitialized in this function [-Wmaybe-uninitialized] drivers/gpu/drm/ttm/ttm_object.c:60: error: Cannot parse struct or union! drivers/pinctrl/core.c:1338: error: Cannot parse struct or union! fs/gfs2/glock.o: warning: objtool: finish_xmote()+0x6a9: can't find switch jump table include/linux/filter.h:332:4: warning: cast between incompatible function types from 'int (* const)(struct bpf_map *, void *)' to 'u64 (*)(u64, u64, u64, u64, u64)' {aka 'long long unsigned int (*)(long long unsigned int, long long unsigned int, long long unsigned int, long long unsigned int, long long unsigned int)'} [-Wcast-function-type] include/linux/filter.h:332:4: warning: cast between incompatible function types from 'int (* const)(struct bpf_map *, void *, void *, u64)' {aka 'int (* const)(struct bpf_map *, void *, void *, long long unsigned int)'} to 'u64 (*)(u64, u64, u64, u64, u64)' {aka 'long long unsigned int (*)(long long unsigned int, long long unsigned int, long long unsigned int, long long unsigned int, long long unsigned int)'} [-Wcast-function-type] include/linux/filter.h:332:4: warning: cast between incompatible function types from 'void * (* const)(struct bpf_map *, void *)' to 'u64 (*)(u64, u64, u64, u64, u64)' {aka 'long long unsigned int (*)(long long unsigned int, long long unsigned int, long long unsigned int, long long unsigned int, long long unsigned int)'} [-Wcast-function-type] include/linux/uaccess.h:112:17: warning: 'entry' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'rinfo' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'slot' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'ticks' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:114:17: warning: 'args32' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:115:17: warning: 'ioeventfd' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:115:17: warning: 'ms_info' may be used uninitialized [-Wmaybe-uninitialized] init/Kconfig:34: syntax error kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace' mm/page_ext.o: warning: objtool: missing symbol for section .init.text samples/vfio-mdev/mdpy-fb.o: warning: objtool: missing symbol for section .init.text Unverified Error/Warning (likely false positive, kindly check if interested): /kbuild/src/headers/Makefile:626: include/config/auto.conf.cmd: No such file or directory drivers/base/regmap/regmap.o: warning: objtool: regmap_raw_read() falls through to next function _regmap_raw_read() drivers/gpu/drm/i915/i915_gem.o: warning: objtool: i915_gem_fault() falls through to next function i915_gem_object_ggtt_pin() drivers/gpu/drm/i915/intel_display.o: warning: objtool: _intel_adjust_tile_offset() falls through to next function rcu_lock_acquire() drivers/gpu/drm/i915/intel_display.o: warning: objtool: _intel_compute_tile_offset() falls through to next function skl_format_to_fourcc() drivers/gpu/drm/i915/intel_display.o: warning: objtool: skl_plane_stride() falls through to next function skl_plane_ctl() drivers/gpu/drm/i915/vlv_dsi_pll.o: warning: objtool: bxt_dsi_pll_enable() falls through to next function bxt_dsi_reset_clocks() drivers/net/ethernet/intel/e1000/e1000_main.o: warning: objtool: e1000_watchdog() falls through to next function e1000_82547_tx_fifo_stall_task() drivers/rtc/rtc-ds1685.c:1106: error: Cannot parse struct or union! drivers/staging/gmjstcm/tcm_tis_spi.c:249:3: warning: 'inten' may be used uninitialized in this function [-Wmaybe-uninitialized] drivers/staging/gmjstcm/tcm_tis_spi.c:264:14: warning: 'vendor' may be used uninitialized in this function [-Wmaybe-uninitialized] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-001-20250403 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-002-20250403 | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-uaccess.h:warning:args32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:entry-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ioeventfd-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ms_info-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rinfo-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:slot-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:ticks-may-be-used-uninitialized |-- arm64-randconfig-003-20250403 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-staging-gmjstcm-tcm_tis_spi.c:warning:inten-may-be-used-uninitialized-in-this-function | |-- drivers-staging-gmjstcm-tcm_tis_spi.c:warning:vendor-may-be-used-uninitialized-in-this-function | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-lo | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-void-u64)-aka-int-(-const)(struct-bpf_map-void-void-long-long-unsigned-int)-to-u64-(-)(u64 | `-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-void-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-l |-- arm64-randconfig-004-20250403 | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | `-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union |-- arm64-randconfig-r122-20250404 | `-- init-Kconfig:syntax-error |-- x86_64-allnoconfig | |-- Makefile:include-config-auto.conf.cmd:No-such-file-or-directory | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | `-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type |-- x86_64-buildonly-randconfig-001-20250403 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-003-20250403 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20250403 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_ext.o:warning:objtool:missing-symbol-for-section-.init.text | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20250403 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-nouveau-include-nvkm-core-os.h:warning:reg-may-be-used-uninitialized-in-this-function | |-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized-in-this-function | `-- samples-vfio-mdev-mdpy-fb.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-006-20250403 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-defconfig | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | `-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized-in-this-function |-- x86_64-randconfig-101-20250404 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | `-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- x86_64-randconfig-102-20250404 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-103-20250404 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() | |-- drivers-gpu-drm-i915-i915_gem.o:warning:objtool:i915_gem_fault-falls-through-to-next-function-i915_gem_object_ggtt_pin() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:_intel_adjust_tile_offset-falls-through-to-next-function-rcu_lock_acquire() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:_intel_compute_tile_offset-falls-through-to-next-function-skl_format_to_fourcc() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:skl_plane_stride-falls-through-to-next-function-skl_plane_ctl() | |-- drivers-gpu-drm-i915-vlv_dsi_pll.o:warning:objtool:bxt_dsi_pll_enable-falls-through-to-next-function-bxt_dsi_reset_clocks() | |-- drivers-gpu-drm-radeon-evergreen_cs.o:warning:objtool:evergreen_surface_check-falls-through-to-next-function-evergreen_cs_track_validate_htile() | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-md-raid5.o:warning:objtool:raid5_compute_sector-falls-through-to-next-function-raid5_compute_blocknr() | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | `-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool |-- x86_64-randconfig-104-20250404 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | `-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- x86_64-randconfig-121-20250404 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-122-20250404 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- block-blk-cgroup.c:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-input-mouse-elantech.o:warning:objtool:elantech_process_byte:can-t-find-switch-jump-table | |-- drivers-leds-leds-lm355x.o:warning:objtool:lm355x_control:can-t-find-switch-jump-table | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- fs-gfs2-glock.o:warning:objtool:finish_xmote:can-t-find-switch-jump-table | `-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): |-- x86_64-randconfig-123-20250404 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- mm-maccess.c:sparse:sparse:symbol-__probe_user_read-was-not-declared.-Should-it-be-static | |-- mm-memory.c:sparse:sparse:Using-plain-integer-as-NULL-pointer | `-- mm-page_alloc.c:sparse:sparse:invalid-assignment: `-- x86_64-randconfig-161-20250404 |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() |-- drivers-gpu-drm-radeon-evergreen_cs.o:warning:objtool:evergreen_surface_check-falls-through-to-next-function-evergreen_cs_track_validate_htile() |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union |-- drivers-md-raid5.o:warning:objtool:raid5_compute_sector-falls-through-to-next-function-raid5_compute_blocknr() |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration elapsed time: 1460m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250403 gcc-6.5.0 arm64 randconfig-002-20250403 gcc-14.2.0 arm64 randconfig-003-20250403 gcc-10.5.0 arm64 randconfig-004-20250403 gcc-12.3.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250403 clang-20 x86_64 buildonly-randconfig-002-20250403 clang-20 x86_64 buildonly-randconfig-003-20250403 clang-20 x86_64 buildonly-randconfig-004-20250403 clang-20 x86_64 buildonly-randconfig-005-20250403 gcc-11 x86_64 buildonly-randconfig-006-20250403 clang-20 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2089/2089] fs/ntfs/collate.o: warning: objtool: ntfs_collate+0x9c: can't find jump dest instruction at .text+0x3dc
by kernel test robot 04 Apr '25

04 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 7b875ea720bc6e57bfde437f67d42230a63438f6 commit: 7984eaba9ede77910543832d6e19af3f84f49d7c [2089/2089] LoongArch: Add ORC stack unwinder support config: loongarch-randconfig-r064-20250404 (https://download.01.org/0day-ci/archive/20250404/202504041224.uqw8VTgL-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250404/202504041224.uqw8VTgL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504041224.uqw8VTgL-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/ntfs/collate.o: warning: objtool: ntfs_collate+0x9c: can't find jump dest instruction at .text+0x3dc -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 v2 0/2] CVE-2024-57857
by Liu Jian 03 Apr '25

03 Apr '25

CVE-2024-57857 Bernard Metzler (1): RDMA/siw: Remove direct link to net_device Liu Jian (1): RDMA: Export ib_device_get_netdev() drivers/infiniband/core/device.c | 4 +++ drivers/infiniband/sw/siw/siw.h | 7 +++--- drivers/infiniband/sw/siw/siw_cm.c | 27 ++++++++++++++++----- drivers/infiniband/sw/siw/siw_main.c | 14 +---------- drivers/infiniband/sw/siw/siw_verbs.c | 35 ++++++++++++++++++--------- include/rdma/ib_verbs.h | 2 ++ 6 files changed, 55 insertions(+), 34 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] drm/drm_vma_manager: Add drm_vma_node_allow_once()
by Yang Yingliang 03 Apr '25

03 Apr '25

From: Nirmoy Das <nirmoy.das(a)intel.com> mainline inclusion from mainline-v6.2-rc6 commit 899d3a3c19ac0e5da013ce34833dccb97d19b5e4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVX3 CVE: CVE-2023-53001 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently there is no easy way for a drm driver to safely check and allow drm_vma_offset_node for a drm file just once. Allow drm drivers to call non-refcounted version of drm_vma_node_allow() so that a driver doesn't need to keep track of each drm_vma_node_allow() to call subsequent drm_vma_node_revoke() to prevent memory leak. Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> Cc: Maxime Ripard <mripard(a)kernel.org> Cc: Thomas Zimmermann <tzimmermann(a)suse.de> Cc: David Airlie <airlied(a)gmail.com> Cc: Daniel Vetter <daniel(a)ffwll.ch> Cc: Tvrtko Ursulin <tvrtko.ursulin(a)linux.intel.com> Cc: Andi Shyti <andi.shyti(a)linux.intel.com> Suggested-by: Chris Wilson <chris.p.wilson(a)intel.com> Signed-off-by: Nirmoy Das <nirmoy.das(a)intel.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com> Reviewed-by: Andi Shyti <andi.shyti(a)linux.intel.com> Link: https://lore.kernel.org/r/20230117175236.22317-1-nirmoy.das@intel.com Signed-off-by: Maxime Ripard <maxime(a)cerno.tech> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/gpu/drm/drm_vma_manager.c | 76 ++++++++++++++++++++++--------- include/drm/drm_vma_manager.h | 1 + 2 files changed, 55 insertions(+), 22 deletions(-) diff --git a/drivers/gpu/drm/drm_vma_manager.c b/drivers/gpu/drm/drm_vma_manager.c index 4565319fa6b3..7f0dc56321ae 100644 --- a/drivers/gpu/drm/drm_vma_manager.c +++ b/drivers/gpu/drm/drm_vma_manager.c @@ -240,27 +240,8 @@ void drm_vma_offset_remove(struct drm_vma_offset_manager *mgr, } EXPORT_SYMBOL(drm_vma_offset_remove); -/** - * drm_vma_node_allow - Add open-file to list of allowed users - * @node: Node to modify - * @tag: Tag of file to remove - * - * Add @tag to the list of allowed open-files for this node. If @tag is - * already on this list, the ref-count is incremented. - * - * The list of allowed-users is preserved across drm_vma_offset_add() and - * drm_vma_offset_remove() calls. You may even call it if the node is currently - * not added to any offset-manager. - * - * You must remove all open-files the same number of times as you added them - * before destroying the node. Otherwise, you will leak memory. - * - * This is locked against concurrent access internally. - * - * RETURNS: - * 0 on success, negative error code on internal failure (out-of-mem) - */ -int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag) +static int vma_node_allow(struct drm_vma_offset_node *node, + struct drm_file *tag, bool ref_counted) { struct rb_node **iter; struct rb_node *parent = NULL; @@ -282,7 +263,8 @@ int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag) entry = rb_entry(*iter, struct drm_vma_offset_file, vm_rb); if (tag == entry->vm_tag) { - entry->vm_count++; + if (ref_counted) + entry->vm_count++; goto unlock; } else if (tag > entry->vm_tag) { iter = &(*iter)->rb_right; @@ -307,8 +289,58 @@ int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag) kfree(new); return ret; } + +/** + * drm_vma_node_allow - Add open-file to list of allowed users + * @node: Node to modify + * @tag: Tag of file to remove + * + * Add @tag to the list of allowed open-files for this node. If @tag is + * already on this list, the ref-count is incremented. + * + * The list of allowed-users is preserved across drm_vma_offset_add() and + * drm_vma_offset_remove() calls. You may even call it if the node is currently + * not added to any offset-manager. + * + * You must remove all open-files the same number of times as you added them + * before destroying the node. Otherwise, you will leak memory. + * + * This is locked against concurrent access internally. + * + * RETURNS: + * 0 on success, negative error code on internal failure (out-of-mem) + */ +int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag) +{ + return vma_node_allow(node, tag, true); +} EXPORT_SYMBOL(drm_vma_node_allow); +/** + * drm_vma_node_allow_once - Add open-file to list of allowed users + * @node: Node to modify + * @tag: Tag of file to remove + * + * Add @tag to the list of allowed open-files for this node. + * + * The list of allowed-users is preserved across drm_vma_offset_add() and + * drm_vma_offset_remove() calls. You may even call it if the node is currently + * not added to any offset-manager. + * + * This is not ref-counted unlike drm_vma_node_allow() hence drm_vma_node_revoke() + * should only be called once after this. + * + * This is locked against concurrent access internally. + * + * RETURNS: + * 0 on success, negative error code on internal failure (out-of-mem) + */ +int drm_vma_node_allow_once(struct drm_vma_offset_node *node, struct drm_file *tag) +{ + return vma_node_allow(node, tag, false); +} +EXPORT_SYMBOL(drm_vma_node_allow_once); + /** * drm_vma_node_revoke - Remove open-file from list of allowed users * @node: Node to modify diff --git a/include/drm/drm_vma_manager.h b/include/drm/drm_vma_manager.h index 76ac5e97a559..ed54bce9a005 100644 --- a/include/drm/drm_vma_manager.h +++ b/include/drm/drm_vma_manager.h @@ -74,6 +74,7 @@ void drm_vma_offset_remove(struct drm_vma_offset_manager *mgr, struct drm_vma_offset_node *node); int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag); +int drm_vma_node_allow_once(struct drm_vma_offset_node *node, struct drm_file *tag); void drm_vma_node_revoke(struct drm_vma_offset_node *node, struct drm_file *tag); bool drm_vma_node_is_allowed(struct drm_vma_offset_node *node, -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1555/1555] drivers/iommu/dmar.o: warning: objtool: dmar_acpi_insert_dev_scope()+0xaf: unreachable instruction
by kernel test robot 03 Apr '25

03 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ecd01009a68c85a017e3ae2d2189eab81a6272a6 commit: 0f7d0c8b66a415734cbd2c8a7afc586c4a1d61cc [1555/1555] iommu/vt-d:Add support for detecting ACPI device in RMRR config: x86_64-buildonly-randconfig-005-20250402 (https://download.01.org/0day-ci/archive/20250403/202504031027.4sVPB11F-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250403/202504031027.4sVPB11F-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504031027.4sVPB11F-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/iommu/dmar.c:769:38: warning: arithmetic on a null pointer treated as a cast from integer to pointer is a GNU extension [-Wgnu-null-pointer-arithmetic] 769 | if (!ACPI_SUCCESS(acpi_get_handle(ACPI_ROOT_OBJECT, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~ 770 | andd->device_name, | ~~~~~~~~~~~~~~~~~~ 771 | &h))) { | ~~~~ include/acpi/actypes.h:458:56: note: expanded from macro 'ACPI_ROOT_OBJECT' 458 | #define ACPI_ROOT_OBJECT ((acpi_handle) ACPI_TO_POINTER (ACPI_MAX_PTR)) | ^ include/acpi/actypes.h:509:41: note: expanded from macro 'ACPI_TO_POINTER' 509 | #define ACPI_TO_POINTER(i) ACPI_ADD_PTR (void, (void *) 0, (acpi_size) (i)) | ^ include/acpi/actypes.h:503:84: note: expanded from macro 'ACPI_ADD_PTR' 503 | #define ACPI_ADD_PTR(t, a, b) ACPI_CAST_PTR (t, (ACPI_CAST_PTR (u8, (a)) + (acpi_size)(b))) | ^ include/acpi/actypes.h:501:66: note: expanded from macro 'ACPI_CAST_PTR' 501 | #define ACPI_CAST_PTR(t, p) ((t *) (acpi_uintptr_t) (p)) | ^ include/acpi/acexcep.h:57:44: note: expanded from macro 'ACPI_SUCCESS' 57 | #define ACPI_SUCCESS(a) (!(a)) | ^ 1 warning generated. drivers/iommu/dmar.c:391: warning: Function parameter or member 'header' not described in 'dmar_parse_one_drhd' drivers/iommu/dmar.c:391: warning: Function parameter or member 'arg' not described in 'dmar_parse_one_drhd' >> drivers/iommu/dmar.o: warning: objtool: dmar_acpi_insert_dev_scope()+0xaf: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] tracing/osnoise: Fix possible recursive locking for cpus_read_lock()
by Xiaomeng Zhang 03 Apr '25

03 Apr '25

From: Ran Xiaokai <ran.xiaokai(a)zte.com.cn> mainline inclusion from mainline-v6.15-rc1 commit 7e6b3fcc9c5294aeafed0dbe1a09a1bc899bd0f2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY77F Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Lockdep reports this deadlock log: osnoise: could not start sampling thread ============================================ WARNING: possible recursive locking detected -------------------------------------------- CPU0 ---- lock(cpu_hotplug_lock); lock(cpu_hotplug_lock); Call Trace: <TASK> print_deadlock_bug+0x282/0x3c0 __lock_acquire+0x1610/0x29a0 lock_acquire+0xcb/0x2d0 cpus_read_lock+0x49/0x120 stop_per_cpu_kthreads+0x7/0x60 start_kthread+0x103/0x120 osnoise_hotplug_workfn+0x5e/0x90 process_one_work+0x44f/0xb30 worker_thread+0x33e/0x5e0 kthread+0x206/0x3b0 ret_from_fork+0x31/0x50 ret_from_fork_asm+0x11/0x20 </TASK> This is the deadlock scenario: osnoise_hotplug_workfn() guard(cpus_read_lock)(); // first lock call start_kthread(cpu) if (IS_ERR(kthread)) { stop_per_cpu_kthreads(); { cpus_read_lock(); // second lock call. Cause the AA deadlock } } It is not necessary to call stop_per_cpu_kthreads() which stops osnoise kthread for every other CPUs in the system if a failure occurs during hotplug of a certain CPU. For start_per_cpu_kthreads(), if the start_kthread() call fails, this function calls stop_per_cpu_kthreads() to handle the error. Therefore, similarly, there is no need to call stop_per_cpu_kthreads() again within start_kthread(). So just remove stop_per_cpu_kthreads() from start_kthread to solve this issue. Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/20250321095249.2739397-1-ranxiaokai627@163.com Fixes: c8895e271f79 ("trace/osnoise: Support hotplug operations") Signed-off-by: Ran Xiaokai <ran.xiaokai(a)zte.com.cn> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace_osnoise.c [The conflicts were due to some minor issue.] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/trace/trace_osnoise.c | 1 - 1 file changed, 1 deletion(-) diff --git a/kernel/trace/trace_osnoise.c b/kernel/trace/trace_osnoise.c index cc155590018f..5bd781359d38 100644 --- a/kernel/trace/trace_osnoise.c +++ b/kernel/trace/trace_osnoise.c @@ -2038,7 +2038,6 @@ static int start_kthread(unsigned int cpu) if (IS_ERR(kthread)) { pr_err(BANNER "could not start sampling thread\n"); - stop_per_cpu_kthreads(); return -ENOMEM; } -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Add tracepoints with null-able arguments
by Pu Lehui 03 Apr '25

03 Apr '25

From: Jiri Olsa <jolsa(a)kernel.org> mainline inclusion from mainline-v6.15-rc1 commit c83e2d970bae8616b94c40caa43d85f2f2c7d81e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY5DV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Some of the tracepoints slipped when we did the first scan, adding them now. Fixes: 838a10bd2ebf ("bpf: Augment raw_tp arguments with PTR_MAYBE_NULL") Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Link: https://lore.kernel.org/r/20250210175913.2893549-1-jolsa@kernel.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/btf.c | 99 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 99 insertions(+) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index bbc99401b4e7..39fc33e6368f 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -5997,6 +5997,8 @@ static const struct bpf_raw_tp_null_args raw_tp_null_args[] = { /* rxrpc */ { "rxrpc_recvdata", 0x1 }, { "rxrpc_resend", 0x10 }, + { "rxrpc_tq", 0x10 }, + { "rxrpc_client", 0x1 }, /* sunrpc */ { "xs_stream_read_data", 0x1 }, /* ... from xprt_cong_event event class */ @@ -6017,6 +6019,103 @@ static const struct bpf_raw_tp_null_args raw_tp_null_args[] = { { "mr_integ_alloc", 0x2000 }, /* bpf_testmod */ { "bpf_testmod_test_read", 0x0 }, + /* amdgpu */ + { "amdgpu_vm_bo_map", 0x1 }, + { "amdgpu_vm_bo_unmap", 0x1 }, + /* netfs */ + { "netfs_folioq", 0x1 }, + /* xfs from xfs_defer_pending_class */ + { "xfs_defer_create_intent", 0x1 }, + { "xfs_defer_cancel_list", 0x1 }, + { "xfs_defer_pending_finish", 0x1 }, + { "xfs_defer_pending_abort", 0x1 }, + { "xfs_defer_relog_intent", 0x1 }, + { "xfs_defer_isolate_paused", 0x1 }, + { "xfs_defer_item_pause", 0x1 }, + { "xfs_defer_item_unpause", 0x1 }, + /* xfs from xfs_defer_pending_item_class */ + { "xfs_defer_add_item", 0x1 }, + { "xfs_defer_cancel_item", 0x1 }, + { "xfs_defer_finish_item", 0x1 }, + /* xfs from xfs_icwalk_class */ + { "xfs_ioc_free_eofblocks", 0x10 }, + { "xfs_blockgc_free_space", 0x10 }, + /* xfs from xfs_btree_cur_class */ + { "xfs_btree_updkeys", 0x100 }, + { "xfs_btree_overlapped_query_range", 0x100 }, + /* xfs from xfs_imap_class*/ + { "xfs_map_blocks_found", 0x10000 }, + { "xfs_map_blocks_alloc", 0x10000 }, + { "xfs_iomap_alloc", 0x1000 }, + { "xfs_iomap_found", 0x1000 }, + /* xfs from xfs_fs_class */ + { "xfs_inodegc_flush", 0x1 }, + { "xfs_inodegc_push", 0x1 }, + { "xfs_inodegc_start", 0x1 }, + { "xfs_inodegc_stop", 0x1 }, + { "xfs_inodegc_queue", 0x1 }, + { "xfs_inodegc_throttle", 0x1 }, + { "xfs_fs_sync_fs", 0x1 }, + { "xfs_blockgc_start", 0x1 }, + { "xfs_blockgc_stop", 0x1 }, + { "xfs_blockgc_worker", 0x1 }, + { "xfs_blockgc_flush_all", 0x1 }, + /* xfs_scrub */ + { "xchk_nlinks_live_update", 0x10 }, + /* xfs_scrub from xchk_metapath_class */ + { "xchk_metapath_lookup", 0x100 }, + /* nfsd */ + { "nfsd_dirent", 0x1 }, + { "nfsd_file_acquire", 0x1001 }, + { "nfsd_file_insert_err", 0x1 }, + { "nfsd_file_cons_err", 0x1 }, + /* nfs4 */ + { "nfs4_setup_sequence", 0x1 }, + { "pnfs_update_layout", 0x10000 }, + { "nfs4_inode_callback_event", 0x200 }, + { "nfs4_inode_stateid_callback_event", 0x200 }, + /* nfs from pnfs_layout_event */ + { "pnfs_mds_fallback_pg_init_read", 0x10000 }, + { "pnfs_mds_fallback_pg_init_write", 0x10000 }, + { "pnfs_mds_fallback_pg_get_mirror_count", 0x10000 }, + { "pnfs_mds_fallback_read_done", 0x10000 }, + { "pnfs_mds_fallback_write_done", 0x10000 }, + { "pnfs_mds_fallback_read_pagelist", 0x10000 }, + { "pnfs_mds_fallback_write_pagelist", 0x10000 }, + /* coda */ + { "coda_dec_pic_run", 0x10 }, + { "coda_dec_pic_done", 0x10 }, + /* cfg80211 */ + { "cfg80211_scan_done", 0x11 }, + { "rdev_set_coalesce", 0x10 }, + { "cfg80211_report_wowlan_wakeup", 0x100 }, + { "cfg80211_inform_bss_frame", 0x100 }, + { "cfg80211_michael_mic_failure", 0x10000 }, + /* cfg80211 from wiphy_work_event */ + { "wiphy_work_queue", 0x10 }, + { "wiphy_work_run", 0x10 }, + { "wiphy_work_cancel", 0x10 }, + { "wiphy_work_flush", 0x10 }, + /* hugetlbfs */ + { "hugetlbfs_alloc_inode", 0x10 }, + /* spufs */ + { "spufs_context", 0x10 }, + /* kvm_hv */ + { "kvm_page_fault_enter", 0x100 }, + /* dpu */ + { "dpu_crtc_setup_mixer", 0x100 }, + /* binder */ + { "binder_transaction", 0x100 }, + /* bcachefs */ + { "btree_path_free", 0x100 }, + /* hfi1_tx */ + { "hfi1_sdma_progress", 0x1000 }, + /* iptfs */ + { "iptfs_ingress_postq_event", 0x1000 }, + /* neigh */ + { "neigh_update", 0x10 }, + /* snd_firewire_lib */ + { "amdtp_packet", 0x100 }, }; bool btf_ctx_access(int off, int size, enum bpf_access_type type, -- 2.34.1

2 1

[PATCH OLK-5.10] bnxt: Do not read past the end of test names
by Liu Chuang 03 Apr '25

03 Apr '25

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v6.2-rc5 commit d3e599c090fc6977331150c5f0a69ab8ce87da21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVYG CVE: CVE-2023-53010 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------- Test names were being concatenated based on a offset beyond the end of the first name, which tripped the buffer overflow detection logic: detected buffer overflow in strnlen [...] Call Trace: bnxt_ethtool_init.cold+0x18/0x18 Refactor struct hwrm_selftest_qlist_output to use an actual array, and adjust the concatenation to use snprintf() rather than a series of strncat() calls. Reported-by: Niklas Cassel <Niklas.Cassel(a)wdc.com> Link: https://lore.kernel.org/lkml/Y8F%2F1w1AZTvLglFX@x1-carbon/ Tested-by: Niklas Cassel <Niklas.Cassel(a)wdc.com> Fixes: eb51365846bc ("bnxt_en: Add basic ethtool -t selftest support.") Cc: Michael Chan <michael.chan(a)broadcom.com> Cc: "David S. Miller" <davem(a)davemloft.net> Cc: Eric Dumazet <edumazet(a)google.com> Cc: Jakub Kicinski <kuba(a)kernel.org> Cc: Paolo Abeni <pabeni(a)redhat.com> Cc: netdev(a)vger.kernel.org Signed-off-by: Kees Cook <keescook(a)chromium.org> Reviewed-by: Michael Chan <michael.chan(a)broadcom.com> Reviewed-by: Niklas Cassel <niklas.cassel(a)wdc.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c [Conflicts due to context difference.] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 13 ++++--------- drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h | 9 +-------- 2 files changed, 5 insertions(+), 17 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c index eacc39140d9f..2836f0ee1491 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c @@ -3885,7 +3885,7 @@ void bnxt_ethtool_init(struct bnxt *bp) test_info->timeout = HWRM_CMD_TIMEOUT; for (i = 0; i < bp->num_tests; i++) { char *str = test_info->string[i]; - char *fw_str = resp->test0_name + i * 32; + char *fw_str = resp->test_name[i]; if (i == BNXT_MACLPBK_TEST_IDX) { strcpy(str, "Mac loopback test (offline)"); @@ -3896,14 +3896,9 @@ void bnxt_ethtool_init(struct bnxt *bp) } else if (i == BNXT_IRQ_TEST_IDX) { strcpy(str, "Interrupt_test (offline)"); } else { - strlcpy(str, fw_str, ETH_GSTRING_LEN); - strncat(str, " test", ETH_GSTRING_LEN - strlen(str)); - if (test_info->offline_mask & (1 << i)) - strncat(str, " (offline)", - ETH_GSTRING_LEN - strlen(str)); - else - strncat(str, " (online)", - ETH_GSTRING_LEN - strlen(str)); + snprintf(str, ETH_GSTRING_LEN, "%s test (%s)", + fw_str, test_info->offline_mask & (1 << i) ? + "offline" : "online"); } } diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h index 2d3e962bdac3..fb8952f92df7 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h @@ -8543,14 +8543,7 @@ struct hwrm_selftest_qlist_output { u8 unused_0; __le16 test_timeout; u8 unused_1[2]; - char test0_name[32]; - char test1_name[32]; - char test2_name[32]; - char test3_name[32]; - char test4_name[32]; - char test5_name[32]; - char test6_name[32]; - char test7_name[32]; + char test_name[8][32]; u8 eyescope_target_BER_support; #define SELFTEST_QLIST_RESP_EYESCOPE_TARGET_BER_SUPPORT_BER_1E8_SUPPORTED 0x0UL #define SELFTEST_QLIST_RESP_EYESCOPE_TARGET_BER_SUPPORT_BER_1E9_SUPPORTED 0x1UL -- 2.34.1

2 1

[openeuler:OLK-5.10 2839/2839] drivers/dma/idxd/perfmon.o: warning: objtool: perfmon_init()+0x73: unreachable instruction
by kernel test robot 03 Apr '25

03 Apr '25

Hi Tom, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: faf7eef4adf1de1ce630b582ca245747042e43bd commit: bceacf8315c0518375a30a5f85eff25bbcdb380a [2839/2839] dmaengine: idxd: Add IDXD performance monitor support config: x86_64-buildonly-randconfig-005-20250402 (https://download.01.org/0day-ci/archive/20250403/202504030550.AkZJTxTF-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250403/202504030550.AkZJTxTF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504030550.AkZJTxTF-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/dma/idxd/perfmon.o: warning: objtool: perfmon_init()+0x73: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1555/1555] kernel/trace/trace_output.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 02 Apr '25

02 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 7951fd324625a8af5097e1476cdc8c33c6009b48 commit: 31bf327231bb582ec7dca0490cc90c364b36e095 [1555/1555] tracing: Make sure trace_printk() can output as soon as it can be used config: x86_64-buildonly-randconfig-001-20250402 (https://download.01.org/0day-ci/archive/20250402/202504021912.9ieuHMMu-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021912.9ieuHMMu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021912.9ieuHMMu-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/trace/trace_output.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2077/2077] kernel/module/strict_rwx.c:36:6: warning: no previous prototype for 'module_disable_ro'
by kernel test robot 02 Apr '25

02 Apr '25

Hi Zheng, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 75db7d4fff188725f4adc2de1281daa5b8680603 commit: c8783f92771c891518257c9deb22cd91d4e1a212 [2077/2077] livepatch/core: Revert module_enable_ro and module_disable_ro config: x86_64-randconfig-161-20250402 (https://download.01.org/0day-ci/archive/20250402/202504021840.VgjrPfcw-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021840.VgjrPfcw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021840.VgjrPfcw-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/module/strict_rwx.c:36:6: warning: no previous prototype for 'module_disable_ro' [-Wmissing-prototypes] 36 | void module_disable_ro(const struct module *mod) | ^~~~~~~~~~~~~~~~~ vim +/module_disable_ro +36 kernel/module/strict_rwx.c 34 35 #ifdef CONFIG_LIVEPATCH_WO_FTRACE > 36 void module_disable_ro(const struct module *mod) 37 { 38 if (!IS_ENABLED(CONFIG_STRICT_MODULE_RWX)) 39 return; 40 #ifdef CONFIG_STRICT_MODULE_RWX 41 if (!rodata_enabled) 42 return; 43 #endif 44 45 module_set_memory(mod, MOD_TEXT, set_memory_rw); 46 module_set_memory(mod, MOD_INIT_TEXT, set_memory_rw); 47 module_set_memory(mod, MOD_RODATA, set_memory_rw); 48 module_set_memory(mod, MOD_INIT_RODATA, set_memory_rw); 49 } 50 #endif /* CONFIG_LIVEPATCH_WO_FTRACE */ 51 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1546/1546] include/linux/uaccess.h:115:17: warning: 'stats' may be used uninitialized
by kernel test robot 02 Apr '25

02 Apr '25

Hi Guillaume, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 7951fd324625a8af5097e1476cdc8c33c6009b48 commit: 528534f0deda05c668756313a22974429a9df05a [1546/1546] l2tp: remove pppol2tp_tunnel_ioctl() config: arm64-randconfig-002-20250401 (https://download.01.org/0day-ci/archive/20250402/202504021807.twewxnJE-lkp@…) compiler: aarch64-linux-gcc (GCC) 12.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021807.twewxnJE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021807.twewxnJE-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): net/l2tp/l2tp_ppp.c: In function 'pppol2tp_ioctl': net/l2tp/l2tp_ppp.c:1122:13: warning: variable 'val' set but not used [-Wunused-but-set-variable] 1122 | int val; | ^~~ In file included from net/l2tp/l2tp_ppp.c:62: net/l2tp/l2tp_ppp.c: At top level: include/linux/module.h:132:13: warning: 'init_module' specifies less restrictive attribute than its target 'pppol2tp_init': 'cold' [-Wmissing-attributes] 132 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ net/l2tp/l2tp_ppp.c:1802:1: note: in expansion of macro 'module_init' 1802 | module_init(pppol2tp_init); | ^~~~~~~~~~~ net/l2tp/l2tp_ppp.c:1754:19: note: 'init_module' target declared here 1754 | static int __init pppol2tp_init(void) | ^~~~~~~~~~~~~ include/linux/module.h:138:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'pppol2tp_exit': 'cold' [-Wmissing-attributes] 138 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ net/l2tp/l2tp_ppp.c:1803:1: note: in expansion of macro 'module_exit' 1803 | module_exit(pppol2tp_exit); | ^~~~~~~~~~~ net/l2tp/l2tp_ppp.c:1792:20: note: 'cleanup_module' target declared here 1792 | static void __exit pppol2tp_exit(void) | ^~~~~~~~~~~~~ In file included from net/l2tp/l2tp_ppp.c:65: In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:147:7, inlined from 'pppol2tp_ioctl' at net/l2tp/l2tp_ppp.c:1163:8: >> include/linux/uaccess.h:115:17: warning: 'stats' may be used uninitialized [-Wmaybe-uninitialized] 115 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler.h:246, from include/linux/kernel.h:10, from include/linux/list.h:9, from include/linux/module.h:9: include/linux/kasan-checks.h: In function 'pppol2tp_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ net/l2tp/l2tp_ppp.c:1120:35: note: 'stats' declared here 1120 | struct pppol2tp_ioc_stats stats; | ^~~~~ vim +/stats +115 include/linux/uaccess.h d597580d373774 Al Viro 2017-03-20 107 d597580d373774 Al Viro 2017-03-20 108 #ifdef INLINE_COPY_FROM_USER d597580d373774 Al Viro 2017-03-20 109 static inline unsigned long d597580d373774 Al Viro 2017-03-20 110 _copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774 Al Viro 2017-03-20 111 { d597580d373774 Al Viro 2017-03-20 112 unsigned long res = n; 9c5f6908de03a4 Al Viro 2017-06-29 113 might_fault(); 9c5f6908de03a4 Al Viro 2017-06-29 114 if (likely(access_ok(VERIFY_READ, from, n))) { 9c5f6908de03a4 Al Viro 2017-06-29 @115 kasan_check_write(to, n); d597580d373774 Al Viro 2017-03-20 116 res = raw_copy_from_user(to, from, n); 9c5f6908de03a4 Al Viro 2017-06-29 117 } d597580d373774 Al Viro 2017-03-20 118 if (unlikely(res)) d597580d373774 Al Viro 2017-03-20 119 memset(to + (n - res), 0, res); d597580d373774 Al Viro 2017-03-20 120 return res; d597580d373774 Al Viro 2017-03-20 121 } d597580d373774 Al Viro 2017-03-20 122 #else d597580d373774 Al Viro 2017-03-20 123 extern unsigned long d597580d373774 Al Viro 2017-03-20 124 _copy_from_user(void *, const void __user *, unsigned long); d597580d373774 Al Viro 2017-03-20 125 #endif d597580d373774 Al Viro 2017-03-20 126 :::::: The code at line 115 was first introduced by commit :::::: 9c5f6908de03a4f52ba7364b11fcd6116225480c copy_{from,to}_user(): move kasan checks and might_fault() out-of-line :::::: TO: Al Viro <viro(a)zeniv.linux.org.uk> :::::: CC: Al Viro <viro(a)zeniv.linux.org.uk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] gpio: aggregator: protect driver attr handlers against module unload
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Koichiro Den <koichiro.den(a)canonical.com> stable inclusion from stable-v5.10.235 commit fd6aa1f8cbe0979eb66ac32ebc231bf0b10a2117 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY441 CVE: CVE-2025-21943 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 12f65d1203507f7db3ba59930fe29a3b8eee9945 upstream. Both new_device_store and delete_device_store touch module global resources (e.g. gpio_aggregator_lock). To prevent race conditions with module unload, a reference needs to be held. Add try_module_get() in these handlers. For new_device_store, this eliminates what appears to be the most dangerous scenario: if an id is allocated from gpio_aggregator_idr but platform_device_register has not yet been called or completed, a concurrent module unload could fail to unregister/delete the device, leaving behind a dangling platform device/GPIO forwarder. This can result in various issues. The following simple reproducer demonstrates these problems: #!/bin/bash while :; do # note: whether 'gpiochip0 0' exists or not does not matter. echo 'gpiochip0 0' > /sys/bus/platform/drivers/gpio-aggregator/new_device done & while :; do modprobe gpio-aggregator modprobe -r gpio-aggregator done & wait Starting with the following warning, several kinds of warnings will appear and the system may become unstable: ------------[ cut here ]------------ list_del corruption, ffff888103e2e980->next is LIST_POISON1 (dead000000000100) WARNING: CPU: 1 PID: 1327 at lib/list_debug.c:56 __list_del_entry_valid_or_report+0xa3/0x120 [...] RIP: 0010:__list_del_entry_valid_or_report+0xa3/0x120 [...] Call Trace: <TASK> ? __list_del_entry_valid_or_report+0xa3/0x120 ? __warn.cold+0x93/0xf2 ? __list_del_entry_valid_or_report+0xa3/0x120 ? report_bug+0xe6/0x170 ? __irq_work_queue_local+0x39/0xe0 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x60 ? asm_exc_invalid_op+0x16/0x20 ? __list_del_entry_valid_or_report+0xa3/0x120 gpiod_remove_lookup_table+0x22/0x60 new_device_store+0x315/0x350 [gpio_aggregator] kernfs_fop_write_iter+0x137/0x1f0 vfs_write+0x262/0x430 ksys_write+0x60/0xd0 do_syscall_64+0x6c/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] </TASK> ---[ end trace 0000000000000000 ]--- Fixes: 828546e24280 ("gpio: Add GPIO Aggregator") Cc: stable(a)vger.kernel.org Signed-off-by: Koichiro Den <koichiro.den(a)canonical.com> Link: https://lore.kernel.org/r/20250224143134.3024598-2-koichiro.den@canonical.c… Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/gpio/gpio-aggregator.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/drivers/gpio/gpio-aggregator.c b/drivers/gpio/gpio-aggregator.c index d5f25246404d..4017f132656a 100644 --- a/drivers/gpio/gpio-aggregator.c +++ b/drivers/gpio/gpio-aggregator.c @@ -173,10 +173,15 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, struct platform_device *pdev; int res, id; + if (!try_module_get(THIS_MODULE)) + return -ENOENT; + /* kernfs guarantees string termination, so count + 1 is safe */ aggr = kzalloc(sizeof(*aggr) + count + 1, GFP_KERNEL); - if (!aggr) - return -ENOMEM; + if (!aggr) { + res = -ENOMEM; + goto put_module; + } memcpy(aggr->args, buf, count + 1); @@ -215,6 +220,7 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, } aggr->pdev = pdev; + module_put(THIS_MODULE); return count; remove_table: @@ -229,6 +235,8 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, kfree(aggr->lookups); free_ga: kfree(aggr); +put_module: + module_put(THIS_MODULE); return res; } @@ -257,13 +265,19 @@ static ssize_t delete_device_store(struct device_driver *driver, if (error) return error; + if (!try_module_get(THIS_MODULE)) + return -ENOENT; + mutex_lock(&gpio_aggregator_lock); aggr = idr_remove(&gpio_aggregator_idr, id); mutex_unlock(&gpio_aggregator_lock); - if (!aggr) + if (!aggr) { + module_put(THIS_MODULE); return -ENOENT; + } gpio_aggregator_free(aggr); + module_put(THIS_MODULE); return count; } static DRIVER_ATTR_WO(delete_device); -- 2.25.1

2 1

[PATCH OLK-6.6] gpio: aggregator: protect driver attr handlers against module unload
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Koichiro Den <koichiro.den(a)canonical.com> stable inclusion from stable-v6.6.83 commit d99dc8f7ea01ee1b21306e0eda8eb18a4af80db6 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY441 CVE: CVE-2025-21943 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 12f65d1203507f7db3ba59930fe29a3b8eee9945 upstream. Both new_device_store and delete_device_store touch module global resources (e.g. gpio_aggregator_lock). To prevent race conditions with module unload, a reference needs to be held. Add try_module_get() in these handlers. For new_device_store, this eliminates what appears to be the most dangerous scenario: if an id is allocated from gpio_aggregator_idr but platform_device_register has not yet been called or completed, a concurrent module unload could fail to unregister/delete the device, leaving behind a dangling platform device/GPIO forwarder. This can result in various issues. The following simple reproducer demonstrates these problems: #!/bin/bash while :; do # note: whether 'gpiochip0 0' exists or not does not matter. echo 'gpiochip0 0' > /sys/bus/platform/drivers/gpio-aggregator/new_device done & while :; do modprobe gpio-aggregator modprobe -r gpio-aggregator done & wait Starting with the following warning, several kinds of warnings will appear and the system may become unstable: ------------[ cut here ]------------ list_del corruption, ffff888103e2e980->next is LIST_POISON1 (dead000000000100) WARNING: CPU: 1 PID: 1327 at lib/list_debug.c:56 __list_del_entry_valid_or_report+0xa3/0x120 [...] RIP: 0010:__list_del_entry_valid_or_report+0xa3/0x120 [...] Call Trace: <TASK> ? __list_del_entry_valid_or_report+0xa3/0x120 ? __warn.cold+0x93/0xf2 ? __list_del_entry_valid_or_report+0xa3/0x120 ? report_bug+0xe6/0x170 ? __irq_work_queue_local+0x39/0xe0 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x60 ? asm_exc_invalid_op+0x16/0x20 ? __list_del_entry_valid_or_report+0xa3/0x120 gpiod_remove_lookup_table+0x22/0x60 new_device_store+0x315/0x350 [gpio_aggregator] kernfs_fop_write_iter+0x137/0x1f0 vfs_write+0x262/0x430 ksys_write+0x60/0xd0 do_syscall_64+0x6c/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] </TASK> ---[ end trace 0000000000000000 ]--- Fixes: 828546e24280 ("gpio: Add GPIO Aggregator") Cc: stable(a)vger.kernel.org Signed-off-by: Koichiro Den <koichiro.den(a)canonical.com> Link: https://lore.kernel.org/r/20250224143134.3024598-2-koichiro.den@canonical.c… Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/gpio/gpio-aggregator.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/drivers/gpio/gpio-aggregator.c b/drivers/gpio/gpio-aggregator.c index 38e0fff9afe7..cc6ee4334602 100644 --- a/drivers/gpio/gpio-aggregator.c +++ b/drivers/gpio/gpio-aggregator.c @@ -121,10 +121,15 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, struct platform_device *pdev; int res, id; + if (!try_module_get(THIS_MODULE)) + return -ENOENT; + /* kernfs guarantees string termination, so count + 1 is safe */ aggr = kzalloc(sizeof(*aggr) + count + 1, GFP_KERNEL); - if (!aggr) - return -ENOMEM; + if (!aggr) { + res = -ENOMEM; + goto put_module; + } memcpy(aggr->args, buf, count + 1); @@ -163,6 +168,7 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, } aggr->pdev = pdev; + module_put(THIS_MODULE); return count; remove_table: @@ -177,6 +183,8 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, kfree(aggr->lookups); free_ga: kfree(aggr); +put_module: + module_put(THIS_MODULE); return res; } @@ -205,13 +213,19 @@ static ssize_t delete_device_store(struct device_driver *driver, if (error) return error; + if (!try_module_get(THIS_MODULE)) + return -ENOENT; + mutex_lock(&gpio_aggregator_lock); aggr = idr_remove(&gpio_aggregator_idr, id); mutex_unlock(&gpio_aggregator_lock); - if (!aggr) + if (!aggr) { + module_put(THIS_MODULE); return -ENOENT; + } gpio_aggregator_free(aggr); + module_put(THIS_MODULE); return count; } static DRIVER_ATTR_WO(delete_device); -- 2.25.1

2 1

[PATCH OLK-5.10] [Backport] gpio: aggregator: protect driver attr handlers against module unload
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Koichiro Den <koichiro.den(a)canonical.com> stable inclusion from stable-v5.10.235 commit fd6aa1f8cbe0979eb66ac32ebc231bf0b10a2117 category: bugfix bugzilla: 189268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 12f65d1203507f7db3ba59930fe29a3b8eee9945 upstream. Both new_device_store and delete_device_store touch module global resources (e.g. gpio_aggregator_lock). To prevent race conditions with module unload, a reference needs to be held. Add try_module_get() in these handlers. For new_device_store, this eliminates what appears to be the most dangerous scenario: if an id is allocated from gpio_aggregator_idr but platform_device_register has not yet been called or completed, a concurrent module unload could fail to unregister/delete the device, leaving behind a dangling platform device/GPIO forwarder. This can result in various issues. The following simple reproducer demonstrates these problems: #!/bin/bash while :; do # note: whether 'gpiochip0 0' exists or not does not matter. echo 'gpiochip0 0' > /sys/bus/platform/drivers/gpio-aggregator/new_device done & while :; do modprobe gpio-aggregator modprobe -r gpio-aggregator done & wait Starting with the following warning, several kinds of warnings will appear and the system may become unstable: ------------[ cut here ]------------ list_del corruption, ffff888103e2e980->next is LIST_POISON1 (dead000000000100) WARNING: CPU: 1 PID: 1327 at lib/list_debug.c:56 __list_del_entry_valid_or_report+0xa3/0x120 [...] RIP: 0010:__list_del_entry_valid_or_report+0xa3/0x120 [...] Call Trace: <TASK> ? __list_del_entry_valid_or_report+0xa3/0x120 ? __warn.cold+0x93/0xf2 ? __list_del_entry_valid_or_report+0xa3/0x120 ? report_bug+0xe6/0x170 ? __irq_work_queue_local+0x39/0xe0 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x60 ? asm_exc_invalid_op+0x16/0x20 ? __list_del_entry_valid_or_report+0xa3/0x120 gpiod_remove_lookup_table+0x22/0x60 new_device_store+0x315/0x350 [gpio_aggregator] kernfs_fop_write_iter+0x137/0x1f0 vfs_write+0x262/0x430 ksys_write+0x60/0xd0 do_syscall_64+0x6c/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] </TASK> ---[ end trace 0000000000000000 ]--- Fixes: 828546e24280 ("gpio: Add GPIO Aggregator") Cc: stable(a)vger.kernel.org Signed-off-by: Koichiro Den <koichiro.den(a)canonical.com> Link: https://lore.kernel.org/r/20250224143134.3024598-2-koichiro.den@canonical.c… Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/gpio/gpio-aggregator.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/drivers/gpio/gpio-aggregator.c b/drivers/gpio/gpio-aggregator.c index d5f25246404d..4017f132656a 100644 --- a/drivers/gpio/gpio-aggregator.c +++ b/drivers/gpio/gpio-aggregator.c @@ -173,10 +173,15 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, struct platform_device *pdev; int res, id; + if (!try_module_get(THIS_MODULE)) + return -ENOENT; + /* kernfs guarantees string termination, so count + 1 is safe */ aggr = kzalloc(sizeof(*aggr) + count + 1, GFP_KERNEL); - if (!aggr) - return -ENOMEM; + if (!aggr) { + res = -ENOMEM; + goto put_module; + } memcpy(aggr->args, buf, count + 1); @@ -215,6 +220,7 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, } aggr->pdev = pdev; + module_put(THIS_MODULE); return count; remove_table: @@ -229,6 +235,8 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, kfree(aggr->lookups); free_ga: kfree(aggr); +put_module: + module_put(THIS_MODULE); return res; } @@ -257,13 +265,19 @@ static ssize_t delete_device_store(struct device_driver *driver, if (error) return error; + if (!try_module_get(THIS_MODULE)) + return -ENOENT; + mutex_lock(&gpio_aggregator_lock); aggr = idr_remove(&gpio_aggregator_idr, id); mutex_unlock(&gpio_aggregator_lock); - if (!aggr) + if (!aggr) { + module_put(THIS_MODULE); return -ENOENT; + } gpio_aggregator_free(aggr); + module_put(THIS_MODULE); return count; } static DRIVER_ATTR_WO(delete_device); -- 2.25.1

2 1

[PATCH OLK-5.10] bpf, sockmap: Fix race between element replace and close()
by Liu Jian 02 Apr '25

02 Apr '25

From: Michal Luczaj <mhal(a)rbox.co> mainline inclusion from mainline-v6.13-rc3 commit ed1fc5d76b81a4d681211333c026202cad4d5649 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMZ CVE: CVE-2024-56664 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- Element replace (with a socket different from the one stored) may race with socket's close() link popping & unlinking. __sock_map_delete() unconditionally unrefs the (wrong) element: // set map[0] = s0 map_update_elem(map, 0, s0) // drop fd of s0 close(s0) sock_map_close() lock_sock(sk) (s0!) sock_map_remove_links(sk) link = sk_psock_link_pop() sock_map_unlink(sk, link) sock_map_delete_from_link // replace map[0] with s1 map_update_elem(map, 0, s1) sock_map_update_elem (s1!) lock_sock(sk) sock_map_update_common psock = sk_psock(sk) spin_lock(&stab->lock) osk = stab->sks[idx] sock_map_add_link(..., &stab->sks[idx]) sock_map_unref(osk, &stab->sks[idx]) psock = sk_psock(osk) sk_psock_put(sk, psock) if (refcount_dec_and_test(&psock)) sk_psock_drop(sk, psock) spin_unlock(&stab->lock) unlock_sock(sk) __sock_map_delete spin_lock(&stab->lock) sk = *psk // s1 replaced s0; sk == s1 if (!sk_test || sk_test == sk) // sk_test (s0) != sk (s1); no branch sk = xchg(psk, NULL) if (sk) sock_map_unref(sk, psk) // unref s1; sks[idx] will dangle psock = sk_psock(sk) sk_psock_put(sk, psock) if (refcount_dec_and_test()) sk_psock_drop(sk, psock) spin_unlock(&stab->lock) release_sock(sk) Then close(map) enqueues bpf_map_free_deferred, which finally calls sock_map_free(). This results in some refcount_t warnings along with a KASAN splat [1]. Fix __sock_map_delete(), do not allow sock_map_unref() on elements that may have been replaced. [1]: BUG: KASAN: slab-use-after-free in sock_map_free+0x10e/0x330 Write of size 4 at addr ffff88811f5b9100 by task kworker/u64:12/1063 CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Not tainted 6.12.0+ #125 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Workqueue: events_unbound bpf_map_free_deferred Call Trace: <TASK> dump_stack_lvl+0x68/0x90 print_report+0x174/0x4f6 kasan_report+0xb9/0x190 kasan_check_range+0x10f/0x1e0 sock_map_free+0x10e/0x330 bpf_map_free_deferred+0x173/0x320 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 1202: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 __kasan_slab_alloc+0x85/0x90 kmem_cache_alloc_noprof+0x131/0x450 sk_prot_alloc+0x5b/0x220 sk_alloc+0x2c/0x870 unix_create1+0x88/0x8a0 unix_create+0xc5/0x180 __sock_create+0x241/0x650 __sys_socketpair+0x1ce/0x420 __x64_sys_socketpair+0x92/0x100 do_syscall_64+0x93/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 46: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x60 __kasan_slab_free+0x4b/0x70 kmem_cache_free+0x1a1/0x590 __sk_destruct+0x388/0x5a0 sk_psock_destroy+0x73e/0xa50 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 The buggy address belongs to the object at ffff88811f5b9080 which belongs to the cache UNIX-STREAM of size 1984 The buggy address is located 128 bytes inside of freed 1984-byte region [ffff88811f5b9080, ffff88811f5b9840) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11f5b8 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff888127d49401 flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff) page_type: f5(slab) raw: 0017ffffc0000040 ffff8881042e4500 dead000000000122 0000000000000000 raw: 0000000000000000 00000000800f000f 00000001f5000000 ffff888127d49401 head: 0017ffffc0000040 ffff8881042e4500 dead000000000122 0000000000000000 head: 0000000000000000 00000000800f000f 00000001f5000000 ffff888127d49401 head: 0017ffffc0000003 ffffea00047d6e01 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88811f5b9000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88811f5b9080: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88811f5b9180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811f5b9200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Disabling lock debugging due to kernel taint refcount_t: addition on 0; use-after-free. WARNING: CPU: 14 PID: 1063 at lib/refcount.c:25 refcount_warn_saturate+0xce/0x150 CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Tainted: G B 6.12.0+ #125 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Workqueue: events_unbound bpf_map_free_deferred RIP: 0010:refcount_warn_saturate+0xce/0x150 Code: 34 73 eb 03 01 e8 82 53 ad fe 0f 0b eb b1 80 3d 27 73 eb 03 00 75 a8 48 c7 c7 80 bd 95 84 c6 05 17 73 eb 03 01 e8 62 53 ad fe <0f> 0b eb 91 80 3d 06 73 eb 03 00 75 88 48 c7 c7 e0 bd 95 84 c6 05 RSP: 0018:ffff88815c49fc70 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88811f5b9100 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: 0000000000000002 R08: 0000000000000001 R09: ffffed10bcde6349 R10: ffff8885e6f31a4b R11: 0000000000000000 R12: ffff88813be0b000 R13: ffff88811f5b9100 R14: ffff88811f5b9080 R15: ffff88813be0b024 FS: 0000000000000000(0000) GS:ffff8885e6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055dda99b0250 CR3: 000000015dbac000 CR4: 0000000000752ef0 PKRU: 55555554 Call Trace: <TASK> ? __warn.cold+0x5f/0x1ff ? refcount_warn_saturate+0xce/0x150 ? report_bug+0x1ec/0x390 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0xce/0x150 sock_map_free+0x2e5/0x330 bpf_map_free_deferred+0x173/0x320 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> irq event stamp: 10741 hardirqs last enabled at (10741): [<ffffffff84400ec6>] asm_sysvec_apic_timer_interrupt+0x16/0x20 hardirqs last disabled at (10740): [<ffffffff811e532d>] handle_softirqs+0x60d/0x770 softirqs last enabled at (10506): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210 softirqs last disabled at (10301): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210 refcount_t: underflow; use-after-free. WARNING: CPU: 14 PID: 1063 at lib/refcount.c:28 refcount_warn_saturate+0xee/0x150 CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Tainted: G B W 6.12.0+ #125 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Workqueue: events_unbound bpf_map_free_deferred RIP: 0010:refcount_warn_saturate+0xee/0x150 Code: 17 73 eb 03 01 e8 62 53 ad fe 0f 0b eb 91 80 3d 06 73 eb 03 00 75 88 48 c7 c7 e0 bd 95 84 c6 05 f6 72 eb 03 01 e8 42 53 ad fe <0f> 0b e9 6e ff ff ff 80 3d e6 72 eb 03 00 0f 85 61 ff ff ff 48 c7 RSP: 0018:ffff88815c49fc70 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88811f5b9100 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: 0000000000000003 R08: 0000000000000001 R09: ffffed10bcde6349 R10: ffff8885e6f31a4b R11: 0000000000000000 R12: ffff88813be0b000 R13: ffff88811f5b9100 R14: ffff88811f5b9080 R15: ffff88813be0b024 FS: 0000000000000000(0000) GS:ffff8885e6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055dda99b0250 CR3: 000000015dbac000 CR4: 0000000000752ef0 PKRU: 55555554 Call Trace: <TASK> ? __warn.cold+0x5f/0x1ff ? refcount_warn_saturate+0xee/0x150 ? report_bug+0x1ec/0x390 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0xee/0x150 sock_map_free+0x2d3/0x330 bpf_map_free_deferred+0x173/0x320 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> irq event stamp: 10741 hardirqs last enabled at (10741): [<ffffffff84400ec6>] asm_sysvec_apic_timer_interrupt+0x16/0x20 hardirqs last disabled at (10740): [<ffffffff811e532d>] handle_softirqs+0x60d/0x770 softirqs last enabled at (10506): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210 softirqs last disabled at (10301): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210 Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: Michal Luczaj <mhal(a)rbox.co> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Reviewed-by: John Fastabend <john.fastabend(a)gmail.com> Link: https://lore.kernel.org/bpf/20241202-sockmap-replace-v1-3-1e88579e7bd5@rbox… Conflicts: net/core/sock_map.c [Did not backport 35d2b7ffffc1d.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/sock_map.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/net/core/sock_map.c b/net/core/sock_map.c index c3c7f4469c80..beb8768a9285 100644 --- a/net/core/sock_map.c +++ b/net/core/sock_map.c @@ -431,12 +431,11 @@ static void *sock_map_lookup_sys(struct bpf_map *map, void *key) static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test, struct sock **psk) { - struct sock *sk; + struct sock *sk = NULL; int err = 0; raw_spin_lock_bh(&stab->lock); - sk = *psk; - if (!sk_test || sk_test == sk) + if (!sk_test || sk_test == *psk) sk = xchg(psk, NULL); if (likely(sk)) -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2024-56642
by Liu Jian 02 Apr '25

02 Apr '25

CVE-2024-56642 Eric Dumazet (1): tipc: fix NULL deref in cleanup_bearer() Kuniyuki Iwashima (1): tipc: Fix use-after-free of kernel socket in cleanup_bearer(). net/tipc/udp_media.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] CVE-2024-57857
by Liu Jian 02 Apr '25

02 Apr '25

CVE-2024-57857 Bernard Metzler (1): RDMA/siw: Remove direct link to net_device Liu Jian (1): RDMA: Export ib_device_get_netdev() drivers/infiniband/core/device.c | 4 +++ drivers/infiniband/sw/siw/siw.h | 7 +++--- drivers/infiniband/sw/siw/siw_cm.c | 27 ++++++++++++++++----- drivers/infiniband/sw/siw/siw_main.c | 14 +---------- drivers/infiniband/sw/siw/siw_verbs.c | 35 ++++++++++++++++++--------- include/rdma/ib_verbs.h | 2 ++ 6 files changed, 55 insertions(+), 34 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] dmaengine: Fix double increment of client_count in dma_chan_get()
by Xiaomeng Zhang 02 Apr '25

02 Apr '25

From: Koba Ko <koba.ko(a)canonical.com> stable inclusion from stable-v4.19.272 commit c6221afe573413fd2981e291f7df4a58283e0654 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVX7 CVE: CVE-2022-49753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f3dc1b3b4750851a94212dba249703dd0e50bb20 ] The first time dma_chan_get() is called for a channel the channel client_count is incorrectly incremented twice for public channels, first in balance_ref_count(), and again prior to returning. This results in an incorrect client count which will lead to the channel resources not being freed when they should be. A simple test of repeated module load and unload of async_tx on a Dell Power Edge R7425 also shows this resulting in a kref underflow warning. [ 124.329662] async_tx: api initialized (async) [ 129.000627] async_tx: api initialized (async) [ 130.047839] ------------[ cut here ]------------ [ 130.052472] refcount_t: underflow; use-after-free. [ 130.057279] WARNING: CPU: 3 PID: 19364 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110 [ 130.065811] Modules linked in: async_tx(-) rfkill intel_rapl_msr intel_rapl_common amd64_edac edac_mce_amd ipmi_ssif kvm_amd dcdbas kvm mgag200 drm_shmem_helper acpi_ipmi irqbypass drm_kms_helper ipmi_si syscopyarea sysfillrect rapl pcspkr ipmi_devintf sysimgblt fb_sys_fops k10temp i2c_piix4 ipmi_msghandler acpi_power_meter acpi_cpufreq vfat fat drm fuse xfs libcrc32c sd_mod t10_pi sg ahci crct10dif_pclmul libahci crc32_pclmul crc32c_intel ghash_clmulni_intel igb megaraid_sas i40e libata i2c_algo_bit ccp sp5100_tco dca dm_mirror dm_region_hash dm_log dm_mod [last unloaded: async_tx] [ 130.117361] CPU: 3 PID: 19364 Comm: modprobe Kdump: loaded Not tainted 5.14.0-185.el9.x86_64 #1 [ 130.126091] Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS 1.18.0 01/17/2022 [ 130.133806] RIP: 0010:refcount_warn_saturate+0xba/0x110 [ 130.139041] Code: 01 01 e8 6d bd 55 00 0f 0b e9 72 9d 8a 00 80 3d 26 18 9c 01 00 75 85 48 c7 c7 f8 a3 03 9d c6 05 16 18 9c 01 01 e8 4a bd 55 00 <0f> 0b e9 4f 9d 8a 00 80 3d 01 18 9c 01 00 0f 85 5e ff ff ff 48 c7 [ 130.157807] RSP: 0018:ffffbf98898afe68 EFLAGS: 00010286 [ 130.163036] RAX: 0000000000000000 RBX: ffff9da06028e598 RCX: 0000000000000000 [ 130.170172] RDX: ffff9daf9de26480 RSI: ffff9daf9de198a0 RDI: ffff9daf9de198a0 [ 130.177316] RBP: ffff9da7cddf3970 R08: 0000000000000000 R09: 00000000ffff7fff [ 130.184459] R10: ffffbf98898afd00 R11: ffffffff9d9e8c28 R12: ffff9da7cddf1970 [ 130.191596] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 130.198739] FS: 00007f646435c740(0000) GS:ffff9daf9de00000(0000) knlGS:0000000000000000 [ 130.206832] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 130.212586] CR2: 00007f6463b214f0 CR3: 00000008ab98c000 CR4: 00000000003506e0 [ 130.219729] Call Trace: [ 130.222192] <TASK> [ 130.224305] dma_chan_put+0x10d/0x110 [ 130.227988] dmaengine_put+0x7a/0xa0 [ 130.231575] __do_sys_delete_module.constprop.0+0x178/0x280 [ 130.237157] ? syscall_trace_enter.constprop.0+0x145/0x1d0 [ 130.242652] do_syscall_64+0x5c/0x90 [ 130.246240] ? exc_page_fault+0x62/0x150 [ 130.250178] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 130.255243] RIP: 0033:0x7f6463a3f5ab [ 130.258830] Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89 01 48 [ 130.277591] RSP: 002b:00007fff22f972c8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [ 130.285164] RAX: ffffffffffffffda RBX: 000055b6786edd40 RCX: 00007f6463a3f5ab [ 130.292303] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055b6786edda8 [ 130.299443] RBP: 000055b6786edd40 R08: 0000000000000000 R09: 0000000000000000 [ 130.306584] R10: 00007f6463b9eac0 R11: 0000000000000206 R12: 000055b6786edda8 [ 130.313731] R13: 0000000000000000 R14: 000055b6786edda8 R15: 00007fff22f995f8 [ 130.320875] </TASK> [ 130.323081] ---[ end trace eff7156d56b5cf25 ]--- cat /sys/class/dma/dma0chan*/in_use would get the wrong result. 2 2 2 Fixes: d2f4f99db3e9 ("dmaengine: Rework dma_chan_get") Signed-off-by: Koba Ko <koba.ko(a)canonical.com> Reviewed-by: Jie Hai <haijie1(a)huawei.com> Test-by: Jie Hai <haijie1(a)huawei.com> Reviewed-by: Jerry Snitselaar <jsnitsel(a)redhat.com> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Tested-by: Joel Savitz <jsavitz(a)redhat.com> Link: https://lore.kernel.org/r/20221201030050.978595-1-koba.ko@canonical.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/dma/dmaengine.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c index f1a441ab395d..450b1c4b2129 100644 --- a/drivers/dma/dmaengine.c +++ b/drivers/dma/dmaengine.c @@ -223,7 +223,8 @@ static int dma_chan_get(struct dma_chan *chan) /* The channel is already in use, update client count */ if (chan->client_count) { __module_get(owner); - goto out; + chan->client_count++; + return 0; } if (!try_module_get(owner)) @@ -236,11 +237,11 @@ static int dma_chan_get(struct dma_chan *chan) goto err_out; } + chan->client_count++; + if (!dma_has_cap(DMA_PRIVATE, chan->device->cap_mask)) balance_ref_count(chan); -out: - chan->client_count++; return 0; err_out: -- 2.34.1

2 1

[PATCH OLK-6.6] scsi: ufs: core: bsg: Fix crash when arpmb command fails
by Xiangwei Li 02 Apr '25

02 Apr '25

From: Arthur Simchaev <arthur.simchaev(a)sandisk.com> stable inclusion from stable-v6.6.81 commit 32fb5ec825f6f76bc28902181c65429a904a07fe category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVSZ CVE: CVE-2025-21873 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f27a95845b01e86d67c8b014b4f41bd3327daa63 upstream. If the device doesn't support arpmb we'll crash due to copying user data in bsg_transport_sg_io_fn(). In the case where ufs_bsg_exec_advanced_rpmb_req() returns an error, do not set the job's reply_len. Memory crash backtrace: 3,1290,531166405,-;ufshcd 0000:00:12.5: ARPMB OP failed: error code -22 4,1308,531166555,-;Call Trace: 4,1309,531166559,-; <TASK> 4,1310,531166565,-; ? show_regs+0x6d/0x80 4,1311,531166575,-; ? die+0x37/0xa0 4,1312,531166583,-; ? do_trap+0xd4/0xf0 4,1313,531166593,-; ? do_error_trap+0x71/0xb0 4,1314,531166601,-; ? usercopy_abort+0x6c/0x80 4,1315,531166610,-; ? exc_invalid_op+0x52/0x80 4,1316,531166622,-; ? usercopy_abort+0x6c/0x80 4,1317,531166630,-; ? asm_exc_invalid_op+0x1b/0x20 4,1318,531166643,-; ? usercopy_abort+0x6c/0x80 4,1319,531166652,-; __check_heap_object+0xe3/0x120 4,1320,531166661,-; check_heap_object+0x185/0x1d0 4,1321,531166670,-; __check_object_size.part.0+0x72/0x150 4,1322,531166679,-; __check_object_size+0x23/0x30 4,1323,531166688,-; bsg_transport_sg_io_fn+0x314/0x3b0 Fixes: 6ff265fc5ef6 ("scsi: ufs: core: bsg: Add advanced RPMB support in ufs_bsg") Cc: stable(a)vger.kernel.org Reviewed-by: Bean Huo <beanhuo(a)micron.com> Signed-off-by: Arthur Simchaev <arthur.simchaev(a)sandisk.com> Link: https://lore.kernel.org/r/20250220142039.250992-1-arthur.simchaev@sandisk.c… Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- drivers/ufs/core/ufs_bsg.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c index 8fbd46cd8c2b..0043d69077b6 100644 --- a/drivers/ufs/core/ufs_bsg.c +++ b/drivers/ufs/core/ufs_bsg.c @@ -194,10 +194,12 @@ static int ufs_bsg_request(struct bsg_job *job) ufshcd_rpm_put_sync(hba); kfree(buff); bsg_reply->result = ret; - job->reply_len = !rpmb ? sizeof(struct ufs_bsg_reply) : sizeof(struct ufs_rpmb_reply); /* complete the job here only if no error */ - if (ret == 0) + if (ret == 0) { + job->reply_len = rpmb ? sizeof(struct ufs_rpmb_reply) : + sizeof(struct ufs_bsg_reply); bsg_job_done(job, ret, bsg_reply->reply_payload_rcv_len); + } return ret; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] EDAC/highbank: Fix memory leak in highbank_mc_probe()
by Xiangwei Li 02 Apr '25

02 Apr '25

From: Miaoqian Lin <linmq006(a)gmail.com> stable inclusion from stable-v4.19.272 commit 0db40e23b56d217eebd385bebb64057ef764b2c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVWI CVE: CVE-2022-49757 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e7a293658c20a7945014570e1921bf7d25d68a36 ] When devres_open_group() fails, it returns -ENOMEM without freeing memory allocated by edac_mc_alloc(). Call edac_mc_free() on the error handling path to avoid a memory leak. [ bp: Massage commit message. ] Fixes: a1b01edb2745 ("edac: add support for Calxeda highbank memory controller") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Andre Przywara <andre.przywara(a)arm.com> Link: https://lore.kernel.org/r/20221229054825.1361993-1-linmq006@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- drivers/edac/highbank_mc_edac.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/edac/highbank_mc_edac.c b/drivers/edac/highbank_mc_edac.c index 6092e61be605..bcf41601a977 100644 --- a/drivers/edac/highbank_mc_edac.c +++ b/drivers/edac/highbank_mc_edac.c @@ -185,8 +185,10 @@ static int highbank_mc_probe(struct platform_device *pdev) drvdata = mci->pvt_info; platform_set_drvdata(pdev, mci); - if (!devres_open_group(&pdev->dev, NULL, GFP_KERNEL)) - return -ENOMEM; + if (!devres_open_group(&pdev->dev, NULL, GFP_KERNEL)) { + res = -ENOMEM; + goto free; + } r = platform_get_resource(pdev, IORESOURCE_MEM, 0); if (!r) { @@ -254,6 +256,7 @@ static int highbank_mc_probe(struct platform_device *pdev) edac_mc_del_mc(&pdev->dev); err: devres_release_group(&pdev->dev, NULL); +free: edac_mc_free(mci); return res; } -- 2.25.1

2 1

[PATCH OLK-5.10] uprobes: Reject the shared zeropage in uprobe_write_opcode()
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Tong Tiangen <tongtiangen(a)huawei.com> mainline inclusion from mainline-v6.14-rc5 commit bddf10d26e6e5114e7415a0e442ec6f51a559468 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVTY CVE: CVE-2025-21881 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We triggered the following crash in syzkaller tests: BUG: Bad page state in process syz.7.38 pfn:1eff3 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eff3 flags: 0x3fffff00004004(referenced|reserved|node=0|zone=1|lastcpupid=0x1fffff) raw: 003fffff00004004 ffffe6c6c07bfcc8 ffffe6c6c07bfcc8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x32/0x50 bad_page+0x69/0xf0 free_unref_page_prepare+0x401/0x500 free_unref_page+0x6d/0x1b0 uprobe_write_opcode+0x460/0x8e0 install_breakpoint.part.0+0x51/0x80 register_for_each_vma+0x1d9/0x2b0 __uprobe_register+0x245/0x300 bpf_uprobe_multi_link_attach+0x29b/0x4f0 link_create+0x1e2/0x280 __sys_bpf+0x75f/0xac0 __x64_sys_bpf+0x1a/0x30 do_syscall_64+0x56/0x100 entry_SYSCALL_64_after_hwframe+0x78/0xe2 BUG: Bad rss-counter state mm:00000000452453e0 type:MM_FILEPAGES val:-1 The following syzkaller test case can be used to reproduce: r2 = creat(&(0x7f0000000000)='./file0\x00', 0x8) write$nbd(r2, &(0x7f0000000580)=ANY=[], 0x10) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0) r5 = userfaultfd(0x80801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x20}) r6 = userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2}) ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x2, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000120000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r7, 0x0, 0x30, 0x1e, @val=@uprobe_multi={&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=[0x2], 0x0, 0x0, 0x1}}, 0x40) The cause is that zero pfn is set to the PTE without increasing the RSS count in mfill_atomic_pte_zeropage() and the refcount of zero folio does not increase accordingly. Then, the operation on the same pfn is performed in uprobe_write_opcode()->__replace_page() to unconditional decrease the RSS count and old_folio's refcount. Therefore, two bugs are introduced: 1. The RSS count is incorrect, when process exit, the check_mm() report error "Bad rss-count". 2. The reserved folio (zero folio) is freed when folio->refcount is zero, then free_pages_prepare->free_page_is_bad() report error "Bad page state". There is more, the following warning could also theoretically be triggered: __replace_page() -> ... -> folio_remove_rmap_pte() -> VM_WARN_ON_FOLIO(is_zero_folio(folio), folio) Considering that uprobe hit on the zero folio is a very rare case, just reject zero old folio immediately after get_user_page_vma_remote(). [ mingo: Cleaned up the changelog ] Fixes: 7396fa818d62 ("uprobes/core: Make background page replacement logic account for rss_stat counters") Fixes: 2b1444983508 ("uprobes, mm, x86: Add the ability to install and remove uprobes breakpoints") Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Oleg Nesterov <oleg(a)redhat.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Link: https://lore.kernel.org/r/20250224031149.1598949-1-tongtiangen@huawei.com Conflict: kernel/events/uprobes.c [c8070b787519 ('mm: Don't pin ZERO_PAGE in pin_user_pages()') is not merged, use is_zero_pfn instead of is_zero_page.] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- kernel/events/uprobes.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index e045b12662f1..8a6c5ee003c2 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -488,6 +488,11 @@ int uprobe_write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm, if (ret <= 0) goto put_old; + if (is_zero_pfn(page_to_pfn(old_page))) { + ret = -EINVAL; + goto put_old; + } + if (WARN(!is_register && PageCompound(old_page), "uprobe unregister should never work on compound page\n")) { ret = -EINVAL; -- 2.25.1

2 1

[PATCH OLK-5.10 0/1] Fix kmemleak false positive
by Lin Yujun 02 Apr '25

02 Apr '25

Waiman Long (1): efi/arm64: Fix kmemleak false positive in arm64_efi_rt_init() arch/arm64/kernel/efi.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] Fix kmemleak false positive
by Lin Yujun 02 Apr '25

02 Apr '25

Waiman Long (1): efi/arm64: Fix kmemleak false positive in arm64_efi_rt_init() arch/arm64/kernel/efi.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.34.1

2 2

[PATCH OLK-5.10] powerpc: Fix save r13 on kprobe/ftrace entry
by Chen Zhongjin 02 Apr '25

02 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY4FQ -------------------------------- In kprobe and ftrace entry, r13 will be saved to stack and restored after handler. There is a period between entry and handler where the task can be scheduled, then the r13 for one cpu will be restored to another cpu, and cause the paca_ptrs wrong. Fix this by stop saving and restoring r13 in kprobe/ftrace entry. Fixes: 51c9c0843993 ("powerpc/kprobes: Implement Optprobes") Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- arch/powerpc/kernel/optprobes_head.S | 10 ++++++---- arch/powerpc/kernel/trace/ftrace_64_mprofile.S | 10 ++++++---- 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/arch/powerpc/kernel/optprobes_head.S b/arch/powerpc/kernel/optprobes_head.S index ff8ba4d3824d..9d803cc2392f 100644 --- a/arch/powerpc/kernel/optprobes_head.S +++ b/arch/powerpc/kernel/optprobes_head.S @@ -36,8 +36,9 @@ optprobe_template_entry: addi r0,r1,INT_FRAME_SIZE std r0,GPR1(r1) SAVE_10GPRS(2,r1) - SAVE_10GPRS(12,r1) - SAVE_10GPRS(22,r1) + SAVE_GPR(12,r1) + SAVE_10GPRS(14,r1) + SAVE_8GPRS(24,r1) /* Save SPRS */ mfmsr r5 std r5,_MSR(r1) @@ -119,8 +120,9 @@ optprobe_template_call_emulate: mtcr r5 REST_GPR(0,r1) REST_10GPRS(2,r1) - REST_10GPRS(12,r1) - REST_10GPRS(22,r1) + REST_GPR(12,r1) + REST_10GPRS(14,r1) + REST_8GPRS(24,r1) /* Restore the previous SP */ addi r1,r1,INT_FRAME_SIZE diff --git a/arch/powerpc/kernel/trace/ftrace_64_mprofile.S b/arch/powerpc/kernel/trace/ftrace_64_mprofile.S index 0bc39ff53233..32e354d9ee9b 100644 --- a/arch/powerpc/kernel/trace/ftrace_64_mprofile.S +++ b/arch/powerpc/kernel/trace/ftrace_64_mprofile.S @@ -51,8 +51,9 @@ _GLOBAL(ftrace_regs_caller) cmpdi r3, 0 beq ftrace_no_trace - SAVE_10GPRS(12, r1) - SAVE_10GPRS(22, r1) + SAVE_GPR(12,r1) + SAVE_10GPRS(14,r1) + SAVE_8GPRS(24,r1) /* Save previous stack pointer (r1) */ addi r8, r1, SWITCH_FRAME_SIZE+STACK_FRAME_MIN_SIZE @@ -115,8 +116,9 @@ ftrace_regs_call: /* Restore gprs */ REST_GPR(0,r1) REST_10GPRS(2,r1) - REST_10GPRS(12,r1) - REST_10GPRS(22,r1) + REST_GPR(12,r1) + REST_10GPRS(14,r1) + REST_8GPRS(24,r1) /* Restore possibly modified LR */ ld r0, _LINK(r1) -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1537/1537] kernel/seccomp.o: warning: objtool: do_seccomp()+0xa8a: unreachable instruction
by kernel test robot 02 Apr '25

02 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 7951fd324625a8af5097e1476cdc8c33c6009b48 commit: e5d58f5ee731b2ff4e5c801cb875c804c63593e4 [1537/1537] seccomp: Invalidate seccomp mode to catch death failures config: x86_64-buildonly-randconfig-004-20250331 (https://download.01.org/0day-ci/archive/20250402/202504021615.GKzmsAcB-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021615.GKzmsAcB-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021615.GKzmsAcB-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/seccomp.c:190: warning: Function parameter or member 'ret' not described in 'ACTION_ONLY' kernel/seccomp.c:190: warning: Excess function parameter 'sd' description in 'ACTION_ONLY' kernel/seccomp.c:190: warning: Excess function parameter 'match' description in 'ACTION_ONLY' kernel/seccomp.c:320: warning: Function parameter or member 'flags' not described in 'seccomp_sync_threads' >> kernel/seccomp.o: warning: objtool: do_seccomp()+0xa8a: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.15-rc1 commit 2c118f50d7fd4d9aefc4533a26f83338b2906b7a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYAPJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit: 2e4be0d011f2 ("x86/show_trace_log_lvl: Ensure stack pointer is aligned, again") was intended to ensure alignment of the stack pointer; but it also moved the initialization of the "stack" variable down into the loop header. This was likely intended as a no-op cleanup, since the commit message does not mention it; however, this caused a behavioral change because the value of "regs" is different between the two places. Originally, get_stack_pointer() used the regs provided by the caller; after that commit, get_stack_pointer() instead uses the regs at the top of the stack frame the unwinder is looking at. Often, there are no such regs at all, and "regs" is NULL, causing get_stack_pointer() to fall back to the task's current stack pointer, which is not what we want here, but probably happens to mostly work. Other times, the original regs will point to another regs frame - in that case, the linear guess unwind logic in show_trace_log_lvl() will start unwinding too far up the stack, causing the first frame found by the proper unwinder to never be visited, resulting in a stack trace consisting purely of guess lines. Fix it by moving the "stack = " assignment back where it belongs. Fixes: 2e4be0d011f2 ("x86/show_trace_log_lvl: Ensure stack pointer is aligned, again") Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://lore.kernel.org/r/20250325-2025-03-unwind-fixes-v1-2-acd774364768@g… Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- arch/x86/kernel/dumpstack.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c index f18ca44c904b..52dc5839d1e8 100644 --- a/arch/x86/kernel/dumpstack.c +++ b/arch/x86/kernel/dumpstack.c @@ -195,6 +195,7 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, printk("%sCall Trace:\n", log_lvl); unwind_start(&state, task, regs, stack); + stack = stack ?: get_stack_pointer(task, regs); regs = unwind_get_entry_regs(&state, &partial); /* @@ -213,9 +214,7 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, * - hardirq stack * - entry stack */ - for (stack = stack ?: get_stack_pointer(task, regs); - stack; - stack = stack_info.next_sp) { + for (; stack; stack = stack_info.next_sp) { const char *stack_name; stack = PTR_ALIGN(stack, sizeof(long)); -- 2.25.1

2 1

[PATCH v3 OLK-6.6 0/6] Support the FEAT_HDBSS introduced in Armv9.5
by Zhenyu Ye 02 Apr '25

02 Apr '25

From: eillon <yezhenyu2(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB103D CVE: NA ---------------------------------------------------------------------- This series of patches add support to the Hardware Dirty state tracking Structure(HDBSS) feature, which is introduced by the ARM architecture in the DDI0601(ID121123) version. The HDBSS feature is an extension to the architecture that enhances tracking translation table descriptors' dirty state, identified as FEAT_HDBSS. The goal of this feature is to reduce the cost of surveying for dirtied granules, with minimal effect on recording when a granule has been dirtied. The purpose of this feature is to make the execution overhead of live migration lower to both the guest and the host, compared to existing approaches (write-protect or search stage 2 tables). After these patches, users(such as qemu) can use the KVM_CAP_ARM_HW_DIRTY_STATE_TRACK ioctl to enable or disable the HDBSS feature before and after the live migration. Changes in v3: - fix kabi broken Changes in v2: - adapt the commit format See patches for details, Thanks. eillon (5): arm64/sysreg: add HDBSS related register information arm64/kvm: support set the DBM attr during memory abort arm64/kvm: using ioctl to enable/disable the HDBSS feature arm64/kvm: support to handle the HDBSSF event arm64/config: add config to control whether enable HDBSS feature arch/arm64/Kconfig | 12 ++++ arch/arm64/configs/openeuler_defconfig | 6 ++ arch/arm64/include/asm/cpufeature.h | 14 ++++ arch/arm64/include/asm/esr.h | 2 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_host.h | 8 +++ arch/arm64/include/asm/kvm_mmu.h | 14 ++++ arch/arm64/include/asm/kvm_pgtable.h | 1 + arch/arm64/include/asm/sysreg.h | 14 ++++ arch/arm64/kvm/arm.c | 88 ++++++++++++++++++++++++++ arch/arm64/kvm/handle_exit.c | 50 +++++++++++++++ arch/arm64/kvm/hyp/pgtable.c | 12 ++++ arch/arm64/kvm/hyp/vhe/switch.c | 3 + arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 4 ++ arch/arm64/kvm/mmu.c | 17 ++++- arch/arm64/kvm/reset.c | 9 +++ arch/arm64/tools/sysreg | 28 ++++++++ include/linux/kvm_host.h | 3 + include/uapi/linux/kvm.h | 2 + tools/include/uapi/linux/kvm.h | 2 + 20 files changed, 289 insertions(+), 1 deletion(-) -- 2.39.3

2 7

[PATCH OLK-5.10] x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.15-rc1 commit 2c118f50d7fd4d9aefc4533a26f83338b2906b7a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYAPJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit: 2e4be0d011f2 ("x86/show_trace_log_lvl: Ensure stack pointer is aligned, again") was intended to ensure alignment of the stack pointer; but it also moved the initialization of the "stack" variable down into the loop header. This was likely intended as a no-op cleanup, since the commit message does not mention it; however, this caused a behavioral change because the value of "regs" is different between the two places. Originally, get_stack_pointer() used the regs provided by the caller; after that commit, get_stack_pointer() instead uses the regs at the top of the stack frame the unwinder is looking at. Often, there are no such regs at all, and "regs" is NULL, causing get_stack_pointer() to fall back to the task's current stack pointer, which is not what we want here, but probably happens to mostly work. Other times, the original regs will point to another regs frame - in that case, the linear guess unwind logic in show_trace_log_lvl() will start unwinding too far up the stack, causing the first frame found by the proper unwinder to never be visited, resulting in a stack trace consisting purely of guess lines. Fix it by moving the "stack = " assignment back where it belongs. Fixes: 2e4be0d011f2 ("x86/show_trace_log_lvl: Ensure stack pointer is aligned, again") Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://lore.kernel.org/r/20250325-2025-03-unwind-fixes-v1-2-acd774364768@g… Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- arch/x86/kernel/dumpstack.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c index b726174024da..d9cbcdbdf1e0 100644 --- a/arch/x86/kernel/dumpstack.c +++ b/arch/x86/kernel/dumpstack.c @@ -195,6 +195,7 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, printk("%sCall Trace:\n", log_lvl); unwind_start(&state, task, regs, stack); + stack = stack ?: get_stack_pointer(task, regs); regs = unwind_get_entry_regs(&state, &partial); /* @@ -213,9 +214,7 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, * - hardirq stack * - entry stack */ - for (stack = stack ?: get_stack_pointer(task, regs); - stack; - stack = stack_info.next_sp) { + for (; stack; stack = stack_info.next_sp) { const char *stack_name; stack = PTR_ALIGN(stack, sizeof(long)); -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] Sync two patches to olk
by Chen Zhongjin 02 Apr '25

02 Apr '25

See: https://gitee.com/openeuler/kernel/issues/IBY4FJ https://gitee.com/openeuler/kernel/issues/IBY4FQ Chen Zhongjin (2): kprobes: Fix deadlock when unwinding kretprobe_trampoline powerpc: Fix save r13 on kprobe/ftrace entry arch/powerpc/kernel/optprobes_head.S | 10 ++++++---- arch/powerpc/kernel/trace/ftrace_64_mprofile.S | 10 ++++++---- kernel/kprobes.c | 9 +++++++-- 3 files changed, 19 insertions(+), 10 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS V1 0/2] fix-CVE-2022-49538
by Cheng Yu 02 Apr '25

02 Apr '25

fix-CVE-2022-49538 Amadeusz Sławiński (1): ALSA: jack: Access input_dev under mutex Takashi Iwai (1): ALSA: jack: Fix mutex call in snd_jack_report() include/sound/jack.h | 1 + sound/core/jack.c | 39 +++++++++++++++++++++++++++++---------- 2 files changed, 30 insertions(+), 10 deletions(-) -- 2.25.1

2 3

[openeuler:OLK-5.10 2830/2830] fs/ext4/file.o: warning: objtool: ext4_file_write_iter()+0x893: unreachable instruction
by kernel test robot 02 Apr '25

02 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 1a6f72935307d39713f310345f6049fcc3058091 commit: 52c6fec939dd6f0de6d534d8b08ac06be8cfe5c4 [2830/2830] ext4: properly sync file size update after O_SYNC direct IO config: x86_64-buildonly-randconfig-004-20250331 (https://download.01.org/0day-ci/archive/20250402/202504021552.RjBa0DvI-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021552.RjBa0DvI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021552.RjBa0DvI-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/ext4/file.o: warning: objtool: ext4_file_write_iter()+0x893: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] perf/core: Fix pmus_lock vs. pmus_srcu ordering
by Luo Gengkun 02 Apr '25

02 Apr '25

From: Peter Zijlstra <peterz(a)infradead.org> stable inclusion from stable-v6.6.83 commit 7c823e4c30d6fdc16089e13924260086eaea76be category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBXQNU Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2565e42539b120b81a68a58da961ce5d1e34eac8 ] Commit a63fbed776c7 ("perf/tracing/cpuhotplug: Fix locking order") placed pmus_lock inside pmus_srcu, this makes perf_pmu_unregister() trip lockdep. Move the locking about such that only pmu_idr and pmus (list) are modified while holding pmus_lock. This avoids doing synchronize_srcu() while holding pmus_lock and all is well again. Fixes: a63fbed776c7 ("perf/tracing/cpuhotplug: Fix locking order") Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://lore.kernel.org/r/20241104135517.679556858@infradead.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/events/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 0b9e703641d1..9b5d35c4a3ec 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -11670,6 +11670,8 @@ void perf_pmu_unregister(struct pmu *pmu) { mutex_lock(&pmus_lock); list_del_rcu(&pmu->entry); + idr_remove(&pmu_idr, pmu->type); + mutex_unlock(&pmus_lock); /* * We dereference the pmu list under both SRCU and regular RCU, so @@ -11679,7 +11681,6 @@ void perf_pmu_unregister(struct pmu *pmu) synchronize_rcu(); free_percpu(pmu->pmu_disable_count); - idr_remove(&pmu_idr, pmu->type); if (pmu_bus_running && pmu->dev && pmu->dev != PMU_NULL_DEV) { if (pmu->nr_addr_filters) device_remove_file(pmu->dev, &dev_attr_nr_addr_filters); @@ -11687,7 +11688,6 @@ void perf_pmu_unregister(struct pmu *pmu) put_device(pmu->dev); } free_pmu_context(pmu); - mutex_unlock(&pmus_lock); } EXPORT_SYMBOL_GPL(perf_pmu_unregister); -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2025-21963 && CVE-2025-21964
by Li Lingfeng 02 Apr '25

02 Apr '25

CVE-2025-21963 && CVE-2025-21964 Murad Masimov (2): cifs: Fix integer overflow while processing acregmax mount option cifs: Fix integer overflow while processing acdirmax mount option fs/smb/client/fs_context.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) -- 2.31.1

2 3

[PATCH OLK-6.6] tracing: Fix bad hist from corrupting named_triggers list
by Tengda Wu 02 Apr '25

02 Apr '25

From: Steven Rostedt <rostedt(a)goodmis.org> stable inclusion from stable-v6.6.81 commit 43b254d46c740bf9dbe65709afa021dd726dfa99 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY44G CVE: CVE-2025-21899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e upstream. The following commands causes a crash: ~# cd /sys/kernel/tracing/events/rcu/rcu_callback ~# echo 'hist:name=bad:keys=common_pid:onmax(bogus).save(common_pid)' > trigger bash: echo: write error: Invalid argument ~# echo 'hist:name=bad:keys=common_pid' > trigger Because the following occurs: event_trigger_write() { trigger_process_regex() { event_hist_trigger_parse() { data = event_trigger_alloc(..); event_trigger_register(.., data) { cmd_ops->reg(.., data, ..) [hist_register_trigger()] { data->ops->init() [event_hist_trigger_init()] { save_named_trigger(name, data) { list_add(&data->named_list, &named_triggers); } } } } ret = create_actions(); (return -EINVAL) if (ret) goto out_unreg; [..] ret = hist_trigger_enable(data, ...) { list_add_tail_rcu(&data->list, &file->triggers); <<<---- SKIPPED!!! (this is important!) [..] out_unreg: event_hist_unregister(.., data) { cmd_ops->unreg(.., data, ..) [hist_unregister_trigger()] { list_for_each_entry(iter, &file->triggers, list) { if (!hist_trigger_match(data, iter, named_data, false)) <- never matches continue; [..] test = iter; } if (test && test->ops->free) <<<-- test is NULL test->ops->free(test) [event_hist_trigger_free()] { [..] if (data->name) del_named_trigger(data) { list_del(&data->named_list); <<<<-- NEVER gets removed! } } } } [..] kfree(data); <<<-- frees item but it is still on list The next time a hist with name is registered, it causes an u-a-f bug and the kernel can crash. Move the code around such that if event_trigger_register() succeeds, the next thing called is hist_trigger_enable() which adds it to the list. A bunch of actions is called if get_named_trigger_data() returns false. But that doesn't need to be called after event_trigger_register(), so it can be moved up, allowing event_trigger_register() to be called just before hist_trigger_enable() keeping them together and allowing the file->triggers to be properly populated. Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://lore.kernel.org/20250227163944.1c37f85f@gandalf.local.home Fixes: 067fe038e70f6 ("tracing: Add variable reference handling to hist triggers") Reported-by: Tomas Glozar <tglozar(a)redhat.com> Tested-by: Tomas Glozar <tglozar(a)redhat.com> Reviewed-by: Tom Zanussi <zanussi(a)kernel.org> Closes: https://lore.kernel.org/all/CAP4=nvTsxjckSBTz=Oe_UYh8keD9_sZC4i++4h72mJLic4… Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_events_hist.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index dd16faf0d150..604d63380a90 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -6660,27 +6660,27 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops, if (existing_hist_update_only(glob, trigger_data, file)) goto out_free; - ret = event_trigger_register(cmd_ops, file, glob, trigger_data); - if (ret < 0) - goto out_free; + if (!get_named_trigger_data(trigger_data)) { - if (get_named_trigger_data(trigger_data)) - goto enable; + ret = create_actions(hist_data); + if (ret) + goto out_free; - ret = create_actions(hist_data); - if (ret) - goto out_unreg; + if (has_hist_vars(hist_data) || hist_data->n_var_refs) { + ret = save_hist_vars(hist_data); + if (ret) + goto out_free; + } - if (has_hist_vars(hist_data) || hist_data->n_var_refs) { - ret = save_hist_vars(hist_data); + ret = tracing_map_init(hist_data->map); if (ret) - goto out_unreg; + goto out_free; } - ret = tracing_map_init(hist_data->map); - if (ret) - goto out_unreg; -enable: + ret = event_trigger_register(cmd_ops, file, glob, trigger_data); + if (ret < 0) + goto out_free; + ret = hist_trigger_enable(trigger_data, file); if (ret) goto out_unreg; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
by Pu Lehui 02 Apr '25

02 Apr '25

From: Luis Gerhorst <gerhorst(a)cs.fau.de> stable inclusion from stable-v4.19.272 commit aae109414a57ab4164218f36e2e4a17f027fcaaa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVYS CVE: CVE-2023-53024 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e4f4db47794c9f474b184ee1418f42e6a07412b6 ] To mitigate Spectre v4, 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store bypass mitigation") inserts lfence instructions after 1) initializing a stack slot and 2) spilling a pointer to the stack. However, this does not cover cases where a stack slot is first initialized with a pointer (subject to sanitization) but then overwritten with a scalar (not subject to sanitization because the slot was already initialized). In this case, the second write may be subject to speculative store bypass (SSB) creating a speculative pointer-as-scalar type confusion. This allows the program to subsequently leak the numerical pointer value using, for example, a branch-based cache side channel. To fix this, also sanitize scalars if they write a stack slot that previously contained a pointer. Assuming that pointer-spills are only generated by LLVM on register-pressure, the performance impact on most real-world BPF programs should be small. The following unprivileged BPF bytecode drafts a minimal exploit and the mitigation: [...] // r6 = 0 or 1 (skalar, unknown user input) // r7 = accessible ptr for side channel // r10 = frame pointer (fp), to be leaked // r9 = r10 # fp alias to encourage ssb *(u64 *)(r9 - 8) = r10 // fp[-8] = ptr, to be leaked // lfence added here because of pointer spill to stack. // // Ommitted: Dummy bpf_ringbuf_output() here to train alias predictor // for no r9-r10 dependency. // *(u64 *)(r10 - 8) = r6 // fp[-8] = scalar, overwrites ptr // 2039f26f3aca: no lfence added because stack slot was not STACK_INVALID, // store may be subject to SSB // // fix: also add an lfence when the slot contained a ptr // r8 = *(u64 *)(r9 - 8) // r8 = architecturally a scalar, speculatively a ptr // // leak ptr using branch-based cache side channel: r8 &= 1 // choose bit to leak if r8 == 0 goto SLOW // no mispredict // architecturally dead code if input r6 is 0, // only executes speculatively iff ptr bit is 1 r8 = *(u64 *)(r7 + 0) # encode bit in cache (0: slow, 1: fast) SLOW: [...] After running this, the program can time the access to *(r7 + 0) to determine whether the chosen pointer bit was 0 or 1. Repeat this 64 times to recover the whole address on amd64. In summary, sanitization can only be skipped if one scalar is overwritten with another scalar. Scalar-confusion due to speculative store bypass can not lead to invalid accesses because the pointer bounds deducted during verification are enforced using branchless logic. See 979d63d50c0c ("bpf: prevent out of bounds speculation on pointer arithmetic") for details. Do not make the mitigation depend on !env->allow_{uninit_stack,ptr_leaks} because speculative leaks are likely unexpected if these were enabled. For example, leaking the address to a protected log file may be acceptable while disabling the mitigation might unintentionally leak the address into the cached-state of a map that is accessible to unprivileged processes. Fixes: 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store bypass mitigation") Signed-off-by: Luis Gerhorst <gerhorst(a)cs.fau.de> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Henriette Hofmeier <henriette.hofmeier(a)rub.de> Link: https://lore.kernel.org/bpf/edc95bad-aada-9cfc-ffe2-fa9bb206583c@cs.fau.de Link: https://lore.kernel.org/bpf/20230109150544.41465-1-gerhorst@cs.fau.de Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index c3c592654cf1..e00cb52fb480 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -1013,7 +1013,9 @@ static int check_stack_write(struct bpf_verifier_env *env, bool sanitize = reg && is_spillable_regtype(reg->type); for (i = 0; i < size; i++) { - if (state->stack[spi].slot_type[i] == STACK_INVALID) { + u8 type = state->stack[spi].slot_type[i]; + + if (type != STACK_MISC && type != STACK_ZERO) { sanitize = true; break; } -- 2.34.1

2 1

[PATCH OLK-6.6] HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
by Pu Lehui 02 Apr '25

02 Apr '25

From: Zhang Lixu <lixu.zhang(a)intel.com> stable inclusion from stable-v6.6.83 commit 560f4d1299342504a6ab8a47f575b5e6b8345ada category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY43Y CVE: CVE-2025-21928 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 07583a0010696a17fb0942e0b499a62785c5fc9f ] The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtp_hid_remove() function. The function currently frees the `driver_data` directly within the loop that destroys the HID devices, which can lead to accessing freed memory. Specifically, `hid_destroy_device()` uses `driver_data` when it calls `hid_ishtp_set_feature()` to power off the sensor, so freeing `driver_data` beforehand can result in accessing invalid memory. This patch resolves the issue by storing the `driver_data` in a temporary variable before calling `hid_destroy_device()`, and then freeing the `driver_data` after the device is destroyed. Fixes: 0b28cb4bcb17 ("HID: intel-ish-hid: ISH HID client driver") Signed-off-by: Zhang Lixu <lixu.zhang(a)intel.com> Acked-by: Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/hid/intel-ish-hid/ishtp-hid.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/hid/intel-ish-hid/ishtp-hid.c b/drivers/hid/intel-ish-hid/ishtp-hid.c index 00c6f0ebf356..be2c62fc8251 100644 --- a/drivers/hid/intel-ish-hid/ishtp-hid.c +++ b/drivers/hid/intel-ish-hid/ishtp-hid.c @@ -261,12 +261,14 @@ int ishtp_hid_probe(unsigned int cur_hid_dev, */ void ishtp_hid_remove(struct ishtp_cl_data *client_data) { + void *data; int i; for (i = 0; i < client_data->num_hid_devices; ++i) { if (client_data->hid_sensor_hubs[i]) { - kfree(client_data->hid_sensor_hubs[i]->driver_data); + data = client_data->hid_sensor_hubs[i]->driver_data; hid_destroy_device(client_data->hid_sensor_hubs[i]); + kfree(data); client_data->hid_sensor_hubs[i] = NULL; } } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS V1] ALSA: jack: Access input_dev under mutex
by Cheng Yu 02 Apr '25

02 Apr '25

From: Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> stable inclusion from stable-v4.19.247 commit c093b62c40027c21d649c5534ad7aa3605a99b00 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3KT CVE: CVE-2022-49538 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1b6a6fc5280e97559287b61eade2d4b363e836f2 ] It is possible when using ASoC that input_dev is unregistered while calling snd_jack_report, which causes NULL pointer dereference. In order to prevent this serialize access to input_dev using mutex lock. Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> Reviewed-by: Cezary Rojewski <cezary.rojewski(a)intel.com> Link: https://lore.kernel.org/r/20220412091628.3056922-1-amadeuszx.slawinski@linu… Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: sound/core/jack.c [Context conflicts.] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- include/sound/jack.h | 1 + sound/core/jack.c | 34 +++++++++++++++++++++++++++------- 2 files changed, 28 insertions(+), 7 deletions(-) diff --git a/include/sound/jack.h b/include/sound/jack.h index 1e84bfb553cf..4742f842b457 100644 --- a/include/sound/jack.h +++ b/include/sound/jack.h @@ -77,6 +77,7 @@ struct snd_jack { const char *id; #ifdef CONFIG_SND_JACK_INPUT_DEV struct input_dev *input_dev; + struct mutex input_dev_lock; int registered; int type; char name[100]; diff --git a/sound/core/jack.c b/sound/core/jack.c index 84c2a17c56ee..2f43fe667759 100644 --- a/sound/core/jack.c +++ b/sound/core/jack.c @@ -48,8 +48,11 @@ static int snd_jack_dev_disconnect(struct snd_device *device) #ifdef CONFIG_SND_JACK_INPUT_DEV struct snd_jack *jack = device->device_data; - if (!jack->input_dev) + mutex_lock(&jack->input_dev_lock); + if (!jack->input_dev) { + mutex_unlock(&jack->input_dev_lock); return 0; + } /* If the input device is registered with the input subsystem * then we need to use a different deallocator. */ @@ -58,6 +61,7 @@ static int snd_jack_dev_disconnect(struct snd_device *device) else input_free_device(jack->input_dev); jack->input_dev = NULL; + mutex_unlock(&jack->input_dev_lock); #endif /* CONFIG_SND_JACK_INPUT_DEV */ return 0; } @@ -93,8 +97,11 @@ static int snd_jack_dev_register(struct snd_device *device) snprintf(jack->name, sizeof(jack->name), "%s %s", card->shortname, jack->id); - if (!jack->input_dev) + mutex_lock(&jack->input_dev_lock); + if (!jack->input_dev) { + mutex_unlock(&jack->input_dev_lock); return 0; + } jack->input_dev->name = jack->name; @@ -119,6 +126,7 @@ static int snd_jack_dev_register(struct snd_device *device) if (err == 0) jack->registered = 1; + mutex_unlock(&jack->input_dev_lock); return err; } #endif /* CONFIG_SND_JACK_INPUT_DEV */ @@ -235,9 +243,11 @@ int snd_jack_new(struct snd_card *card, const char *id, int type, jack->id = kstrdup(id, GFP_KERNEL); - /* don't creat input device for phantom jack */ - if (!phantom_jack) { #ifdef CONFIG_SND_JACK_INPUT_DEV + mutex_init(&jack->input_dev_lock); + + /* don't create input device for phantom jack */ + if (!phantom_jack) { int i; jack->input_dev = input_allocate_device(); @@ -255,8 +265,8 @@ int snd_jack_new(struct snd_card *card, const char *id, int type, input_set_capability(jack->input_dev, EV_SW, jack_switch_types[i]); -#endif /* CONFIG_SND_JACK_INPUT_DEV */ } +#endif /* CONFIG_SND_JACK_INPUT_DEV */ err = snd_device_new(card, SNDRV_DEV_JACK, jack, &ops); if (err < 0) @@ -296,10 +306,14 @@ EXPORT_SYMBOL(snd_jack_new); void snd_jack_set_parent(struct snd_jack *jack, struct device *parent) { WARN_ON(jack->registered); - if (!jack->input_dev) + mutex_lock(&jack->input_dev_lock); + if (!jack->input_dev) { + mutex_unlock(&jack->input_dev_lock); return; + } jack->input_dev->dev.parent = parent; + mutex_unlock(&jack->input_dev_lock); } EXPORT_SYMBOL(snd_jack_set_parent); @@ -347,6 +361,8 @@ EXPORT_SYMBOL(snd_jack_set_key); /** * snd_jack_report - Report the current status of a jack + * Note: This function uses mutexes and should be called from a + * context which can sleep (such as a workqueue). * * @jack: The jack to report status for * @status: The current status of the jack @@ -366,8 +382,11 @@ void snd_jack_report(struct snd_jack *jack, int status) status & jack_kctl->mask_bits); #ifdef CONFIG_SND_JACK_INPUT_DEV - if (!jack->input_dev) + mutex_lock(&jack->input_dev_lock); + if (!jack->input_dev) { + mutex_unlock(&jack->input_dev_lock); return; + } for (i = 0; i < ARRAY_SIZE(jack->key); i++) { int testbit = SND_JACK_BTN_0 >> i; @@ -386,6 +405,7 @@ void snd_jack_report(struct snd_jack *jack, int status) } input_sync(jack->input_dev); + mutex_unlock(&jack->input_dev_lock); #endif /* CONFIG_SND_JACK_INPUT_DEV */ } EXPORT_SYMBOL(snd_jack_report); -- 2.25.1

2 1

[PATCH OLK-6.6] uprobes: Reject the shared zeropage in uprobe_write_opcode()
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Tong Tiangen <tongtiangen(a)huawei.com> stable inclusion from stable-v6.6.81 commit 0b6f19714588cf2366b0364234f97ba963688f63 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVTY CVE: CVE-2025-21881 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit bddf10d26e6e5114e7415a0e442ec6f51a559468 ] We triggered the following crash in syzkaller tests: BUG: Bad page state in process syz.7.38 pfn:1eff3 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eff3 flags: 0x3fffff00004004(referenced|reserved|node=0|zone=1|lastcpupid=0x1fffff) raw: 003fffff00004004 ffffe6c6c07bfcc8 ffffe6c6c07bfcc8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x32/0x50 bad_page+0x69/0xf0 free_unref_page_prepare+0x401/0x500 free_unref_page+0x6d/0x1b0 uprobe_write_opcode+0x460/0x8e0 install_breakpoint.part.0+0x51/0x80 register_for_each_vma+0x1d9/0x2b0 __uprobe_register+0x245/0x300 bpf_uprobe_multi_link_attach+0x29b/0x4f0 link_create+0x1e2/0x280 __sys_bpf+0x75f/0xac0 __x64_sys_bpf+0x1a/0x30 do_syscall_64+0x56/0x100 entry_SYSCALL_64_after_hwframe+0x78/0xe2 BUG: Bad rss-counter state mm:00000000452453e0 type:MM_FILEPAGES val:-1 The following syzkaller test case can be used to reproduce: r2 = creat(&(0x7f0000000000)='./file0\x00', 0x8) write$nbd(r2, &(0x7f0000000580)=ANY=[], 0x10) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0) r5 = userfaultfd(0x80801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x20}) r6 = userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2}) ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x2, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000120000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r7, 0x0, 0x30, 0x1e, @val=@uprobe_multi={&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=[0x2], 0x0, 0x0, 0x1}}, 0x40) The cause is that zero pfn is set to the PTE without increasing the RSS count in mfill_atomic_pte_zeropage() and the refcount of zero folio does not increase accordingly. Then, the operation on the same pfn is performed in uprobe_write_opcode()->__replace_page() to unconditional decrease the RSS count and old_folio's refcount. Therefore, two bugs are introduced: 1. The RSS count is incorrect, when process exit, the check_mm() report error "Bad rss-count". 2. The reserved folio (zero folio) is freed when folio->refcount is zero, then free_pages_prepare->free_page_is_bad() report error "Bad page state". There is more, the following warning could also theoretically be triggered: __replace_page() -> ... -> folio_remove_rmap_pte() -> VM_WARN_ON_FOLIO(is_zero_folio(folio), folio) Considering that uprobe hit on the zero folio is a very rare case, just reject zero old folio immediately after get_user_page_vma_remote(). [ mingo: Cleaned up the changelog ] Fixes: 7396fa818d62 ("uprobes/core: Make background page replacement logic account for rss_stat counters") Fixes: 2b1444983508 ("uprobes, mm, x86: Add the ability to install and remove uprobes breakpoints") Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Oleg Nesterov <oleg(a)redhat.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Link: https://lore.kernel.org/r/20250224031149.1598949-1-tongtiangen@huawei.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- kernel/events/uprobes.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index a14b0059f177..c135c9704deb 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -483,6 +483,11 @@ int uprobe_write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm, if (ret <= 0) goto put_old; + if (is_zero_page(old_page)) { + ret = -EINVAL; + goto put_old; + } + if (WARN(!is_register && PageCompound(old_page), "uprobe unregister should never work on compound page\n")) { ret = -EINVAL; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS V1] ALSA: jack: Fix mutex call in snd_jack_report()
by Cheng Yu 02 Apr '25

02 Apr '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v4.19.291 commit 839f4e860eb6aff659ad05900963cf0410063eda category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3KT CVE: CVE-2022-49538 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 89dbb335cb6a627a4067bc42caa09c8bc3326d40 ] snd_jack_report() is supposed to be callable from an IRQ context, too, and it's indeed used in that way from virtsnd driver. The fix for input_dev race in commit 1b6a6fc5280e ("ALSA: jack: Access input_dev under mutex"), however, introduced a mutex lock in snd_jack_report(), and this resulted in a potential sleep-in-atomic. For addressing that problem, this patch changes the relevant code to use the object get/put and removes the mutex usage. That is, snd_jack_report(), it takes input_get_device() and leaves with input_put_device() for assuring the input_dev being assigned. Although the whole mutex could be reduced, we keep it because it can be still a protection for potential races between creation and deletion. Fixes: 1b6a6fc5280e ("ALSA: jack: Access input_dev under mutex") Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/r/cf95f7fe-a748-4990-8378-000491b40329@moroto.mount… Tested-by: Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20230706155357.3470-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- sound/core/jack.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/sound/core/jack.c b/sound/core/jack.c index 2f43fe667759..0e26488d8db2 100644 --- a/sound/core/jack.c +++ b/sound/core/jack.c @@ -371,6 +371,7 @@ void snd_jack_report(struct snd_jack *jack, int status) { struct snd_jack_kctl *jack_kctl; #ifdef CONFIG_SND_JACK_INPUT_DEV + struct input_dev *idev; int i; #endif @@ -382,30 +383,28 @@ void snd_jack_report(struct snd_jack *jack, int status) status & jack_kctl->mask_bits); #ifdef CONFIG_SND_JACK_INPUT_DEV - mutex_lock(&jack->input_dev_lock); - if (!jack->input_dev) { - mutex_unlock(&jack->input_dev_lock); + idev = input_get_device(jack->input_dev); + if (!idev) return; - } for (i = 0; i < ARRAY_SIZE(jack->key); i++) { int testbit = SND_JACK_BTN_0 >> i; if (jack->type & testbit) - input_report_key(jack->input_dev, jack->key[i], + input_report_key(idev, jack->key[i], status & testbit); } for (i = 0; i < ARRAY_SIZE(jack_switch_types); i++) { int testbit = 1 << i; if (jack->type & testbit) - input_report_switch(jack->input_dev, + input_report_switch(idev, jack_switch_types[i], status & testbit); } - input_sync(jack->input_dev); - mutex_unlock(&jack->input_dev_lock); + input_sync(idev); + input_put_device(idev); #endif /* CONFIG_SND_JACK_INPUT_DEV */ } EXPORT_SYMBOL(snd_jack_report); -- 2.25.1

2 1

[PATCH OLK-5.10] uprobes: Reject the shared zeropage in uprobe_write_opcode()
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Tong Tiangen <tongtiangen(a)huawei.com> mainline inclusion from mainline-v6.14-rc5 commit bddf10d26e6e5114e7415a0e442ec6f51a559468 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVTY CVE: CVE-2025-21881 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We triggered the following crash in syzkaller tests: BUG: Bad page state in process syz.7.38 pfn:1eff3 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eff3 flags: 0x3fffff00004004(referenced|reserved|node=0|zone=1|lastcpupid=0x1fffff) raw: 003fffff00004004 ffffe6c6c07bfcc8 ffffe6c6c07bfcc8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x32/0x50 bad_page+0x69/0xf0 free_unref_page_prepare+0x401/0x500 free_unref_page+0x6d/0x1b0 uprobe_write_opcode+0x460/0x8e0 install_breakpoint.part.0+0x51/0x80 register_for_each_vma+0x1d9/0x2b0 __uprobe_register+0x245/0x300 bpf_uprobe_multi_link_attach+0x29b/0x4f0 link_create+0x1e2/0x280 __sys_bpf+0x75f/0xac0 __x64_sys_bpf+0x1a/0x30 do_syscall_64+0x56/0x100 entry_SYSCALL_64_after_hwframe+0x78/0xe2 BUG: Bad rss-counter state mm:00000000452453e0 type:MM_FILEPAGES val:-1 The following syzkaller test case can be used to reproduce: r2 = creat(&(0x7f0000000000)='./file0\x00', 0x8) write$nbd(r2, &(0x7f0000000580)=ANY=[], 0x10) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0) r5 = userfaultfd(0x80801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x20}) r6 = userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2}) ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x2, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000120000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r7, 0x0, 0x30, 0x1e, @val=@uprobe_multi={&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=[0x2], 0x0, 0x0, 0x1}}, 0x40) The cause is that zero pfn is set to the PTE without increasing the RSS count in mfill_atomic_pte_zeropage() and the refcount of zero folio does not increase accordingly. Then, the operation on the same pfn is performed in uprobe_write_opcode()->__replace_page() to unconditional decrease the RSS count and old_folio's refcount. Therefore, two bugs are introduced: 1. The RSS count is incorrect, when process exit, the check_mm() report error "Bad rss-count". 2. The reserved folio (zero folio) is freed when folio->refcount is zero, then free_pages_prepare->free_page_is_bad() report error "Bad page state". There is more, the following warning could also theoretically be triggered: __replace_page() -> ... -> folio_remove_rmap_pte() -> VM_WARN_ON_FOLIO(is_zero_folio(folio), folio) Considering that uprobe hit on the zero folio is a very rare case, just reject zero old folio immediately after get_user_page_vma_remote(). [ mingo: Cleaned up the changelog ] Fixes: 7396fa818d62 ("uprobes/core: Make background page replacement logic account for rss_stat counters") Fixes: 2b1444983508 ("uprobes, mm, x86: Add the ability to install and remove uprobes breakpoints") Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Oleg Nesterov <oleg(a)redhat.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Link: https://lore.kernel.org/r/20250224031149.1598949-1-tongtiangen@huawei.com Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- kernel/events/uprobes.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index e045b12662f1..424b24dd029e 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -488,6 +488,11 @@ int uprobe_write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm, if (ret <= 0) goto put_old; + if (is_zero_page(old_page)) { + ret = -EINVAL; + goto put_old; + } + if (WARN(!is_register && PageCompound(old_page), "uprobe unregister should never work on compound page\n")) { ret = -EINVAL; -- 2.25.1

2 1

[PATCH v2 OLK-6.6 0/5] Support the FEAT_HDBSS introduced in Armv9.5
by Zhenyu Ye 02 Apr '25

02 Apr '25

From: eillon <yezhenyu2(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB103D CVE: NA ---------------------------------------------------------------------- This series of patches add support to the Hardware Dirty state tracking Structure(HDBSS) feature, which is introduced by the ARM architecture in the DDI0601(ID121123) version. The HDBSS feature is an extension to the architecture that enhances tracking translation table descriptors' dirty state, identified as FEAT_HDBSS. The goal of this feature is to reduce the cost of surveying for dirtied granules, with minimal effect on recording when a granule has been dirtied. The purpose of this feature is to make the execution overhead of live migration lower to both the guest and the host, compared to existing approaches (write-protect or search stage 2 tables). After these patches, users(such as qemu) can use the KVM_CAP_ARM_HW_DIRTY_STATE_TRACK ioctl to enable or disable the HDBSS feature before and after the live migration. Changes in v2: - adapt the commit format See patches for details, Thanks. eillon (5): arm64/sysreg: add HDBSS related register information arm64/kvm: support set the DBM attr during memory abort arm64/kvm: using ioctl to enable/disable the HDBSS feature arm64/kvm: support to handle the HDBSSF event arm64/config: add config to control whether enable HDBSS feature arch/arm64/Kconfig | 12 ++++ arch/arm64/configs/openeuler_defconfig | 6 ++ arch/arm64/include/asm/cpufeature.h | 14 ++++ arch/arm64/include/asm/esr.h | 2 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_host.h | 8 +++ arch/arm64/include/asm/kvm_mmu.h | 14 ++++ arch/arm64/include/asm/kvm_pgtable.h | 1 + arch/arm64/include/asm/sysreg.h | 14 ++++ arch/arm64/kvm/arm.c | 88 ++++++++++++++++++++++++++ arch/arm64/kvm/handle_exit.c | 50 +++++++++++++++ arch/arm64/kvm/hyp/pgtable.c | 12 ++++ arch/arm64/kvm/hyp/vhe/switch.c | 3 + arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 4 ++ arch/arm64/kvm/mmu.c | 17 ++++- arch/arm64/kvm/reset.c | 9 +++ arch/arm64/tools/sysreg | 28 ++++++++ include/linux/kvm_host.h | 3 + include/uapi/linux/kvm.h | 2 + tools/include/uapi/linux/kvm.h | 2 + 20 files changed, 289 insertions(+), 1 deletion(-) -- 2.39.3

2 6

[PATCH openEuler-1.0-LTS] ftrace: Avoid potential division by zero in function_stat_show()
by Pu Lehui 02 Apr '25

02 Apr '25

From: Nikolay Kuratov <kniv(a)yandex-team.ru> mainline inclusion from mainline-v6.14-rc5 commit a1a7eb89ca0b89dc1c326eeee2596f263291aca3 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY5DV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Check whether denominator expression x * (x - 1) * 1000 mod {2^32, 2^64} produce zero and skip stddev computation in that case. For now don't care about rec->counter * rec->counter overflow because rec->time * rec->time overflow will likely happen earlier. Cc: stable(a)vger.kernel.org Cc: Wen Yang <wenyang(a)linux.alibaba.com> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://lore.kernel.org/20250206090156.1561783-1-kniv@yandex-team.ru Fixes: e31f7939c1c27 ("ftrace: Avoid potential division by zero in function profiler") Signed-off-by: Nikolay Kuratov <kniv(a)yandex-team.ru> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/ftrace.c [The conflicts were due to some minor issue] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/trace/ftrace.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c index 36de4ab34431..8199571d9ab3 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -544,6 +544,7 @@ static int function_stat_show(struct seq_file *m, void *v) static struct trace_seq s; unsigned long long avg; unsigned long long stddev; + unsigned long long stddev_denom; #endif mutex_lock(&ftrace_profile_lock); @@ -565,23 +566,19 @@ static int function_stat_show(struct seq_file *m, void *v) #ifdef CONFIG_FUNCTION_GRAPH_TRACER seq_puts(m, " "); - /* Sample standard deviation (s^2) */ - if (rec->counter <= 1) - stddev = 0; - else { - /* - * Apply Welford's method: - * s^2 = 1 / (n * (n-1)) * (n * \Sum (x_i)^2 - (\Sum x_i)^2) - */ + /* + * Variance formula: + * s^2 = 1 / (n * (n-1)) * (n * \Sum (x_i)^2 - (\Sum x_i)^2) + * Maybe Welford's method is better here? + * Divide only by 1000 for ns^2 -> us^2 conversion. + * trace_print_graph_duration will divide by 1000 again. + */ + stddev = 0; + stddev_denom = rec->counter * (rec->counter - 1) * 1000; + if (stddev_denom) { stddev = rec->counter * rec->time_squared - rec->time * rec->time; - - /* - * Divide only 1000 for ns^2 -> us^2 conversion. - * trace_print_graph_duration will divide 1000 again. - */ - stddev = div64_ul(stddev, - rec->counter * (rec->counter - 1) * 1000); + stddev = div64_ul(stddev, stddev_denom); } trace_seq_init(&s); -- 2.34.1

2 1

[PATCH OLK-6.6] ftrace: Avoid potential division by zero in function_stat_show()
by Pu Lehui 02 Apr '25

02 Apr '25

From: Nikolay Kuratov <kniv(a)yandex-team.ru> stable inclusion from stable-v6.6.81 commit f58a3f8e284d0bdf94164a8e61cd4e70d337a1a3 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY5DV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a1a7eb89ca0b89dc1c326eeee2596f263291aca3 upstream. Check whether denominator expression x * (x - 1) * 1000 mod {2^32, 2^64} produce zero and skip stddev computation in that case. For now don't care about rec->counter * rec->counter overflow because rec->time * rec->time overflow will likely happen earlier. Cc: stable(a)vger.kernel.org Cc: Wen Yang <wenyang(a)linux.alibaba.com> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://lore.kernel.org/20250206090156.1561783-1-kniv@yandex-team.ru Fixes: e31f7939c1c27 ("ftrace: Avoid potential division by zero in function profiler") Signed-off-by: Nikolay Kuratov <kniv(a)yandex-team.ru> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/trace/ftrace.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c index 1043936b352d..fe26b58e753f 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -538,6 +538,7 @@ static int function_stat_show(struct seq_file *m, void *v) static struct trace_seq s; unsigned long long avg; unsigned long long stddev; + unsigned long long stddev_denom; #endif mutex_lock(&ftrace_profile_lock); @@ -559,23 +560,19 @@ static int function_stat_show(struct seq_file *m, void *v) #ifdef CONFIG_FUNCTION_GRAPH_TRACER seq_puts(m, " "); - /* Sample standard deviation (s^2) */ - if (rec->counter <= 1) - stddev = 0; - else { - /* - * Apply Welford's method: - * s^2 = 1 / (n * (n-1)) * (n * \Sum (x_i)^2 - (\Sum x_i)^2) - */ + /* + * Variance formula: + * s^2 = 1 / (n * (n-1)) * (n * \Sum (x_i)^2 - (\Sum x_i)^2) + * Maybe Welford's method is better here? + * Divide only by 1000 for ns^2 -> us^2 conversion. + * trace_print_graph_duration will divide by 1000 again. + */ + stddev = 0; + stddev_denom = rec->counter * (rec->counter - 1) * 1000; + if (stddev_denom) { stddev = rec->counter * rec->time_squared - rec->time * rec->time; - - /* - * Divide only 1000 for ns^2 -> us^2 conversion. - * trace_print_graph_duration will divide 1000 again. - */ - stddev = div64_ul(stddev, - rec->counter * (rec->counter - 1) * 1000); + stddev = div64_ul(stddev, stddev_denom); } trace_seq_init(&s); -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Add tracepoints with null-able arguments
by Pu Lehui 02 Apr '25

02 Apr '25

From: Jiri Olsa <jolsa(a)kernel.org> mainline inclusion from mainline-v6.15-rc1 commit c83e2d970bae8616b94c40caa43d85f2f2c7d81e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY5DV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Some of the tracepoints slipped when we did the first scan, adding them now. Fixes: 838a10bd2ebf ("bpf: Augment raw_tp arguments with PTR_MAYBE_NULL") Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Link: https://lore.kernel.org/r/20250210175913.2893549-1-jolsa@kernel.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/btf.c | 99 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 99 insertions(+) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index bbc99401b4e7..39fc33e6368f 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -5997,6 +5997,8 @@ static const struct bpf_raw_tp_null_args raw_tp_null_args[] = { /* rxrpc */ { "rxrpc_recvdata", 0x1 }, { "rxrpc_resend", 0x10 }, + { "rxrpc_tq", 0x10 }, + { "rxrpc_client", 0x1 }, /* sunrpc */ { "xs_stream_read_data", 0x1 }, /* ... from xprt_cong_event event class */ @@ -6017,6 +6019,103 @@ static const struct bpf_raw_tp_null_args raw_tp_null_args[] = { { "mr_integ_alloc", 0x2000 }, /* bpf_testmod */ { "bpf_testmod_test_read", 0x0 }, + /* amdgpu */ + { "amdgpu_vm_bo_map", 0x1 }, + { "amdgpu_vm_bo_unmap", 0x1 }, + /* netfs */ + { "netfs_folioq", 0x1 }, + /* xfs from xfs_defer_pending_class */ + { "xfs_defer_create_intent", 0x1 }, + { "xfs_defer_cancel_list", 0x1 }, + { "xfs_defer_pending_finish", 0x1 }, + { "xfs_defer_pending_abort", 0x1 }, + { "xfs_defer_relog_intent", 0x1 }, + { "xfs_defer_isolate_paused", 0x1 }, + { "xfs_defer_item_pause", 0x1 }, + { "xfs_defer_item_unpause", 0x1 }, + /* xfs from xfs_defer_pending_item_class */ + { "xfs_defer_add_item", 0x1 }, + { "xfs_defer_cancel_item", 0x1 }, + { "xfs_defer_finish_item", 0x1 }, + /* xfs from xfs_icwalk_class */ + { "xfs_ioc_free_eofblocks", 0x10 }, + { "xfs_blockgc_free_space", 0x10 }, + /* xfs from xfs_btree_cur_class */ + { "xfs_btree_updkeys", 0x100 }, + { "xfs_btree_overlapped_query_range", 0x100 }, + /* xfs from xfs_imap_class*/ + { "xfs_map_blocks_found", 0x10000 }, + { "xfs_map_blocks_alloc", 0x10000 }, + { "xfs_iomap_alloc", 0x1000 }, + { "xfs_iomap_found", 0x1000 }, + /* xfs from xfs_fs_class */ + { "xfs_inodegc_flush", 0x1 }, + { "xfs_inodegc_push", 0x1 }, + { "xfs_inodegc_start", 0x1 }, + { "xfs_inodegc_stop", 0x1 }, + { "xfs_inodegc_queue", 0x1 }, + { "xfs_inodegc_throttle", 0x1 }, + { "xfs_fs_sync_fs", 0x1 }, + { "xfs_blockgc_start", 0x1 }, + { "xfs_blockgc_stop", 0x1 }, + { "xfs_blockgc_worker", 0x1 }, + { "xfs_blockgc_flush_all", 0x1 }, + /* xfs_scrub */ + { "xchk_nlinks_live_update", 0x10 }, + /* xfs_scrub from xchk_metapath_class */ + { "xchk_metapath_lookup", 0x100 }, + /* nfsd */ + { "nfsd_dirent", 0x1 }, + { "nfsd_file_acquire", 0x1001 }, + { "nfsd_file_insert_err", 0x1 }, + { "nfsd_file_cons_err", 0x1 }, + /* nfs4 */ + { "nfs4_setup_sequence", 0x1 }, + { "pnfs_update_layout", 0x10000 }, + { "nfs4_inode_callback_event", 0x200 }, + { "nfs4_inode_stateid_callback_event", 0x200 }, + /* nfs from pnfs_layout_event */ + { "pnfs_mds_fallback_pg_init_read", 0x10000 }, + { "pnfs_mds_fallback_pg_init_write", 0x10000 }, + { "pnfs_mds_fallback_pg_get_mirror_count", 0x10000 }, + { "pnfs_mds_fallback_read_done", 0x10000 }, + { "pnfs_mds_fallback_write_done", 0x10000 }, + { "pnfs_mds_fallback_read_pagelist", 0x10000 }, + { "pnfs_mds_fallback_write_pagelist", 0x10000 }, + /* coda */ + { "coda_dec_pic_run", 0x10 }, + { "coda_dec_pic_done", 0x10 }, + /* cfg80211 */ + { "cfg80211_scan_done", 0x11 }, + { "rdev_set_coalesce", 0x10 }, + { "cfg80211_report_wowlan_wakeup", 0x100 }, + { "cfg80211_inform_bss_frame", 0x100 }, + { "cfg80211_michael_mic_failure", 0x10000 }, + /* cfg80211 from wiphy_work_event */ + { "wiphy_work_queue", 0x10 }, + { "wiphy_work_run", 0x10 }, + { "wiphy_work_cancel", 0x10 }, + { "wiphy_work_flush", 0x10 }, + /* hugetlbfs */ + { "hugetlbfs_alloc_inode", 0x10 }, + /* spufs */ + { "spufs_context", 0x10 }, + /* kvm_hv */ + { "kvm_page_fault_enter", 0x100 }, + /* dpu */ + { "dpu_crtc_setup_mixer", 0x100 }, + /* binder */ + { "binder_transaction", 0x100 }, + /* bcachefs */ + { "btree_path_free", 0x100 }, + /* hfi1_tx */ + { "hfi1_sdma_progress", 0x1000 }, + /* iptfs */ + { "iptfs_ingress_postq_event", 0x1000 }, + /* neigh */ + { "neigh_update", 0x10 }, + /* snd_firewire_lib */ + { "amdtp_packet", 0x100 }, }; bool btf_ctx_access(int off, int size, enum bpf_access_type type, -- 2.34.1

2 1

[openeuler:OLK-5.10 2830/2830] fs/xfs/libxfs/xfs_da_btree.o: warning: objtool: xfs_da3_split()+0x787: unreachable instruction
by kernel test robot 02 Apr '25

02 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 411f2e6e24ad11083d85f2ab7324b1f77ad0d371 commit: f2c902d8c653f8021f9761092a27f7b9db42b662 [2830/2830] tracing: Make tracepoint lockdep check actually test something config: x86_64-buildonly-randconfig-004-20250331 (https://download.01.org/0day-ci/archive/20250402/202504021010.h7TdpCwx-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021010.h7TdpCwx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021010.h7TdpCwx-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/xfs/libxfs/xfs_da_btree.o: warning: objtool: xfs_da3_split()+0x787: unreachable instruction -- >> fs/xfs/libxfs/xfs_attr_leaf.o: warning: objtool: xfs_attr3_leaf_split()+0x2da: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] dmaengine: Fix double increment of client_count in dma_chan_get()
by Xiaomeng Zhang 02 Apr '25

02 Apr '25

From: Koba Ko <koba.ko(a)canonical.com> stable inclusion from stable-v4.19.272 commit c6221afe573413fd2981e291f7df4a58283e0654 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBWVX7 CVE: CVE-2022-49753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f3dc1b3b4750851a94212dba249703dd0e50bb20 ] The first time dma_chan_get() is called for a channel the channel client_count is incorrectly incremented twice for public channels, first in balance_ref_count(), and again prior to returning. This results in an incorrect client count which will lead to the channel resources not being freed when they should be. A simple test of repeated module load and unload of async_tx on a Dell Power Edge R7425 also shows this resulting in a kref underflow warning. [ 124.329662] async_tx: api initialized (async) [ 129.000627] async_tx: api initialized (async) [ 130.047839] ------------[ cut here ]------------ [ 130.052472] refcount_t: underflow; use-after-free. [ 130.057279] WARNING: CPU: 3 PID: 19364 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110 [ 130.065811] Modules linked in: async_tx(-) rfkill intel_rapl_msr intel_rapl_common amd64_edac edac_mce_amd ipmi_ssif kvm_amd dcdbas kvm mgag200 drm_shmem_helper acpi_ipmi irqbypass drm_kms_helper ipmi_si syscopyarea sysfillrect rapl pcspkr ipmi_devintf sysimgblt fb_sys_fops k10temp i2c_piix4 ipmi_msghandler acpi_power_meter acpi_cpufreq vfat fat drm fuse xfs libcrc32c sd_mod t10_pi sg ahci crct10dif_pclmul libahci crc32_pclmul crc32c_intel ghash_clmulni_intel igb megaraid_sas i40e libata i2c_algo_bit ccp sp5100_tco dca dm_mirror dm_region_hash dm_log dm_mod [last unloaded: async_tx] [ 130.117361] CPU: 3 PID: 19364 Comm: modprobe Kdump: loaded Not tainted 5.14.0-185.el9.x86_64 #1 [ 130.126091] Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS 1.18.0 01/17/2022 [ 130.133806] RIP: 0010:refcount_warn_saturate+0xba/0x110 [ 130.139041] Code: 01 01 e8 6d bd 55 00 0f 0b e9 72 9d 8a 00 80 3d 26 18 9c 01 00 75 85 48 c7 c7 f8 a3 03 9d c6 05 16 18 9c 01 01 e8 4a bd 55 00 <0f> 0b e9 4f 9d 8a 00 80 3d 01 18 9c 01 00 0f 85 5e ff ff ff 48 c7 [ 130.157807] RSP: 0018:ffffbf98898afe68 EFLAGS: 00010286 [ 130.163036] RAX: 0000000000000000 RBX: ffff9da06028e598 RCX: 0000000000000000 [ 130.170172] RDX: ffff9daf9de26480 RSI: ffff9daf9de198a0 RDI: ffff9daf9de198a0 [ 130.177316] RBP: ffff9da7cddf3970 R08: 0000000000000000 R09: 00000000ffff7fff [ 130.184459] R10: ffffbf98898afd00 R11: ffffffff9d9e8c28 R12: ffff9da7cddf1970 [ 130.191596] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 130.198739] FS: 00007f646435c740(0000) GS:ffff9daf9de00000(0000) knlGS:0000000000000000 [ 130.206832] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 130.212586] CR2: 00007f6463b214f0 CR3: 00000008ab98c000 CR4: 00000000003506e0 [ 130.219729] Call Trace: [ 130.222192] <TASK> [ 130.224305] dma_chan_put+0x10d/0x110 [ 130.227988] dmaengine_put+0x7a/0xa0 [ 130.231575] __do_sys_delete_module.constprop.0+0x178/0x280 [ 130.237157] ? syscall_trace_enter.constprop.0+0x145/0x1d0 [ 130.242652] do_syscall_64+0x5c/0x90 [ 130.246240] ? exc_page_fault+0x62/0x150 [ 130.250178] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 130.255243] RIP: 0033:0x7f6463a3f5ab [ 130.258830] Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89 01 48 [ 130.277591] RSP: 002b:00007fff22f972c8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [ 130.285164] RAX: ffffffffffffffda RBX: 000055b6786edd40 RCX: 00007f6463a3f5ab [ 130.292303] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055b6786edda8 [ 130.299443] RBP: 000055b6786edd40 R08: 0000000000000000 R09: 0000000000000000 [ 130.306584] R10: 00007f6463b9eac0 R11: 0000000000000206 R12: 000055b6786edda8 [ 130.313731] R13: 0000000000000000 R14: 000055b6786edda8 R15: 00007fff22f995f8 [ 130.320875] </TASK> [ 130.323081] ---[ end trace eff7156d56b5cf25 ]--- cat /sys/class/dma/dma0chan*/in_use would get the wrong result. 2 2 2 Fixes: d2f4f99db3e9 ("dmaengine: Rework dma_chan_get") Signed-off-by: Koba Ko <koba.ko(a)canonical.com> Reviewed-by: Jie Hai <haijie1(a)huawei.com> Test-by: Jie Hai <haijie1(a)huawei.com> Reviewed-by: Jerry Snitselaar <jsnitsel(a)redhat.com> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Tested-by: Joel Savitz <jsavitz(a)redhat.com> Link: https://lore.kernel.org/r/20221201030050.978595-1-koba.ko@canonical.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/dma/dmaengine.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c index f1a441ab395d..450b1c4b2129 100644 --- a/drivers/dma/dmaengine.c +++ b/drivers/dma/dmaengine.c @@ -223,7 +223,8 @@ static int dma_chan_get(struct dma_chan *chan) /* The channel is already in use, update client count */ if (chan->client_count) { __module_get(owner); - goto out; + chan->client_count++; + return 0; } if (!try_module_get(owner)) @@ -236,11 +237,11 @@ static int dma_chan_get(struct dma_chan *chan) goto err_out; } + chan->client_count++; + if (!dma_has_cap(DMA_PRIVATE, chan->device->cap_mask)) balance_ref_count(chan); -out: - chan->client_count++; return 0; err_out: -- 2.34.1

2 1

[PATCH v2 OLK-6.6 0/5] Support the FEAT_HDBSS introduced in Armv9.5
by Zhenyu Ye 02 Apr '25

02 Apr '25

From: eillon <yezhenyu2(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB103D CVE: NA This series of patches add support to the Hardware Dirty state tracking Structure(HDBSS) feature, which is introduced by the ARM architecture in the DDI0601(ID121123) version. The HDBSS feature is an extension to the architecture that enhances tracking translation table descriptors' dirty state, identified as FEAT_HDBSS. The goal of this feature is to reduce the cost of surveying for dirtied granules, with minimal effect on recording when a granule has been dirtied. The purpose of this feature is to make the execution overhead of live migration lower to both the guest and the host, compared to existing approaches (write-protect or search stage 2 tables). After these patches, users(such as qemu) can use the KVM_CAP_ARM_HW_DIRTY_STATE_TRACK ioctl to enable or disable the HDBSS feature before and after the live migration. See patches for details, Thanks. eillon (5): arm64/sysreg: add HDBSS related register information arm64/kvm: support set the DBM attr during memory abort arm64/kvm: using ioctl to enable/disable the HDBSS feature arm64/kvm: support to handle the HDBSSF event arm64/config: add config to control whether enable HDBSS feature arch/arm64/Kconfig | 12 ++++ arch/arm64/configs/openeuler_defconfig | 6 ++ arch/arm64/include/asm/cpufeature.h | 14 ++++ arch/arm64/include/asm/esr.h | 2 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_host.h | 8 +++ arch/arm64/include/asm/kvm_mmu.h | 14 ++++ arch/arm64/include/asm/kvm_pgtable.h | 1 + arch/arm64/include/asm/sysreg.h | 14 ++++ arch/arm64/kvm/arm.c | 88 ++++++++++++++++++++++++++ arch/arm64/kvm/handle_exit.c | 50 +++++++++++++++ arch/arm64/kvm/hyp/pgtable.c | 12 ++++ arch/arm64/kvm/hyp/vhe/switch.c | 3 + arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 4 ++ arch/arm64/kvm/mmu.c | 17 ++++- arch/arm64/kvm/reset.c | 9 +++ arch/arm64/tools/sysreg | 28 ++++++++ include/linux/kvm_host.h | 3 + include/uapi/linux/kvm.h | 2 + tools/include/uapi/linux/kvm.h | 2 + 20 files changed, 289 insertions(+), 1 deletion(-) -- 2.39.3

2 6

[openeuler:openEuler-1.0-LTS 1537/1537] fs/f2fs/gc.o: warning: objtool: f2fs_gc()+0x1f3f: unreachable instruction
by kernel test robot 02 Apr '25

02 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54ad6c4559d2bcbb5d7a03050b2f417a326a1ce2 commit: 8b9ea9010139596e71aae4be5264c3dd901b13cb [1537/1537] pagecache: support percpu refcount to imporve performance config: x86_64-buildonly-randconfig-004-20250331 (https://download.01.org/0day-ci/archive/20250402/202504021020.oxRcBdkg-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021020.oxRcBdkg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021020.oxRcBdkg-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/f2fs/gc.o: warning: objtool: f2fs_gc()+0x1f3f: unreachable instruction -- >> fs/f2fs/file.o: warning: objtool: truncate_partial_data_page()+0x213: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] fix CVE-2025-21712
by Zheng Qixing 02 Apr '25

02 Apr '25

Patch 1 is to fix the UAF issue in CVE-2025-21712. Patch 2 is to fix status collection for external bitmaps. Yu Kuai (1): md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime Zheng Qixing (1): md/md-bitmap: fix stats collection for external bitmaps drivers/md/md-bitmap.c | 3 ++- drivers/md/md.c | 5 +++++ 2 files changed, 7 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[openeuler:OLK-5.10 2836/2836] arch/x86/kernel/fpu/core.c:452:15: warning: no previous prototype for 'get_fpu_registers_pos'
by kernel test robot 02 Apr '25

02 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 411f2e6e24ad11083d85f2ab7324b1f77ad0d371 commit: 0cd6fd52741f659d2a57501ca933ab33040cb911 [2836/2836] mm: Enhanced copy capabilities for Hygon processor config: x86_64-randconfig-101-20250402 (https://download.01.org/0day-ci/archive/20250402/202504020854.WbZXJEHJ-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504020854.WbZXJEHJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504020854.WbZXJEHJ-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/kernel/fpu/core.c:444:14: warning: no previous prototype for 'get_fpustate_free_space' [-Wmissing-prototypes] 444 | unsigned int get_fpustate_free_space(struct fpu *fpu) | ^~~~~~~~~~~~~~~~~~~~~~~ >> arch/x86/kernel/fpu/core.c:452:15: warning: no previous prototype for 'get_fpu_registers_pos' [-Wmissing-prototypes] 452 | unsigned long get_fpu_registers_pos(struct fpu *fpu, unsigned int off) | ^~~~~~~~~~~~~~~~~~~~~ arch/x86/kernel/fpu/core.c:533:6: warning: no previous prototype for 'save_fpregs_to_fpkernelstate' [-Wmissing-prototypes] 533 | void save_fpregs_to_fpkernelstate(struct fpu *kfpu) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/get_fpu_registers_pos +452 arch/x86/kernel/fpu/core.c 451 > 452 unsigned long get_fpu_registers_pos(struct fpu *fpu, unsigned int off) 453 { 454 unsigned long addr = 0; 455 456 if (fpu && (fpu_kernel_nonatomic_xstate_size > off)) { 457 addr = (unsigned long)&fpu->__fpstate.regs.__padding[0]; 458 addr += fpu_kernel_cfg.default_size + off; 459 } 460 return addr; 461 } 462 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1544/1544] mm/share_pool.c:4577:64: error: 'HUGETLB_ALLOC_BUDDY' undeclared
by kernel test robot 02 Apr '25

02 Apr '25

Hi Zhou, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54ad6c4559d2bcbb5d7a03050b2f417a326a1ce2 commit: 0886320b818787f720824229f153f161c89faf70 [1544/1544] mm/sharepool: Charge Buddy hugepage to memcg config: arm64-randconfig-r131-20250401 (https://download.01.org/0day-ci/archive/20250402/202504020332.I3Yx3nDu-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250402/202504020332.I3Yx3nDu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504020332.I3Yx3nDu-lkp@intel.com/ All errors (new ones prefixed by >>): mm/share_pool.c:1086:29: sparse: sparse: incompatible types for operation (<=): mm/share_pool.c:1086:29: sparse: int *num mm/share_pool.c:1086:29: sparse: int mm/share_pool.c:3299:21: sparse: sparse: undefined identifier 'huge_ptep_get' mm/share_pool.c:3299:34: sparse: sparse: invalid initializer mm/share_pool.c:4577:32: sparse: sparse: undefined identifier 'hugetlb_alloc_hugepage' mm/share_pool.c:4585:30: sparse: sparse: undefined identifier 'huge_pte_none' mm/share_pool.c:4606:23: sparse: sparse: undefined identifier 'huge_add_to_page_cache' mm/share_pool.c:4625:14: sparse: sparse: undefined identifier 'huge_pte_none' mm/share_pool.c:4631:9: sparse: sparse: undefined identifier 'set_huge_pte_at' mm/share_pool.c:4633:9: sparse: sparse: undefined identifier 'hugetlb_count_add' mm/share_pool.c:4797:24: sparse: sparse: undefined identifier 'hugetlb_alloc_hugepage' mm/share_pool.c: In function 'mg_sp_group_id_by_pid': mm/share_pool.c:1086:29: warning: ordered comparison of pointer with integer zero [-Wextra] 1086 | if (!spg_ids || num <= 0) | ^~ mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:3299:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 3299 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:3299:21: error: invalid initializer mm/share_pool.c: In function 'sharepool_no_page': mm/share_pool.c:4577:32: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 4577 | page = hugetlb_alloc_hugepage(node_id, HUGETLB_ALLOC_BUDDY); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage >> mm/share_pool.c:4577:64: error: 'HUGETLB_ALLOC_BUDDY' undeclared (first use in this function) 4577 | page = hugetlb_alloc_hugepage(node_id, HUGETLB_ALLOC_BUDDY); | ^~~~~~~~~~~~~~~~~~~ mm/share_pool.c:4577:64: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:4585:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] 4585 | if (!huge_pte_none(huge_ptep_get(ptep))) { | ^~~~~~~~~~~~~ | huge_pte_lock mm/share_pool.c:4606:23: error: implicit declaration of function 'huge_add_to_page_cache'; did you mean 'add_to_page_cache'? [-Werror=implicit-function-declaration] 4606 | err = huge_add_to_page_cache(page, mapping, idx); | ^~~~~~~~~~~~~~~~~~~~~~ | add_to_page_cache mm/share_pool.c:4631:9: error: implicit declaration of function 'set_huge_pte_at'; did you mean 'set_huge_swap_pte_at'? [-Werror=implicit-function-declaration] 4631 | set_huge_pte_at(mm, haddr, ptep, new_pte); | ^~~~~~~~~~~~~~~ | set_huge_swap_pte_at mm/share_pool.c:4633:9: error: implicit declaration of function 'hugetlb_count_add'; did you mean 'hugetlb_count_sub'? [-Werror=implicit-function-declaration] 4633 | hugetlb_count_add(pages_per_huge_page(h), mm); | ^~~~~~~~~~~~~~~~~ | hugetlb_count_sub mm/share_pool.c: In function 'sp_alloc_pages': mm/share_pool.c:4797:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 4797 | page = hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE cc1: some warnings being treated as errors vim +/HUGETLB_ALLOC_BUDDY +4577 mm/share_pool.c 4541 4542 vm_fault_t sharepool_no_page(struct mm_struct *mm, 4543 struct vm_area_struct *vma, 4544 struct address_space *mapping, pgoff_t idx, 4545 unsigned long address, pte_t *ptep, unsigned int flags) 4546 { 4547 struct hstate *h = hstate_vma(vma); 4548 vm_fault_t ret = VM_FAULT_SIGBUS; 4549 unsigned long size; 4550 struct page *page; 4551 pte_t new_pte; 4552 spinlock_t *ptl; 4553 unsigned long haddr = address & huge_page_mask(h); 4554 bool new_page = false; 4555 int err; 4556 int node_id; 4557 struct sp_area *spa; 4558 bool charge_hpage = false; 4559 struct mem_cgroup *memcg; 4560 4561 spa = vma->vm_private_data; 4562 if (!spa) { 4563 pr_err("share pool: vma is invalid, not from sp mmap\n"); 4564 return ret; 4565 } 4566 node_id = spa->node_id; 4567 4568 retry: 4569 page = find_lock_page(mapping, idx); 4570 if (!page) { 4571 size = i_size_read(mapping->host) >> huge_page_shift(h); 4572 if (idx >= size) 4573 goto out; 4574 4575 page = alloc_huge_page(vma, haddr, 0); 4576 if (IS_ERR(page)) { > 4577 page = hugetlb_alloc_hugepage(node_id, HUGETLB_ALLOC_BUDDY); 4578 if (!page) 4579 page = ERR_PTR(-ENOMEM); 4580 else if (!PageKmemcg(page)) 4581 charge_hpage = true; 4582 } 4583 if (IS_ERR(page)) { 4584 ptl = huge_pte_lock(h, mm, ptep); 4585 if (!huge_pte_none(huge_ptep_get(ptep))) { 4586 ret = 0; 4587 spin_unlock(ptl); 4588 goto out; 4589 } 4590 spin_unlock(ptl); 4591 ret = vmf_error(PTR_ERR(page)); 4592 goto out; 4593 } 4594 4595 if (charge_hpage && 4596 mem_cgroup_try_charge_delay(page, vma->vm_mm, GFP_KERNEL, &memcg, true)) { 4597 put_page(page); 4598 ret = vmf_error(-ENOMEM); 4599 goto out; 4600 } 4601 4602 __SetPageUptodate(page); 4603 new_page = true; 4604 4605 /* sharepool pages are all shared */ 4606 err = huge_add_to_page_cache(page, mapping, idx); 4607 if (err) { 4608 if (charge_hpage) { 4609 mem_cgroup_cancel_charge(page, memcg, true); 4610 charge_hpage = false; 4611 } 4612 put_page(page); 4613 if (err == -EEXIST) 4614 goto retry; 4615 goto out; 4616 } 4617 } 4618 4619 ptl = huge_pte_lock(h, mm, ptep); 4620 size = i_size_read(mapping->host) >> huge_page_shift(h); 4621 if (idx >= size) 4622 goto backout; 4623 4624 ret = 0; 4625 if (!huge_pte_none(huge_ptep_get(ptep))) 4626 goto backout; 4627 4628 page_dup_rmap(page, true); 4629 new_pte = make_huge_pte(vma, page, ((vma->vm_flags & VM_WRITE) 4630 && (vma->vm_flags & VM_SHARED))); 4631 set_huge_pte_at(mm, haddr, ptep, new_pte); 4632 4633 hugetlb_count_add(pages_per_huge_page(h), mm); 4634 4635 if (charge_hpage) 4636 mem_cgroup_commit_charge(page, memcg, false, true); 4637 4638 spin_unlock(ptl); 4639 4640 if (new_page) 4641 SetPagePrivate(&page[1]); 4642 4643 unlock_page(page); 4644 out: 4645 return ret; 4646 4647 backout: 4648 spin_unlock(ptl); 4649 unlock_page(page); 4650 if (charge_hpage) 4651 mem_cgroup_cancel_charge(page, memcg, true); 4652 put_page(page); 4653 goto out; 4654 } 4655 EXPORT_SYMBOL(sharepool_no_page); 4656 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1544/1544] mm/share_pool.c:2435:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'?
by kernel test robot 02 Apr '25

02 Apr '25

Hi Weilong, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54ad6c4559d2bcbb5d7a03050b2f417a326a1ce2 commit: 4e851c2bb53e45d92e266c65cf0c203624e74710 [1544/1544] ascend: share_pool: Use sharepool_no_page to alloc hugepage config: arm64-randconfig-r131-20250401 (https://download.01.org/0day-ci/archive/20250402/202504020010.TmMNnpc4-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250402/202504020010.TmMNnpc4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504020010.TmMNnpc4-lkp@intel.com/ All errors (new ones prefixed by >>): mm/share_pool.c:58:5: sparse: sparse: symbol 'enable_mdc_default_group' was not declared. Should it be static? mm/share_pool.c:1685:21: sparse: sparse: undefined identifier 'huge_ptep_get' mm/share_pool.c:1685:34: sparse: sparse: invalid initializer mm/share_pool.c:2435:30: sparse: sparse: undefined identifier 'huge_pte_none' mm/share_pool.c:2448:23: sparse: sparse: undefined identifier 'huge_add_to_page_cache' mm/share_pool.c:2464:14: sparse: sparse: undefined identifier 'huge_pte_none' mm/share_pool.c:2470:9: sparse: sparse: undefined identifier 'set_huge_pte_at' mm/share_pool.c:2472:9: sparse: sparse: undefined identifier 'hugetlb_count_add' mm/share_pool.c:2508:24: sparse: sparse: undefined identifier 'hugetlb_alloc_hugepage' mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:1685:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 1685 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:1685:21: error: invalid initializer mm/share_pool.c: In function 'sharepool_no_page': >> mm/share_pool.c:2435:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] 2435 | if (!huge_pte_none(huge_ptep_get(ptep))) { | ^~~~~~~~~~~~~ | huge_pte_lock >> mm/share_pool.c:2448:23: error: implicit declaration of function 'huge_add_to_page_cache'; did you mean 'add_to_page_cache'? [-Werror=implicit-function-declaration] 2448 | err = huge_add_to_page_cache(page, mapping, idx); | ^~~~~~~~~~~~~~~~~~~~~~ | add_to_page_cache >> mm/share_pool.c:2470:9: error: implicit declaration of function 'set_huge_pte_at'; did you mean 'set_huge_swap_pte_at'? [-Werror=implicit-function-declaration] 2470 | set_huge_pte_at(mm, haddr, ptep, new_pte); | ^~~~~~~~~~~~~~~ | set_huge_swap_pte_at >> mm/share_pool.c:2472:9: error: implicit declaration of function 'hugetlb_count_add'; did you mean 'hugetlb_count_sub'? [-Werror=implicit-function-declaration] 2472 | hugetlb_count_add(pages_per_huge_page(h), mm); | ^~~~~~~~~~~~~~~~~ | hugetlb_count_sub mm/share_pool.c: In function 'sp_alloc_pages': mm/share_pool.c:2508:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 2508 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage mm/share_pool.c:2508:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 2508 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE mm/share_pool.c:2508:61: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:2511:1: warning: control reaches end of non-void function [-Wreturn-type] 2511 | } | ^ cc1: some warnings being treated as errors vim +2435 mm/share_pool.c 2403 2404 vm_fault_t sharepool_no_page(struct mm_struct *mm, 2405 struct vm_area_struct *vma, 2406 struct address_space *mapping, pgoff_t idx, 2407 unsigned long address, pte_t *ptep, unsigned int flags) 2408 { 2409 struct hstate *h = hstate_vma(vma); 2410 vm_fault_t ret = VM_FAULT_SIGBUS; 2411 unsigned long size; 2412 struct page *page; 2413 pte_t new_pte; 2414 spinlock_t *ptl; 2415 unsigned long haddr = address & huge_page_mask(h); 2416 bool new_page = false; 2417 int err; 2418 2419 retry: 2420 page = find_lock_page(mapping, idx); 2421 if (!page) { 2422 size = i_size_read(mapping->host) >> huge_page_shift(h); 2423 if (idx >= size) 2424 goto out; 2425 2426 page = alloc_huge_page(vma, haddr, 0); 2427 if (IS_ERR(page)) { 2428 page = alloc_huge_page_node(hstate_file(vma->vm_file), 2429 numa_mem_id()); 2430 if (!page) 2431 page = ERR_PTR(-ENOMEM); 2432 } 2433 if (IS_ERR(page)) { 2434 ptl = huge_pte_lock(h, mm, ptep); > 2435 if (!huge_pte_none(huge_ptep_get(ptep))) { 2436 ret = 0; 2437 spin_unlock(ptl); 2438 goto out; 2439 } 2440 spin_unlock(ptl); 2441 ret = vmf_error(PTR_ERR(page)); 2442 goto out; 2443 } 2444 __SetPageUptodate(page); 2445 new_page = true; 2446 2447 /* sharepool pages are all shared */ > 2448 err = huge_add_to_page_cache(page, mapping, idx); 2449 if (err) { 2450 put_page(page); 2451 if (err == -EEXIST) 2452 goto retry; 2453 goto out; 2454 } 2455 } 2456 2457 2458 ptl = huge_pte_lock(h, mm, ptep); 2459 size = i_size_read(mapping->host) >> huge_page_shift(h); 2460 if (idx >= size) 2461 goto backout; 2462 2463 ret = 0; 2464 if (!huge_pte_none(huge_ptep_get(ptep))) 2465 goto backout; 2466 2467 page_dup_rmap(page, true); 2468 new_pte = make_huge_pte(vma, page, ((vma->vm_flags & VM_WRITE) 2469 && (vma->vm_flags & VM_SHARED))); > 2470 set_huge_pte_at(mm, haddr, ptep, new_pte); 2471 > 2472 hugetlb_count_add(pages_per_huge_page(h), mm); 2473 2474 spin_unlock(ptl); 2475 2476 if (new_page) { 2477 SetPagePrivate(&page[1]); 2478 } 2479 2480 unlock_page(page); 2481 out: 2482 return ret; 2483 2484 backout: 2485 spin_unlock(ptl); 2486 unlock_page(page); 2487 put_page(page); 2488 goto out; 2489 } 2490 EXPORT_SYMBOL(sharepool_no_page); 2491 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1544/1544] fs/proc/etmem_swap.c:86: undefined reference to `proc_swap_pages_operations'
by kernel test robot 01 Apr '25

01 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54ad6c4559d2bcbb5d7a03050b2f417a326a1ce2 commit: fb3893e8dd62797b531a46bd3c49b2c14dc6eb27 [1544/1544] etmem: add etmem-swap feature config: x86_64-randconfig-r113-20250401 (https://download.01.org/0day-ci/archive/20250401/202504012235.IEGC6Idv-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250401/202504012235.IEGC6Idv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504012235.IEGC6Idv-lkp@intel.com/ All errors (new ones prefixed by >>): ld: warning: arch/x86/lib/csum-copy_64.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: arch/x86/lib/csum-copy_64.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: .tmp_vmlinux1 has a LOAD segment with RWX permissions ld: fs/proc/etmem_scan.o: in function `page_scan_entry': fs/proc/etmem_scan.c:1031: undefined reference to `proc_page_scan_operations' ld: fs/proc/etmem_scan.c:1032: undefined reference to `proc_page_scan_operations' ld: fs/proc/etmem_scan.c:1031: undefined reference to `proc_page_scan_operations' ld: fs/proc/etmem_scan.c:1033: undefined reference to `proc_page_scan_operations' ld: fs/proc/etmem_scan.c:1032: undefined reference to `proc_page_scan_operations' ld: fs/proc/etmem_scan.o:fs/proc/etmem_scan.c:1034: more undefined references to `proc_page_scan_operations' follow ld: fs/proc/etmem_swap.o: in function `swap_pages_entry': >> fs/proc/etmem_swap.c:86: undefined reference to `proc_swap_pages_operations' >> ld: fs/proc/etmem_swap.c:87: undefined reference to `proc_swap_pages_operations' >> ld: fs/proc/etmem_swap.c:86: undefined reference to `proc_swap_pages_operations' ld: fs/proc/etmem_swap.c:88: undefined reference to `proc_swap_pages_operations' >> ld: fs/proc/etmem_swap.c:87: undefined reference to `proc_swap_pages_operations' ld: fs/proc/etmem_swap.o:fs/proc/etmem_swap.c:89: more undefined references to `proc_swap_pages_operations' follow vim +86 fs/proc/etmem_swap.c 83 84 static int swap_pages_entry(void) 85 { > 86 proc_swap_pages_operations.owner = THIS_MODULE; > 87 proc_swap_pages_operations.write = swap_pages_write; 88 proc_swap_pages_operations.open = swap_pages_open; 89 proc_swap_pages_operations.release = swap_pages_release; 90 91 return 0; 92 } 93 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH v1 OLK-6.6 0/5] Support the FEAT_HDBSS introduced in Armv9.5
by Zhenyu Ye 01 Apr '25

01 Apr '25

From: eillon <yezhenyu2(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB103D CVE: NA This series of patches add support to the Hardware Dirty state tracking Structure(HDBSS) feature, which is introduced by the ARM architecture in the DDI0601(ID121123) version. The HDBSS feature is an extension to the architecture that enhances tracking translation table descriptors' dirty state, identified as FEAT_HDBSS. The goal of this feature is to reduce the cost of surveying for dirtied granules, with minimal effect on recording when a granule has been dirtied. The purpose of this feature is to make the execution overhead of live migration lower to both the guest and the host, compared to existing approaches (write-protect or search stage 2 tables). After these patches, users(such as qemu) can use the KVM_CAP_ARM_HW_DIRTY_STATE_TRACK ioctl to enable or disable the HDBSS feature before and after the live migration. See patches for details, Thanks. eillon (5): arm64/sysreg: add HDBSS related register information arm64/kvm: support set the DBM attr during memory abort arm64/kvm: using ioctl to enable/disable the HDBSS feature arm64/kvm: support to handle the HDBSSF event arm64/config: add config to control whether enable HDBSS feature arch/arm64/Kconfig | 12 ++++ arch/arm64/include/asm/cpufeature.h | 14 +++++ arch/arm64/include/asm/esr.h | 2 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_host.h | 8 +++ arch/arm64/include/asm/kvm_mmu.h | 14 +++++ arch/arm64/include/asm/kvm_pgtable.h | 1 + arch/arm64/include/asm/sysreg.h | 14 +++++ arch/arm64/kvm/arm.c | 88 ++++++++++++++++++++++++++++ arch/arm64/kvm/handle_exit.c | 50 ++++++++++++++++ arch/arm64/kvm/hyp/pgtable.c | 12 ++++ arch/arm64/kvm/hyp/vhe/switch.c | 3 + arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 4 ++ arch/arm64/kvm/mmu.c | 17 +++++- arch/arm64/kvm/reset.c | 9 +++ arch/arm64/tools/sysreg | 28 +++++++++ include/linux/kvm_host.h | 3 + include/uapi/linux/kvm.h | 2 + tools/include/uapi/linux/kvm.h | 2 + 19 files changed, 283 insertions(+), 1 deletion(-) -- 2.39.3

2 6

[PATCH OLK-5.10] tracing: Fix use-after-free in print_graph_function_flags during tracer switching
by Tengda Wu 01 Apr '25

01 Apr '25

From: Tengda Wu <wutengda(a)huaweicloud.com> mainline inclusion from mainline-v6.15 commit 7f81f27b1093e4895e87b74143c59c055c3b1906 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBWWU7 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can be reproduced if puting a 'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(), and executing the following script: $ echo function_graph > current_tracer $ cat trace > /dev/null & $ sleep 5 # Ensure the 'cat' reaches the 'mdelay(10)' point $ echo timerlat > current_tracer The root cause lies in the two calls to print_graph_function_flags within print_trace_line during each s_show(): * One through 'iter->trace->print_line()'; * Another through 'event->funcs->trace()', which is hidden in print_trace_fmt() before print_trace_line returns. Tracer switching only updates the former, while the latter continues to use the print_line function of the old tracer, which in the script above is print_graph_function_flags. Moreover, when switching from the 'function_graph' tracer to the 'timerlat' tracer, s_start only calls graph_trace_close of the 'function_graph' tracer to free 'iter->private', but does not set it to NULL. This provides an opportunity for 'event->funcs->trace()' to use an invalid 'iter->private'. To fix this issue, set 'iter->private' to NULL immediately after freeing it in graph_trace_close(), ensuring that an invalid pointer is not passed to other tracers. Additionally, clean up the unnecessary 'iter->private = NULL' during each 'cat trace' when using wakeup and irqsoff tracers. [1] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Zheng Yejian <zhengyejian1(a)huawei.com> Link: https://lore.kernel.org/20250320122137.23635-1-wutengda@huaweicloud.com Fixes: eecb91b9f98d ("tracing: Fix memleak due to race between current_tracer and trace") Closes: https://lore.kernel.org/all/CAMgjq7BW79KDSCyp+tZHjShSzHsScSiJxn5ffskp-QzVM0… Reported-by: Kairui Song <kasong(a)tencent.com> Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_functions_graph.c | 1 + kernel/trace/trace_irqsoff.c | 2 -- kernel/trace/trace_sched_wakeup.c | 2 -- 3 files changed, 1 insertion(+), 4 deletions(-) diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c index 677538c3b9ec..591ca962cc9e 100644 --- a/kernel/trace/trace_functions_graph.c +++ b/kernel/trace/trace_functions_graph.c @@ -1244,6 +1244,7 @@ void graph_trace_close(struct trace_iterator *iter) if (data) { free_percpu(data->cpu_data); kfree(data); + iter->private = NULL; } } diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c index 4a11967c8daa..1dded26115b3 100644 --- a/kernel/trace/trace_irqsoff.c +++ b/kernel/trace/trace_irqsoff.c @@ -231,8 +231,6 @@ static void irqsoff_trace_open(struct trace_iterator *iter) { if (is_graph(iter->tr)) graph_trace_open(iter); - else - iter->private = NULL; } static void irqsoff_trace_close(struct trace_iterator *iter) diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c index c1f582e0e97f..f1c603358ff3 100644 --- a/kernel/trace/trace_sched_wakeup.c +++ b/kernel/trace/trace_sched_wakeup.c @@ -168,8 +168,6 @@ static void wakeup_trace_open(struct trace_iterator *iter) { if (is_graph(iter->tr)) graph_trace_open(iter); - else - iter->private = NULL; } static void wakeup_trace_close(struct trace_iterator *iter) -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1544/1544] block/blk-cgroup.c:478:19: sparse: sparse: incompatible types in comparison expression (different address spaces):
by kernel test robot 01 Apr '25

01 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54ad6c4559d2bcbb5d7a03050b2f417a326a1ce2 commit: 725ee753b5064f03287858bc346d883b8f39319a [1544/1544] bdi: fix use-after-free for the bdi device config: arm64-randconfig-r131-20250401 (https://download.01.org/0day-ci/archive/20250401/202504012009.zDgdqz6W-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250401/202504012009.zDgdqz6W-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504012009.zDgdqz6W-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> block/blk-cgroup.c:478:19: sparse: sparse: incompatible types in comparison expression (different address spaces): block/blk-cgroup.c:478:19: sparse: struct rcu_device [noderef] __rcu * block/blk-cgroup.c:478:19: sparse: struct rcu_device * block/blk-cgroup.c:816:5: sparse: sparse: context imbalance in 'blkg_conf_prep' - wrong count at exit block/blk-cgroup.c:1794: warning: Function parameter or member 'q' not described in 'blkcg_schedule_throttle' block/blk-cgroup.c:1794: warning: Function parameter or member 'use_memdelay' not described in 'blkcg_schedule_throttle' block/blk-cgroup.c:1819: warning: Function parameter or member 'blkg' not described in 'blkcg_add_delay' block/blk-cgroup.c:1819: warning: Function parameter or member 'now' not described in 'blkcg_add_delay' block/blk-cgroup.c:1819: warning: Function parameter or member 'delta' not described in 'blkcg_add_delay' vim +478 block/blk-cgroup.c 472 473 const char *blkg_dev_name(struct blkcg_gq *blkg) 474 { 475 /* some drivers (floppy) instantiate a queue w/o disk registered */ 476 struct rcu_device *rcu_dev; 477 > 478 rcu_dev = rcu_dereference(blkg->q->backing_dev_info->rcu_dev); 479 if (rcu_dev) 480 return dev_name(&rcu_dev->dev); 481 return NULL; 482 } 483 EXPORT_SYMBOL_GPL(blkg_dev_name); 484 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2068/2068] drivers/scsi/linkdata/ps3stor/./linux/ps3_base.c:545:5: error: no previous prototype for 'ps3_pci_init'
by kernel test robot 01 Apr '25

01 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: af5900086b6f0256d261f2c36f7beca966875eb1 commit: 97a2bb6ece556f3882263ee8df2b77f10c511311 [2068/2068] SCSI: Linkdata: Supports Linkdata HBA/RAID Controllers config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20250401/202504012026.kzT6d2HZ-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250401/202504012026.kzT6d2HZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504012026.kzT6d2HZ-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/scsi/linkdata/ps3stor/ps3_ioc_manager.c:307:5: error: no previous prototype for 'ps3_hard_reset_to_ready' [-Werror=missing-prototypes] 307 | int ps3_hard_reset_to_ready(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_scsi_cmd_err.c:876:6: error: no previous prototype for 'ps3_set_task_manager_busy' [-Werror=missing-prototypes] 876 | void ps3_set_task_manager_busy(struct ps3_instance *instance, | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_scsi_cmd_err.c:1110:5: error: no previous prototype for 'ps3_wait_for_outstanding_complete' [-Werror=missing-prototypes] 1110 | int ps3_wait_for_outstanding_complete(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_cmd_complete.c:131:6: error: no previous prototype for 'ps3_trigger_irq_poll' [-Werror=missing-prototypes] 131 | void ps3_trigger_irq_poll(struct ps3_irq *irq) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_cmd_complete.c:243:5: error: no previous prototype for 'ps3_resp_status_convert' [-Werror=missing-prototypes] 243 | int ps3_resp_status_convert(unsigned int resp_status) | ^~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:211:1: error: no previous prototype for 'ps3_qos_cmd_waitq_get' [-Werror=missing-prototypes] 211 | ps3_qos_cmd_waitq_get(struct ps3_qos_tg_context *qos_tg_ctx, | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:335:15: error: no previous prototype for 'ps3_qos_vd_cmdword_get' [-Werror=missing-prototypes] 335 | unsigned char ps3_qos_vd_cmdword_get(struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:351:15: error: no previous prototype for 'ps3_qos_exclusive_cmdword_get' [-Werror=missing-prototypes] 351 | unsigned char ps3_qos_exclusive_cmdword_get(struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:363:15: error: no previous prototype for 'ps3_qos_tg_decision' [-Werror=missing-prototypes] 363 | unsigned char ps3_qos_tg_decision(struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:749:15: error: no previous prototype for 'ps3_qos_all_pd_rc_get' [-Werror=missing-prototypes] 749 | unsigned char ps3_qos_all_pd_rc_get(struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:876:6: error: no previous prototype for 'ps3_pd_quota_waitq_clear_all' [-Werror=missing-prototypes] 876 | void ps3_pd_quota_waitq_clear_all(struct ps3_qos_pd_mgr *qos_pd_mgr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:892:6: error: no previous prototype for 'ps3_pd_quota_waitq_clean' [-Werror=missing-prototypes] 892 | void ps3_pd_quota_waitq_clean(struct ps3_qos_pd_mgr *qos_pd_mgr, | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:1058:6: error: no previous prototype for 'ps3_qos_pd_waitq_ratio_update' [-Werror=missing-prototypes] 1058 | void ps3_qos_pd_waitq_ratio_update(struct ps3_qos_pd_mgr *qos_pd_mgr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2019:15: error: no previous prototype for 'ps3_hba_qos_decision' [-Werror=missing-prototypes] 2019 | unsigned char ps3_hba_qos_decision(struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2040:6: error: no previous prototype for 'ps3_hba_qos_waitq_notify' [-Werror=missing-prototypes] 2040 | void ps3_hba_qos_waitq_notify(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2100:6: error: no previous prototype for 'ps3_cmd_waitq_abort' [-Werror=missing-prototypes] 2100 | bool ps3_cmd_waitq_abort(struct ps3_cmd *aborted_cmd) | ^~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2463:6: error: no previous prototype for 'ps3_hba_qos_waitq_clear_all' [-Werror=missing-prototypes] 2463 | void ps3_hba_qos_waitq_clear_all(struct ps3_instance *instance, int resp_status) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2827:6: error: no previous prototype for 'ps3_hba_qos_vd_init' [-Werror=missing-prototypes] 2827 | void ps3_hba_qos_vd_init(struct ps3_instance *instance, | ^~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2936:6: error: no previous prototype for 'ps3_hba_qos_vd_reset' [-Werror=missing-prototypes] 2936 | void ps3_hba_qos_vd_reset(struct ps3_instance *instance, unsigned short disk_id) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:3023:6: error: no previous prototype for 'ps3_hba_qos_waitq_poll' [-Werror=missing-prototypes] 3023 | void ps3_hba_qos_waitq_poll(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:3279:15: error: no previous prototype for 'ps3_raid_qos_decision' [-Werror=missing-prototypes] 3279 | unsigned char ps3_raid_qos_decision(struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:3334:6: error: no previous prototype for 'ps3_qos_mgrq_resend' [-Werror=missing-prototypes] 3334 | void ps3_qos_mgrq_resend(struct ps3_qos_softq_mgr *softq_mgr) | ^~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:3478:6: error: no previous prototype for 'ps3_raid_qos_waitq_notify' [-Werror=missing-prototypes] 3478 | void ps3_raid_qos_waitq_notify(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:3821:15: error: no previous prototype for 'ps3_raid_qos_waitq_abort' [-Werror=missing-prototypes] 3821 | unsigned char ps3_raid_qos_waitq_abort(struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:4022:6: error: no previous prototype for 'ps3_raid_qos_waitq_clear_all' [-Werror=missing-prototypes] 4022 | void ps3_raid_qos_waitq_clear_all(struct ps3_instance *instance, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/scsi/linkdata/ps3stor/ps3_qos.c:4083:6: error: no previous prototype for 'ps3_raid_qos_waitq_poll' [-Werror=missing-prototypes] 4083 | void ps3_raid_qos_waitq_poll(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_cmd_statistics.c:85:6: error: no previous prototype for 'ps3_cmd_stat_content_clear' [-Werror=missing-prototypes] 85 | void ps3_cmd_stat_content_clear(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_cmd_statistics.c:403:6: error: no previous prototype for 'ps3_io_recv_ok_stat_inc' [-Werror=missing-prototypes] 403 | void ps3_io_recv_ok_stat_inc(struct ps3_instance *ins, | ^~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_ioctl.c:785:6: error: no previous prototype for 'ps3_clean_mgr_cmd' [-Werror=missing-prototypes] 785 | void ps3_clean_mgr_cmd(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:578:5: error: no previous prototype for 'ps3_r1x_hash_bit_check' [-Werror=missing-prototypes] 578 | int ps3_r1x_hash_bit_check(struct ps3_r1x_hash_bit_mgr *hash_mgr, | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:678:6: error: no previous prototype for 'ps3_r1x_conflict_queue_hash_bit_lock' [-Werror=missing-prototypes] 678 | void ps3_r1x_conflict_queue_hash_bit_lock(struct ps3_r1x_lock_mgr *mgr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:730:5: error: no previous prototype for 'ps3_r1x_hash_bit_lock' [-Werror=missing-prototypes] 730 | int ps3_r1x_hash_bit_lock(struct ps3_r1x_lock_mgr *mgr, struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:988:6: error: no previous prototype for 'ps3_r1x_hash_bit_unlock' [-Werror=missing-prototypes] 988 | void ps3_r1x_hash_bit_unlock(struct ps3_r1x_lock_mgr *mgr, struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:1173:5: error: no previous prototype for 'ps3_range_check_and_insert' [-Werror=missing-prototypes] 1173 | int ps3_range_check_and_insert(struct ps3_range_tree_root *range_root, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:1231:5: error: no previous prototype for 'ps3_r1x_hash_range_lock' [-Werror=missing-prototypes] 1231 | int ps3_r1x_hash_range_lock(struct ps3_r1x_lock_mgr *mgr, struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:1312:6: error: no previous prototype for 'ps3_r1x_hash_range_unlock' [-Werror=missing-prototypes] 1312 | void ps3_r1x_hash_range_unlock(struct ps3_r1x_lock_mgr *mgr, | ^~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_debug.c:883:5: error: no previous prototype for 'ps3_dump_dir_length' [-Werror=missing-prototypes] 883 | int ps3_dump_dir_length(const char *buf, size_t count) | ^~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_module_para.c:609:14: error: no previous prototype for 'ps3_cli_ver_query' [-Werror=missing-prototypes] 609 | unsigned int ps3_cli_ver_query(void) | ^~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_rb_tree.c:154:6: error: no previous prototype for 'rbtDelNodeDo' [-Werror=missing-prototypes] 154 | void rbtDelNodeDo(struct Ps3RbRoot *pRoot, struct Ps3RbNode *pNode) | ^~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_device_manager.c:1581:5: error: no previous prototype for 'ps3_scsi_private_init_pd' [-Werror=missing-prototypes] 1581 | int ps3_scsi_private_init_pd(struct scsi_device *sdev) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_device_manager.c:1663:5: error: no previous prototype for 'ps3_scsi_private_init_vd' [-Werror=missing-prototypes] 1663 | int ps3_scsi_private_init_vd(struct scsi_device *sdev) | ^~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors .. vim +/ps3_pci_init +545 drivers/scsi/linkdata/ps3stor/./linux/ps3_base.c 544 > 545 int ps3_pci_init(struct pci_dev *pdev, struct ps3_instance *instance) 546 { 547 resource_size_t base_addr = 0; 548 int ret = PS3_SUCCESS; 549 550 ret = pci_enable_device_mem(pdev); 551 if (ret != PS3_SUCCESS) { 552 LOG_ERROR("hno:%u pci id[%u] pci enable failed\n", 553 PS3_HOST(instance), pdev->dev.id); 554 goto l_pci_enable_device_mem_failed; 555 } 556 557 pci_set_master(pdev); 558 559 instance->reg_bar = PS3_REGISTER_BAR_INDEX; 560 ret = (pci_resource_flags(pdev, instance->reg_bar) & IORESOURCE_MEM); 561 if (!ret) { 562 LOG_ERROR("hno:%u Bar %lu isnot IORESOURCE_MEM\n", 563 PS3_HOST(instance), instance->reg_bar); 564 goto l_bar_check_failed; 565 } 566 ret = pci_request_selected_regions(pdev, 1 << instance->reg_bar, 567 "PS3 pci regions"); 568 if (ret != PS3_SUCCESS) { 569 LOG_ERROR("hno:%u IO memory region busy\n", PS3_HOST(instance)); 570 goto l_pci_request_selected_regions_failed; 571 } 572 #if defined(PS3_SUPPORT_PCIE_REPORT) 573 pci_enable_pcie_error_reporting(pdev); 574 #endif 575 if (instance->ioc_adpter->reg_set) { 576 instance->reg_set = 577 (struct Ps3Fifo __iomem *)instance->ioc_adpter->reg_set( 578 pdev, instance->reg_bar); 579 } else { 580 instance->reg_set = (struct Ps3Fifo __iomem *)ioremap( 581 pci_resource_start(pdev, instance->reg_bar), 582 PS3_REGISTER_SET_SIZE); 583 } 584 if (instance->reg_set == NULL) { 585 LOG_ERROR("hno:%u ioremap failed\n", PS3_HOST(instance)); 586 goto l_ioremap_failed; 587 } else { 588 pci_set_drvdata(pdev, instance); 589 } 590 591 ps3_atomic_set(&instance->watchdog_reg_read_fail_count, 0); 592 LOG_INFO( 593 "reg_bar_idx = %lu, bar_base_paddr = 0x%llx, reg_set_vaddr = 0x%p\n", 594 instance->reg_bar, (unsigned long long)base_addr, instance->reg_set); 595 596 return PS3_SUCCESS; 597 l_ioremap_failed: 598 pci_release_selected_regions(instance->pdev, 1 << instance->reg_bar); 599 #if defined(PS3_SUPPORT_PCIE_REPORT) 600 pci_disable_pcie_error_reporting(pdev); 601 #endif 602 l_pci_request_selected_regions_failed: 603 pci_disable_device(instance->pdev); 604 l_bar_check_failed: 605 l_pci_enable_device_mem_failed: 606 return -PS3_FAILED; 607 } 608 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS V1] drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
by Cheng Yu 01 Apr '25

01 Apr '25

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v4.19.247 commit 6ff986e057bf28e2f7690dad410768b2270f9453 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1K1 CVE: CVE-2022-49491 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f8c242908ad15bbd604d3bcb54961b7d454c43f8 ] It will cause null-ptr-deref in resource_size(), if platform_get_resource() returns NULL, move calling resource_size() after devm_ioremap_resource() that will check 'res' to avoid null-ptr-deref. Fixes: 2048e3286f34 ("drm: rockchip: Add basic drm driver") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Heiko Stuebner <heiko(a)sntech.de> Link: https://patchwork.freedesktop.org/patch/msgid/20220422032854.2995175-1-yang… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c index 873624a11ce8..c0b647435974 100644 --- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c @@ -1595,10 +1595,10 @@ static int vop_bind(struct device *dev, struct device *master, void *data) vop_win_init(vop); res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - vop->len = resource_size(res); vop->regs = devm_ioremap_resource(dev, res); if (IS_ERR(vop->regs)) return PTR_ERR(vop->regs); + vop->len = resource_size(res); vop->regsbak = devm_kzalloc(dev, vop->len, GFP_KERNEL); if (!vop->regsbak) -- 2.25.1

2 1

[PATCH] perf/core: Fix pmus_lock vs. pmus_srcu ordering
by Luo Gengkun 01 Apr '25

01 Apr '25

From: Peter Zijlstra <peterz(a)infradead.org> stable inclusion from stable-v6.6.83 commit 7c823e4c30d6fdc16089e13924260086eaea76be category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBXQNU Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2565e42539b120b81a68a58da961ce5d1e34eac8 ] Commit a63fbed776c7 ("perf/tracing/cpuhotplug: Fix locking order") placed pmus_lock inside pmus_srcu, this makes perf_pmu_unregister() trip lockdep. Move the locking about such that only pmu_idr and pmus (list) are modified while holding pmus_lock. This avoids doing synchronize_srcu() while holding pmus_lock and all is well again. Fixes: a63fbed776c7 ("perf/tracing/cpuhotplug: Fix locking order") Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://lore.kernel.org/r/20241104135517.679556858@infradead.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/events/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 0b9e703641d1..9b5d35c4a3ec 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -11670,6 +11670,8 @@ void perf_pmu_unregister(struct pmu *pmu) { mutex_lock(&pmus_lock); list_del_rcu(&pmu->entry); + idr_remove(&pmu_idr, pmu->type); + mutex_unlock(&pmus_lock); /* * We dereference the pmu list under both SRCU and regular RCU, so @@ -11679,7 +11681,6 @@ void perf_pmu_unregister(struct pmu *pmu) synchronize_rcu(); free_percpu(pmu->pmu_disable_count); - idr_remove(&pmu_idr, pmu->type); if (pmu_bus_running && pmu->dev && pmu->dev != PMU_NULL_DEV) { if (pmu->nr_addr_filters) device_remove_file(pmu->dev, &dev_attr_nr_addr_filters); @@ -11687,7 +11688,6 @@ void perf_pmu_unregister(struct pmu *pmu) put_device(pmu->dev); } free_pmu_context(pmu); - mutex_unlock(&pmus_lock); } EXPORT_SYMBOL_GPL(perf_pmu_unregister); -- 2.34.1

1 0

[PATCH OLK-6.6] ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
by Qi Xi 01 Apr '25

01 Apr '25

From: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> mainline inclusion from mainline-v6.14-rc1 commit 301c26a018acb94dd537a4418cefa0f654500c6f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRED3 CVE: CVE-2024-58077 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 1f5664351410 ("ASoC: lower "no backend DAIs enabled for ... Port" log severity") ignores -EINVAL error message on common soc_pcm_ret(). It is used from many functions, ignoring -EINVAL is over-kill. The reason why -EINVAL was ignored was it really should only be used upon invalid parameters coming from userspace and in that case we don't want to log an error since we do not want to give userspace a way to do a denial-of-service attack on the syslog / diskspace. So don't use soc_pcm_ret() on .prepare callback is better idea. Link: https://lore.kernel.org/r/87v7vptzap.wl-kuninori.morimoto.gx@renesas.com Cc: Hans de Goede <hdegoede(a)redhat.com> Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> Link: https://patch.msgid.link/87bjxg8jju.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- sound/soc/soc-pcm.c | 32 ++++++++++++++++++++++++++++---- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 511446a30c05..60248a6820aa 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -38,7 +38,6 @@ static inline int _soc_pcm_ret(struct snd_soc_pcm_runtime *rtd, switch (ret) { case -EPROBE_DEFER: case -ENOTSUPP: - case -EINVAL: break; default: dev_err(rtd->dev, @@ -902,7 +901,13 @@ static int __soc_pcm_prepare(struct snd_soc_pcm_runtime *rtd, } out: - return soc_pcm_ret(rtd, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } /* PCM prepare ops for non-DPCM streams */ @@ -914,6 +919,13 @@ static int soc_pcm_prepare(struct snd_pcm_substream *substream) snd_soc_dpcm_mutex_lock(rtd); ret = __soc_pcm_prepare(rtd, substream); snd_soc_dpcm_mutex_unlock(rtd); + + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ return ret; } @@ -2461,7 +2473,13 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream) be->dpcm[stream].state = SND_SOC_DPCM_STATE_PREPARE; } - return soc_pcm_ret(fe, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) @@ -2501,7 +2519,13 @@ static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO); snd_soc_dpcm_mutex_unlock(fe); - return soc_pcm_ret(fe, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } static int dpcm_run_update_shutdown(struct snd_soc_pcm_runtime *fe, int stream) -- 2.33.0

2 1

[openeuler:openEuler-1.0-LTS 1544/1544] mm/share_pool.c:2263:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'?
by kernel test robot 01 Apr '25

01 Apr '25

Hi Ding, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54ad6c4559d2bcbb5d7a03050b2f417a326a1ce2 commit: 4a280fac30d27ae2aff096f9f99aa12d50f83426 [1544/1544] ascend: share_pool: support share pool features for ascend platform config: arm64-randconfig-r131-20250401 (https://download.01.org/0day-ci/archive/20250401/202504011702.UDJZ2vxB-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250401/202504011702.UDJZ2vxB-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504011702.UDJZ2vxB-lkp@intel.com/ All errors (new ones prefixed by >>): mm/share_pool.c:55:5: sparse: sparse: symbol 'enable_mdc_default_group' was not declared. Should it be static? mm/share_pool.c:172:6: sparse: sparse: symbol 'host_svm_sp_enable' was not declared. Should it be static? mm/share_pool.c:1542:21: sparse: sparse: undefined identifier 'huge_ptep_get' mm/share_pool.c:1542:34: sparse: sparse: invalid initializer mm/share_pool.c:2263:24: sparse: sparse: undefined identifier 'hugetlb_alloc_hugepage' mm/share_pool.c:236:28: sparse: sparse: context imbalance in 'spa_dec_usage' - unexpected unlock mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:1542:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 1542 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:1542:21: error: invalid initializer mm/share_pool.c: In function 'sp_alloc_pages': >> mm/share_pool.c:2263:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 2263 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage >> mm/share_pool.c:2263:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 2263 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE mm/share_pool.c:2263:61: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:2266:1: warning: control reaches end of non-void function [-Wreturn-type] 2266 | } | ^ cc1: some warnings being treated as errors sparse warnings: (new ones prefixed by >>) mm/share_pool.c:55:5: sparse: sparse: symbol 'enable_mdc_default_group' was not declared. Should it be static? mm/share_pool.c:172:6: sparse: sparse: symbol 'host_svm_sp_enable' was not declared. Should it be static? mm/share_pool.c:1542:21: sparse: sparse: undefined identifier 'huge_ptep_get' >> mm/share_pool.c:1542:34: sparse: sparse: invalid initializer mm/share_pool.c:2263:24: sparse: sparse: undefined identifier 'hugetlb_alloc_hugepage' mm/share_pool.c:236:28: sparse: sparse: context imbalance in 'spa_dec_usage' - unexpected unlock mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:1542:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 1542 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:1542:21: error: invalid initializer mm/share_pool.c: In function 'sp_alloc_pages': mm/share_pool.c:2263:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 2263 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage mm/share_pool.c:2263:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 2263 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE mm/share_pool.c:2263:61: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:2266:1: warning: control reaches end of non-void function [-Wreturn-type] 2266 | } | ^ cc1: some warnings being treated as errors vim +2263 mm/share_pool.c 2257 2258 2259 struct page *sp_alloc_pages(struct vm_struct *area, gfp_t mask, 2260 unsigned int page_order, int node) 2261 { 2262 if (area->flags & VM_HUGE_PAGES) > 2263 return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); 2264 else 2265 return alloc_pages_node(node, mask, page_order); 2266 } 2267 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/5] Some mainline patches merged into drivers/hwmon
by Lifeng Zheng 01 Apr '25

01 Apr '25

From: Xinghai Cen <cenxinghai(a)h-partners.com> Some mainline patches merged into drivers/hwmon Huisong Li (4): hwmon: (acpi_power_meter) Fix fail to load module on platform without _PMD method hwmon: (acpi_power_meter) Fix uninitialized variables hwmon: (acpi_power_meter) Fix update the power trip points on failure hwmon: (acpi_power_meter) Fix the fake power alarm reporting Kazuhiro Abe (1): hwmon: (acpi_power_meter) Fix a check for the return value of read_domain_devices(). drivers/hwmon/acpi_power_meter.c | 46 +++++++++++++++++++++++++------- 1 file changed, 36 insertions(+), 10 deletions(-) -- 2.33.0

2 6

[openeuler:openEuler-1.0-LTS 1544/1544] block/blk-cgroup.c:478:19: sparse: sparse: incompatible types in comparison expression (different address spaces):
by kernel test robot 01 Apr '25

01 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9866a4dd6fd198f871f6c1692e61ce7d10c96836 commit: 725ee753b5064f03287858bc346d883b8f39319a [1544/1544] bdi: fix use-after-free for the bdi device config: arm64-randconfig-r131-20250401 (https://download.01.org/0day-ci/archive/20250401/202504011531.jatxCuOT-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250401/202504011531.jatxCuOT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504011531.jatxCuOT-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> block/blk-cgroup.c:478:19: sparse: sparse: incompatible types in comparison expression (different address spaces): block/blk-cgroup.c:478:19: sparse: struct rcu_device [noderef] __rcu * block/blk-cgroup.c:478:19: sparse: struct rcu_device * block/blk-cgroup.c:816:5: sparse: sparse: context imbalance in 'blkg_conf_prep' - wrong count at exit block/blk-cgroup.c:1794: warning: Function parameter or member 'q' not described in 'blkcg_schedule_throttle' block/blk-cgroup.c:1794: warning: Function parameter or member 'use_memdelay' not described in 'blkcg_schedule_throttle' block/blk-cgroup.c:1819: warning: Function parameter or member 'blkg' not described in 'blkcg_add_delay' block/blk-cgroup.c:1819: warning: Function parameter or member 'now' not described in 'blkcg_add_delay' block/blk-cgroup.c:1819: warning: Function parameter or member 'delta' not described in 'blkcg_add_delay' vim +478 block/blk-cgroup.c 472 473 const char *blkg_dev_name(struct blkcg_gq *blkg) 474 { 475 /* some drivers (floppy) instantiate a queue w/o disk registered */ 476 struct rcu_device *rcu_dev; 477 > 478 rcu_dev = rcu_dereference(blkg->q->backing_dev_info->rcu_dev); 479 if (rcu_dev) 480 return dev_name(&rcu_dev->dev); 481 return NULL; 482 } 483 EXPORT_SYMBOL_GPL(blkg_dev_name); 484 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1544/1544] fs/proc/etmem_scan.c:1031: undefined reference to `proc_page_scan_operations'
by kernel test robot 01 Apr '25

01 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9866a4dd6fd198f871f6c1692e61ce7d10c96836 commit: bad4d8833739acc8eef306e7ad5c7877f9f4f0fb [1544/1544] etmem: add etmem-scan feature config: x86_64-randconfig-r113-20250401 (https://download.01.org/0day-ci/archive/20250401/202504011440.KymThb7O-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250401/202504011440.KymThb7O-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504011440.KymThb7O-lkp@intel.com/ All errors (new ones prefixed by >>): ld: warning: arch/x86/lib/csum-copy_64.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: arch/x86/lib/csum-copy_64.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: .tmp_vmlinux1 has a LOAD segment with RWX permissions ld: fs/proc/etmem_scan.o: in function `page_scan_entry': >> fs/proc/etmem_scan.c:1031: undefined reference to `proc_page_scan_operations' >> ld: fs/proc/etmem_scan.c:1032: undefined reference to `proc_page_scan_operations' >> ld: fs/proc/etmem_scan.c:1031: undefined reference to `proc_page_scan_operations' ld: fs/proc/etmem_scan.c:1033: undefined reference to `proc_page_scan_operations' >> ld: fs/proc/etmem_scan.c:1032: undefined reference to `proc_page_scan_operations' ld: fs/proc/etmem_scan.o:fs/proc/etmem_scan.c:1034: more undefined references to `proc_page_scan_operations' follow vim +1031 fs/proc/etmem_scan.c 1028 1029 static int page_scan_entry(void) 1030 { > 1031 proc_page_scan_operations.owner = THIS_MODULE; > 1032 proc_page_scan_operations.read = page_scan_read; 1033 proc_page_scan_operations.open = page_scan_open; 1034 proc_page_scan_operations.release = page_scan_release; 1035 return 0; 1036 } 1037 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] tty: xilinx_uartps: split sysrq handling
by Yi Yang 01 Apr '25

01 Apr '25

From: Sean Anderson <sean.anderson(a)linux.dev> stable inclusion from stable-v6.6.78 commit 8ea0e7b3d7b8f2f0fc9db491ff22a0abe120801c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLKD CVE: CVE-2025-21820 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b06f388994500297bb91be60ffaf6825ecfd2afe upstream. lockdep detects the following circular locking dependency: CPU 0 CPU 1 ========================== ============================ cdns_uart_isr() printk() uart_port_lock(port) console_lock() cdns_uart_console_write() if (!port->sysrq) uart_port_lock(port) uart_handle_break() port->sysrq = ... uart_handle_sysrq_char() printk() console_lock() The fixed commit attempts to avoid this situation by only taking the port lock in cdns_uart_console_write if port->sysrq unset. However, if (as shown above) cdns_uart_console_write runs before port->sysrq is set, then it will try to take the port lock anyway. This may result in a deadlock. Fix this by splitting sysrq handling into two parts. We use the prepare helper under the port lock and defer handling until we release the lock. Fixes: 74ea66d4ca06 ("tty: xuartps: Improve sysrq handling") Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Cc: stable(a)vger.kernel.org # c980248179d: serial: xilinx_uartps: Use port lock wrappers Acked-by: John Ogness <john.ogness(a)linutronix.de> Link: https://lore.kernel.org/r/20250110213822.2107462-1-sean.anderson@linux.dev Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/serial/xilinx_uartps.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c index 2e5e86a00a77..7f83d2780017 100644 --- a/drivers/tty/serial/xilinx_uartps.c +++ b/drivers/tty/serial/xilinx_uartps.c @@ -268,7 +268,7 @@ static void cdns_uart_handle_rx(void *dev_id, unsigned int isrstatus) continue; } - if (uart_handle_sysrq_char(port, data)) + if (uart_prepare_sysrq_char(port, data)) continue; if (is_rxbs_support) { @@ -369,7 +369,7 @@ static irqreturn_t cdns_uart_isr(int irq, void *dev_id) !(readl(port->membase + CDNS_UART_CR) & CDNS_UART_CR_RX_DIS)) cdns_uart_handle_rx(dev_id, isrstatus); - spin_unlock(&port->lock); + uart_unlock_and_check_sysrq(port); return IRQ_HANDLED; } @@ -1229,10 +1229,8 @@ static void cdns_uart_console_write(struct console *co, const char *s, unsigned int imr, ctrl; int locked = 1; - if (port->sysrq) - locked = 0; - else if (oops_in_progress) - locked = spin_trylock_irqsave(&port->lock, flags); + if (oops_in_progress) + locked = uart_port_trylock_irqsave(port, &flags); else spin_lock_irqsave(&port->lock, flags); -- 2.25.1

2 1

[PATCH OLK-6.6] can: etas_es58x: fix potential NULL pointer dereference on udev->serial
by Yi Yang 01 Apr '25

01 Apr '25

From: Vincent Mailhol <mailhol.vincent(a)wanadoo.fr> stable inclusion from stable-v6.6.79 commit 1590667a60753ee5a54871f2840ceefd4a7831fa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8Y CVE: CVE-2025-21773 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a1ad2109ce41c9e3912dadd07ad8a9c640064ffb upstream. The driver assumed that es58x_dev->udev->serial could never be NULL. While this is true on commercially available devices, an attacker could spoof the device identity providing a NULL USB serial number. That would trigger a NULL pointer dereference. Add a check on es58x_dev->udev->serial before accessing it. Reported-by: yan kang <kangyan91(a)outlook.com> Reported-by: yue sun <samsun1006219(a)gmail.com> Closes: https://lore.kernel.org/linux-can/SY8P300MB0421E0013C0EBD2AA46BA709A1F42@SY… Fixes: 9f06631c3f1f ("can: etas_es58x: export product information through devlink_ops::info_get()") Signed-off-by: Vincent Mailhol <mailhol.vincent(a)wanadoo.fr> Link: https://patch.msgid.link/20250204154859.9797-2-mailhol.vincent@wanadoo.fr Cc: stable(a)vger.kernel.org Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/net/can/usb/etas_es58x/es58x_devlink.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/can/usb/etas_es58x/es58x_devlink.c b/drivers/net/can/usb/etas_es58x/es58x_devlink.c index 635edeb8f68c..e763a9904bed 100644 --- a/drivers/net/can/usb/etas_es58x/es58x_devlink.c +++ b/drivers/net/can/usb/etas_es58x/es58x_devlink.c @@ -248,7 +248,11 @@ static int es58x_devlink_info_get(struct devlink *devlink, return ret; } - return devlink_info_serial_number_put(req, es58x_dev->udev->serial); + if (es58x_dev->udev->serial) + ret = devlink_info_serial_number_put(req, + es58x_dev->udev->serial); + + return ret; } const struct devlink_ops es58x_dl_ops = { -- 2.25.1

2 1

[PATCH] perf/core: Fix pmus_lock vs. pmus_srcu ordering
by Luo Gengkun 01 Apr '25

01 Apr '25

From: Peter Zijlstra <peterz(a)infradead.org> stable inclusion from stable-v6.6.83 commit 7c823e4c30d6fdc16089e13924260086eaea76be category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBXQNU Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2565e42539b120b81a68a58da961ce5d1e34eac8 ] Commit a63fbed776c7 ("perf/tracing/cpuhotplug: Fix locking order") placed pmus_lock inside pmus_srcu, this makes perf_pmu_unregister() trip lockdep. Move the locking about such that only pmu_idr and pmus (list) are modified while holding pmus_lock. This avoids doing synchronize_srcu() while holding pmus_lock and all is well again. Fixes: a63fbed776c7 ("perf/tracing/cpuhotplug: Fix locking order") Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://lore.kernel.org/r/20241104135517.679556858@infradead.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/events/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 0b9e703641d1..9b5d35c4a3ec 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -11670,6 +11670,8 @@ void perf_pmu_unregister(struct pmu *pmu) { mutex_lock(&pmus_lock); list_del_rcu(&pmu->entry); + idr_remove(&pmu_idr, pmu->type); + mutex_unlock(&pmus_lock); /* * We dereference the pmu list under both SRCU and regular RCU, so @@ -11679,7 +11681,6 @@ void perf_pmu_unregister(struct pmu *pmu) synchronize_rcu(); free_percpu(pmu->pmu_disable_count); - idr_remove(&pmu_idr, pmu->type); if (pmu_bus_running && pmu->dev && pmu->dev != PMU_NULL_DEV) { if (pmu->nr_addr_filters) device_remove_file(pmu->dev, &dev_attr_nr_addr_filters); @@ -11687,7 +11688,6 @@ void perf_pmu_unregister(struct pmu *pmu) put_device(pmu->dev); } free_pmu_context(pmu); - mutex_unlock(&pmus_lock); } EXPORT_SYMBOL_GPL(perf_pmu_unregister); -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] ext4: avoid updating the superblock on a r/o mount if not needed
by Yongjian Sun 01 Apr '25

01 Apr '25

From: Theodore Ts'o <tytso(a)mit.edu> mainline inclusion from mainline-v6.5-rc1 commit 2ef6c32a914b85217b44a0a2418e830e520b085e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBXUAV CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ This was noticed by a user who noticied that the mtime of a file backing a loopback device was getting bumped when the loopback device is mounted read/only. Note: This doesn't show up when doing a loopback mount of a file directly, via "mount -o ro /tmp/foo.img /mnt", since the loop device is set read-only when mount automatically creates loop device. However, this is noticeable for a LUKS loop device like this: % cryptsetup luksOpen /tmp/foo.img test % mount -o ro /dev/loop0 /mnt ; umount /mnt or, if LUKS is not in use, if the user manually creates the loop device like this: % losetup /dev/loop0 /tmp/foo.img % mount -o ro /dev/loop0 /mnt ; umount /mnt The modified mtime causes rsync to do a rolling checksum scan of the file on the local and remote side, incrementally increasing the time to rsync the not-modified-but-touched image file. Fixes: eee00237fa5e ("ext4: commit super block if fs record error when journal record without error") Cc: stable(a)kernel.org Link: https://lore.kernel.org/r/ZIauBR7YiV3rVAHL@glitch Reported-by: Sean Greenslade <sean(a)seangreenslade.com> Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/super.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 8761fe5037a6..db47f5acf629 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5160,19 +5160,27 @@ static int ext4_load_journal(struct super_block *sb, err = jbd2_journal_wipe(journal, !really_read_only); if (!err) { char *save = kmalloc(EXT4_S_ERR_LEN, GFP_KERNEL); + __le16 orig_state; + bool changed = false; if (save) memcpy(save, ((char *) es) + EXT4_S_ERR_START, EXT4_S_ERR_LEN); err = jbd2_journal_load(journal); - if (save) + if (save && memcmp(((char *) es) + EXT4_S_ERR_START, + save, EXT4_S_ERR_LEN)) { memcpy(((char *) es) + EXT4_S_ERR_START, save, EXT4_S_ERR_LEN); + changed = true; + } kfree(save); + orig_state = es->s_state; es->s_state |= cpu_to_le16(EXT4_SB(sb)->s_mount_state & EXT4_ERROR_FS); + if (orig_state != es->s_state) + changed = true; /* Write out restored error information to the superblock */ - if (!bdev_read_only(sb->s_bdev)) { + if (changed && !really_read_only) { int err2; err2 = ext4_commit_super(sb); err = err ? : err2; -- 2.39.2

2 1

[PATCH OLK-6.6 0/2] Merge March mainline patch
by Luo Gengkun 01 Apr '25

01 Apr '25

Breno Leitao (1): perf/core: Add RCU read lock protection to perf_iterate_ctx() Peter Zijlstra (1): perf/core: Fix pmus_lock vs. pmus_srcu ordering kernel/events/core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) -- 2.34.1

2 3