- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] mm: do not install PMD mappings when handling a COW fault
by Jinjiang Tu 07 Nov '25

07 Nov '25

From: Zhang Yi <yi.zhang(a)huawei.com> maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID5GEV Reference: https://lore.kernel.org/lkml/20251024102237.3332200-1-yi.zhang@huaweicloud.… ------------------------------------------- When pinning a page with FOLL_LONGTERM in a CoW VMA and a PMD-aligned (2MB on x86) large folio follow_page_mask() failed to obtain a valid anonymous page, resulting in an infinite loop issue. The specific triggering process is as follows: 1. User call mmap with a 2MB size in MAP_PRIVATE mode for a file that has a 2MB large folio installed in the page cache. addr = mmap(NULL, 2*1024*1024, PROT_READ, MAP_PRIVATE, file_fd, 0); 2. The kernel driver pass this mapped address to pin_user_pages_fast() in FOLL_LONGTERM mode. pin_user_pages_fast(addr, 512, FOLL_LONGTERM, pages); -> pin_user_pages_fast() | gup_fast_fallback() | __gup_longterm_locked() | __get_user_pages_locked() | __get_user_pages() | follow_page_mask() | follow_p4d_mask() | follow_pud_mask() | follow_pmd_mask() //pmd_leaf(pmdval) is true because the | //huge PMD is installed. This is normal | //in the first round, but it shouldn't | //happen in the second round. | follow_huge_pmd() //require an anonymous page | return -EMLINK; | faultin_page() | handle_mm_fault() | wp_huge_pmd() //remove PMD and fall back to PTE | handle_pte_fault() | do_pte_missing() | do_fault() | do_read_fault() //FAULT_FLAG_WRITE is not set | finish_fault() | do_set_pmd() //install a huge PMD again, this is wrong!!! | do_wp_page() //create private anonymous pages <- goto retry; Due to an incorrectly large PMD set in do_read_fault(), follow_pmd_mask() always returns -EMLINK, causing an infinite loop. David pointed out that we can preallocate a page table and remap the PMD to be mapped by a PTE table in wp_huge_pmd() in the future. But now we can avoid this issue by not installing PMD mappings when handling a COW and unshare fault in do_set_pmd(). Fixes: a7f226604170 ("mm/gup: trigger FAULT_FLAG_UNSHARE when R/O-pinning a possibly shared anonymous page") Reported-by: Karol Wachowski <karol.wachowski(a)linux.intel.com> Closes: https://lore.kernel.org/linux-ext4/844e5cd4-462e-4b88-b3b5-816465a3b7e3@lin… Suggested-by: David Hildenbrand <david(a)redhat.com> Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> Acked-by: David Hildenbrand <david(a)redhat.com> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/memory.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/mm/memory.c b/mm/memory.c index 4bb3acfc3dd9..ead7b4eb2e40 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -4922,6 +4922,11 @@ vm_fault_t do_set_pmd(struct vm_fault *vmf, struct page *page) if (!thp_vma_suitable_order(vma, haddr, PMD_ORDER)) return ret; + /* We're about to trigger CoW, so never map it through a PMD. */ + if (is_cow_mapping(vma->vm_flags) && + (vmf->flags & (FAULT_FLAG_WRITE|FAULT_FLAG_UNSHARE))) + return ret; + if (folio_order(folio) != HPAGE_PMD_ORDER) return ret; page = &folio->page; -- 2.43.0

2 1

[openeuler:OLK-6.6 3075/3075] drivers/irqchip/irq-gic-v3-its-ub-msi.c:149:12: warning: no previous prototype for function 'its_ub_msi_init'
by kernel test robot 07 Nov '25

07 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 5fbff312766cccbe69b33ef625e720c49e8cc866 commit: 81962d0ecc6e3e039f4df445d38650dd6109bc78 [3075/3075] ub:ubus: Support UBUS Interrupt framework config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20251107/202511070221.5BlpE2PF-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251107/202511070221.5BlpE2PF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511070221.5BlpE2PF-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/irqchip/irq-gic-v3-its-ub-msi.c:149:12: warning: no previous prototype for function 'its_ub_msi_init' [-Wmissing-prototypes] 149 | int __init its_ub_msi_init(void) | ^ drivers/irqchip/irq-gic-v3-its-ub-msi.c:149:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 149 | int __init its_ub_msi_init(void) | ^ | static 1 warning generated. vim +/its_ub_msi_init +149 drivers/irqchip/irq-gic-v3-its-ub-msi.c 148 > 149 int __init its_ub_msi_init(void) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 v4 00/10] Add xcall 2.0 support
by Jinjie Ruan 06 Nov '25

06 Nov '25

Add xcall 2.0 support, which is compatible with xcall1.0, and can be used to dynamic instruction replacement for hardware xcall. Compilation works normally under the switch hardware xcall and xcall2.0. And hardware xcall tested normally using xcall 2.0 or dynamic library method. Changes in v4: - Reuse uprobe_write_opcode() instead of use __replace_page() and copy_to_page(). - Handle error for uprobe_write_opcode(). - Support xcall1.0 before 920G. - Change xcall1.0 bitmap to byte array to save check insns. - Use percpu variable to save check insns for xcall1.0. - A little cleanup. Changes in v3: - Add validity checks during xcall registration to prevent out-of-bounds access and null pointer dereferences. - Extract __replace_page() and copy_to_page() from uprobe, to avoid code duplication. - Replace with new compatible refactored code. - Remove unnecessary member, such as old_name. Changes in v2: - Remove duplicates or unnecessary ~300 LOC, such as link_slot, init_task. - Fix kabi. - Some cleanups. Jinjie Ruan (1): xcall2.0: Support xcall1.0 for hardware xcall Liao Chang (8): xcall2.0: Add userspace proc interface xcall2.0: Add xcall module register interface xcall2.0: Add xcall_area xcall2.0: Hajack syscall with dynamic instruciton replace xcall: Refactor the early exception entry for ACTLR.xcall arm64: Revert the hack to the early entry of SYNC exception xcall: Refactor the early entry for SYNC exception xcall2.0: Add a basic testcase Yuntao Liu (1): xcall2.0: Intruduce xcall2.0 prefetch kernel module arch/arm64/Kconfig.turbo | 13 + arch/arm64/include/asm/exception.h | 4 +- arch/arm64/include/asm/mmu_context.h | 7 - arch/arm64/include/asm/xcall.h | 142 ++++---- arch/arm64/kernel/cpufeature.c | 71 ++-- arch/arm64/kernel/entry-common.c | 65 +++- arch/arm64/kernel/entry.S | 86 +---- arch/arm64/kernel/probes/uprobes.c | 6 + arch/arm64/kernel/process.c | 5 + arch/arm64/kernel/syscall.c | 14 + arch/arm64/kernel/xcall/Makefile | 3 +- arch/arm64/kernel/xcall/core.c | 396 +++++++++++++++++++++ arch/arm64/kernel/xcall/entry.S | 185 ++++++++-- arch/arm64/kernel/xcall/proc.c | 204 +++++++++++ arch/arm64/kernel/xcall/xcall.c | 56 +-- arch/arm64/kvm/sys_regs.c | 1 + drivers/staging/Kconfig | 2 + drivers/staging/Makefile | 1 + drivers/staging/xcall/Kconfig | 19 + drivers/staging/xcall/Makefile | 1 + drivers/staging/xcall/dynamic_xcall_test.c | 97 +++++ drivers/staging/xcall/prefetch.c | 270 ++++++++++++++ fs/proc/proc_xcall.c | 141 ++------ include/linux/mm_types.h | 4 + include/linux/xcall.h | 52 +++ kernel/events/uprobes.c | 19 + kernel/fork.c | 2 + mm/mmap.c | 14 +- 28 files changed, 1512 insertions(+), 368 deletions(-) create mode 100644 arch/arm64/kernel/xcall/core.c create mode 100644 arch/arm64/kernel/xcall/proc.c create mode 100644 drivers/staging/xcall/Kconfig create mode 100644 drivers/staging/xcall/Makefile create mode 100644 drivers/staging/xcall/dynamic_xcall_test.c create mode 100644 drivers/staging/xcall/prefetch.c create mode 100644 include/linux/xcall.h -- 2.34.1

2 11

[PATCH OLK-5.10 v2 0/4] fix CVE-2025-40080
by Zheng Qixing 06 Nov '25

06 Nov '25

Changes in v2: Add pre patch ("bpf, sockmap: Use stricter sk state checks in sk_lookup_assign"). Eric Dumazet (2): net: use sk_is_tcp() in more places nbd: restrict sockets to TCP and UDP John Fastabend (2): bpf, sockmap: Use stricter sk state checks in sk_lookup_assign bpf: syzkaller found null ptr deref in unix_bpf proto add drivers/block/nbd.c | 8 ++++++++ include/linux/skmsg.h | 6 ++++++ include/net/sock.h | 10 ++++++++++ net/core/filter.c | 6 ++++-- net/core/skbuff.c | 6 ++---- net/core/sock.c | 6 ++---- net/core/sock_map.c | 12 ------------ 7 files changed, 32 insertions(+), 22 deletions(-) -- 2.39.2

2 5

[PATCH OLK-6.6 0/2] fs/resctrl: Fix the L3 CMAX conversion mechanism
by Zeng Heng 06 Nov '25

06 Nov '25

Zeng Heng (2): fs/resctrl: Fix the L3 CMAX conversion mechanism arm64/mpam: Add quirk for L3 CPBM validity check drivers/platform/mpam/mpam_resctrl.c | 30 +++++++++++++++++++++++++--- fs/resctrl/ctrlmondata.c | 6 +++++- 2 files changed, 32 insertions(+), 4 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] scsi: sg: prevent the use of size 0 to obtain the page order of sg
by Wang Zhaolong 06 Nov '25

06 Nov '25

From: Edward Adam Davis <eadavis(a)qq.com> maillist inclusion category: other bugzilla: https://gitee.com/openeuler/kernel/issues/ICU6FW CVE: NA Reference: https://lore.kernel.org/all/tencent_E2504B081B1B2582BA8CBBB133399E6E1B08@qq… -------------------------------- syzbot reported a shift-out-of-bounds in sg_build_indirect. [1] The reproducer changes the value of scatter_elem_sz to 0 before executing the open operation to open "/dev/sg0", which leads to [1]. When the value of num is 0, set its value to PAGE_SIZE to avoid this oob. [1] UBSAN: shift-out-of-bounds in drivers/scsi/sg.c:1897:13 shift exponent 64 is too large for 32-bit type 'int' CPU: 1 UID: 0 PID: 5832 Comm: syz-executor361 Not tainted 6.14.0-rc2-syzkaller-00185-g128c8f96eb86 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_shift_out_of_bounds+0x24f/0x3f0 lib/ubsan.c:468 sg_build_indirect.cold+0x1b/0x20 drivers/scsi/sg.c:1897 sg_build_reserve+0xc4/0x180 drivers/scsi/sg.c:2007 sg_add_sfp drivers/scsi/sg.c:2189 [inline] sg_open+0xc37/0x1910 drivers/scsi/sg.c:348 chrdev_open+0x237/0x6a0 fs/char_dev.c:414 do_dentry_open+0x735/0x1c40 fs/open.c:956 vfs_open+0x82/0x3f0 fs/open.c:1086 do_open fs/namei.c:3830 [inline] path_openat+0x1e88/0x2d80 fs/namei.c:3989 do_filp_open+0x20c/0x470 fs/namei.c:4016 do_sys_openat2+0x17a/0x1e0 fs/open.c:1428 do_sys_open fs/open.c:1443 [inline] __do_sys_openat fs/open.c:1459 [inline] __se_sys_openat fs/open.c:1454 [inline] __x64_sys_openat+0x175/0x210 fs/open.c:1454 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Reported-by: syzbot+270f1c719ee7baab9941(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=270f1c719ee7baab9941 Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- drivers/scsi/sg.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index 62574886a911..0f6bfabf5372 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -1888,10 +1888,12 @@ sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size) num = scatter_elem_sz; if (unlikely(num != scatter_elem_sz_prev)) { if (num < PAGE_SIZE) { scatter_elem_sz = PAGE_SIZE; scatter_elem_sz_prev = PAGE_SIZE; + if (!num) + num = PAGE_SIZE; } else scatter_elem_sz_prev = num; } order = get_order(num); -- 2.34.3

2 1

[PATCH OLK-5.10] scsi: sg: prevent the use of size 0 to obtain the page order of sg
by Wang Zhaolong 06 Nov '25

06 Nov '25

From: Edward Adam Davis <eadavis(a)qq.com> maillist inclusion category: other bugzilla: https://gitee.com/openeuler/kernel/issues/ICU6FW CVE: NA Reference: https://lore.kernel.org/all/tencent_E2504B081B1B2582BA8CBBB133399E6E1B08@qq… -------------------------------- syzbot reported a shift-out-of-bounds in sg_build_indirect. [1] The reproducer changes the value of scatter_elem_sz to 0 before executing the open operation to open "/dev/sg0", which leads to [1]. When the value of num is 0, set its value to PAGE_SIZE to avoid this oob. [1] UBSAN: shift-out-of-bounds in drivers/scsi/sg.c:1897:13 shift exponent 64 is too large for 32-bit type 'int' CPU: 1 UID: 0 PID: 5832 Comm: syz-executor361 Not tainted 6.14.0-rc2-syzkaller-00185-g128c8f96eb86 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_shift_out_of_bounds+0x24f/0x3f0 lib/ubsan.c:468 sg_build_indirect.cold+0x1b/0x20 drivers/scsi/sg.c:1897 sg_build_reserve+0xc4/0x180 drivers/scsi/sg.c:2007 sg_add_sfp drivers/scsi/sg.c:2189 [inline] sg_open+0xc37/0x1910 drivers/scsi/sg.c:348 chrdev_open+0x237/0x6a0 fs/char_dev.c:414 do_dentry_open+0x735/0x1c40 fs/open.c:956 vfs_open+0x82/0x3f0 fs/open.c:1086 do_open fs/namei.c:3830 [inline] path_openat+0x1e88/0x2d80 fs/namei.c:3989 do_filp_open+0x20c/0x470 fs/namei.c:4016 do_sys_openat2+0x17a/0x1e0 fs/open.c:1428 do_sys_open fs/open.c:1443 [inline] __do_sys_openat fs/open.c:1459 [inline] __se_sys_openat fs/open.c:1454 [inline] __x64_sys_openat+0x175/0x210 fs/open.c:1454 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Reported-by: syzbot+270f1c719ee7baab9941(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=270f1c719ee7baab9941 Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- drivers/scsi/sg.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index fbd973b184bb..a605425cfab7 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -1909,10 +1909,12 @@ sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size) num = scatter_elem_sz; if (unlikely(num != scatter_elem_sz_prev)) { if (num < PAGE_SIZE) { scatter_elem_sz = PAGE_SIZE; scatter_elem_sz_prev = PAGE_SIZE; + if (!num) + num = PAGE_SIZE; } else scatter_elem_sz_prev = num; } if (sdp->device->host->unchecked_isa_dma) -- 2.34.3

2 1

[openeuler:OLK-6.6 3116/3116] drivers/ub/ubase/ubase_cmd.c:551:26: warning: variable 'desc' set but not used
by kernel test robot 06 Nov '25

06 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b2b8512ca97108929f3aca5405875d91577b8c80 commit: 663203772f391e4bd5f17d800974f694137fc2e9 [3116/3116] !18710 ub: ubase: Add support of base driver for ub network config: arm64-allyesconfig (https://download.01.org/0day-ci/archive/20251106/202511061247.ZMPukP6K-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project d2625a438020ad35330cda29c3def102c1687b1b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251106/202511061247.ZMPukP6K-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511061247.ZMPukP6K-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from <built-in>:3: In file included from include/linux/compiler_types.h:150: include/linux/compiler-clang.h:42:9: warning: '__SANITIZE_THREAD__' macro redefined [-Wmacro-redefined] 42 | #define __SANITIZE_THREAD__ | ^ <built-in>:368:9: note: previous definition is here 368 | #define __SANITIZE_THREAD__ 1 | ^ >> drivers/ub/ubase/ubase_cmd.c:551:26: warning: variable 'desc' set but not used [-Wunused-but-set-variable] 551 | struct ubase_cmdq_desc *desc; | ^ >> drivers/ub/ubase/ubase_cmd.c:576:6: warning: no previous prototype for function 'ubase_cmd_crq_handler' [-Wmissing-prototypes] 576 | void ubase_cmd_crq_handler(struct ubase_dev *udev) | ^ drivers/ub/ubase/ubase_cmd.c:576:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 576 | void ubase_cmd_crq_handler(struct ubase_dev *udev) | ^ | static 3 warnings generated. -- In file included from <built-in>:3: In file included from include/linux/compiler_types.h:150: include/linux/compiler-clang.h:42:9: warning: '__SANITIZE_THREAD__' macro redefined [-Wmacro-redefined] 42 | #define __SANITIZE_THREAD__ | ^ <built-in>:368:9: note: previous definition is here 368 | #define __SANITIZE_THREAD__ 1 | ^ >> drivers/ub/ubase/ubase_eq.c:785:6: warning: no previous prototype for function 'ubase_irq_table_free' [-Wmissing-prototypes] 785 | void ubase_irq_table_free(struct ubase_dev *udev) | ^ drivers/ub/ubase/ubase_eq.c:785:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 785 | void ubase_irq_table_free(struct ubase_dev *udev) | ^ | static 2 warnings generated. -- >> drivers/ub/ubase/ubase_cmd.c:757: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * When uninstalling, cmdq needs to be successfully sended as much as possible, vim +/desc +551 drivers/ub/ubase/ubase_cmd.c 8d68017f37faef Xiongchuan Zhou 2025-09-12 547 8d68017f37faef Xiongchuan Zhou 2025-09-12 548 static void ubase_gen_single_bd_data(struct ubase_dev *udev, void **msg_data) 8d68017f37faef Xiongchuan Zhou 2025-09-12 549 { 8d68017f37faef Xiongchuan Zhou 2025-09-12 550 struct ubase_cmdq_ring *crq = &udev->hw.cmdq.crq; 8d68017f37faef Xiongchuan Zhou 2025-09-12 @551 struct ubase_cmdq_desc *desc; 8d68017f37faef Xiongchuan Zhou 2025-09-12 552 8d68017f37faef Xiongchuan Zhou 2025-09-12 553 desc = &crq->desc[crq->ci]; 8d68017f37faef Xiongchuan Zhou 2025-09-12 554 *msg_data = crq->desc[crq->ci].data; 8d68017f37faef Xiongchuan Zhou 2025-09-12 555 UBASE_MOVE_CRQ_RING_PTR(crq); 8d68017f37faef Xiongchuan Zhou 2025-09-12 556 } 8d68017f37faef Xiongchuan Zhou 2025-09-12 557 8d68017f37faef Xiongchuan Zhou 2025-09-12 558 static void ubase_gen_bd_data(struct ubase_dev *udev, u32 bd_num, 8d68017f37faef Xiongchuan Zhou 2025-09-12 559 void **msg_data, u32 msg_data_len) 8d68017f37faef Xiongchuan Zhou 2025-09-12 560 { 8d68017f37faef Xiongchuan Zhou 2025-09-12 561 if (bd_num == 1) { 8d68017f37faef Xiongchuan Zhou 2025-09-12 562 ubase_gen_single_bd_data(udev, msg_data); 8d68017f37faef Xiongchuan Zhou 2025-09-12 563 return; 8d68017f37faef Xiongchuan Zhou 2025-09-12 564 } 8d68017f37faef Xiongchuan Zhou 2025-09-12 565 8d68017f37faef Xiongchuan Zhou 2025-09-12 566 ubase_gen_multi_bd_data(udev, bd_num, msg_data, msg_data_len); 8d68017f37faef Xiongchuan Zhou 2025-09-12 567 } 8d68017f37faef Xiongchuan Zhou 2025-09-12 568 8d68017f37faef Xiongchuan Zhou 2025-09-12 569 static bool ubase_cmd_crq_empty(struct ubase_dev *udev, struct ubase_hw *hw) 8d68017f37faef Xiongchuan Zhou 2025-09-12 570 { 8d68017f37faef Xiongchuan Zhou 2025-09-12 571 hw->cmdq.crq.pi = ubase_read_dev(hw, UBASE_CRQ_TAIL_REG); 8d68017f37faef Xiongchuan Zhou 2025-09-12 572 8d68017f37faef Xiongchuan Zhou 2025-09-12 573 return hw->cmdq.crq.pi == hw->cmdq.crq.ci; 8d68017f37faef Xiongchuan Zhou 2025-09-12 574 } 8d68017f37faef Xiongchuan Zhou 2025-09-12 575 8d68017f37faef Xiongchuan Zhou 2025-09-12 @576 void ubase_cmd_crq_handler(struct ubase_dev *udev) 8d68017f37faef Xiongchuan Zhou 2025-09-12 577 { 8d68017f37faef Xiongchuan Zhou 2025-09-12 578 struct ubase_cmdq_ring *crq = &udev->hw.cmdq.crq; 8d68017f37faef Xiongchuan Zhou 2025-09-12 579 u32 msg_data_len; 8d68017f37faef Xiongchuan Zhou 2025-09-12 580 void *msg_data; 8d68017f37faef Xiongchuan Zhou 2025-09-12 581 u16 opcode; 8d68017f37faef Xiongchuan Zhou 2025-09-12 582 u8 bd_num; 8d68017f37faef Xiongchuan Zhou 2025-09-12 583 u8 flag; 8d68017f37faef Xiongchuan Zhou 2025-09-12 584 8d68017f37faef Xiongchuan Zhou 2025-09-12 585 while (!ubase_cmd_crq_empty(udev, &udev->hw)) { 8d68017f37faef Xiongchuan Zhou 2025-09-12 586 if (test_bit(UBASE_STATE_CMD_DISABLE, &udev->hw.state)) { 8d68017f37faef Xiongchuan Zhou 2025-09-12 587 ubase_warn(udev, 8d68017f37faef Xiongchuan Zhou 2025-09-12 588 "command queue needs re-initializing.\n"); 8d68017f37faef Xiongchuan Zhou 2025-09-12 589 return; 8d68017f37faef Xiongchuan Zhou 2025-09-12 590 } 8d68017f37faef Xiongchuan Zhou 2025-09-12 591 8d68017f37faef Xiongchuan Zhou 2025-09-12 592 opcode = crq->desc[crq->ci].opcode; 8d68017f37faef Xiongchuan Zhou 2025-09-12 593 bd_num = crq->desc[crq->ci].bd_num; 8d68017f37faef Xiongchuan Zhou 2025-09-12 594 flag = crq->desc[crq->ci].flag; 8d68017f37faef Xiongchuan Zhou 2025-09-12 595 msg_data_len = bd_num * sizeof(struct ubase_cmdq_desc) - 8d68017f37faef Xiongchuan Zhou 2025-09-12 596 UBASE_CMD_HEADER_LENGTH; 8d68017f37faef Xiongchuan Zhou 2025-09-12 597 8d68017f37faef Xiongchuan Zhou 2025-09-12 598 if (unlikely(!bd_num || !(flag & UBASE_CMD_FLAG_OUT))) { 8d68017f37faef Xiongchuan Zhou 2025-09-12 599 ubase_err(udev, 8d68017f37faef Xiongchuan Zhou 2025-09-12 600 "drop invalid crq message, opcode = 0x%x, bd_num = %u, flag = 0x%x.", 8d68017f37faef Xiongchuan Zhou 2025-09-12 601 opcode, bd_num, flag); 8d68017f37faef Xiongchuan Zhou 2025-09-12 602 UBASE_MOVE_CRQ_RING_PTR(crq); 8d68017f37faef Xiongchuan Zhou 2025-09-12 603 continue; 8d68017f37faef Xiongchuan Zhou 2025-09-12 604 } 8d68017f37faef Xiongchuan Zhou 2025-09-12 605 8d68017f37faef Xiongchuan Zhou 2025-09-12 606 ubase_gen_bd_data(udev, bd_num, &msg_data, msg_data_len); 8d68017f37faef Xiongchuan Zhou 2025-09-12 607 8d68017f37faef Xiongchuan Zhou 2025-09-12 608 ubase_cmd_exec_callback(udev, opcode, msg_data, 8d68017f37faef Xiongchuan Zhou 2025-09-12 609 msg_data_len); 8d68017f37faef Xiongchuan Zhou 2025-09-12 610 8d68017f37faef Xiongchuan Zhou 2025-09-12 611 ubase_free_bd_data(msg_data, bd_num); 8d68017f37faef Xiongchuan Zhou 2025-09-12 612 } 8d68017f37faef Xiongchuan Zhou 2025-09-12 613 8d68017f37faef Xiongchuan Zhou 2025-09-12 614 ubase_write_dev(&udev->hw, UBASE_CRQ_HEAD_REG, crq->ci); 8d68017f37faef Xiongchuan Zhou 2025-09-12 615 } 8d68017f37faef Xiongchuan Zhou 2025-09-12 616 :::::: The code at line 551 was first introduced by commit :::::: 8d68017f37faefe5f545dbfd994e1b5141ec06e1 ub: ubase: support for command process :::::: TO: Xiongchuan Zhou <zhouxiongchuan(a)h-partners.com> :::::: CC: Fengyan Mu <mufengyan(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3075/3075] drivers/ub/ubus/cap.c:12:6: warning: no previous prototype for function 'ub_set_cap_bitmap'
by kernel test robot 06 Nov '25

06 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b2b8512ca97108929f3aca5405875d91577b8c80 commit: c21b483526d766fd97d491f3951433f69fde3ac3 [3075/3075] ub:ubus: Add UBUS capability interfaces config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20251106/202511061247.kuPODIrY-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251106/202511061247.kuPODIrY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511061247.kuPODIrY-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/ubus/cap.c:12:6: warning: no previous prototype for function 'ub_set_cap_bitmap' [-Wmissing-prototypes] 12 | void ub_set_cap_bitmap(struct ub_entity *uent) | ^ drivers/ub/ubus/cap.c:12:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 12 | void ub_set_cap_bitmap(struct ub_entity *uent) | ^ | static >> drivers/ub/ubus/cap.c:47:5: warning: no previous prototype for function 'ub_find_capability' [-Wmissing-prototypes] 47 | u32 ub_find_capability(u32 cap) | ^ drivers/ub/ubus/cap.c:47:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 47 | u32 ub_find_capability(u32 cap) | ^ | static >> drivers/ub/ubus/cap.c:52:5: warning: no previous prototype for function 'ub_cap_read_byte' [-Wmissing-prototypes] 52 | int ub_cap_read_byte(struct ub_entity *uent, u32 cap, u32 off, u8 *val) | ^ drivers/ub/ubus/cap.c:52:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 52 | int ub_cap_read_byte(struct ub_entity *uent, u32 cap, u32 off, u8 *val) | ^ | static >> drivers/ub/ubus/cap.c:70:5: warning: no previous prototype for function 'ub_cap_read_word' [-Wmissing-prototypes] 70 | int ub_cap_read_word(struct ub_entity *uent, u32 cap, u32 off, u16 *val) | ^ drivers/ub/ubus/cap.c:70:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 70 | int ub_cap_read_word(struct ub_entity *uent, u32 cap, u32 off, u16 *val) | ^ | static >> drivers/ub/ubus/cap.c:88:5: warning: no previous prototype for function 'ub_cap_read_dword' [-Wmissing-prototypes] 88 | int ub_cap_read_dword(struct ub_entity *uent, u32 cap, u32 off, u32 *val) | ^ drivers/ub/ubus/cap.c:88:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 88 | int ub_cap_read_dword(struct ub_entity *uent, u32 cap, u32 off, u32 *val) | ^ | static >> drivers/ub/ubus/cap.c:106:5: warning: no previous prototype for function 'ub_cap_write_byte' [-Wmissing-prototypes] 106 | int ub_cap_write_byte(struct ub_entity *uent, u32 cap, u32 off, u8 val) | ^ drivers/ub/ubus/cap.c:106:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 106 | int ub_cap_write_byte(struct ub_entity *uent, u32 cap, u32 off, u8 val) | ^ | static >> drivers/ub/ubus/cap.c:117:5: warning: no previous prototype for function 'ub_cap_write_word' [-Wmissing-prototypes] 117 | int ub_cap_write_word(struct ub_entity *uent, u32 cap, u32 off, u16 val) | ^ drivers/ub/ubus/cap.c:117:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 117 | int ub_cap_write_word(struct ub_entity *uent, u32 cap, u32 off, u16 val) | ^ | static >> drivers/ub/ubus/cap.c:128:5: warning: no previous prototype for function 'ub_cap_write_dword' [-Wmissing-prototypes] 128 | int ub_cap_write_dword(struct ub_entity *uent, u32 cap, u32 off, u32 val) | ^ drivers/ub/ubus/cap.c:128:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 128 | int ub_cap_write_dword(struct ub_entity *uent, u32 cap, u32 off, u32 val) | ^ | static >> drivers/ub/ubus/cap.c:139:5: warning: no previous prototype for function 'ub_cap_clear_and_set_word' [-Wmissing-prototypes] 139 | int ub_cap_clear_and_set_word(struct ub_entity *dev, u32 cap, u32 off, | ^ drivers/ub/ubus/cap.c:139:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 139 | int ub_cap_clear_and_set_word(struct ub_entity *dev, u32 cap, u32 off, | ^ | static >> drivers/ub/ubus/cap.c:155:5: warning: no previous prototype for function 'ub_cap_clear_and_set_dword' [-Wmissing-prototypes] 155 | int ub_cap_clear_and_set_dword(struct ub_entity *dev, u32 cap, u32 off, | ^ drivers/ub/ubus/cap.c:155:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 155 | int ub_cap_clear_and_set_dword(struct ub_entity *dev, u32 cap, u32 off, | ^ | static >> drivers/ub/ubus/cap.c:224:6: warning: no previous prototype for function 'ub_init_capabilities' [-Wmissing-prototypes] 224 | void ub_init_capabilities(struct ub_entity *uent) | ^ drivers/ub/ubus/cap.c:224:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 224 | void ub_init_capabilities(struct ub_entity *uent) | ^ | static >> drivers/ub/ubus/cap.c:238:6: warning: no previous prototype for function 'ub_uninit_capabilities' [-Wmissing-prototypes] 238 | void ub_uninit_capabilities(struct ub_entity *uent) | ^ drivers/ub/ubus/cap.c:238:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 238 | void ub_uninit_capabilities(struct ub_entity *uent) | ^ | static drivers/ub/ubus/cap.c:171:19: warning: unused function 'ub_cap_set_word' [-Wunused-function] 171 | static inline int ub_cap_set_word(struct ub_entity *dev, u32 cap, u32 off, | ^~~~~~~~~~~~~~~ drivers/ub/ubus/cap.c:177:19: warning: unused function 'ub_cap_set_dword' [-Wunused-function] 177 | static inline int ub_cap_set_dword(struct ub_entity *dev, u32 cap, u32 off, | ^~~~~~~~~~~~~~~~ drivers/ub/ubus/cap.c:183:19: warning: unused function 'ub_cap_clear_word' [-Wunused-function] 183 | static inline int ub_cap_clear_word(struct ub_entity *dev, u32 cap, u32 off, | ^~~~~~~~~~~~~~~~~ drivers/ub/ubus/cap.c:189:19: warning: unused function 'ub_cap_clear_dword' [-Wunused-function] 189 | static inline int ub_cap_clear_dword(struct ub_entity *dev, u32 cap, u32 off, | ^~~~~~~~~~~~~~~~~~ 16 warnings generated. vim +/ub_set_cap_bitmap +12 drivers/ub/ubus/cap.c 11 > 12 void ub_set_cap_bitmap(struct ub_entity *uent) 13 { 14 int ret; 15 u32 i; 16 17 for (i = 0; i < SZ_8; i++) { 18 ret = ub_cfg_read_dword(uent, UB_CFG1_CAP_BITMAP + (i << SZ_2), 19 &uent->cfg1_bitmap[i]); 20 if (ret) 21 ub_err(uent, "Read cfg1 cap bitmap failed, ret=%d\n", 22 ret); 23 } 24 25 if (is_p_device(uent)) 26 return; 27 28 for (i = 0; i < SZ_8; i++) { 29 ret = ub_cfg_read_dword(uent, UB_CFG0_CAP_BITMAP + (i << SZ_2), 30 &uent->cfg0_bitmap[i]); 31 if (ret) 32 ub_err(uent, "Read cfg0 cap bitmap failed, ret=%d\n", 33 ret); 34 } 35 } 36 37 /* Check whether the capbility register is implemented. */ 38 static bool ub_cap_reg_implemented(struct ub_entity *uent, u32 cap) 39 { 40 u32 i = (cap & 0xFF) / SZ_32; 41 u32 val = (cap >> SZ_8) ? uent->cfg1_bitmap[i] : uent->cfg0_bitmap[i]; 42 43 return val & BIT((cap & 0xFF) % SZ_32); 44 } 45 46 /* find the start address of capability */ > 47 u32 ub_find_capability(u32 cap) 48 { 49 return (cap << BITS_PER_BYTE) << SZ_2; 50 } 51 > 52 int ub_cap_read_byte(struct ub_entity *uent, u32 cap, u32 off, u8 *val) 53 { 54 int ret; 55 56 *val = 0; 57 if (off >= SZ_1K) 58 return -EFAULT; 59 60 if (!ub_cap_reg_implemented(uent, cap)) 61 return -ENXIO; 62 63 ret = ub_cfg_read_byte(uent, ub_find_capability(cap) + off, val); 64 if (ret) 65 *val = 0; 66 67 return ret; 68 } 69 > 70 int ub_cap_read_word(struct ub_entity *uent, u32 cap, u32 off, u16 *val) 71 { 72 int ret; 73 74 *val = 0; 75 if (off & 1 || off >= SZ_1K) 76 return -EFAULT; 77 78 if (!ub_cap_reg_implemented(uent, cap)) 79 return -ENXIO; 80 81 ret = ub_cfg_read_word(uent, ub_find_capability(cap) + off, val); 82 if (ret) 83 *val = 0; 84 85 return ret; 86 } 87 > 88 int ub_cap_read_dword(struct ub_entity *uent, u32 cap, u32 off, u32 *val) 89 { 90 int ret; 91 92 *val = 0; 93 if (off & DW_CHECK || off >= SZ_1K) 94 return -EFAULT; 95 96 if (!ub_cap_reg_implemented(uent, cap)) 97 return -ENXIO; 98 99 ret = ub_cfg_read_dword(uent, ub_find_capability(cap) + off, val); 100 if (ret) 101 *val = 0; 102 103 return ret; 104 } 105 > 106 int ub_cap_write_byte(struct ub_entity *uent, u32 cap, u32 off, u8 val) 107 { 108 if (off >= SZ_1K) 109 return -EFAULT; 110 111 if (!ub_cap_reg_implemented(uent, cap)) 112 return -ENXIO; 113 114 return ub_cfg_write_byte(uent, ub_find_capability(cap) + off, val); 115 } 116 > 117 int ub_cap_write_word(struct ub_entity *uent, u32 cap, u32 off, u16 val) 118 { 119 if (off & 1 || off >= SZ_1K) 120 return -EFAULT; 121 122 if (!ub_cap_reg_implemented(uent, cap)) 123 return -ENXIO; 124 125 return ub_cfg_write_word(uent, ub_find_capability(cap) + off, val); 126 } 127 > 128 int ub_cap_write_dword(struct ub_entity *uent, u32 cap, u32 off, u32 val) 129 { 130 if (off & DW_CHECK || off >= SZ_1K) 131 return -EFAULT; 132 133 if (!ub_cap_reg_implemented(uent, cap)) 134 return -ENXIO; 135 136 return ub_cfg_write_dword(uent, ub_find_capability(cap) + off, val); 137 } 138 > 139 int ub_cap_clear_and_set_word(struct ub_entity *dev, u32 cap, u32 off, 140 u16 clear, u16 set) 141 { 142 u16 val; 143 int ret; 144 145 ret = ub_cap_read_word(dev, cap, off, &val); 146 if (!ret) { 147 val &= ~clear; 148 val |= set; 149 ret = ub_cap_write_word(dev, cap, off, val); 150 } 151 152 return ret; 153 } 154 > 155 int ub_cap_clear_and_set_dword(struct ub_entity *dev, u32 cap, u32 off, 156 u32 clear, u32 set) 157 { 158 u32 val; 159 int ret; 160 161 ret = ub_cap_read_dword(dev, cap, off, &val); 162 if (!ret) { 163 val &= ~clear; 164 val |= set; 165 ret = ub_cap_write_dword(dev, cap, off, val); 166 } 167 168 return ret; 169 } 170 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 v2 00/18] Backport some memory policy feature and bugfix from mainline
by Ze Zuo 06 Nov '25

06 Nov '25

Implementation of weight-based L/R memory interleaving allocation v2: - add Signed-off-by for patch one. Gregory Price (3): mm/mempolicy: refactor a read-once mechanism into a function for re-use mm/mempolicy: introduce MPOL_WEIGHTED_INTERLEAVE for weighted interleaving mm/mempolicy: protect task interleave functions with tsk->mems_allowed_seq Honggyu Kim (1): mm/mempolicy: count MPOL_WEIGHTED_INTERLEAVE to "interleave_hit" Hugh Dickins (10): mempolicy: fix migrate_pages(2) syscall return nr_failed mempolicy trivia: delete those ancient pr_debug()s mempolicy trivia: slightly more consistent naming mempolicy trivia: use pgoff_t in shared mempolicy tree mempolicy: mpol_shared_policy_init() without pseudo-vma mempolicy: remove confusing MPOL_MF_LAZY dead code kernfs: drop shared NUMA mempolicy hooks mempolicy: alloc_pages_mpol() for NUMA policy without vma mempolicy: mmap_lock is not needed while migrating folios mempolicy: migration attempt to match interleave nodes Lukas Bulwahn (1): mempolicy: clean up minor dead code in queue_pages_test_walk() Rakie Kim (2): mm/mempolicy: implement the sysfs-based weighted_interleave interface mm/mempolicy: fix memory leaks in weighted interleave sysfs Ze Zuo (1): Revert "mm/mempolicy.c: fix the out-of-bounds access issue in mpol_parse_str" .../ABI/testing/sysfs-kernel-mm-mempolicy | 4 + ...fs-kernel-mm-mempolicy-weighted-interleave | 25 + .../admin-guide/mm/numa_memory_policy.rst | 9 + fs/kernfs/file.c | 49 - fs/proc/task_mmu.c | 5 +- include/linux/gfp.h | 10 +- include/linux/hugetlb.h | 9 - include/linux/mempolicy.h | 51 +- include/uapi/linux/mempolicy.h | 2 +- ipc/shm.c | 19 +- mm/hugetlb.c | 38 +- mm/mempolicy.c | 1505 ++++++++++------- mm/shmem.c | 77 +- mm/swap.h | 7 +- mm/swap_state.c | 81 +- mm/zswap.c | 7 +- 16 files changed, 1143 insertions(+), 755 deletions(-) create mode 100644 Documentation/ABI/testing/sysfs-kernel-mm-mempolicy create mode 100644 Documentation/ABI/testing/sysfs-kernel-mm-mempolicy-weighted-interleave -- 2.25.1

2 19