- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1942/1942] drivers/scsi/huawei/hifc/hifc_hba.c:762:37: warning: default initialization of an object of type 'struct unf_low_level_function_op_s' with const member leaves the object uninitialized
by kernel test robot 25 Dec '25

25 Dec '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4e9c55920995d70b3e88b60c69753df54b03fdf4 commit: 7fc993d55d1b54ae40e29dfac825a18d04d644c6 [1942/1942] scsi/hifc: add hifc driver FC service module config: x86_64-randconfig-071-20251213 (https://download.01.org/0day-ci/archive/20251225/202512251713.lhlEoibn-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 1335a05ab8bc8339ce24be3a9da89d8c3f4e0571) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251225/202512251713.lhlEoibn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512251713.lhlEoibn-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from <built-in>:2: In file included from include/linux/compiler_types.h:59: include/linux/compiler-clang.h:20:9: warning: '__SANITIZE_ADDRESS__' macro redefined [-Wmacro-redefined] 20 | #define __SANITIZE_ADDRESS__ | ^ <built-in>:353:9: note: previous definition is here 353 | #define __SANITIZE_ADDRESS__ 1 | ^ drivers/scsi/huawei/hifc/hifc_hba.c:343:6: warning: no previous prototype for function 'hifc_flush_root_ctx' [-Wmissing-prototypes] 343 | void hifc_flush_root_ctx(struct hifc_hba_s *v_hba) | ^ drivers/scsi/huawei/hifc/hifc_hba.c:343:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 343 | void hifc_flush_root_ctx(struct hifc_hba_s *v_hba) | ^ | static drivers/scsi/huawei/hifc/hifc_hba.c:406:6: warning: no previous prototype for function 'hifc_flush_srq_ctx' [-Wmissing-prototypes] 406 | void hifc_flush_srq_ctx(struct hifc_hba_s *v_hba) | ^ drivers/scsi/huawei/hifc/hifc_hba.c:406:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 406 | void hifc_flush_srq_ctx(struct hifc_hba_s *v_hba) | ^ | static >> drivers/scsi/huawei/hifc/hifc_hba.c:762:37: warning: default initialization of an object of type 'struct unf_low_level_function_op_s' with const member leaves the object uninitialized [-Wdefault-const-init-field-unsafe] 762 | struct unf_low_level_function_op_s low_level_fun; | ^ drivers/scsi/huawei/hifc/unf_common.h:1779:21: note: member 'xchg_mgr_type' declared 'const' here 1779 | const unsigned int xchg_mgr_type; | ^ drivers/scsi/huawei/hifc/hifc_hba.c:786:6: warning: no previous prototype for function 'hifc_release_probe_index' [-Wmissing-prototypes] 786 | void hifc_release_probe_index(unsigned int probe_index) | ^ drivers/scsi/huawei/hifc/hifc_hba.c:786:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 786 | void hifc_release_probe_index(unsigned int probe_index) | ^ | static drivers/scsi/huawei/hifc/hifc_hba.c:1016:14: warning: no previous prototype for function 'hifc_assign_probe_index' [-Wmissing-prototypes] 1016 | unsigned int hifc_assign_probe_index(unsigned int *v_probe_index) | ^ drivers/scsi/huawei/hifc/hifc_hba.c:1016:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1016 | unsigned int hifc_assign_probe_index(unsigned int *v_probe_index) | ^ | static drivers/scsi/huawei/hifc/hifc_hba.c:1038:5: warning: no previous prototype for function 'hifc_probe' [-Wmissing-prototypes] 1038 | int hifc_probe(struct hifc_lld_dev *lld_dev, void **uld_dev, char *uld_dev_name) | ^ drivers/scsi/huawei/hifc/hifc_hba.c:1038:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1038 | int hifc_probe(struct hifc_lld_dev *lld_dev, void **uld_dev, char *uld_dev_name) | ^ | static drivers/scsi/huawei/hifc/hifc_hba.c:1497:6: warning: no previous prototype for function 'hifc_remove' [-Wmissing-prototypes] 1497 | void hifc_remove(struct hifc_lld_dev *lld_dev, void *uld_dev) | ^ drivers/scsi/huawei/hifc/hifc_hba.c:1497:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1497 | void hifc_remove(struct hifc_lld_dev *lld_dev, void *uld_dev) | ^ | static drivers/scsi/huawei/hifc/hifc_hba.c:1570:6: warning: no previous prototype for function 'hifc_event' [-Wmissing-prototypes] 1570 | void hifc_event(struct hifc_lld_dev *lld_dev, void *uld_dev, | ^ drivers/scsi/huawei/hifc/hifc_hba.c:1570:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1570 | void hifc_event(struct hifc_lld_dev *lld_dev, void *uld_dev, | ^ | static 9 warnings generated. vim +762 drivers/scsi/huawei/hifc/hifc_hba.c 31015b9ad992c4 Chenguangli 2020-11-16 758 31015b9ad992c4 Chenguangli 2020-11-16 759 static unsigned int hifc_create_lport(struct hifc_hba_s *v_hba) 31015b9ad992c4 Chenguangli 2020-11-16 760 { 31015b9ad992c4 Chenguangli 2020-11-16 761 void *lport = NULL; 31015b9ad992c4 Chenguangli 2020-11-16 @762 struct unf_low_level_function_op_s low_level_fun; 31015b9ad992c4 Chenguangli 2020-11-16 763 31015b9ad992c4 Chenguangli 2020-11-16 764 HIFC_CHECK(INVALID_VALUE32, v_hba, return UNF_RETURN_ERROR); 31015b9ad992c4 Chenguangli 2020-11-16 765 hifc_fun_op.dev = v_hba->pci_dev; 31015b9ad992c4 Chenguangli 2020-11-16 766 memcpy(&low_level_fun, &hifc_fun_op, 31015b9ad992c4 Chenguangli 2020-11-16 767 sizeof(struct unf_low_level_function_op_s)); 31015b9ad992c4 Chenguangli 2020-11-16 768 31015b9ad992c4 Chenguangli 2020-11-16 769 /* Update port configuration table */ 31015b9ad992c4 Chenguangli 2020-11-16 770 hifc_update_lport_config(v_hba, &low_level_fun); 31015b9ad992c4 Chenguangli 2020-11-16 771 31015b9ad992c4 Chenguangli 2020-11-16 772 /* Apply for lport resources */ 31015b9ad992c4 Chenguangli 2020-11-16 773 UNF_LOWLEVEL_ALLOC_LPORT(lport, v_hba, &low_level_fun); 31015b9ad992c4 Chenguangli 2020-11-16 774 if (!lport) { 31015b9ad992c4 Chenguangli 2020-11-16 775 HIFC_TRACE(UNF_EVTLOG_DRIVER_ERR, UNF_LOG_REG_ATT, UNF_ERR, 31015b9ad992c4 Chenguangli 2020-11-16 776 "[err]Port(0x%x) can't allocate Lport", 31015b9ad992c4 Chenguangli 2020-11-16 777 v_hba->port_cfg.port_id); 31015b9ad992c4 Chenguangli 2020-11-16 778 31015b9ad992c4 Chenguangli 2020-11-16 779 return UNF_RETURN_ERROR; 31015b9ad992c4 Chenguangli 2020-11-16 780 } 31015b9ad992c4 Chenguangli 2020-11-16 781 v_hba->lport = lport; 31015b9ad992c4 Chenguangli 2020-11-16 782 31015b9ad992c4 Chenguangli 2020-11-16 783 return RETURN_OK; 31015b9ad992c4 Chenguangli 2020-11-16 784 } 31015b9ad992c4 Chenguangli 2020-11-16 785 :::::: The code at line 762 was first introduced by commit :::::: 31015b9ad992c40fc0db81055932bbabe74f2533 scsi/hifc: add hifc driver port resource module :::::: TO: Chenguangli <chenguangli2(a)huawei.com> :::::: CC: Yang Yingliang <yangyingliang(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 10/10] mm/share_pool.c:68: warning: expecting prototype for mp_sp_group_id_by_pid(). Prototype was for mg_sp_group_id_by_pid() instead
by kernel test robot 25 Dec '25

25 Dec '25

Hi Wang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 610575a82bdf3c3be06ce9559609d5bfa65472e8 commit: fb31808921b891789a2f6cbfc7e277fd0918144a [10/10] mm/sharepool: Add base framework for share_pool config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20251225/202512251747.a9usmhG0-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251225/202512251747.a9usmhG0-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512251747.a9usmhG0-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/share_pool.c:68: warning: expecting prototype for mp_sp_group_id_by_pid(). Prototype was for mg_sp_group_id_by_pid() instead >> mm/share_pool.c:176: warning: duplicate section name 'Return' >> mm/share_pool.c:211: warning: Function parameter or member 'spg_id' not described in 'mg_sp_unshare' vim +68 mm/share_pool.c 54 55 /** 56 * mp_sp_group_id_by_pid() - Get the sp_group ID array of a process. 57 * @tgid: tgid of target process. 58 * @spg_ids: point to an array to save the group ids the process belongs to 59 * @num: input the spg_ids array size; output the spg number of the process 60 * 61 * Return: 62 * >0 - the sp_group ID. 63 * -ENODEV - target process doesn't belong to any sp_group. 64 * -EINVAL - spg_ids or num is NULL. 65 * -E2BIG - the num of groups process belongs to is larger than *num 66 */ 67 int mg_sp_group_id_by_pid(int tgid, int *spg_ids, int *num) > 68 { 69 return -EOPNOTSUPP; 70 } 71 EXPORT_SYMBOL_GPL(mg_sp_group_id_by_pid); 72 73 /** 74 * mg_sp_group_add_task() - Add a process to an share group (sp_group). 75 * @tgid: the tgid of the task to be added. 76 * @prot: the prot of task for this spg. 77 * @spg_id: the ID of the sp_group. 78 * 79 * Return: A postive group number for success, -errno on failure. 80 * 81 * Valid @spg_id: 82 * [SPG_ID_MIN, SPG_ID_MAX]: 83 * the task would be added to the group with @spg_id, if the 84 * group doesn't exist, just create it. 85 * [SPG_ID_AUTO_MIN, SPG_ID_AUTO_MAX]: 86 * the task would be added to the group with @spg_id, if it 87 * doesn't exist ,return failed. 88 * SPG_ID_AUTO: 89 * the task would be added into a new group with a new id in range 90 * [SPG_ID_AUTO_MIN, SPG_ID_AUTO_MAX]. 91 * 92 * This function can be taken into four parts: 93 * 1. Check and initlize the task specified by @tgid properly. 94 * 2. Create or get the spg specified by @spg_id. 95 * 3. Check the spg and task together and link the task into the spg if 96 * everything looks good. 97 * 4. Map the existing sp_area from the spg into the new task. 98 */ 99 int mg_sp_group_add_task(int tgid, unsigned long prot, int spg_id) 100 { 101 return -EOPNOTSUPP; 102 } 103 EXPORT_SYMBOL_GPL(mg_sp_group_add_task); 104 105 int mg_sp_id_of_current(void) 106 { 107 return -EOPNOTSUPP; 108 } 109 EXPORT_SYMBOL_GPL(mg_sp_id_of_current); 110 111 /** 112 * mg_sp_free() - Free the memory allocated by mg_sp_alloc() or 113 * mg_sp_alloc_nodemask(). 114 * 115 * @addr: the starting VA of the memory. 116 * @id: Address space identifier, which is used to distinguish the addr. 117 * 118 * Return: 119 * * 0 - success. 120 * * -EINVAL - the memory can't be found or was not allocated by share pool. 121 * * -EPERM - the caller has no permision to free the memory. 122 */ 123 int mg_sp_free(unsigned long addr, int id) 124 { 125 return -EOPNOTSUPP; 126 } 127 EXPORT_SYMBOL_GPL(mg_sp_free); 128 129 static void __init proc_sharepool_init(void) 130 { 131 if (!proc_mkdir("sharepool", NULL)) 132 return; 133 } 134 135 void *mg_sp_alloc_nodemask(unsigned long size, unsigned long sp_flags, int spg_id, 136 nodemask_t nodemask) 137 { 138 return ERR_PTR(-EOPNOTSUPP); 139 } 140 EXPORT_SYMBOL_GPL(mg_sp_alloc_nodemask); 141 142 /** 143 * mg_sp_alloc() - Allocate shared memory for all the processes in a sp_group. 144 * @size: the size of memory to allocate. 145 * @sp_flags: how to allocate the memory. 146 * @spg_id: the share group that the memory is allocated to. 147 * 148 * Use pass through allocation if spg_id == SPG_ID_DEFAULT in multi-group mode. 149 * 150 * Return: 151 * * if succeed, return the starting address of the shared memory. 152 * * if fail, return the pointer of -errno. 153 */ 154 void *mg_sp_alloc(unsigned long size, unsigned long sp_flags, int spg_id) 155 { 156 return ERR_PTR(-EOPNOTSUPP); 157 } 158 EXPORT_SYMBOL_GPL(mg_sp_alloc); 159 160 /** 161 * mg_sp_make_share_k2u() - Share kernel memory to current process or an sp_group. 162 * @kva: the VA of shared kernel memory. 163 * @size: the size of shared kernel memory. 164 * @sp_flags: how to allocate the memory. We only support SP_DVPP. 165 * @tgid: the tgid of the specified process (Not currently in use). 166 * @spg_id: the share group that the memory is shared to. 167 * 168 * Return: the shared target user address to start at 169 * 170 * Share kernel memory to current task if spg_id == SPG_ID_NONE 171 * or SPG_ID_DEFAULT in multi-group mode. 172 * 173 * Return: 174 * * if succeed, return the shared user address to start at. 175 * * if fail, return the pointer of -errno. > 176 */ 177 void *mg_sp_make_share_k2u(unsigned long kva, unsigned long size, 178 unsigned long sp_flags, int tgid, int spg_id) 179 { 180 return ERR_PTR(-EOPNOTSUPP); 181 } 182 EXPORT_SYMBOL_GPL(mg_sp_make_share_k2u); 183 184 /** 185 * mg_sp_make_share_u2k() - Share user memory of a specified process to kernel. 186 * @uva: the VA of shared user memory 187 * @size: the size of shared user memory 188 * @tgid: the tgid of the specified process(Not currently in use) 189 * 190 * Return: 191 * * if success, return the starting kernel address of the shared memory. 192 * * if failed, return the pointer of -errno. 193 */ 194 void *mg_sp_make_share_u2k(unsigned long uva, unsigned long size, int tgid) 195 { 196 return ERR_PTR(-EOPNOTSUPP); 197 } 198 EXPORT_SYMBOL_GPL(mg_sp_make_share_u2k); 199 200 /** 201 * mg_sp_unshare() - Unshare the kernel or user memory which shared by calling 202 * sp_make_share_{k2u,u2k}(). 203 * @va: the specified virtual address of memory 204 * @size: the size of unshared memory 205 * 206 * Use spg_id of current thread if spg_id == SPG_ID_DEFAULT. 207 * 208 * Return: 0 for success, -errno on failure. 209 */ 210 int mg_sp_unshare(unsigned long va, unsigned long size, int spg_id) > 211 { 212 return -EOPNOTSUPP; 213 } 214 EXPORT_SYMBOL_GPL(mg_sp_unshare); 215 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 10/10] mm/page_cache_limit.c:35:5: warning: no previous prototype for function 'cache_reclaim_enable_handler'
by kernel test robot 25 Dec '25

25 Dec '25

Hi Ze, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 610575a82bdf3c3be06ce9559609d5bfa65472e8 commit: 621647ce254f1d347ae9bc3d328c09cbb2732487 [10/10] mm: support periodical memory reclaim config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20251225/202512251637.3XaOXOTN-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251225/202512251637.3XaOXOTN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512251637.3XaOXOTN-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/page_cache_limit.c:6: In file included from include/linux/mm.h:2181: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> mm/page_cache_limit.c:35:5: warning: no previous prototype for function 'cache_reclaim_enable_handler' [-Wmissing-prototypes] 35 | int cache_reclaim_enable_handler(struct ctl_table *table, int write, | ^ mm/page_cache_limit.c:35:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 35 | int cache_reclaim_enable_handler(struct ctl_table *table, int write, | ^ | static >> mm/page_cache_limit.c:51:5: warning: no previous prototype for function 'cache_reclaim_sysctl_handler' [-Wmissing-prototypes] 51 | int cache_reclaim_sysctl_handler(struct ctl_table *table, int write, | ^ mm/page_cache_limit.c:51:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 51 | int cache_reclaim_sysctl_handler(struct ctl_table *table, int write, | ^ | static 7 warnings generated. vim +/cache_reclaim_enable_handler +35 mm/page_cache_limit.c 34 > 35 int cache_reclaim_enable_handler(struct ctl_table *table, int write, 36 void *buffer, size_t *length, loff_t *ppos) 37 { 38 int ret; 39 40 ret = proc_dointvec_minmax(table, write, buffer, length, ppos); 41 if (ret || !write) 42 return ret; 43 44 if (should_periodical_reclaim()) 45 schedule_delayed_work(&shepherd, round_jiffies_relative( 46 (unsigned long)vm_cache_reclaim_s * HZ)); 47 48 return 0; 49 } 50 > 51 int cache_reclaim_sysctl_handler(struct ctl_table *table, int write, 52 void *buffer, size_t *length, loff_t *ppos) 53 { 54 int ret; 55 56 ret = proc_dointvec_minmax(table, write, buffer, length, ppos); 57 if (ret || !write) 58 return ret; 59 60 if (should_periodical_reclaim()) 61 mod_delayed_work(system_unbound_wq, &shepherd, 62 round_jiffies_relative( 63 (unsigned long)vm_cache_reclaim_s * HZ)); 64 65 return ret; 66 } 67 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] scsi: sg: Do not sleep in atomic context
by Zheng Qixing 25 Dec '25

25 Dec '25

From: Bart Van Assche <bvanassche(a)acm.org> mainline inclusion from mainline-v6.18-rc7 commit 90449f2d1e1f020835cba5417234636937dd657e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11214 CVE: CVE-2025-40259 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ sg_finish_rem_req() calls blk_rq_unmap_user(). The latter function may sleep. Hence, call sg_finish_rem_req() with interrupts enabled instead of disabled. Reported-by: syzbot+c01f8e6e73f20459912e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-scsi/691560c4.a70a0220.3124cb.001a.GAE@google… Cc: Hannes Reinecke <hare(a)suse.de> Cc: stable(a)vger.kernel.org Fixes: 97d27b0dd015 ("scsi: sg: close race condition in sg_remove_sfp_usercontext()") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Link: https://patch.msgid.link/20251113181643.1108973-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/sg.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index 7c9c63be214d..4698b79a62ff 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -2208,9 +2208,17 @@ sg_remove_sfp_usercontext(struct work_struct *work) write_lock_irqsave(&sfp->rq_list_lock, iflags); while (!list_empty(&sfp->rq_list)) { srp = list_first_entry(&sfp->rq_list, Sg_request, entry); - sg_finish_rem_req(srp); list_del(&srp->entry); + write_unlock_irqrestore(&sfp->rq_list_lock, iflags); + + sg_finish_rem_req(srp); + /* + * sg_rq_end_io() uses srp->parentfp. Hence, only clear + * srp->parentfp after blk_mq_free_request() has been called. + */ srp->parentfp = NULL; + + write_lock_irqsave(&sfp->rq_list_lock, iflags); } write_unlock_irqrestore(&sfp->rq_list_lock, iflags); -- 2.39.2

2 1

[PATCH OLK-5.10] scsi: sg: Do not sleep in atomic context
by Zheng Qixing 25 Dec '25

25 Dec '25

From: Bart Van Assche <bvanassche(a)acm.org> stable inclusion from stable-v5.10.247 commit db6ac8703ab2b473e1ec845f57f6dd961a388d9f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11214 CVE: CVE-2025-40259 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit 90449f2d1e1f020835cba5417234636937dd657e upstream. sg_finish_rem_req() calls blk_rq_unmap_user(). The latter function may sleep. Hence, call sg_finish_rem_req() with interrupts enabled instead of disabled. Reported-by: syzbot+c01f8e6e73f20459912e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-scsi/691560c4.a70a0220.3124cb.001a.GAE@google… Cc: Hannes Reinecke <hare(a)suse.de> Cc: stable(a)vger.kernel.org Fixes: 97d27b0dd015 ("scsi: sg: close race condition in sg_remove_sfp_usercontext()") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Link: https://patch.msgid.link/20251113181643.1108973-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/sg.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index fbd973b184bb..98baa9cd46bf 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -2235,9 +2235,17 @@ sg_remove_sfp_usercontext(struct work_struct *work) write_lock_irqsave(&sfp->rq_list_lock, iflags); while (!list_empty(&sfp->rq_list)) { srp = list_first_entry(&sfp->rq_list, Sg_request, entry); - sg_finish_rem_req(srp); list_del(&srp->entry); + write_unlock_irqrestore(&sfp->rq_list_lock, iflags); + + sg_finish_rem_req(srp); + /* + * sg_rq_end_io() uses srp->parentfp. Hence, only clear + * srp->parentfp after blk_mq_free_request() has been called. + */ srp->parentfp = NULL; + + write_lock_irqsave(&sfp->rq_list_lock, iflags); } write_unlock_irqrestore(&sfp->rq_list_lock, iflags); -- 2.39.2

2 1

[PATCH OLK-6.6] scsi: sg: Do not sleep in atomic context
by Zheng Qixing 25 Dec '25

25 Dec '25

From: Bart Van Assche <bvanassche(a)acm.org> stable inclusion from stable-v6.6.118 commit b343cee5df7e750d9033fba33e96fc4399fa88a5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11214 CVE: CVE-2025-40259 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit 90449f2d1e1f020835cba5417234636937dd657e upstream. sg_finish_rem_req() calls blk_rq_unmap_user(). The latter function may sleep. Hence, call sg_finish_rem_req() with interrupts enabled instead of disabled. Reported-by: syzbot+c01f8e6e73f20459912e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-scsi/691560c4.a70a0220.3124cb.001a.GAE@google… Cc: Hannes Reinecke <hare(a)suse.de> Cc: stable(a)vger.kernel.org Fixes: 97d27b0dd015 ("scsi: sg: close race condition in sg_remove_sfp_usercontext()") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Link: https://patch.msgid.link/20251113181643.1108973-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/sg.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index 62574886a911..9258a1a8c23c 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -2212,9 +2212,17 @@ sg_remove_sfp_usercontext(struct work_struct *work) write_lock_irqsave(&sfp->rq_list_lock, iflags); while (!list_empty(&sfp->rq_list)) { srp = list_first_entry(&sfp->rq_list, Sg_request, entry); - sg_finish_rem_req(srp); list_del(&srp->entry); + write_unlock_irqrestore(&sfp->rq_list_lock, iflags); + + sg_finish_rem_req(srp); + /* + * sg_rq_end_io() uses srp->parentfp. Hence, only clear + * srp->parentfp after blk_mq_free_request() has been called. + */ srp->parentfp = NULL; + + write_lock_irqsave(&sfp->rq_list_lock, iflags); } write_unlock_irqrestore(&sfp->rq_list_lock, iflags); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] md/raid10: fix null-ptr-deref in raid10_sync_request
by Zheng Qixing 25 Dec '25

25 Dec '25

From: Li Nan <linan122(a)huawei.com> stable inclusion from stable-v4.19.283 commit 38d33593260536840b49fd1dcac9aedfd14a9d42 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11456 CVE: CVE-2023-53832 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit a405c6f0229526160aa3f177f65e20c86fce84c5 upstream. init_resync() inits mempool and sets conf->have_replacemnt at the beginning of sync, close_sync() frees the mempool when sync is completed. After [1] recovery might be skipped and init_resync() is called but close_sync() is not. null-ptr-deref occurs with r10bio->dev[i].repl_bio. The following is one way to reproduce the issue. 1) create a array, wait for resync to complete, mddev->recovery_cp is set to MaxSector. 2) recovery is woken and it is skipped. conf->have_replacement is set to 0 in init_resync(). close_sync() not called. 3) some io errors and rdev A is set to WantReplacement. 4) a new device is added and set to A's replacement. 5) recovery is woken, A have replacement, but conf->have_replacemnt is 0. r10bio->dev[i].repl_bio will not be alloced and null-ptr-deref occurs. Fix it by not calling init_resync() if recovery skipped. [1] commit 7e83ccbecd60 ("md/raid10: Allow skipping recovery when clean arrays are assembled") Fixes: 7e83ccbecd60 ("md/raid10: Allow skipping recovery when clean arrays are assembled") Cc: stable(a)vger.kernel.org Signed-off-by: Li Nan <linan122(a)huawei.com> Signed-off-by: Song Liu <song(a)kernel.org> Link: https://lore.kernel.org/r/20230222041000.3341651-3-linan666@huaweicloud.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid10.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index 5f0a20174979..67493be59f7f 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -2989,10 +2989,6 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr, sector_t chunk_mask = conf->geo.chunk_mask; int page_idx = 0; - if (!mempool_initialized(&conf->r10buf_pool)) - if (init_resync(conf)) - return 0; - /* * Allow skipping a full rebuild for incremental assembly * of a clean array, like RAID1 does. @@ -3008,6 +3004,10 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr, return mddev->dev_sectors - sector_nr; } + if (!mempool_initialized(&conf->r10buf_pool)) + if (init_resync(conf)) + return 0; + skipped: max_sector = mddev->dev_sectors; if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery) || -- 2.39.2

2 1

[openeuler:openEuler-1.0-LTS 1942/1942] arch/x86/kernel/cpu/hygon.c:439:14: warning: no previous prototype for function 'get_nt_block_copy_mini_len'
by kernel test robot 25 Dec '25

25 Dec '25

Hi qiuzhiteng, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4e9c55920995d70b3e88b60c69753df54b03fdf4 commit: 1e3cb18ebe2976b3294e85c3d162736cc3c7c92b [1942/1942] x86: Enhanced copy capabilities for Hygon processor config: x86_64-allmodconfig (https://download.01.org/0day-ci/archive/20251225/202512251003.lVv73hTo-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 1335a05ab8bc8339ce24be3a9da89d8c3f4e0571) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251225/202512251003.lVv73hTo-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512251003.lVv73hTo-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from <built-in>:2: In file included from include/linux/compiler_types.h:59: include/linux/compiler-clang.h:20:9: warning: '__SANITIZE_ADDRESS__' macro redefined [-Wmacro-redefined] 20 | #define __SANITIZE_ADDRESS__ | ^ <built-in>:353:9: note: previous definition is here 353 | #define __SANITIZE_ADDRESS__ 1 | ^ arch/x86/kernel/cpu/hygon.c:434:6: warning: no previous prototype for function 'set_c86_features_para_invalid' [-Wmissing-prototypes] 434 | void set_c86_features_para_invalid(void) | ^ arch/x86/kernel/cpu/hygon.c:434:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 434 | void set_c86_features_para_invalid(void) | ^ | static >> arch/x86/kernel/cpu/hygon.c:439:14: warning: no previous prototype for function 'get_nt_block_copy_mini_len' [-Wmissing-prototypes] 439 | unsigned int get_nt_block_copy_mini_len(void) | ^ arch/x86/kernel/cpu/hygon.c:439:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 439 | unsigned int get_nt_block_copy_mini_len(void) | ^ | static 3 warnings generated. In file included from <built-in>:2: In file included from include/linux/compiler_types.h:59: include/linux/compiler-clang.h:20:9: warning: '__SANITIZE_ADDRESS__' macro redefined [-Wmacro-redefined] 20 | #define __SANITIZE_ADDRESS__ | ^ <built-in>:353:9: note: previous definition is here 353 | #define __SANITIZE_ADDRESS__ 1 | ^ 1 warning generated. -- In file included from <built-in>:2: In file included from include/linux/compiler_types.h:59: include/linux/compiler-clang.h:20:9: warning: '__SANITIZE_ADDRESS__' macro redefined [-Wmacro-redefined] 20 | #define __SANITIZE_ADDRESS__ | ^ <built-in>:353:9: note: previous definition is here 353 | #define __SANITIZE_ADDRESS__ 1 | ^ >> arch/x86/kernel/fpu/core.c:149:14: warning: no previous prototype for function 'get_fpustate_free_space' [-Wmissing-prototypes] 149 | unsigned int get_fpustate_free_space(struct fpu *fpu) | ^ arch/x86/kernel/fpu/core.c:149:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 149 | unsigned int get_fpustate_free_space(struct fpu *fpu) | ^ | static >> arch/x86/kernel/fpu/core.c:175:14: warning: mixing declarations and code is a C99 extension [-Wdeclaration-after-statement] 175 | struct fpu *fpu = &current->thread.fpu; | ^ 3 warnings generated. In file included from <built-in>:2: In file included from include/linux/compiler_types.h:59: include/linux/compiler-clang.h:20:9: warning: '__SANITIZE_ADDRESS__' macro redefined [-Wmacro-redefined] 20 | #define __SANITIZE_ADDRESS__ | ^ <built-in>:353:9: note: previous definition is here 353 | #define __SANITIZE_ADDRESS__ 1 | ^ 1 warning generated. vim +/get_nt_block_copy_mini_len +439 arch/x86/kernel/cpu/hygon.c 438 > 439 unsigned int get_nt_block_copy_mini_len(void) 440 { 441 unsigned int mini_len = hygon_c86_data.nt_cpy_mini_len; 442 443 return mini_len; 444 } 445 EXPORT_SYMBOL_GPL(get_nt_block_copy_mini_len); 446 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] perf/x86/intel: Fix KASAN global-out-of-bounds warning
by Luo Gengkun 25 Dec '25

25 Dec '25

From: Dapeng Mi <dapeng1.mi(a)linux.intel.com> mainline inclusion from mainline-v6.18-rc4 commit 0ba6502ce167fc3d598c08c2cc3b4ed7ca5aa251 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11639 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- When running "perf mem record" command on CWF, the below KASAN global-out-of-bounds warning is seen. ================================================================== BUG: KASAN: global-out-of-bounds in cmt_latency_data+0x176/0x1b0 Read of size 4 at addr ffffffffb721d000 by task dtlb/9850 Call Trace: kasan_report+0xb8/0xf0 cmt_latency_data+0x176/0x1b0 setup_arch_pebs_sample_data+0xf49/0x2560 intel_pmu_drain_arch_pebs+0x577/0xb00 handle_pmi_common+0x6c4/0xc80 The issue is caused by below code in __grt_latency_data(). The code tries to access x86_hybrid_pmu structure which doesn't exist on non-hybrid platform like CWF. WARN_ON_ONCE(hybrid_pmu(event->pmu)->pmu_type == hybrid_big) So add is_hybrid() check before calling this WARN_ON_ONCE to fix the global-out-of-bounds access issue. Fixes: 090262439f66 ("perf/x86/intel: Rename model-specific pebs_latency_data functions") Reported-by: Xudong Hao <xudong.hao(a)intel.com> Signed-off-by: Dapeng Mi <dapeng1.mi(a)linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Zide Chen <zide.chen(a)intel.com> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20251028064214.1451968-1-dapeng1.mi@linux.intel.com Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/intel/ds.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c index 3010a90a339a..c313aee99d9a 100644 --- a/arch/x86/events/intel/ds.c +++ b/arch/x86/events/intel/ds.c @@ -304,7 +304,8 @@ static u64 __grt_latency_data(struct perf_event *event, u64 status, { u64 val; - WARN_ON_ONCE(hybrid_pmu(event->pmu)->pmu_type == hybrid_big); + WARN_ON_ONCE(is_hybrid() && + hybrid_pmu(event->pmu)->pmu_type == hybrid_big); dse &= PERF_PEBS_DATA_SOURCE_GRT_MASK; val = hybrid_var(event->pmu, pebs_data_source)[dse]; -- 2.34.1

2 1

[PATCH OLK-6.6] mm: migrate: add dma copy offloading for hugetlb
by Zeng Heng 25 Dec '25

25 Dec '25

From: Tong Tiangen <tongtiangen(a)huawei.com> hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/7837 ------------------------------- Large memory migration imposes significant overhead on the CPU. This patch introduces enhancements to the page migration by offloading the copy to UDMA hardware which based on the DMA engine framework, and a new migration mode has been introduced, If DMA migration fails, it will fall back to CPU migration. DMA migration supports both asynchronous and synchronous modes for subsequent debugging purposes. Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/migrate_mode.h | 7 ++ include/linux/mm.h | 8 ++ mm/Kconfig | 12 +++ mm/Makefile | 1 + mm/migrate.c | 9 ++ mm/migrate_dma.c | 143 +++++++++++++++++++++++++ 8 files changed, 182 insertions(+) create mode 100644 mm/migrate_dma.c diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index c25ac4ff6c2f..08af29cf2776 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -1186,6 +1186,7 @@ CONFIG_COMPACTION=y CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1 CONFIG_PAGE_REPORTING=y CONFIG_MIGRATION=y +CONFIG_MIGRATE_PAGES_DMA_OFFLOADING=y CONFIG_DEVICE_MIGRATION=y CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION=y CONFIG_ARCH_ENABLE_THP_MIGRATION=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 612ef34a6c73..7d9ce1496e18 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -1147,6 +1147,7 @@ CONFIG_COMPACTION=y CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1 CONFIG_PAGE_REPORTING=y CONFIG_MIGRATION=y +# CONFIG_MIGRATE_PAGES_DMA_OFFLOADING is not set CONFIG_DEVICE_MIGRATION=y CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION=y CONFIG_ARCH_ENABLE_THP_MIGRATION=y diff --git a/include/linux/migrate_mode.h b/include/linux/migrate_mode.h index 0f577f932bb4..5283e62b7d1b 100644 --- a/include/linux/migrate_mode.h +++ b/include/linux/migrate_mode.h @@ -19,6 +19,13 @@ enum migrate_mode { MIGRATE_SYNC_NO_COPY, }; +/* + * Actually the macro MIGRATE_ASYNC_DMA_OFFLOADING definition should be + * placed within enum migrate_mode, but for KABI compatibility, it is + * defined here alone. + */ +#define MIGRATE_ASYNC_DMA_OFFLOADING (10) + enum migrate_reason { MR_COMPACTION, MR_MEMORY_FAILURE, diff --git a/include/linux/mm.h b/include/linux/mm.h index c0040a2014c4..036822cb1b9d 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -1330,6 +1330,14 @@ void put_pages_list(struct list_head *pages); void split_page(struct page *page, unsigned int order); void folio_copy(struct folio *dst, struct folio *src); int folio_mc_copy(struct folio *dst, struct folio *src); +#ifdef CONFIG_MIGRATE_PAGES_DMA_OFFLOADING +int folio_dma_copy(struct folio *dst, struct folio *src); +#else +static inline int folio_dma_copy(struct folio *dst, struct folio *src) +{ + return -ENODEV; +} +#endif unsigned long nr_free_buffer_pages(void); diff --git a/mm/Kconfig b/mm/Kconfig index 4eb0642b71e5..12438e8dff88 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -696,6 +696,18 @@ config MIGRATION pages as migration can relocate pages to satisfy a huge page allocation instead of reclaiming. +config MIGRATE_PAGES_DMA_OFFLOADING + bool "Support to use DMA channels for page migration" + depends on DMA_ENGINE + depends on MIGRATION + default y + help + This config enhances page migration by introducing a new mode + that offloads copy operations to UB-DMA hardware based on the + DMA engine framework, with automatic fallback to CPU migration + if DMA migration fails. DMA migration supports both asynchronous + and synchronous modes to facilitate debugging. + config DEVICE_MIGRATION def_bool MIGRATION && ZONE_DEVICE diff --git a/mm/Makefile b/mm/Makefile index e45cdeda47b7..dd81f8c33e03 100644 --- a/mm/Makefile +++ b/mm/Makefile @@ -92,6 +92,7 @@ obj-$(CONFIG_FAILSLAB) += failslab.o obj-$(CONFIG_FAIL_PAGE_ALLOC) += fail_page_alloc.o obj-$(CONFIG_MEMTEST) += memtest.o obj-$(CONFIG_MIGRATION) += migrate.o +obj-$(CONFIG_MIGRATE_PAGES_DMA_OFFLOADING) += migrate_dma.o obj-$(CONFIG_NUMA) += memory-tiers.o obj-$(CONFIG_DEVICE_MIGRATION) += migrate_device.o obj-$(CONFIG_TRANSPARENT_HUGEPAGE) += huge_memory.o khugepaged.o diff --git a/mm/migrate.c b/mm/migrate.c index 148e55fab012..216f45c9570f 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -583,6 +583,15 @@ static int folio_migrate_mc_copy(struct folio *dst, struct folio *src, if (mode == MIGRATE_SYNC_NO_COPY) return 0; + if (mode == MIGRATE_ASYNC_DMA_OFFLOADING) { + if (folio_test_hugetlb(src) || + folio_test_pmd_mappable(src)) { + /* if dma offloading fail, fallback */ + if (!folio_dma_copy(dst, src)) + return 0; + } + } + return folio_mc_copy(dst, src); } diff --git a/mm/migrate_dma.c b/mm/migrate_dma.c new file mode 100644 index 000000000000..796cd9a5477e --- /dev/null +++ b/mm/migrate_dma.c @@ -0,0 +1,143 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Support to use DMA channels for page migration. + * + * Copyright (C) 2025 Huawei Limited + */ + +#define pr_fmt(fmt) "migrate_dma: " fmt + +#include <linux/dmaengine.h> +#include <linux/dma-mapping.h> + +/* DMA channel track its transfers done */ +struct dma_channel_work { + struct dma_chan *chan; + enum dma_status status; + struct completion done; +}; + +static void folios_dma_copy_completion_callback(void *param, + const struct dmaengine_result *result) +{ + struct dma_channel_work *chan_work = param; + + if (result) { + enum dmaengine_tx_result dma_res = result->result; + + if (dma_res == DMA_TRANS_NOERROR) + chan_work->status = DMA_COMPLETE; + else + chan_work->status = DMA_ERROR; + } + + complete(&chan_work->done); +} + +static int process_folio_dma_transfer(struct dma_channel_work *chan_work, + struct folio *src, struct folio *dst) +{ + struct dma_chan *chan = chan_work->chan; + struct device *dev = dmaengine_get_dma_device(chan); + enum dma_ctrl_flags flags = DMA_CTRL_ACK | DMA_PREP_INTERRUPT; + struct dma_async_tx_descriptor *tx; + dma_addr_t src_handle, dst_handle; + size_t size = folio_size(src); + int ret; + + src_handle = dma_map_page(dev, &src->page, 0, size, DMA_TO_DEVICE); + if (dma_mapping_error(dev, src_handle)) { + dev_err(dev, "map dma src page error.\n"); + return -ENOMEM; + } + + dst_handle = dma_map_page(dev, &dst->page, 0, size, DMA_FROM_DEVICE); + if (dma_mapping_error(dev, dst_handle)) { + dev_err(dev, "map dma dst page error.\n"); + ret = -ENOMEM; + goto out_unmap; + } + + tx = dmaengine_prep_dma_memcpy(chan, dst_handle, src_handle, + size, flags); + if (unlikely(!tx)) { + dev_err(dev, "prep dma memcpy error.\n"); + ret = -EBUSY; + goto out_unmap_all; + } + + tx->callback_result = folios_dma_copy_completion_callback; + tx->callback_param = chan_work; + init_completion(&chan_work->done); + chan_work->status = DMA_ERROR; + + if (dma_submit_error(dmaengine_submit(tx))) { + dev_err(dev, "dma submit error.\n"); + ret = -EINVAL; + goto out_unmap_all; + } + + dma_async_issue_pending(chan); + if (!wait_for_completion_timeout(&chan_work->done, + msecs_to_jiffies(1000))) { + ret = -ETIMEDOUT; + goto out_unmap_all; + } + + ret = (chan_work->status == DMA_COMPLETE) ? 0 : -EPROTO; + +out_unmap_all: + dma_unmap_page(dev, dst_handle, size, DMA_FROM_DEVICE); +out_unmap: + dma_unmap_page(dev, src_handle, size, DMA_TO_DEVICE); + + return ret; +} + +static bool folio_dma_chan_filter(struct dma_chan *chan, void *param) +{ + return !strcmp(dev_name(chan->device->dev), "ub_dma_device"); +} + +int folio_dma_copy(struct folio *dst, struct folio *src) +{ + struct dma_channel_work *chan_work; + struct dma_slave_config dma_cfg; + struct dma_chan *chan; + dma_cap_mask_t mask; + int ret = -ENODEV; + + dma_cap_zero(mask); + dma_cap_set(DMA_MEMCPY, mask); + chan = dma_request_channel(mask, folio_dma_chan_filter, NULL); + if (!chan) { + pr_err("failed to allocate dma channel.\n"); + return ret; + } + + memset(&dma_cfg, 0, sizeof(dma_cfg)); + dma_cfg.direction = DMA_MEM_TO_MEM; + ret = dmaengine_slave_config(chan, &dma_cfg); + if (ret) { + pr_err("failed to config dma channel.\n"); + goto out_release; + } + + chan_work = kmalloc(sizeof(*chan_work), GFP_KERNEL); + if (unlikely(!chan_work)) { + pr_err("failed to allocate memory for chan work.\n"); + goto out_release; + } + + chan_work->chan = chan; + ret = process_folio_dma_transfer(chan_work, src, dst); + if (unlikely(ret)) + pr_err("failed to process folio dma transfer.\n"); + + kfree(chan_work); +out_release: + dma_release_channel(chan); + + return ret; +} +EXPORT_SYMBOL(folio_dma_copy); -- 2.25.1

2 1