- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 2229/2229] drivers/crypto/ccp/hygon/psp-dev.c:25:10: warning: no previous prototype for function 'atomic64_exchange'
by kernel test robot 15 May '25

15 May '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a53913bacac4876eee9ce118b3101dff842318ef commit: fe08767e3a083e73a72f08432bc6fbd864fa7179 [2229/2229] drivers/crypto/ccp: concurrent psp access support between user and kernel space config: x86_64-rhel-9.4-rust (https://download.01.org/0day-ci/archive/20250515/202505150643.AFNuSCPC-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) rustc: rustc 1.73.0 (cc66ad468 2023-10-03) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250515/202505150643.AFNuSCPC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505150643.AFNuSCPC-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/crypto/ccp/hygon/psp-dev.c:25:10: warning: no previous prototype for function 'atomic64_exchange' [-Wmissing-prototypes] 25 | uint64_t atomic64_exchange(uint64_t *dst, uint64_t val) | ^ drivers/crypto/ccp/hygon/psp-dev.c:25:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 25 | uint64_t atomic64_exchange(uint64_t *dst, uint64_t val) | ^ | static >> drivers/crypto/ccp/hygon/psp-dev.c:30:5: warning: no previous prototype for function 'psp_mutex_init' [-Wmissing-prototypes] 30 | int psp_mutex_init(struct psp_mutex *mutex) | ^ drivers/crypto/ccp/hygon/psp-dev.c:30:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 30 | int psp_mutex_init(struct psp_mutex *mutex) | ^ | static drivers/crypto/ccp/hygon/psp-dev.c:38:5: warning: no previous prototype for function 'psp_mutex_trylock' [-Wmissing-prototypes] 38 | int psp_mutex_trylock(struct psp_mutex *mutex) | ^ drivers/crypto/ccp/hygon/psp-dev.c:38:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 38 | int psp_mutex_trylock(struct psp_mutex *mutex) | ^ | static 3 warnings generated. vim +/atomic64_exchange +25 drivers/crypto/ccp/hygon/psp-dev.c 24 > 25 uint64_t atomic64_exchange(uint64_t *dst, uint64_t val) 26 { 27 return xchg(dst, val); 28 } 29 > 30 int psp_mutex_init(struct psp_mutex *mutex) 31 { 32 if (!mutex) 33 return -1; 34 mutex->locked = 0; 35 return 0; 36 } 37 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2229/2229] drivers/crypto/ccp/hygon/tdm-kernel-guard.c:151:5: warning: no previous prototype for function 'tdm_service_run'
by kernel test robot 15 May '25

15 May '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a53913bacac4876eee9ce118b3101dff842318ef commit: 3ad98583441f7c8a2553e1e8d6340ed4397033e2 [2229/2229] crypto: tdm: Support dynamic protection for SCT and IDT by HYGON TDM config: x86_64-rhel-9.4-rust (https://download.01.org/0day-ci/archive/20250515/202505150403.myIeqBlp-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) rustc: rustc 1.73.0 (cc66ad468 2023-10-03) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250515/202505150403.myIeqBlp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505150403.myIeqBlp-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/crypto/ccp/hygon/tdm-kernel-guard.c:151:5: warning: no previous prototype for function 'tdm_service_run' [-Wmissing-prototypes] 151 | int tdm_service_run(struct tdm_security_enhance *data) | ^ drivers/crypto/ccp/hygon/tdm-kernel-guard.c:151:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 151 | int tdm_service_run(struct tdm_security_enhance *data) | ^ | static >> drivers/crypto/ccp/hygon/tdm-kernel-guard.c:212:5: warning: no previous prototype for function 'tdm_service_exit' [-Wmissing-prototypes] 212 | int tdm_service_exit(struct tdm_security_enhance *data) | ^ drivers/crypto/ccp/hygon/tdm-kernel-guard.c:212:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 212 | int tdm_service_exit(struct tdm_security_enhance *data) | ^ | static >> drivers/crypto/ccp/hygon/tdm-kernel-guard.c:243:15: warning: no previous prototype for function 'kprobe_symbol_address_byname' [-Wmissing-prototypes] 243 | unsigned long kprobe_symbol_address_byname(const char *name) | ^ drivers/crypto/ccp/hygon/tdm-kernel-guard.c:243:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 243 | unsigned long kprobe_symbol_address_byname(const char *name) | ^ | static 3 warnings generated. vim +/tdm_service_run +151 drivers/crypto/ccp/hygon/tdm-kernel-guard.c 150 > 151 int tdm_service_run(struct tdm_security_enhance *data) 152 { 153 int ret = 0; 154 struct addr_range_info *addr_range = NULL; 155 156 // Allocate memory for addr_range 157 addr_range = kzalloc(sizeof(struct addr_range_info) + sizeof(struct addr_info), GFP_KERNEL); 158 if (!addr_range) { 159 ret = -DYN_ERR_MEM; 160 pr_err("addr_range kzalloc memory failed\n"); 161 goto end; 162 } 163 164 // Fill in addr_range 165 addr_range->count = 1; 166 addr_range->addr[0].addr_start = data->vaddr; 167 addr_range->addr[0].length = data->size; 168 data->mem_range = addr_range; 169 170 // Context configuration 171 data->context |= TASK_CREATE_VADDR; 172 173 // Allocate memory for authcode 174 data->authcode = kzalloc(sizeof(struct authcode_2b) + AUTHCODE_MAX, GFP_KERNEL); 175 if (!data->authcode) { 176 ret = -DYN_ERR_MEM; 177 pr_err("authcode_2b kzalloc memory failed\n"); 178 goto free_addr_range_info; 179 } 180 181 data->authcode->len = AUTHCODE_MAX; 182 183 // Measurement data configuration 184 data->mdata.hash_algo = HASH_ALGO_SM3; 185 data->mdata.period_ms = 0; 186 ret = calc_expected_hash((uint8_t *)data->vaddr, data->size, 187 data->mdata.expected_measurement); 188 if (ret) { 189 pr_err("calculate expected hash failed!\n"); 190 goto free_authcode; 191 } 192 193 // Create and start tdm task 194 ret = tdm_task_create_and_run(data); 195 if (ret) { 196 pr_err("tdm_task_create_and_run failed!\n"); 197 goto free_authcode; 198 } 199 200 return ret; 201 202 free_authcode: 203 kfree(data->authcode); 204 data->authcode = NULL; 205 free_addr_range_info: 206 kfree(data->mem_range); 207 data->mem_range = NULL; 208 end: 209 return ret; 210 } 211 > 212 int tdm_service_exit(struct tdm_security_enhance *data) 213 { 214 int ret = 0; 215 int task_status = 0; 216 217 task_status = psp_startstop_measure_task(data->task_id, data->authcode, false); 218 if (task_status < 0) { 219 ret = task_status; 220 pr_err("task_id %d stop failed with 0x%x\n", data->task_id, ret); 221 goto end; 222 } 223 224 // Waiting for the task to end 225 msleep(40); 226 227 psp_destroy_measure_task(data->task_id, data->authcode); 228 229 kfree(data->authcode); 230 data->authcode = NULL; 231 kfree(data->mem_range); 232 data->mem_range = NULL; 233 end: 234 return ret; 235 } 236 237 #if !IS_BUILTIN(CONFIG_TDM_KERNEL_GUARD) 238 static int p_tmp_kprobe_handler(struct kprobe *p_ri, struct pt_regs *p_regs) 239 { 240 return 0; 241 } 242 > 243 unsigned long kprobe_symbol_address_byname(const char *name) 244 { 245 int p_ret; 246 struct kprobe p_kprobe; 247 unsigned long addr = 0; 248 249 memset(&p_kprobe, 0, sizeof(p_kprobe)); 250 251 p_kprobe.pre_handler = p_tmp_kprobe_handler; 252 p_kprobe.symbol_name = name; 253 254 p_ret = register_kprobe(&p_kprobe); 255 if (p_ret < 0) { 256 pr_err("register_kprobe error [%d] :(\n", p_ret); 257 return 0; 258 } 259 260 addr = (unsigned long)p_kprobe.addr; 261 unregister_kprobe(&p_kprobe); 262 263 return addr; 264 } 265 #endif 266 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2229/2229] drivers/crypto/ccp/hygon/tdm-dev.c:94:6: warning: variable 'ret' set but not used
by kernel test robot 15 May '25

15 May '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a53913bacac4876eee9ce118b3101dff842318ef commit: a1dd4972da4e66d9a9d1a89b3dfd8f742c20193b [2229/2229] crypto: tdm: Add Hygon TDM driver config: x86_64-rhel-9.4-rust (https://download.01.org/0day-ci/archive/20250515/202505150253.nSMsteDG-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) rustc: rustc 1.73.0 (cc66ad468 2023-10-03) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250515/202505150253.nSMsteDG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505150253.nSMsteDG-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/crypto/ccp/hygon/tdm-dev.c:94:6: warning: variable 'ret' set but not used [-Wunused-but-set-variable] 94 | int ret = 0; | ^ >> drivers/crypto/ccp/hygon/tdm-dev.c:606:20: warning: variable 'head' set but not used [-Wunused-but-set-variable] 606 | struct list_head *head = NULL; | ^ 2 warnings generated. vim +/ret +94 drivers/crypto/ccp/hygon/tdm-dev.c 91 92 static int list_enqueue(void *entry) 93 { > 94 int ret = 0; 95 struct list_head *head, *entry_list = NULL; 96 rwlock_t *lock = NULL; 97 98 if (!entry) { 99 ret = -DYN_NULL_POINTER; 100 pr_err("Null pointer\n"); 101 goto end; 102 } 103 104 head = &dyn_head.head; 105 lock = &dyn_head.lock; 106 entry_list = &(((struct tdm_task_ctx *)entry)->list); 107 108 write_lock(lock); 109 if (entry_list) 110 list_add_tail(entry_list, head); 111 write_unlock(lock); 112 113 end: 114 return 0; 115 } 116 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2229/2229] arch/x86/kernel/head64.c:382:12: warning: no previous prototype for function 'early_clflush_bss_decrypted_section'
by kernel test robot 15 May '25

15 May '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a53913bacac4876eee9ce118b3101dff842318ef commit: ca0c1fa1ec4b6d9040cec7e543d50a93fc88d4c6 [2229/2229] x86/head/64: Flush caches for .bss..decrypted section after CR3 switches to early_top_pgt config: x86_64-rhel-9.4-rust (https://download.01.org/0day-ci/archive/20250515/202505150041.GhGsIYWp-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) rustc: rustc 1.73.0 (cc66ad468 2023-10-03) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250515/202505150041.GhGsIYWp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505150041.GhGsIYWp-lkp@intel.com/ Note: functions only called from assembly code should be annotated with the asmlinkage attribute All warnings (new ones prefixed by >>): >> arch/x86/kernel/head64.c:382:12: warning: no previous prototype for function 'early_clflush_bss_decrypted_section' [-Wmissing-prototypes] 382 | void __ref early_clflush_bss_decrypted_section(void) | ^ arch/x86/kernel/head64.c:382:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 382 | void __ref early_clflush_bss_decrypted_section(void) | ^ | static 1 warning generated. vim +/early_clflush_bss_decrypted_section +382 arch/x86/kernel/head64.c 381 > 382 void __ref early_clflush_bss_decrypted_section(void) 383 { 384 unsigned long vaddr, vaddr_end; 385 char *cl, *start, *end; 386 387 /* Only allow bsp flush these caches and the bsp must at early boot stage */ 388 if (bsp_flush_bss_decrypted_section_handled) 389 return; 390 391 if (read_cr3_pa() != __pa_nodebug(early_top_pgt)) 392 return; 393 394 /* Only Hygon CSV guest should do the clflush */ 395 if (!__should_do_clflush()) 396 goto handled; 397 398 /* 399 * The memory region of .bss..decrypted section maybe mapped 400 * with encryption in earlier stage. If the correspond stale 401 * caches lives in earlier stage were not flushed before we 402 * access that memory region, then Linux will crash later 403 * because the stale caches will pollute the memory. So we 404 * need flush the caches with encrypted mapping before we 405 * access .bss..decrypted section. 406 * 407 * The function __startup_64() have already filled the 408 * encrypted mapping for .bss..decrypted section, use that 409 * mapping here. 410 */ 411 vaddr = (unsigned long)__start_bss_decrypted - 412 __START_KERNEL_map + phys_base; 413 vaddr_end = (unsigned long)__end_bss_decrypted - 414 __START_KERNEL_map + phys_base; 415 416 /* Hardcode cl-size to 64 at this stage. */ 417 start = (char *)(vaddr & ~63); 418 end = (char *)((vaddr_end + 63) & ~63); 419 420 asm volatile("mfence" : : : "memory"); 421 for (cl = start; cl != end; cl += 64) 422 clflush(cl); 423 asm volatile("mfence" : : : "memory"); 424 425 handled: 426 bsp_flush_bss_decrypted_section_handled = true; 427 } 428 #endif 429 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2229/2229] arch/x86/kvm/svm/sev.c:2198:6: warning: no previous prototype for function 'sev_install_hooks'
by kernel test robot 15 May '25

15 May '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a53913bacac4876eee9ce118b3101dff842318ef commit: 0f13b8634792cff1f2fb18bf35e5a24d7a8cbf8e [2229/2229] KVM: x86: Support VM_ATTESTATION hypercall config: x86_64-rhel-9.4-rust (https://download.01.org/0day-ci/archive/20250514/202505142149.OSrCD2AH-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) rustc: rustc 1.73.0 (cc66ad468 2023-10-03) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250514/202505142149.OSrCD2AH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505142149.OSrCD2AH-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/kvm/svm/sev.c:2198:6: warning: no previous prototype for function 'sev_install_hooks' [-Wmissing-prototypes] 2198 | void sev_install_hooks(void) | ^ arch/x86/kvm/svm/sev.c:2198:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2198 | void sev_install_hooks(void) | ^ | static 1 warning generated. -- >> arch/x86/kvm/svm/csv.c:30:5: warning: no previous prototype for function 'csv_vm_attestation' [-Wmissing-prototypes] 30 | int csv_vm_attestation(struct kvm *kvm, unsigned long gpa, unsigned long len) | ^ arch/x86/kvm/svm/csv.c:30:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 30 | int csv_vm_attestation(struct kvm *kvm, unsigned long gpa, unsigned long len) | ^ | static 1 warning generated. vim +/sev_install_hooks +2198 arch/x86/kvm/svm/sev.c 2195 2196 #ifdef CONFIG_HYGON_CSV 2197 /* Code to set all of the function and vaiable pointers */ > 2198 void sev_install_hooks(void) 2199 { 2200 hygon_kvm_hooks.sev_issue_cmd = sev_issue_cmd; 2201 hygon_kvm_hooks.get_num_contig_pages = get_num_contig_pages; 2202 hygon_kvm_hooks.sev_pin_memory = sev_pin_memory; 2203 hygon_kvm_hooks.sev_unpin_memory = sev_unpin_memory; 2204 2205 hygon_kvm_hooks.sev_hooks_installed = true; 2206 } 2207 #endif 2208 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop
by Liu Mingrui 15 May '25

15 May '25

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v6.6.90 commit a1723e9c53fe6431415be19302a56543daf503f5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRNN1 CVE: CVE-2025-21839 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c2fee09fc167c74a64adb08656cb993ea475197e upstream. Move the conditional loading of hardware DR6 with the guest's DR6 value out of the core .vcpu_run() loop to fix a bug where KVM can load hardware with a stale vcpu->arch.dr6. When the guest accesses a DR and host userspace isn't debugging the guest, KVM disables DR interception and loads the guest's values into hardware on VM-Enter and saves them on VM-Exit. This allows the guest to access DRs at will, e.g. so that a sequence of DR accesses to configure a breakpoint only generates one VM-Exit. For DR0-DR3, the logic/behavior is identical between VMX and SVM, and also identical between KVM_DEBUGREG_BP_ENABLED (userspace debugging the guest) and KVM_DEBUGREG_WONT_EXIT (guest using DRs), and so KVM handles loading DR0-DR3 in common code, _outside_ of the core kvm_x86_ops.vcpu_run() loop. But for DR6, the guest's value doesn't need to be loaded into hardware for KVM_DEBUGREG_BP_ENABLED, and SVM provides a dedicated VMCB field whereas VMX requires software to manually load the guest value, and so loading the guest's value into DR6 is handled by {svm,vmx}_vcpu_run(), i.e. is done _inside_ the core run loop. Unfortunately, saving the guest values on VM-Exit is initiated by common x86, again outside of the core run loop. If the guest modifies DR6 (in hardware, when DR interception is disabled), and then the next VM-Exit is a fastpath VM-Exit, KVM will reload hardware DR6 with vcpu->arch.dr6 and clobber the guest's actual value. The bug shows up primarily with nested VMX because KVM handles the VMX preemption timer in the fastpath, and the window between hardware DR6 being modified (in guest context) and DR6 being read by guest software is orders of magnitude larger in a nested setup. E.g. in non-nested, the VMX preemption timer would need to fire precisely between #DB injection and the #DB handler's read of DR6, whereas with a KVM-on-KVM setup, the window where hardware DR6 is "dirty" extends all the way from L1 writing DR6 to VMRESUME (in L1). L1's view: ========== <L1 disables DR interception> CPU 0/KVM-7289 [023] d.... 2925.640961: kvm_entry: vcpu 0 A: L1 Writes DR6 CPU 0/KVM-7289 [023] d.... 2925.640963: <hack>: Set DRs, DR6 = 0xffff0ff1 B: CPU 0/KVM-7289 [023] d.... 2925.640967: kvm_exit: vcpu 0 reason EXTERNAL_INTERRUPT intr_info 0x800000ec D: L1 reads DR6, arch.dr6 = 0 CPU 0/KVM-7289 [023] d.... 2925.640969: <hack>: Sync DRs, DR6 = 0xffff0ff0 CPU 0/KVM-7289 [023] d.... 2925.640976: kvm_entry: vcpu 0 L2 reads DR6, L1 disables DR interception CPU 0/KVM-7289 [023] d.... 2925.640980: kvm_exit: vcpu 0 reason DR_ACCESS info1 0x0000000000000216 CPU 0/KVM-7289 [023] d.... 2925.640983: kvm_entry: vcpu 0 CPU 0/KVM-7289 [023] d.... 2925.640983: <hack>: Set DRs, DR6 = 0xffff0ff0 L2 detects failure CPU 0/KVM-7289 [023] d.... 2925.640987: kvm_exit: vcpu 0 reason HLT L1 reads DR6 (confirms failure) CPU 0/KVM-7289 [023] d.... 2925.640990: <hack>: Sync DRs, DR6 = 0xffff0ff0 L0's view: ========== L2 reads DR6, arch.dr6 = 0 CPU 23/KVM-5046 [001] d.... 3410.005610: kvm_exit: vcpu 23 reason DR_ACCESS info1 0x0000000000000216 CPU 23/KVM-5046 [001] ..... 3410.005610: kvm_nested_vmexit: vcpu 23 reason DR_ACCESS info1 0x0000000000000216 L2 => L1 nested VM-Exit CPU 23/KVM-5046 [001] ..... 3410.005610: kvm_nested_vmexit_inject: reason: DR_ACCESS ext_inf1: 0x0000000000000216 CPU 23/KVM-5046 [001] d.... 3410.005610: kvm_entry: vcpu 23 CPU 23/KVM-5046 [001] d.... 3410.005611: kvm_exit: vcpu 23 reason VMREAD CPU 23/KVM-5046 [001] d.... 3410.005611: kvm_entry: vcpu 23 CPU 23/KVM-5046 [001] d.... 3410.005612: kvm_exit: vcpu 23 reason VMREAD CPU 23/KVM-5046 [001] d.... 3410.005612: kvm_entry: vcpu 23 L1 writes DR7, L0 disables DR interception CPU 23/KVM-5046 [001] d.... 3410.005612: kvm_exit: vcpu 23 reason DR_ACCESS info1 0x0000000000000007 CPU 23/KVM-5046 [001] d.... 3410.005613: kvm_entry: vcpu 23 L0 writes DR6 = 0 (arch.dr6) CPU 23/KVM-5046 [001] d.... 3410.005613: <hack>: Set DRs, DR6 = 0xffff0ff0 A: <L1 writes DR6 = 1, no interception, arch.dr6 is still '0'> B: CPU 23/KVM-5046 [001] d.... 3410.005614: kvm_exit: vcpu 23 reason PREEMPTION_TIMER CPU 23/KVM-5046 [001] d.... 3410.005614: kvm_entry: vcpu 23 C: L0 writes DR6 = 0 (arch.dr6) CPU 23/KVM-5046 [001] d.... 3410.005614: <hack>: Set DRs, DR6 = 0xffff0ff0 L1 => L2 nested VM-Enter CPU 23/KVM-5046 [001] d.... 3410.005616: kvm_exit: vcpu 23 reason VMRESUME L0 reads DR6, arch.dr6 = 0 Reported-by: John Stultz <jstultz(a)google.com> Closes: https://lkml.kernel.org/r/CANDhNCq5_F3HfFYABqFGCA1bPd_%2BxgNj-iDQhH4tDk%2Bw… Fixes: 375e28ffc0cf ("KVM: X86: Set host DR6 only on VMX and for KVM_DEBUGREG_WONT_EXIT") Fixes: d67668e9dd76 ("KVM: x86, SVM: isolate vcpu->arch.dr6 from vmcb->save.dr6") Cc: stable(a)vger.kernel.org Cc: Jim Mattson <jmattson(a)google.com> Tested-by: John Stultz <jstultz(a)google.com> Link: https://lore.kernel.org/r/20250125011833.3644371-1-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> [jth: Handled conflicts with kvm_x86_ops reshuffle] Signed-off-by: James Houghton <jthoughton(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- arch/x86/include/asm/kvm-x86-ops.h | 1 + arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/svm/svm.c | 13 ++++++------- arch/x86/kvm/vmx/vmx.c | 11 +++++++---- arch/x86/kvm/x86.c | 3 +++ 5 files changed, 18 insertions(+), 11 deletions(-) diff --git a/arch/x86/include/asm/kvm-x86-ops.h b/arch/x86/include/asm/kvm-x86-ops.h index fd830075fc50..1023076686ba 100644 --- a/arch/x86/include/asm/kvm-x86-ops.h +++ b/arch/x86/include/asm/kvm-x86-ops.h @@ -48,6 +48,7 @@ KVM_X86_OP(set_idt) KVM_X86_OP(get_gdt) KVM_X86_OP(set_gdt) KVM_X86_OP(sync_dirty_debug_regs) +KVM_X86_OP(set_dr6) KVM_X86_OP(set_dr7) KVM_X86_OP(cache_reg) KVM_X86_OP(get_rflags) diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h index 48b48408a8f2..d27a280daf5c 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -1613,6 +1613,7 @@ struct kvm_x86_ops { void (*get_gdt)(struct kvm_vcpu *vcpu, struct desc_ptr *dt); void (*set_gdt)(struct kvm_vcpu *vcpu, struct desc_ptr *dt); void (*sync_dirty_debug_regs)(struct kvm_vcpu *vcpu); + void (*set_dr6)(struct kvm_vcpu *vcpu, unsigned long value); void (*set_dr7)(struct kvm_vcpu *vcpu, unsigned long value); void (*cache_reg)(struct kvm_vcpu *vcpu, enum kvm_reg reg); unsigned long (*get_rflags)(struct kvm_vcpu *vcpu); diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 568b98842818..b8ac4486dd56 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -2024,11 +2024,11 @@ static void new_asid(struct vcpu_svm *svm, struct svm_cpu_data *sd) svm->asid = sd->next_asid++; } -static void svm_set_dr6(struct vcpu_svm *svm, unsigned long value) +static void svm_set_dr6(struct kvm_vcpu *vcpu, unsigned long value) { - struct vmcb *vmcb = svm->vmcb; + struct vmcb *vmcb = to_svm(vcpu)->vmcb; - if (svm->vcpu.arch.guest_state_protected) + if (vcpu->arch.guest_state_protected) return; if (unlikely(value != vmcb->save.dr6)) { @@ -4234,10 +4234,8 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu) * Run with all-zero DR6 unless needed, so that we can get the exact cause * of a #DB. */ - if (unlikely(vcpu->arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT)) - svm_set_dr6(svm, vcpu->arch.dr6); - else - svm_set_dr6(svm, DR6_ACTIVE_LOW); + if (likely(!(vcpu->arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT))) + svm_set_dr6(vcpu, DR6_ACTIVE_LOW); clgi(); kvm_load_guest_xsave_state(vcpu); @@ -5022,6 +5020,7 @@ static struct kvm_x86_ops svm_x86_ops __initdata = { .set_idt = svm_set_idt, .get_gdt = svm_get_gdt, .set_gdt = svm_set_gdt, + .set_dr6 = svm_set_dr6, .set_dr7 = svm_set_dr7, .sync_dirty_debug_regs = svm_sync_dirty_debug_regs, .cache_reg = svm_cache_reg, diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index ef4e2a832b5c..205b14951d57 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -5619,6 +5619,12 @@ static void vmx_sync_dirty_debug_regs(struct kvm_vcpu *vcpu) set_debugreg(DR6_RESERVED, 6); } +static void vmx_set_dr6(struct kvm_vcpu *vcpu, unsigned long val) +{ + lockdep_assert_irqs_disabled(); + set_debugreg(vcpu->arch.dr6, 6); +} + static void vmx_set_dr7(struct kvm_vcpu *vcpu, unsigned long val) { vmcs_writel(GUEST_DR7, val); @@ -7366,10 +7372,6 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu) vmx->loaded_vmcs->host_state.cr4 = cr4; } - /* When KVM_DEBUGREG_WONT_EXIT, dr6 is accessible in guest. */ - if (unlikely(vcpu->arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT)) - set_debugreg(vcpu->arch.dr6, 6); - /* When single-stepping over STI and MOV SS, we must clear the * corresponding interruptibility bits in the guest state. Otherwise * vmentry fails as it then expects bit 14 (BS) in pending debug @@ -8351,6 +8353,7 @@ static struct kvm_x86_ops vmx_x86_ops __initdata = { .set_idt = vmx_set_idt, .get_gdt = vmx_get_gdt, .set_gdt = vmx_set_gdt, + .set_dr6 = vmx_set_dr6, .set_dr7 = vmx_set_dr7, .sync_dirty_debug_regs = vmx_sync_dirty_debug_regs, .cache_reg = vmx_cache_reg, diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 3e9d6f368eed..9834ab807726 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -10923,6 +10923,9 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) set_debugreg(vcpu->arch.eff_db[1], 1); set_debugreg(vcpu->arch.eff_db[2], 2); set_debugreg(vcpu->arch.eff_db[3], 3); + /* When KVM_DEBUGREG_WONT_EXIT, dr6 is accessible in guest. */ + if (unlikely(vcpu->arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT)) + static_call(kvm_x86_set_dr6)(vcpu, vcpu->arch.dr6); } else if (unlikely(hw_breakpoint_active())) { set_debugreg(0, 7); } -- 2.25.1

2 1

[PATCH OLK-5.10 V1] sched/fair: Fix the bug in dynamic smt when getting physical core load
by Cheng Yu 15 May '25

15 May '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC4CNP CVE: NA -------------------------------- Fix a bug in the dynamic smt feature. Specifically, when determining whether a physical core has idle capacity, there is a bug in obtaining the load of the core. We should use "core_id" instead of "cpu". Fixes: 5ea39a25cc45 ("sched/fair: Optimize the dynamic smt") Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/fair.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 5fc8d6a25b9a..5a191054d73f 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7333,9 +7333,8 @@ int sysctl_sched_util_ratio = 100; static bool core_has_spare(int cpu) { int core_id = cpumask_first(cpu_smt_mask(cpu)); - struct rq *rq = cpu_rq(core_id); - unsigned long util = cpu_util(cpu); - unsigned long capacity = rq->cpu_capacity; + unsigned long util = cpu_util(core_id); + unsigned long capacity = capacity_of(core_id); if (sysctl_sched_util_ratio == 100) return true; -- 2.25.1

2 1

[PATCH OLK-6.6 v2 0/5] CVE-2024-58098
by Pu Lehui 15 May '25

15 May '25

Eduard Zingerman (4): bpf: add find_containing_subprog() utility function bpf: refactor bpf_helper_changes_pkt_data to use helper number bpf: track changes_pkt_data property for global functions selftests/bpf: test for changing packet data from global functions Pu Lehui (1): bpf: Fix kabi breakage in struct bpf_subprog_info include/linux/bpf_verifier.h | 1 + include/linux/filter.h | 2 +- kernel/bpf/core.c | 2 +- kernel/bpf/verifier.c | 62 ++++++++++++++++-- net/core/filter.c | 63 +++++++++---------- .../selftests/bpf/progs/verifier_sock.c | 28 +++++++++ 6 files changed, 115 insertions(+), 43 deletions(-) -- 2.34.1

2 6

[openeuler:OLK-6.6 2221/2221] include/linux/suspend.h:36:60: error: expected ')' before numeric constant
by kernel test robot 15 May '25

15 May '25

Hi Jianmin, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b3779f76a7335b38d2bd7adfc80ff7bc31357299 commit: 1f46f3a128f21c190281c72cad99267bcc177e34 [2221/2221] PCI: PM: fix pcie mrrs restoring config: loongarch-randconfig-001-20250513 (https://download.01.org/0day-ci/archive/20250515/202505151330.oarlCuye-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250515/202505151330.oarlCuye-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505151330.oarlCuye-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from drivers/pci/pci.c:35: >> include/linux/suspend.h:36:60: error: expected ')' before numeric constant 36 | #define PM_SUSPEND_ON ((__force suspend_state_t) 0) | ^ include/linux/suspend.h:341:34: note: in expansion of macro 'PM_SUSPEND_ON' 341 | #define pm_suspend_target_state (PM_SUSPEND_ON) | ^~~~~~~~~~~~~ drivers/pci/pci.c:177:17: note: in expansion of macro 'pm_suspend_target_state' 177 | suspend_state_t pm_suspend_target_state; | ^~~~~~~~~~~~~~~~~~~~~~~ vim +36 include/linux/suspend.h 95d9ffbe01fb21 Rafael J. Wysocki 2007-10-18 35 95d9ffbe01fb21 Rafael J. Wysocki 2007-10-18 @36 #define PM_SUSPEND_ON ((__force suspend_state_t) 0) 690cbb90a709c1 Rafael J. Wysocki 2017-08-10 37 #define PM_SUSPEND_TO_IDLE ((__force suspend_state_t) 1) 7e73c5ae6e7991 Zhang Rui 2013-02-06 38 #define PM_SUSPEND_STANDBY ((__force suspend_state_t) 2) 95d9ffbe01fb21 Rafael J. Wysocki 2007-10-18 39 #define PM_SUSPEND_MEM ((__force suspend_state_t) 3) 690cbb90a709c1 Rafael J. Wysocki 2017-08-10 40 #define PM_SUSPEND_MIN PM_SUSPEND_TO_IDLE 95d9ffbe01fb21 Rafael J. Wysocki 2007-10-18 41 #define PM_SUSPEND_MAX ((__force suspend_state_t) 4) 95d9ffbe01fb21 Rafael J. Wysocki 2007-10-18 42 :::::: The code at line 36 was first introduced by commit :::::: 95d9ffbe01fb21d524c86bf77871255066bc6e55 PM: Move definition of struct pm_ops to suspend.h :::::: TO: Rafael J. Wysocki <rjw(a)sisk.pl> :::::: CC: Linus Torvalds <torvalds(a)woody.linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] fs/jfs: Prevent integer overflow in AG size calculation
by Zhang Kunbo 15 May '25

15 May '25

From: Rand Deeb <rand.sec96(a)gmail.com> stable inclusion from stable-v5.10.237 commit 8bb29629a5e4090e1ef7199cb42db04a52802239 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6PV5 CVE: CVE-2025-37858 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7fcbf789629cdb9fbf4e2172ce31136cfed11e5e ] The JFS filesystem calculates allocation group (AG) size using 1 << l2agsize in dbExtendFS(). When l2agsize exceeds 31 (possible with >2TB aggregates on 32-bit systems), this 32-bit shift operation causes undefined behavior and improper AG sizing. On 32-bit architectures: - Left-shifting 1 by 32+ bits results in 0 due to integer overflow - This creates invalid AG sizes (0 or garbage values) in sbi->bmap->db_agsize - Subsequent block allocations would reference invalid AG structures - Could lead to: - Filesystem corruption during extend operations - Kernel crashes due to invalid memory accesses - Security vulnerabilities via malformed on-disk structures Fix by casting to s64 before shifting: bmp->db_agsize = (s64)1 << l2agsiz'e; This ensures 64-bit arithmetic even on 32-bit architectures. The cast matches the data type of db_agsize (s64) and follows similar patterns in JFS block calculation code. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Rand Deeb <rand.sec96(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- fs/jfs/jfs_dmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index bd69bc08222f..8d3ff41f092a 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -3462,7 +3462,7 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks) oldl2agsize = bmp->db_agl2size; bmp->db_agl2size = l2agsize; - bmp->db_agsize = 1 << l2agsize; + bmp->db_agsize = (s64)1 << l2agsize; /* compute new number of AG */ agno = bmp->db_numag; -- 2.34.1

2 1