Kernel
Threads by month
- ----- 2025 -----
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2024 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- 42 participants
- 20343 discussions
15 Apr '24
From: Maximilian Heyne <mheyne(a)amazon.de>
stable inclusion
from stable-v5.15.154
commit ea592baf9e41779fe9a0424c03dd2f324feca3b3
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2GS
CVE: CVE-2024-26687
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit fa765c4b4aed2d64266b694520ecb025c862c5a9 upstream.
shutdown_pirq and startup_pirq are not taking the
irq_mapping_update_lock because they can't due to lock inversion. Both
are called with the irq_desc->lock being taking. The lock order,
however, is first irq_mapping_update_lock and then irq_desc->lock.
This opens multiple races:
- shutdown_pirq can be interrupted by a function that allocates an event
channel:
CPU0 CPU1
shutdown_pirq {
xen_evtchn_close(e)
__startup_pirq {
EVTCHNOP_bind_pirq
-> returns just freed evtchn e
set_evtchn_to_irq(e, irq)
}
xen_irq_info_cleanup() {
set_evtchn_to_irq(e, -1)
}
}
Assume here event channel e refers here to the same event channel
number.
After this race the evtchn_to_irq mapping for e is invalid (-1).
- __startup_pirq races with __unbind_from_irq in a similar way. Because
__startup_pirq doesn't take irq_mapping_update_lock it can grab the
evtchn that __unbind_from_irq is currently freeing and cleaning up. In
this case even though the event channel is allocated, its mapping can
be unset in evtchn_to_irq.
The fix is to first cleanup the mappings and then close the event
channel. In this way, when an event channel gets allocated it's
potential previous evtchn_to_irq mappings are guaranteed to be unset already.
This is also the reverse order of the allocation where first the event
channel is allocated and then the mappings are setup.
On a 5.10 kernel prior to commit 3fcdaf3d7634 ("xen/events: modify internal
[un]bind interfaces"), we hit a BUG like the following during probing of NVMe
devices. The issue is that during nvme_setup_io_queues, pci_free_irq
is called for every device which results in a call to shutdown_pirq.
With many nvme devices it's therefore likely to hit this race during
boot because there will be multiple calls to shutdown_pirq and
startup_pirq are running potentially in parallel.
------------[ cut here ]------------
blkfront: xvda: barrier or flush: disabled; persistent grants: enabled; indirect descriptors: enabled; bounce buffer: enabled
kernel BUG at drivers/xen/events/events_base.c:499!
invalid opcode: 0000 [#1] SMP PTI
CPU: 44 PID: 375 Comm: kworker/u257:23 Not tainted 5.10.201-191.748.amzn2.x86_64 #1
Hardware name: Xen HVM domU, BIOS 4.11.amazon 08/24/2006
Workqueue: nvme-reset-wq nvme_reset_work
RIP: 0010:bind_evtchn_to_cpu+0xdf/0xf0
Code: 5d 41 5e c3 cc cc cc cc 44 89 f7 e8 2b 55 ad ff 49 89 c5 48 85 c0 0f 84 64 ff ff ff 4c 8b 68 30 41 83 fe ff 0f 85 60 ff ff ff <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 0f 1f 44 00 00
RSP: 0000:ffffc9000d533b08 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000006
RDX: 0000000000000028 RSI: 00000000ffffffff RDI: 00000000ffffffff
RBP: ffff888107419680 R08: 0000000000000000 R09: ffffffff82d72b00
R10: 0000000000000000 R11: 0000000000000000 R12: 00000000000001ed
R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000002
FS: 0000000000000000(0000) GS:ffff88bc8b500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000002610001 CR4: 00000000001706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
? show_trace_log_lvl+0x1c1/0x2d9
? show_trace_log_lvl+0x1c1/0x2d9
? set_affinity_irq+0xdc/0x1c0
? __die_body.cold+0x8/0xd
? die+0x2b/0x50
? do_trap+0x90/0x110
? bind_evtchn_to_cpu+0xdf/0xf0
? do_error_trap+0x65/0x80
? bind_evtchn_to_cpu+0xdf/0xf0
? exc_invalid_op+0x4e/0x70
? bind_evtchn_to_cpu+0xdf/0xf0
? asm_exc_invalid_op+0x12/0x20
? bind_evtchn_to_cpu+0xdf/0xf0
? bind_evtchn_to_cpu+0xc5/0xf0
set_affinity_irq+0xdc/0x1c0
irq_do_set_affinity+0x1d7/0x1f0
irq_setup_affinity+0xd6/0x1a0
irq_startup+0x8a/0xf0
__setup_irq+0x639/0x6d0
? nvme_suspend+0x150/0x150
request_threaded_irq+0x10c/0x180
? nvme_suspend+0x150/0x150
pci_request_irq+0xa8/0xf0
? __blk_mq_free_request+0x74/0xa0
queue_request_irq+0x6f/0x80
nvme_create_queue+0x1af/0x200
nvme_create_io_queues+0xbd/0xf0
nvme_setup_io_queues+0x246/0x320
? nvme_irq_check+0x30/0x30
nvme_reset_work+0x1c8/0x400
process_one_work+0x1b0/0x350
worker_thread+0x49/0x310
? process_one_work+0x350/0x350
kthread+0x11b/0x140
? __kthread_bind_mask+0x60/0x60
ret_from_fork+0x22/0x30
Modules linked in:
---[ end trace a11715de1eee1873 ]---
Fixes: d46a78b05c0e ("xen: implement pirq type event channels")
Cc: stable(a)vger.kernel.org
Co-debugged-by: Andrew Panyakin <apanyaki(a)amazon.com>
Signed-off-by: Maximilian Heyne <mheyne(a)amazon.de>
Reviewed-by: Juergen Gross <jgross(a)suse.com>
Link: https://lore.kernel.org/r/20240124163130.31324-1-mheyne@amazon.de
Signed-off-by: Juergen Gross <jgross(a)suse.com>
[apanyaki: backport to v5.15-stable]
Signed-off-by: Andrew Paniakin <apanyaki(a)amazon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
conflicts:
drivers/xen/events/events_base.c
Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com>
---
drivers/xen/events/events_base.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 9c0ade529ec3..c9dc2108052a 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -742,8 +742,8 @@ static void shutdown_pirq(struct irq_data *data)
return;
mask_evtchn(evtchn);
- xen_evtchn_close(evtchn);
xen_irq_info_cleanup(info);
+ xen_evtchn_close(evtchn);
}
static void enable_pirq(struct irq_data *data)
@@ -786,8 +786,6 @@ static void __unbind_from_irq(unsigned int irq)
if (VALID_EVTCHN(evtchn)) {
unsigned int cpu = cpu_from_irq(irq);
- xen_evtchn_close(evtchn);
-
switch (type_from_irq(irq)) {
case IRQT_VIRQ:
per_cpu(virq_to_irq, cpu)[virq_from_irq(irq)] = -1;
@@ -800,6 +798,7 @@ static void __unbind_from_irq(unsigned int irq)
}
xen_irq_info_cleanup(info);
+ xen_evtchn_close(evtchn);
}
xen_free_irq(irq);
--
2.17.1
2
1
[PATCH openEuler-22.03-LTS] dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
by Jinjiang Tu 15 Apr '24
by Jinjiang Tu 15 Apr '24
15 Apr '24
From: Sergey Senozhatsky <senozhatsky(a)chromium.org>
stable inclusion
from stable-v5.10.198
commit c79300599923daaa30f417c75555d5566b3d31ae
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AXL
CVE: CVE-2023-52516
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit fb5a4315591dae307a65fc246ca80b5159d296e1 ]
__dma_entry_alloc_check_leak() calls into printk -> serial console
output (qcom geni) and grabs port->lock under free_entries_lock
spin lock, which is a reverse locking dependency chain as qcom_geni
IRQ handler can call into dma-debug code and grab free_entries_lock
under port->lock.
Move __dma_entry_alloc_check_leak() call out of free_entries_lock
scope so that we don't acquire serial console's port->lock under it.
Trimmed-down lockdep splat:
The existing dependency chain (in reverse order) is:
-> #2 (free_entries_lock){-.-.}-{2:2}:
_raw_spin_lock_irqsave+0x60/0x80
dma_entry_alloc+0x38/0x110
debug_dma_map_page+0x60/0xf8
dma_map_page_attrs+0x1e0/0x230
dma_map_single_attrs.constprop.0+0x6c/0xc8
geni_se_rx_dma_prep+0x40/0xcc
qcom_geni_serial_isr+0x310/0x510
__handle_irq_event_percpu+0x110/0x244
handle_irq_event_percpu+0x20/0x54
handle_irq_event+0x50/0x88
handle_fasteoi_irq+0xa4/0xcc
handle_irq_desc+0x28/0x40
generic_handle_domain_irq+0x24/0x30
gic_handle_irq+0xc4/0x148
do_interrupt_handler+0xa4/0xb0
el1_interrupt+0x34/0x64
el1h_64_irq_handler+0x18/0x24
el1h_64_irq+0x64/0x68
arch_local_irq_enable+0x4/0x8
____do_softirq+0x18/0x24
...
-> #1 (&port_lock_key){-.-.}-{2:2}:
_raw_spin_lock_irqsave+0x60/0x80
qcom_geni_serial_console_write+0x184/0x1dc
console_flush_all+0x344/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
register_console+0x230/0x38c
uart_add_one_port+0x338/0x494
qcom_geni_serial_probe+0x390/0x424
platform_probe+0x70/0xc0
really_probe+0x148/0x280
__driver_probe_device+0xfc/0x114
driver_probe_device+0x44/0x100
__device_attach_driver+0x64/0xdc
bus_for_each_drv+0xb0/0xd8
__device_attach+0xe4/0x140
device_initial_probe+0x1c/0x28
bus_probe_device+0x44/0xb0
device_add+0x538/0x668
of_device_add+0x44/0x50
of_platform_device_create_pdata+0x94/0xc8
of_platform_bus_create+0x270/0x304
of_platform_populate+0xac/0xc4
devm_of_platform_populate+0x60/0xac
geni_se_probe+0x154/0x160
platform_probe+0x70/0xc0
...
-> #0 (console_owner){-...}-{0:0}:
__lock_acquire+0xdf8/0x109c
lock_acquire+0x234/0x284
console_flush_all+0x330/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
dma_entry_alloc+0xb4/0x110
debug_dma_map_sg+0xdc/0x2f8
__dma_map_sg_attrs+0xac/0xe4
dma_map_sgtable+0x30/0x4c
get_pages+0x1d4/0x1e4 [msm]
msm_gem_pin_pages_locked+0x38/0xac [msm]
msm_gem_pin_vma_locked+0x58/0x88 [msm]
msm_ioctl_gem_submit+0xde4/0x13ac [msm]
drm_ioctl_kernel+0xe0/0x15c
drm_ioctl+0x2e8/0x3f4
vfs_ioctl+0x30/0x50
...
Chain exists of:
console_owner --> &port_lock_key --> free_entries_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(free_entries_lock);
lock(&port_lock_key);
lock(free_entries_lock);
lock(console_owner);
*** DEADLOCK ***
Call trace:
dump_backtrace+0xb4/0xf0
show_stack+0x20/0x30
dump_stack_lvl+0x60/0x84
dump_stack+0x18/0x24
print_circular_bug+0x1cc/0x234
check_noncircular+0x78/0xac
__lock_acquire+0xdf8/0x109c
lock_acquire+0x234/0x284
console_flush_all+0x330/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
dma_entry_alloc+0xb4/0x110
debug_dma_map_sg+0xdc/0x2f8
__dma_map_sg_attrs+0xac/0xe4
dma_map_sgtable+0x30/0x4c
get_pages+0x1d4/0x1e4 [msm]
msm_gem_pin_pages_locked+0x38/0xac [msm]
msm_gem_pin_vma_locked+0x58/0x88 [msm]
msm_ioctl_gem_submit+0xde4/0x13ac [msm]
drm_ioctl_kernel+0xe0/0x15c
drm_ioctl+0x2e8/0x3f4
vfs_ioctl+0x30/0x50
...
Reported-by: Rob Clark <robdclark(a)chromium.org>
Signed-off-by: Sergey Senozhatsky <senozhatsky(a)chromium.org>
Acked-by: Robin Murphy <robin.murphy(a)arm.com>
Signed-off-by: Christoph Hellwig <hch(a)lst.de>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: sanglipeng <sanglipeng1(a)jd.com>
Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com>
---
kernel/dma/debug.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
index ae9fc1ee6d20..026398308909 100644
--- a/kernel/dma/debug.c
+++ b/kernel/dma/debug.c
@@ -606,15 +606,19 @@ static struct dma_debug_entry *__dma_entry_alloc(void)
return entry;
}
-static void __dma_entry_alloc_check_leak(void)
+/*
+ * This should be called outside of free_entries_lock scope to avoid potential
+ * deadlocks with serial consoles that use DMA.
+ */
+static void __dma_entry_alloc_check_leak(u32 nr_entries)
{
- u32 tmp = nr_total_entries % nr_prealloc_entries;
+ u32 tmp = nr_entries % nr_prealloc_entries;
/* Shout each time we tick over some multiple of the initial pool */
if (tmp < DMA_DEBUG_DYNAMIC_ENTRIES) {
pr_info("dma_debug_entry pool grown to %u (%u00%%)\n",
- nr_total_entries,
- (nr_total_entries / nr_prealloc_entries));
+ nr_entries,
+ (nr_entries / nr_prealloc_entries));
}
}
@@ -625,8 +629,10 @@ static void __dma_entry_alloc_check_leak(void)
*/
static struct dma_debug_entry *dma_entry_alloc(void)
{
+ bool alloc_check_leak = false;
struct dma_debug_entry *entry;
unsigned long flags;
+ u32 nr_entries;
spin_lock_irqsave(&free_entries_lock, flags);
if (num_free_entries == 0) {
@@ -636,13 +642,17 @@ static struct dma_debug_entry *dma_entry_alloc(void)
pr_err("debugging out of memory - disabling\n");
return NULL;
}
- __dma_entry_alloc_check_leak();
+ alloc_check_leak = true;
+ nr_entries = nr_total_entries;
}
entry = __dma_entry_alloc();
spin_unlock_irqrestore(&free_entries_lock, flags);
+ if (alloc_check_leak)
+ __dma_entry_alloc_check_leak(nr_entries);
+
#ifdef CONFIG_STACKTRACE
entry->stack_len = stack_trace_save(entry->stack_entries,
ARRAY_SIZE(entry->stack_entries),
--
2.25.1
2
1
[PATCH openEuler-22.03-LTS-SP2] dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
by Jinjiang Tu 15 Apr '24
by Jinjiang Tu 15 Apr '24
15 Apr '24
From: Sergey Senozhatsky <senozhatsky(a)chromium.org>
stable inclusion
from stable-v5.10.198
commit c79300599923daaa30f417c75555d5566b3d31ae
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AXL
CVE: CVE-2023-52516
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit fb5a4315591dae307a65fc246ca80b5159d296e1 ]
__dma_entry_alloc_check_leak() calls into printk -> serial console
output (qcom geni) and grabs port->lock under free_entries_lock
spin lock, which is a reverse locking dependency chain as qcom_geni
IRQ handler can call into dma-debug code and grab free_entries_lock
under port->lock.
Move __dma_entry_alloc_check_leak() call out of free_entries_lock
scope so that we don't acquire serial console's port->lock under it.
Trimmed-down lockdep splat:
The existing dependency chain (in reverse order) is:
-> #2 (free_entries_lock){-.-.}-{2:2}:
_raw_spin_lock_irqsave+0x60/0x80
dma_entry_alloc+0x38/0x110
debug_dma_map_page+0x60/0xf8
dma_map_page_attrs+0x1e0/0x230
dma_map_single_attrs.constprop.0+0x6c/0xc8
geni_se_rx_dma_prep+0x40/0xcc
qcom_geni_serial_isr+0x310/0x510
__handle_irq_event_percpu+0x110/0x244
handle_irq_event_percpu+0x20/0x54
handle_irq_event+0x50/0x88
handle_fasteoi_irq+0xa4/0xcc
handle_irq_desc+0x28/0x40
generic_handle_domain_irq+0x24/0x30
gic_handle_irq+0xc4/0x148
do_interrupt_handler+0xa4/0xb0
el1_interrupt+0x34/0x64
el1h_64_irq_handler+0x18/0x24
el1h_64_irq+0x64/0x68
arch_local_irq_enable+0x4/0x8
____do_softirq+0x18/0x24
...
-> #1 (&port_lock_key){-.-.}-{2:2}:
_raw_spin_lock_irqsave+0x60/0x80
qcom_geni_serial_console_write+0x184/0x1dc
console_flush_all+0x344/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
register_console+0x230/0x38c
uart_add_one_port+0x338/0x494
qcom_geni_serial_probe+0x390/0x424
platform_probe+0x70/0xc0
really_probe+0x148/0x280
__driver_probe_device+0xfc/0x114
driver_probe_device+0x44/0x100
__device_attach_driver+0x64/0xdc
bus_for_each_drv+0xb0/0xd8
__device_attach+0xe4/0x140
device_initial_probe+0x1c/0x28
bus_probe_device+0x44/0xb0
device_add+0x538/0x668
of_device_add+0x44/0x50
of_platform_device_create_pdata+0x94/0xc8
of_platform_bus_create+0x270/0x304
of_platform_populate+0xac/0xc4
devm_of_platform_populate+0x60/0xac
geni_se_probe+0x154/0x160
platform_probe+0x70/0xc0
...
-> #0 (console_owner){-...}-{0:0}:
__lock_acquire+0xdf8/0x109c
lock_acquire+0x234/0x284
console_flush_all+0x330/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
dma_entry_alloc+0xb4/0x110
debug_dma_map_sg+0xdc/0x2f8
__dma_map_sg_attrs+0xac/0xe4
dma_map_sgtable+0x30/0x4c
get_pages+0x1d4/0x1e4 [msm]
msm_gem_pin_pages_locked+0x38/0xac [msm]
msm_gem_pin_vma_locked+0x58/0x88 [msm]
msm_ioctl_gem_submit+0xde4/0x13ac [msm]
drm_ioctl_kernel+0xe0/0x15c
drm_ioctl+0x2e8/0x3f4
vfs_ioctl+0x30/0x50
...
Chain exists of:
console_owner --> &port_lock_key --> free_entries_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(free_entries_lock);
lock(&port_lock_key);
lock(free_entries_lock);
lock(console_owner);
*** DEADLOCK ***
Call trace:
dump_backtrace+0xb4/0xf0
show_stack+0x20/0x30
dump_stack_lvl+0x60/0x84
dump_stack+0x18/0x24
print_circular_bug+0x1cc/0x234
check_noncircular+0x78/0xac
__lock_acquire+0xdf8/0x109c
lock_acquire+0x234/0x284
console_flush_all+0x330/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
dma_entry_alloc+0xb4/0x110
debug_dma_map_sg+0xdc/0x2f8
__dma_map_sg_attrs+0xac/0xe4
dma_map_sgtable+0x30/0x4c
get_pages+0x1d4/0x1e4 [msm]
msm_gem_pin_pages_locked+0x38/0xac [msm]
msm_gem_pin_vma_locked+0x58/0x88 [msm]
msm_ioctl_gem_submit+0xde4/0x13ac [msm]
drm_ioctl_kernel+0xe0/0x15c
drm_ioctl+0x2e8/0x3f4
vfs_ioctl+0x30/0x50
...
Reported-by: Rob Clark <robdclark(a)chromium.org>
Signed-off-by: Sergey Senozhatsky <senozhatsky(a)chromium.org>
Acked-by: Robin Murphy <robin.murphy(a)arm.com>
Signed-off-by: Christoph Hellwig <hch(a)lst.de>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: sanglipeng <sanglipeng1(a)jd.com>
Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com>
---
kernel/dma/debug.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
index ae9fc1ee6d20..026398308909 100644
--- a/kernel/dma/debug.c
+++ b/kernel/dma/debug.c
@@ -606,15 +606,19 @@ static struct dma_debug_entry *__dma_entry_alloc(void)
return entry;
}
-static void __dma_entry_alloc_check_leak(void)
+/*
+ * This should be called outside of free_entries_lock scope to avoid potential
+ * deadlocks with serial consoles that use DMA.
+ */
+static void __dma_entry_alloc_check_leak(u32 nr_entries)
{
- u32 tmp = nr_total_entries % nr_prealloc_entries;
+ u32 tmp = nr_entries % nr_prealloc_entries;
/* Shout each time we tick over some multiple of the initial pool */
if (tmp < DMA_DEBUG_DYNAMIC_ENTRIES) {
pr_info("dma_debug_entry pool grown to %u (%u00%%)\n",
- nr_total_entries,
- (nr_total_entries / nr_prealloc_entries));
+ nr_entries,
+ (nr_entries / nr_prealloc_entries));
}
}
@@ -625,8 +629,10 @@ static void __dma_entry_alloc_check_leak(void)
*/
static struct dma_debug_entry *dma_entry_alloc(void)
{
+ bool alloc_check_leak = false;
struct dma_debug_entry *entry;
unsigned long flags;
+ u32 nr_entries;
spin_lock_irqsave(&free_entries_lock, flags);
if (num_free_entries == 0) {
@@ -636,13 +642,17 @@ static struct dma_debug_entry *dma_entry_alloc(void)
pr_err("debugging out of memory - disabling\n");
return NULL;
}
- __dma_entry_alloc_check_leak();
+ alloc_check_leak = true;
+ nr_entries = nr_total_entries;
}
entry = __dma_entry_alloc();
spin_unlock_irqrestore(&free_entries_lock, flags);
+ if (alloc_check_leak)
+ __dma_entry_alloc_check_leak(nr_entries);
+
#ifdef CONFIG_STACKTRACE
entry->stack_len = stack_trace_save(entry->stack_entries,
ARRAY_SIZE(entry->stack_entries),
--
2.25.1
2
1
[PATCH openEuler-22.03-LTS-SP1] dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
by Jinjiang Tu 15 Apr '24
by Jinjiang Tu 15 Apr '24
15 Apr '24
From: Sergey Senozhatsky <senozhatsky(a)chromium.org>
stable inclusion
from stable-v5.10.198
commit c79300599923daaa30f417c75555d5566b3d31ae
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AXL
CVE: CVE-2023-52516
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit fb5a4315591dae307a65fc246ca80b5159d296e1 ]
__dma_entry_alloc_check_leak() calls into printk -> serial console
output (qcom geni) and grabs port->lock under free_entries_lock
spin lock, which is a reverse locking dependency chain as qcom_geni
IRQ handler can call into dma-debug code and grab free_entries_lock
under port->lock.
Move __dma_entry_alloc_check_leak() call out of free_entries_lock
scope so that we don't acquire serial console's port->lock under it.
Trimmed-down lockdep splat:
The existing dependency chain (in reverse order) is:
-> #2 (free_entries_lock){-.-.}-{2:2}:
_raw_spin_lock_irqsave+0x60/0x80
dma_entry_alloc+0x38/0x110
debug_dma_map_page+0x60/0xf8
dma_map_page_attrs+0x1e0/0x230
dma_map_single_attrs.constprop.0+0x6c/0xc8
geni_se_rx_dma_prep+0x40/0xcc
qcom_geni_serial_isr+0x310/0x510
__handle_irq_event_percpu+0x110/0x244
handle_irq_event_percpu+0x20/0x54
handle_irq_event+0x50/0x88
handle_fasteoi_irq+0xa4/0xcc
handle_irq_desc+0x28/0x40
generic_handle_domain_irq+0x24/0x30
gic_handle_irq+0xc4/0x148
do_interrupt_handler+0xa4/0xb0
el1_interrupt+0x34/0x64
el1h_64_irq_handler+0x18/0x24
el1h_64_irq+0x64/0x68
arch_local_irq_enable+0x4/0x8
____do_softirq+0x18/0x24
...
-> #1 (&port_lock_key){-.-.}-{2:2}:
_raw_spin_lock_irqsave+0x60/0x80
qcom_geni_serial_console_write+0x184/0x1dc
console_flush_all+0x344/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
register_console+0x230/0x38c
uart_add_one_port+0x338/0x494
qcom_geni_serial_probe+0x390/0x424
platform_probe+0x70/0xc0
really_probe+0x148/0x280
__driver_probe_device+0xfc/0x114
driver_probe_device+0x44/0x100
__device_attach_driver+0x64/0xdc
bus_for_each_drv+0xb0/0xd8
__device_attach+0xe4/0x140
device_initial_probe+0x1c/0x28
bus_probe_device+0x44/0xb0
device_add+0x538/0x668
of_device_add+0x44/0x50
of_platform_device_create_pdata+0x94/0xc8
of_platform_bus_create+0x270/0x304
of_platform_populate+0xac/0xc4
devm_of_platform_populate+0x60/0xac
geni_se_probe+0x154/0x160
platform_probe+0x70/0xc0
...
-> #0 (console_owner){-...}-{0:0}:
__lock_acquire+0xdf8/0x109c
lock_acquire+0x234/0x284
console_flush_all+0x330/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
dma_entry_alloc+0xb4/0x110
debug_dma_map_sg+0xdc/0x2f8
__dma_map_sg_attrs+0xac/0xe4
dma_map_sgtable+0x30/0x4c
get_pages+0x1d4/0x1e4 [msm]
msm_gem_pin_pages_locked+0x38/0xac [msm]
msm_gem_pin_vma_locked+0x58/0x88 [msm]
msm_ioctl_gem_submit+0xde4/0x13ac [msm]
drm_ioctl_kernel+0xe0/0x15c
drm_ioctl+0x2e8/0x3f4
vfs_ioctl+0x30/0x50
...
Chain exists of:
console_owner --> &port_lock_key --> free_entries_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(free_entries_lock);
lock(&port_lock_key);
lock(free_entries_lock);
lock(console_owner);
*** DEADLOCK ***
Call trace:
dump_backtrace+0xb4/0xf0
show_stack+0x20/0x30
dump_stack_lvl+0x60/0x84
dump_stack+0x18/0x24
print_circular_bug+0x1cc/0x234
check_noncircular+0x78/0xac
__lock_acquire+0xdf8/0x109c
lock_acquire+0x234/0x284
console_flush_all+0x330/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
dma_entry_alloc+0xb4/0x110
debug_dma_map_sg+0xdc/0x2f8
__dma_map_sg_attrs+0xac/0xe4
dma_map_sgtable+0x30/0x4c
get_pages+0x1d4/0x1e4 [msm]
msm_gem_pin_pages_locked+0x38/0xac [msm]
msm_gem_pin_vma_locked+0x58/0x88 [msm]
msm_ioctl_gem_submit+0xde4/0x13ac [msm]
drm_ioctl_kernel+0xe0/0x15c
drm_ioctl+0x2e8/0x3f4
vfs_ioctl+0x30/0x50
...
Reported-by: Rob Clark <robdclark(a)chromium.org>
Signed-off-by: Sergey Senozhatsky <senozhatsky(a)chromium.org>
Acked-by: Robin Murphy <robin.murphy(a)arm.com>
Signed-off-by: Christoph Hellwig <hch(a)lst.de>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: sanglipeng <sanglipeng1(a)jd.com>
Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com>
---
kernel/dma/debug.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
index ae9fc1ee6d20..026398308909 100644
--- a/kernel/dma/debug.c
+++ b/kernel/dma/debug.c
@@ -606,15 +606,19 @@ static struct dma_debug_entry *__dma_entry_alloc(void)
return entry;
}
-static void __dma_entry_alloc_check_leak(void)
+/*
+ * This should be called outside of free_entries_lock scope to avoid potential
+ * deadlocks with serial consoles that use DMA.
+ */
+static void __dma_entry_alloc_check_leak(u32 nr_entries)
{
- u32 tmp = nr_total_entries % nr_prealloc_entries;
+ u32 tmp = nr_entries % nr_prealloc_entries;
/* Shout each time we tick over some multiple of the initial pool */
if (tmp < DMA_DEBUG_DYNAMIC_ENTRIES) {
pr_info("dma_debug_entry pool grown to %u (%u00%%)\n",
- nr_total_entries,
- (nr_total_entries / nr_prealloc_entries));
+ nr_entries,
+ (nr_entries / nr_prealloc_entries));
}
}
@@ -625,8 +629,10 @@ static void __dma_entry_alloc_check_leak(void)
*/
static struct dma_debug_entry *dma_entry_alloc(void)
{
+ bool alloc_check_leak = false;
struct dma_debug_entry *entry;
unsigned long flags;
+ u32 nr_entries;
spin_lock_irqsave(&free_entries_lock, flags);
if (num_free_entries == 0) {
@@ -636,13 +642,17 @@ static struct dma_debug_entry *dma_entry_alloc(void)
pr_err("debugging out of memory - disabling\n");
return NULL;
}
- __dma_entry_alloc_check_leak();
+ alloc_check_leak = true;
+ nr_entries = nr_total_entries;
}
entry = __dma_entry_alloc();
spin_unlock_irqrestore(&free_entries_lock, flags);
+ if (alloc_check_leak)
+ __dma_entry_alloc_check_leak(nr_entries);
+
#ifdef CONFIG_STACKTRACE
entry->stack_len = stack_trace_save(entry->stack_entries,
ARRAY_SIZE(entry->stack_entries),
--
2.25.1
2
1
[PATCH openEuler-22.03-LTS-SP2] wifi: rt2x00: restart beacon queue when hardware reset
by Pu Lehui 15 Apr '24
by Pu Lehui 15 Apr '24
15 Apr '24
From: Shiji Yang <yangshiji66(a)outlook.com>
stable inclusion
from stable-v5.10.210
commit 69e905beca193125820c201ab3db4fb0e245124e
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GO9
CVE: CVE-2023-52595
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit a11d965a218f0cd95b13fe44d0bcd8a20ce134a8 ]
When a hardware reset is triggered, all registers are reset, so all
queues are forced to stop in hardware interface. However, mac80211
will not automatically stop the queue. If we don't manually stop the
beacon queue, the queue will be deadlocked and unable to start again.
This patch fixes the issue where Apple devices cannot connect to the
AP after calling ieee80211_restart_hw().
Signed-off-by: Shiji Yang <yangshiji66(a)outlook.com>
Acked-by: Stanislaw Gruszka <stf_xl(a)wp.pl>
Signed-off-by: Kalle Valo <kvalo(a)kernel.org>
Link: https://lore.kernel.org/r/TYAP286MB031530EB6D98DCE4DF20766CBCA4A@TYAP286MB0…
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Pu Lehui <pulehui(a)huawei.com>
---
drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 3 +++
drivers/net/wireless/ralink/rt2x00/rt2x00mac.c | 11 +++++++++++
2 files changed, 14 insertions(+)
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
index b04f76551ca4..be3c153ab3b0 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
@@ -101,6 +101,7 @@ void rt2x00lib_disable_radio(struct rt2x00_dev *rt2x00dev)
rt2x00link_stop_tuner(rt2x00dev);
rt2x00queue_stop_queues(rt2x00dev);
rt2x00queue_flush_queues(rt2x00dev, true);
+ rt2x00queue_stop_queue(rt2x00dev->bcn);
/*
* Disable radio.
@@ -1272,6 +1273,7 @@ int rt2x00lib_start(struct rt2x00_dev *rt2x00dev)
rt2x00dev->intf_ap_count = 0;
rt2x00dev->intf_sta_count = 0;
rt2x00dev->intf_associated = 0;
+ rt2x00dev->intf_beaconing = 0;
/* Enable the radio */
retval = rt2x00lib_enable_radio(rt2x00dev);
@@ -1298,6 +1300,7 @@ void rt2x00lib_stop(struct rt2x00_dev *rt2x00dev)
rt2x00dev->intf_ap_count = 0;
rt2x00dev->intf_sta_count = 0;
rt2x00dev->intf_associated = 0;
+ rt2x00dev->intf_beaconing = 0;
}
static inline void rt2x00lib_set_if_combinations(struct rt2x00_dev *rt2x00dev)
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
index 2f68a31072ae..795bd3b0ebd8 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
@@ -599,6 +599,17 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
*/
if (changes & BSS_CHANGED_BEACON_ENABLED) {
mutex_lock(&intf->beacon_skb_mutex);
+
+ /*
+ * Clear the 'enable_beacon' flag and clear beacon because
+ * the beacon queue has been stopped after hardware reset.
+ */
+ if (test_bit(DEVICE_STATE_RESET, &rt2x00dev->flags) &&
+ intf->enable_beacon) {
+ intf->enable_beacon = false;
+ rt2x00queue_clear_beacon(rt2x00dev, vif);
+ }
+
if (!bss_conf->enable_beacon && intf->enable_beacon) {
rt2x00dev->intf_beaconing--;
intf->enable_beacon = false;
--
2.34.1
2
1
[PATCH openEuler-22.03-LTS-SP1] wifi: rt2x00: restart beacon queue when hardware reset
by Pu Lehui 15 Apr '24
by Pu Lehui 15 Apr '24
15 Apr '24
From: Shiji Yang <yangshiji66(a)outlook.com>
stable inclusion
from stable-v5.10.210
commit 69e905beca193125820c201ab3db4fb0e245124e
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GO9
CVE: CVE-2023-52595
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit a11d965a218f0cd95b13fe44d0bcd8a20ce134a8 ]
When a hardware reset is triggered, all registers are reset, so all
queues are forced to stop in hardware interface. However, mac80211
will not automatically stop the queue. If we don't manually stop the
beacon queue, the queue will be deadlocked and unable to start again.
This patch fixes the issue where Apple devices cannot connect to the
AP after calling ieee80211_restart_hw().
Signed-off-by: Shiji Yang <yangshiji66(a)outlook.com>
Acked-by: Stanislaw Gruszka <stf_xl(a)wp.pl>
Signed-off-by: Kalle Valo <kvalo(a)kernel.org>
Link: https://lore.kernel.org/r/TYAP286MB031530EB6D98DCE4DF20766CBCA4A@TYAP286MB0…
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Pu Lehui <pulehui(a)huawei.com>
---
drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 3 +++
drivers/net/wireless/ralink/rt2x00/rt2x00mac.c | 11 +++++++++++
2 files changed, 14 insertions(+)
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
index b04f76551ca4..be3c153ab3b0 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
@@ -101,6 +101,7 @@ void rt2x00lib_disable_radio(struct rt2x00_dev *rt2x00dev)
rt2x00link_stop_tuner(rt2x00dev);
rt2x00queue_stop_queues(rt2x00dev);
rt2x00queue_flush_queues(rt2x00dev, true);
+ rt2x00queue_stop_queue(rt2x00dev->bcn);
/*
* Disable radio.
@@ -1272,6 +1273,7 @@ int rt2x00lib_start(struct rt2x00_dev *rt2x00dev)
rt2x00dev->intf_ap_count = 0;
rt2x00dev->intf_sta_count = 0;
rt2x00dev->intf_associated = 0;
+ rt2x00dev->intf_beaconing = 0;
/* Enable the radio */
retval = rt2x00lib_enable_radio(rt2x00dev);
@@ -1298,6 +1300,7 @@ void rt2x00lib_stop(struct rt2x00_dev *rt2x00dev)
rt2x00dev->intf_ap_count = 0;
rt2x00dev->intf_sta_count = 0;
rt2x00dev->intf_associated = 0;
+ rt2x00dev->intf_beaconing = 0;
}
static inline void rt2x00lib_set_if_combinations(struct rt2x00_dev *rt2x00dev)
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
index 2f68a31072ae..795bd3b0ebd8 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
@@ -599,6 +599,17 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
*/
if (changes & BSS_CHANGED_BEACON_ENABLED) {
mutex_lock(&intf->beacon_skb_mutex);
+
+ /*
+ * Clear the 'enable_beacon' flag and clear beacon because
+ * the beacon queue has been stopped after hardware reset.
+ */
+ if (test_bit(DEVICE_STATE_RESET, &rt2x00dev->flags) &&
+ intf->enable_beacon) {
+ intf->enable_beacon = false;
+ rt2x00queue_clear_beacon(rt2x00dev, vif);
+ }
+
if (!bss_conf->enable_beacon && intf->enable_beacon) {
rt2x00dev->intf_beaconing--;
intf->enable_beacon = false;
--
2.34.1
2
1
[PATCH openEuler-22.03-LTS] wifi: rt2x00: restart beacon queue when hardware reset
by Pu Lehui 15 Apr '24
by Pu Lehui 15 Apr '24
15 Apr '24
From: Shiji Yang <yangshiji66(a)outlook.com>
stable inclusion
from stable-v5.10.210
commit 69e905beca193125820c201ab3db4fb0e245124e
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GO9
CVE: CVE-2023-52595
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit a11d965a218f0cd95b13fe44d0bcd8a20ce134a8 ]
When a hardware reset is triggered, all registers are reset, so all
queues are forced to stop in hardware interface. However, mac80211
will not automatically stop the queue. If we don't manually stop the
beacon queue, the queue will be deadlocked and unable to start again.
This patch fixes the issue where Apple devices cannot connect to the
AP after calling ieee80211_restart_hw().
Signed-off-by: Shiji Yang <yangshiji66(a)outlook.com>
Acked-by: Stanislaw Gruszka <stf_xl(a)wp.pl>
Signed-off-by: Kalle Valo <kvalo(a)kernel.org>
Link: https://lore.kernel.org/r/TYAP286MB031530EB6D98DCE4DF20766CBCA4A@TYAP286MB0…
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Pu Lehui <pulehui(a)huawei.com>
---
drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 3 +++
drivers/net/wireless/ralink/rt2x00/rt2x00mac.c | 11 +++++++++++
2 files changed, 14 insertions(+)
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
index b04f76551ca4..be3c153ab3b0 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
@@ -101,6 +101,7 @@ void rt2x00lib_disable_radio(struct rt2x00_dev *rt2x00dev)
rt2x00link_stop_tuner(rt2x00dev);
rt2x00queue_stop_queues(rt2x00dev);
rt2x00queue_flush_queues(rt2x00dev, true);
+ rt2x00queue_stop_queue(rt2x00dev->bcn);
/*
* Disable radio.
@@ -1272,6 +1273,7 @@ int rt2x00lib_start(struct rt2x00_dev *rt2x00dev)
rt2x00dev->intf_ap_count = 0;
rt2x00dev->intf_sta_count = 0;
rt2x00dev->intf_associated = 0;
+ rt2x00dev->intf_beaconing = 0;
/* Enable the radio */
retval = rt2x00lib_enable_radio(rt2x00dev);
@@ -1298,6 +1300,7 @@ void rt2x00lib_stop(struct rt2x00_dev *rt2x00dev)
rt2x00dev->intf_ap_count = 0;
rt2x00dev->intf_sta_count = 0;
rt2x00dev->intf_associated = 0;
+ rt2x00dev->intf_beaconing = 0;
}
static inline void rt2x00lib_set_if_combinations(struct rt2x00_dev *rt2x00dev)
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
index 2f68a31072ae..795bd3b0ebd8 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
@@ -599,6 +599,17 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
*/
if (changes & BSS_CHANGED_BEACON_ENABLED) {
mutex_lock(&intf->beacon_skb_mutex);
+
+ /*
+ * Clear the 'enable_beacon' flag and clear beacon because
+ * the beacon queue has been stopped after hardware reset.
+ */
+ if (test_bit(DEVICE_STATE_RESET, &rt2x00dev->flags) &&
+ intf->enable_beacon) {
+ intf->enable_beacon = false;
+ rt2x00queue_clear_beacon(rt2x00dev, vif);
+ }
+
if (!bss_conf->enable_beacon && intf->enable_beacon) {
rt2x00dev->intf_beaconing--;
intf->enable_beacon = false;
--
2.34.1
2
1
15 Apr '24
From: Shiji Yang <yangshiji66(a)outlook.com>
stable inclusion
from stable-v5.10.210
commit 69e905beca193125820c201ab3db4fb0e245124e
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GO9
CVE: CVE-2023-52595
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit a11d965a218f0cd95b13fe44d0bcd8a20ce134a8 ]
When a hardware reset is triggered, all registers are reset, so all
queues are forced to stop in hardware interface. However, mac80211
will not automatically stop the queue. If we don't manually stop the
beacon queue, the queue will be deadlocked and unable to start again.
This patch fixes the issue where Apple devices cannot connect to the
AP after calling ieee80211_restart_hw().
Signed-off-by: Shiji Yang <yangshiji66(a)outlook.com>
Acked-by: Stanislaw Gruszka <stf_xl(a)wp.pl>
Signed-off-by: Kalle Valo <kvalo(a)kernel.org>
Link: https://lore.kernel.org/r/TYAP286MB031530EB6D98DCE4DF20766CBCA4A@TYAP286MB0…
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Pu Lehui <pulehui(a)huawei.com>
---
drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 3 +++
drivers/net/wireless/ralink/rt2x00/rt2x00mac.c | 11 +++++++++++
2 files changed, 14 insertions(+)
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
index b04f76551ca4..be3c153ab3b0 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
@@ -101,6 +101,7 @@ void rt2x00lib_disable_radio(struct rt2x00_dev *rt2x00dev)
rt2x00link_stop_tuner(rt2x00dev);
rt2x00queue_stop_queues(rt2x00dev);
rt2x00queue_flush_queues(rt2x00dev, true);
+ rt2x00queue_stop_queue(rt2x00dev->bcn);
/*
* Disable radio.
@@ -1272,6 +1273,7 @@ int rt2x00lib_start(struct rt2x00_dev *rt2x00dev)
rt2x00dev->intf_ap_count = 0;
rt2x00dev->intf_sta_count = 0;
rt2x00dev->intf_associated = 0;
+ rt2x00dev->intf_beaconing = 0;
/* Enable the radio */
retval = rt2x00lib_enable_radio(rt2x00dev);
@@ -1298,6 +1300,7 @@ void rt2x00lib_stop(struct rt2x00_dev *rt2x00dev)
rt2x00dev->intf_ap_count = 0;
rt2x00dev->intf_sta_count = 0;
rt2x00dev->intf_associated = 0;
+ rt2x00dev->intf_beaconing = 0;
}
static inline void rt2x00lib_set_if_combinations(struct rt2x00_dev *rt2x00dev)
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
index 2f68a31072ae..795bd3b0ebd8 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
@@ -599,6 +599,17 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
*/
if (changes & BSS_CHANGED_BEACON_ENABLED) {
mutex_lock(&intf->beacon_skb_mutex);
+
+ /*
+ * Clear the 'enable_beacon' flag and clear beacon because
+ * the beacon queue has been stopped after hardware reset.
+ */
+ if (test_bit(DEVICE_STATE_RESET, &rt2x00dev->flags) &&
+ intf->enable_beacon) {
+ intf->enable_beacon = false;
+ rt2x00queue_clear_beacon(rt2x00dev, vif);
+ }
+
if (!bss_conf->enable_beacon && intf->enable_beacon) {
rt2x00dev->intf_beaconing--;
intf->enable_beacon = false;
--
2.34.1
2
1
[PATCH openEuler-22.03-LTS-SP2] cifs: Fix UAF in cifs_demultiplex_thread()
by ZhaoLong Wang 15 Apr '24
by ZhaoLong Wang 15 Apr '24
15 Apr '24
From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com>
mainline inclusion
from mainline-v6.6-rc3
commit d527f51331cace562393a8038d870b3e9916686f
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AUA
CVE: CVE-2023-52572
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
There is a UAF when xfstests on cifs:
BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160
Read of size 4 at addr ffff88810103fc08 by task cifsd/923
CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45
...
Call Trace:
<TASK>
dump_stack_lvl+0x34/0x44
print_report+0x171/0x472
kasan_report+0xad/0x130
kasan_check_range+0x145/0x1a0
smb2_is_network_name_deleted+0x27/0x160
cifs_demultiplex_thread.cold+0x172/0x5a4
kthread+0x165/0x1a0
ret_from_fork+0x1f/0x30
</TASK>
Allocated by task 923:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
__kasan_slab_alloc+0x54/0x60
kmem_cache_alloc+0x147/0x320
mempool_alloc+0xe1/0x260
cifs_small_buf_get+0x24/0x60
allocate_buffers+0xa1/0x1c0
cifs_demultiplex_thread+0x199/0x10d0
kthread+0x165/0x1a0
ret_from_fork+0x1f/0x30
Freed by task 921:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
kasan_save_free_info+0x2a/0x40
____kasan_slab_free+0x143/0x1b0
kmem_cache_free+0xe3/0x4d0
cifs_small_buf_release+0x29/0x90
SMB2_negotiate+0x8b7/0x1c60
smb2_negotiate+0x51/0x70
cifs_negotiate_protocol+0xf0/0x160
cifs_get_smb_ses+0x5fa/0x13c0
mount_get_conns+0x7a/0x750
cifs_mount+0x103/0xd00
cifs_smb3_do_mount+0x1dd/0xcb0
smb3_get_tree+0x1d5/0x300
vfs_get_tree+0x41/0xf0
path_mount+0x9b3/0xdd0
__x64_sys_mount+0x190/0x1d0
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
The UAF is because:
mount(pid: 921) | cifsd(pid: 923)
-------------------------------|-------------------------------
| cifs_demultiplex_thread
SMB2_negotiate |
cifs_send_recv |
compound_send_recv |
smb_send_rqst |
wait_for_response |
wait_event_state [1] |
| standard_receive3
| cifs_handle_standard
| handle_mid
| mid->resp_buf = buf; [2]
| dequeue_mid [3]
KILL the process [4] |
resp_iov[i].iov_base = buf |
free_rsp_buf [5] |
| is_network_name_deleted [6]
| callback
1. After send request to server, wait the response until
mid->mid_state != SUBMITTED;
2. Receive response from server, and set it to mid;
3. Set the mid state to RECEIVED;
4. Kill the process, the mid state already RECEIVED, get 0;
5. Handle and release the negotiate response;
6. UAF.
It can be easily reproduce with add some delay in [3] - [6].
Only sync call has the problem since async call's callback is
executed in cifsd process.
Add an extra state to mark the mid state to READY before wakeup the
waitter, then it can get the resp safely.
Fixes: ec637e3ffb6b ("[CIFS] Avoid extra large buffer allocation (and memcpy) in cifs_readpages")
Reviewed-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com>
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com>
Signed-off-by: Steve French <stfrench(a)microsoft.com>
Conflicts:
fs/cifs/transport.c
Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com>
---
fs/cifs/cifsglob.h | 1 +
fs/cifs/transport.c | 34 +++++++++++++++++++++++-----------
2 files changed, 24 insertions(+), 11 deletions(-)
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 92a7628560cc..a6697954fd68 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -1768,6 +1768,7 @@ static inline bool is_retryable_error(int error)
#define MID_RETRY_NEEDED 8 /* session closed while this request out */
#define MID_RESPONSE_MALFORMED 0x10
#define MID_SHUTDOWN 0x20
+#define MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */
/* Flags */
#define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 4409f56fc37e..488893962708 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -47,6 +47,8 @@
void
cifs_wake_up_task(struct mid_q_entry *mid)
{
+ if (mid->mid_state == MID_RESPONSE_RECEIVED)
+ mid->mid_state = MID_RESPONSE_READY;
wake_up_process(mid->callback_data);
}
@@ -99,7 +101,8 @@ static void _cifs_mid_q_entry_release(struct kref *refcount)
struct TCP_Server_Info *server = midEntry->server;
if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) &&
- midEntry->mid_state == MID_RESPONSE_RECEIVED &&
+ (midEntry->mid_state == MID_RESPONSE_RECEIVED ||
+ midEntry->mid_state == MID_RESPONSE_READY) &&
server->ops->handle_cancelled_mid)
server->ops->handle_cancelled_mid(midEntry, server);
@@ -733,7 +736,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ)
int error;
error = wait_event_freezekillable_unsafe(server->response_q,
- midQ->mid_state != MID_REQUEST_SUBMITTED);
+ midQ->mid_state != MID_REQUEST_SUBMITTED &&
+ midQ->mid_state != MID_RESPONSE_RECEIVED);
if (error < 0)
return -ERESTARTSYS;
@@ -885,7 +889,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server)
spin_lock(&GlobalMid_Lock);
switch (mid->mid_state) {
- case MID_RESPONSE_RECEIVED:
+ case MID_RESPONSE_READY:
spin_unlock(&GlobalMid_Lock);
return rc;
case MID_RETRY_NEEDED:
@@ -984,6 +988,9 @@ cifs_compound_callback(struct mid_q_entry *mid)
credits.instance = server->reconnect_instance;
add_credits(server, &credits, mid->optype);
+
+ if (mid->mid_state == MID_RESPONSE_RECEIVED)
+ mid->mid_state = MID_RESPONSE_READY;
}
static void
@@ -1172,7 +1179,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
send_cancel(server, &rqst[i], midQ[i]);
spin_lock(&GlobalMid_Lock);
midQ[i]->mid_flags |= MID_WAIT_CANCELLED;
- if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) {
+ if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED ||
+ midQ[i]->mid_state == MID_RESPONSE_RECEIVED) {
midQ[i]->callback = cifs_cancelled_callback;
cancelled_mid[i] = true;
credits[i].value = 0;
@@ -1193,7 +1201,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
}
if (!midQ[i]->resp_buf ||
- midQ[i]->mid_state != MID_RESPONSE_RECEIVED) {
+ midQ[i]->mid_state != MID_RESPONSE_READY) {
rc = -EIO;
cifs_dbg(FYI, "Bad MID state?\n");
goto out;
@@ -1372,7 +1380,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses,
if (rc != 0) {
send_cancel(server, &rqst, midQ);
spin_lock(&GlobalMid_Lock);
- if (midQ->mid_state == MID_REQUEST_SUBMITTED) {
+ if (midQ->mid_state == MID_REQUEST_SUBMITTED ||
+ midQ->mid_state == MID_RESPONSE_RECEIVED) {
/* no longer considered to be "in-flight" */
midQ->callback = DeleteMidQEntry;
spin_unlock(&GlobalMid_Lock);
@@ -1389,7 +1398,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses,
}
if (!midQ->resp_buf || !out_buf ||
- midQ->mid_state != MID_RESPONSE_RECEIVED) {
+ midQ->mid_state != MID_RESPONSE_READY) {
rc = -EIO;
cifs_server_dbg(VFS, "Bad MID state?\n");
goto out;
@@ -1509,13 +1518,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
/* Wait for a reply - allow signals to interrupt. */
rc = wait_event_interruptible(server->response_q,
- (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) ||
+ (!(midQ->mid_state == MID_REQUEST_SUBMITTED ||
+ midQ->mid_state == MID_RESPONSE_RECEIVED)) ||
((server->tcpStatus != CifsGood) &&
(server->tcpStatus != CifsNew)));
/* Were we interrupted by a signal ? */
if ((rc == -ERESTARTSYS) &&
- (midQ->mid_state == MID_REQUEST_SUBMITTED) &&
+ (midQ->mid_state == MID_REQUEST_SUBMITTED ||
+ midQ->mid_state == MID_RESPONSE_RECEIVED) &&
((server->tcpStatus == CifsGood) ||
(server->tcpStatus == CifsNew))) {
@@ -1545,7 +1556,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
if (rc) {
send_cancel(server, &rqst, midQ);
spin_lock(&GlobalMid_Lock);
- if (midQ->mid_state == MID_REQUEST_SUBMITTED) {
+ if (midQ->mid_state == MID_REQUEST_SUBMITTED ||
+ midQ->mid_state == MID_RESPONSE_RECEIVED) {
/* no longer considered to be "in-flight" */
midQ->callback = DeleteMidQEntry;
spin_unlock(&GlobalMid_Lock);
@@ -1563,7 +1575,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
return rc;
/* rcvd frame is ok */
- if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) {
+ if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) {
rc = -EIO;
cifs_tcon_dbg(VFS, "Bad MID state?\n");
goto out;
--
2.39.2
2
1
[PATCH openEuler-22.03-LTS-SP1] cifs: Fix UAF in cifs_demultiplex_thread()
by ZhaoLong Wang 15 Apr '24
by ZhaoLong Wang 15 Apr '24
15 Apr '24
From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com>
mainline inclusion
from mainline-v6.6-rc3
commit d527f51331cace562393a8038d870b3e9916686f
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AUA
CVE: CVE-2023-52572
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
There is a UAF when xfstests on cifs:
BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160
Read of size 4 at addr ffff88810103fc08 by task cifsd/923
CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45
...
Call Trace:
<TASK>
dump_stack_lvl+0x34/0x44
print_report+0x171/0x472
kasan_report+0xad/0x130
kasan_check_range+0x145/0x1a0
smb2_is_network_name_deleted+0x27/0x160
cifs_demultiplex_thread.cold+0x172/0x5a4
kthread+0x165/0x1a0
ret_from_fork+0x1f/0x30
</TASK>
Allocated by task 923:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
__kasan_slab_alloc+0x54/0x60
kmem_cache_alloc+0x147/0x320
mempool_alloc+0xe1/0x260
cifs_small_buf_get+0x24/0x60
allocate_buffers+0xa1/0x1c0
cifs_demultiplex_thread+0x199/0x10d0
kthread+0x165/0x1a0
ret_from_fork+0x1f/0x30
Freed by task 921:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
kasan_save_free_info+0x2a/0x40
____kasan_slab_free+0x143/0x1b0
kmem_cache_free+0xe3/0x4d0
cifs_small_buf_release+0x29/0x90
SMB2_negotiate+0x8b7/0x1c60
smb2_negotiate+0x51/0x70
cifs_negotiate_protocol+0xf0/0x160
cifs_get_smb_ses+0x5fa/0x13c0
mount_get_conns+0x7a/0x750
cifs_mount+0x103/0xd00
cifs_smb3_do_mount+0x1dd/0xcb0
smb3_get_tree+0x1d5/0x300
vfs_get_tree+0x41/0xf0
path_mount+0x9b3/0xdd0
__x64_sys_mount+0x190/0x1d0
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
The UAF is because:
mount(pid: 921) | cifsd(pid: 923)
-------------------------------|-------------------------------
| cifs_demultiplex_thread
SMB2_negotiate |
cifs_send_recv |
compound_send_recv |
smb_send_rqst |
wait_for_response |
wait_event_state [1] |
| standard_receive3
| cifs_handle_standard
| handle_mid
| mid->resp_buf = buf; [2]
| dequeue_mid [3]
KILL the process [4] |
resp_iov[i].iov_base = buf |
free_rsp_buf [5] |
| is_network_name_deleted [6]
| callback
1. After send request to server, wait the response until
mid->mid_state != SUBMITTED;
2. Receive response from server, and set it to mid;
3. Set the mid state to RECEIVED;
4. Kill the process, the mid state already RECEIVED, get 0;
5. Handle and release the negotiate response;
6. UAF.
It can be easily reproduce with add some delay in [3] - [6].
Only sync call has the problem since async call's callback is
executed in cifsd process.
Add an extra state to mark the mid state to READY before wakeup the
waitter, then it can get the resp safely.
Fixes: ec637e3ffb6b ("[CIFS] Avoid extra large buffer allocation (and memcpy) in cifs_readpages")
Reviewed-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com>
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com>
Signed-off-by: Steve French <stfrench(a)microsoft.com>
Conflicts:
fs/cifs/transport.c
Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com>
---
fs/cifs/cifsglob.h | 1 +
fs/cifs/transport.c | 34 +++++++++++++++++++++++-----------
2 files changed, 24 insertions(+), 11 deletions(-)
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 196285b0fe46..cb50b1c91aa6 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -1765,6 +1765,7 @@ static inline bool is_retryable_error(int error)
#define MID_RETRY_NEEDED 8 /* session closed while this request out */
#define MID_RESPONSE_MALFORMED 0x10
#define MID_SHUTDOWN 0x20
+#define MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */
/* Flags */
#define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index b137006f0fd2..d209f989bb70 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -47,6 +47,8 @@
void
cifs_wake_up_task(struct mid_q_entry *mid)
{
+ if (mid->mid_state == MID_RESPONSE_RECEIVED)
+ mid->mid_state = MID_RESPONSE_READY;
wake_up_process(mid->callback_data);
}
@@ -99,7 +101,8 @@ static void _cifs_mid_q_entry_release(struct kref *refcount)
struct TCP_Server_Info *server = midEntry->server;
if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) &&
- midEntry->mid_state == MID_RESPONSE_RECEIVED &&
+ (midEntry->mid_state == MID_RESPONSE_RECEIVED ||
+ midEntry->mid_state == MID_RESPONSE_READY) &&
server->ops->handle_cancelled_mid)
server->ops->handle_cancelled_mid(midEntry, server);
@@ -728,7 +731,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ)
int error;
error = wait_event_freezekillable_unsafe(server->response_q,
- midQ->mid_state != MID_REQUEST_SUBMITTED);
+ midQ->mid_state != MID_REQUEST_SUBMITTED &&
+ midQ->mid_state != MID_RESPONSE_RECEIVED);
if (error < 0)
return -ERESTARTSYS;
@@ -882,7 +886,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server)
spin_lock(&GlobalMid_Lock);
switch (mid->mid_state) {
- case MID_RESPONSE_RECEIVED:
+ case MID_RESPONSE_READY:
spin_unlock(&GlobalMid_Lock);
return rc;
case MID_RETRY_NEEDED:
@@ -981,6 +985,9 @@ cifs_compound_callback(struct mid_q_entry *mid)
credits.instance = server->reconnect_instance;
add_credits(server, &credits, mid->optype);
+
+ if (mid->mid_state == MID_RESPONSE_RECEIVED)
+ mid->mid_state = MID_RESPONSE_READY;
}
static void
@@ -1171,7 +1178,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
send_cancel(server, &rqst[i], midQ[i]);
spin_lock(&GlobalMid_Lock);
midQ[i]->mid_flags |= MID_WAIT_CANCELLED;
- if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) {
+ if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED ||
+ midQ[i]->mid_state == MID_RESPONSE_RECEIVED) {
midQ[i]->callback = cifs_cancelled_callback;
cancelled_mid[i] = true;
credits[i].value = 0;
@@ -1192,7 +1200,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
}
if (!midQ[i]->resp_buf ||
- midQ[i]->mid_state != MID_RESPONSE_RECEIVED) {
+ midQ[i]->mid_state != MID_RESPONSE_READY) {
rc = -EIO;
cifs_dbg(FYI, "Bad MID state?\n");
goto out;
@@ -1373,7 +1381,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses,
if (rc != 0) {
send_cancel(server, &rqst, midQ);
spin_lock(&GlobalMid_Lock);
- if (midQ->mid_state == MID_REQUEST_SUBMITTED) {
+ if (midQ->mid_state == MID_REQUEST_SUBMITTED ||
+ midQ->mid_state == MID_RESPONSE_RECEIVED) {
/* no longer considered to be "in-flight" */
midQ->callback = DeleteMidQEntry;
spin_unlock(&GlobalMid_Lock);
@@ -1390,7 +1399,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses,
}
if (!midQ->resp_buf || !out_buf ||
- midQ->mid_state != MID_RESPONSE_RECEIVED) {
+ midQ->mid_state != MID_RESPONSE_READY) {
rc = -EIO;
cifs_server_dbg(VFS, "Bad MID state?\n");
goto out;
@@ -1512,13 +1521,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
/* Wait for a reply - allow signals to interrupt. */
rc = wait_event_interruptible(server->response_q,
- (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) ||
+ (!(midQ->mid_state == MID_REQUEST_SUBMITTED ||
+ midQ->mid_state == MID_RESPONSE_RECEIVED)) ||
((server->tcpStatus != CifsGood) &&
(server->tcpStatus != CifsNew)));
/* Were we interrupted by a signal ? */
if ((rc == -ERESTARTSYS) &&
- (midQ->mid_state == MID_REQUEST_SUBMITTED) &&
+ (midQ->mid_state == MID_REQUEST_SUBMITTED ||
+ midQ->mid_state == MID_RESPONSE_RECEIVED) &&
((server->tcpStatus == CifsGood) ||
(server->tcpStatus == CifsNew))) {
@@ -1548,7 +1559,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
if (rc) {
send_cancel(server, &rqst, midQ);
spin_lock(&GlobalMid_Lock);
- if (midQ->mid_state == MID_REQUEST_SUBMITTED) {
+ if (midQ->mid_state == MID_REQUEST_SUBMITTED ||
+ midQ->mid_state == MID_RESPONSE_RECEIVED) {
/* no longer considered to be "in-flight" */
midQ->callback = DeleteMidQEntry;
spin_unlock(&GlobalMid_Lock);
@@ -1566,7 +1578,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
return rc;
/* rcvd frame is ok */
- if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) {
+ if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) {
rc = -EIO;
cifs_tcon_dbg(VFS, "Bad MID state?\n");
goto out;
--
2.39.2
2
1
15 Apr '24
From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com>
mainline inclusion
from mainline-v6.6-rc3
commit d527f51331cace562393a8038d870b3e9916686f
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AUA
CVE: CVE-2023-52572
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
There is a UAF when xfstests on cifs:
BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160
Read of size 4 at addr ffff88810103fc08 by task cifsd/923
CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45
...
Call Trace:
<TASK>
dump_stack_lvl+0x34/0x44
print_report+0x171/0x472
kasan_report+0xad/0x130
kasan_check_range+0x145/0x1a0
smb2_is_network_name_deleted+0x27/0x160
cifs_demultiplex_thread.cold+0x172/0x5a4
kthread+0x165/0x1a0
ret_from_fork+0x1f/0x30
</TASK>
Allocated by task 923:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
__kasan_slab_alloc+0x54/0x60
kmem_cache_alloc+0x147/0x320
mempool_alloc+0xe1/0x260
cifs_small_buf_get+0x24/0x60
allocate_buffers+0xa1/0x1c0
cifs_demultiplex_thread+0x199/0x10d0
kthread+0x165/0x1a0
ret_from_fork+0x1f/0x30
Freed by task 921:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
kasan_save_free_info+0x2a/0x40
____kasan_slab_free+0x143/0x1b0
kmem_cache_free+0xe3/0x4d0
cifs_small_buf_release+0x29/0x90
SMB2_negotiate+0x8b7/0x1c60
smb2_negotiate+0x51/0x70
cifs_negotiate_protocol+0xf0/0x160
cifs_get_smb_ses+0x5fa/0x13c0
mount_get_conns+0x7a/0x750
cifs_mount+0x103/0xd00
cifs_smb3_do_mount+0x1dd/0xcb0
smb3_get_tree+0x1d5/0x300
vfs_get_tree+0x41/0xf0
path_mount+0x9b3/0xdd0
__x64_sys_mount+0x190/0x1d0
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
The UAF is because:
mount(pid: 921) | cifsd(pid: 923)
-------------------------------|-------------------------------
| cifs_demultiplex_thread
SMB2_negotiate |
cifs_send_recv |
compound_send_recv |
smb_send_rqst |
wait_for_response |
wait_event_state [1] |
| standard_receive3
| cifs_handle_standard
| handle_mid
| mid->resp_buf = buf; [2]
| dequeue_mid [3]
KILL the process [4] |
resp_iov[i].iov_base = buf |
free_rsp_buf [5] |
| is_network_name_deleted [6]
| callback
1. After send request to server, wait the response until
mid->mid_state != SUBMITTED;
2. Receive response from server, and set it to mid;
3. Set the mid state to RECEIVED;
4. Kill the process, the mid state already RECEIVED, get 0;
5. Handle and release the negotiate response;
6. UAF.
It can be easily reproduce with add some delay in [3] - [6].
Only sync call has the problem since async call's callback is
executed in cifsd process.
Add an extra state to mark the mid state to READY before wakeup the
waitter, then it can get the resp safely.
Fixes: ec637e3ffb6b ("[CIFS] Avoid extra large buffer allocation (and memcpy) in cifs_readpages")
Reviewed-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com>
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com>
Signed-off-by: Steve French <stfrench(a)microsoft.com>
Conflicts:
fs/cifs/transport.c
Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com>
---
fs/cifs/cifsglob.h | 1 +
fs/cifs/transport.c | 34 +++++++++++++++++++++++-----------
2 files changed, 24 insertions(+), 11 deletions(-)
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 196285b0fe46..cb50b1c91aa6 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -1765,6 +1765,7 @@ static inline bool is_retryable_error(int error)
#define MID_RETRY_NEEDED 8 /* session closed while this request out */
#define MID_RESPONSE_MALFORMED 0x10
#define MID_SHUTDOWN 0x20
+#define MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */
/* Flags */
#define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 503a0056b60f..e1e21bbb07eb 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -47,6 +47,8 @@
void
cifs_wake_up_task(struct mid_q_entry *mid)
{
+ if (mid->mid_state == MID_RESPONSE_RECEIVED)
+ mid->mid_state = MID_RESPONSE_READY;
wake_up_process(mid->callback_data);
}
@@ -99,7 +101,8 @@ static void _cifs_mid_q_entry_release(struct kref *refcount)
struct TCP_Server_Info *server = midEntry->server;
if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) &&
- midEntry->mid_state == MID_RESPONSE_RECEIVED &&
+ (midEntry->mid_state == MID_RESPONSE_RECEIVED ||
+ midEntry->mid_state == MID_RESPONSE_READY) &&
server->ops->handle_cancelled_mid)
server->ops->handle_cancelled_mid(midEntry, server);
@@ -732,7 +735,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ)
int error;
error = wait_event_freezekillable_unsafe(server->response_q,
- midQ->mid_state != MID_REQUEST_SUBMITTED);
+ midQ->mid_state != MID_REQUEST_SUBMITTED &&
+ midQ->mid_state != MID_RESPONSE_RECEIVED);
if (error < 0)
return -ERESTARTSYS;
@@ -886,7 +890,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server)
spin_lock(&GlobalMid_Lock);
switch (mid->mid_state) {
- case MID_RESPONSE_RECEIVED:
+ case MID_RESPONSE_READY:
spin_unlock(&GlobalMid_Lock);
return rc;
case MID_RETRY_NEEDED:
@@ -985,6 +989,9 @@ cifs_compound_callback(struct mid_q_entry *mid)
credits.instance = server->reconnect_instance;
add_credits(server, &credits, mid->optype);
+
+ if (mid->mid_state == MID_RESPONSE_RECEIVED)
+ mid->mid_state = MID_RESPONSE_READY;
}
static void
@@ -1175,7 +1182,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
send_cancel(server, &rqst[i], midQ[i]);
spin_lock(&GlobalMid_Lock);
midQ[i]->mid_flags |= MID_WAIT_CANCELLED;
- if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) {
+ if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED ||
+ midQ[i]->mid_state == MID_RESPONSE_RECEIVED) {
midQ[i]->callback = cifs_cancelled_callback;
cancelled_mid[i] = true;
credits[i].value = 0;
@@ -1196,7 +1204,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
}
if (!midQ[i]->resp_buf ||
- midQ[i]->mid_state != MID_RESPONSE_RECEIVED) {
+ midQ[i]->mid_state != MID_RESPONSE_READY) {
rc = -EIO;
cifs_dbg(FYI, "Bad MID state?\n");
goto out;
@@ -1377,7 +1385,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses,
if (rc != 0) {
send_cancel(server, &rqst, midQ);
spin_lock(&GlobalMid_Lock);
- if (midQ->mid_state == MID_REQUEST_SUBMITTED) {
+ if (midQ->mid_state == MID_REQUEST_SUBMITTED ||
+ midQ->mid_state == MID_RESPONSE_RECEIVED) {
/* no longer considered to be "in-flight" */
midQ->callback = DeleteMidQEntry;
spin_unlock(&GlobalMid_Lock);
@@ -1394,7 +1403,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses,
}
if (!midQ->resp_buf || !out_buf ||
- midQ->mid_state != MID_RESPONSE_RECEIVED) {
+ midQ->mid_state != MID_RESPONSE_READY) {
rc = -EIO;
cifs_server_dbg(VFS, "Bad MID state?\n");
goto out;
@@ -1516,13 +1525,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
/* Wait for a reply - allow signals to interrupt. */
rc = wait_event_interruptible(server->response_q,
- (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) ||
+ (!(midQ->mid_state == MID_REQUEST_SUBMITTED ||
+ midQ->mid_state == MID_RESPONSE_RECEIVED)) ||
((server->tcpStatus != CifsGood) &&
(server->tcpStatus != CifsNew)));
/* Were we interrupted by a signal ? */
if ((rc == -ERESTARTSYS) &&
- (midQ->mid_state == MID_REQUEST_SUBMITTED) &&
+ (midQ->mid_state == MID_REQUEST_SUBMITTED ||
+ midQ->mid_state == MID_RESPONSE_RECEIVED) &&
((server->tcpStatus == CifsGood) ||
(server->tcpStatus == CifsNew))) {
@@ -1552,7 +1563,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
if (rc) {
send_cancel(server, &rqst, midQ);
spin_lock(&GlobalMid_Lock);
- if (midQ->mid_state == MID_REQUEST_SUBMITTED) {
+ if (midQ->mid_state == MID_REQUEST_SUBMITTED ||
+ midQ->mid_state == MID_RESPONSE_RECEIVED) {
/* no longer considered to be "in-flight" */
midQ->callback = DeleteMidQEntry;
spin_unlock(&GlobalMid_Lock);
@@ -1570,7 +1582,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
return rc;
/* rcvd frame is ok */
- if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) {
+ if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) {
rc = -EIO;
cifs_tcon_dbg(VFS, "Bad MID state?\n");
goto out;
--
2.39.2
2
1
From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com>
mainline inclusion
from mainline-v6.6-rc3
commit d527f51331cace562393a8038d870b3e9916686f
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AUA
CVE: CVE-2023-52572
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
There is a UAF when xfstests on cifs:
BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160
Read of size 4 at addr ffff88810103fc08 by task cifsd/923
CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45
...
Call Trace:
<TASK>
dump_stack_lvl+0x34/0x44
print_report+0x171/0x472
kasan_report+0xad/0x130
kasan_check_range+0x145/0x1a0
smb2_is_network_name_deleted+0x27/0x160
cifs_demultiplex_thread.cold+0x172/0x5a4
kthread+0x165/0x1a0
ret_from_fork+0x1f/0x30
</TASK>
Allocated by task 923:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
__kasan_slab_alloc+0x54/0x60
kmem_cache_alloc+0x147/0x320
mempool_alloc+0xe1/0x260
cifs_small_buf_get+0x24/0x60
allocate_buffers+0xa1/0x1c0
cifs_demultiplex_thread+0x199/0x10d0
kthread+0x165/0x1a0
ret_from_fork+0x1f/0x30
Freed by task 921:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
kasan_save_free_info+0x2a/0x40
____kasan_slab_free+0x143/0x1b0
kmem_cache_free+0xe3/0x4d0
cifs_small_buf_release+0x29/0x90
SMB2_negotiate+0x8b7/0x1c60
smb2_negotiate+0x51/0x70
cifs_negotiate_protocol+0xf0/0x160
cifs_get_smb_ses+0x5fa/0x13c0
mount_get_conns+0x7a/0x750
cifs_mount+0x103/0xd00
cifs_smb3_do_mount+0x1dd/0xcb0
smb3_get_tree+0x1d5/0x300
vfs_get_tree+0x41/0xf0
path_mount+0x9b3/0xdd0
__x64_sys_mount+0x190/0x1d0
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
The UAF is because:
mount(pid: 921) | cifsd(pid: 923)
-------------------------------|-------------------------------
| cifs_demultiplex_thread
SMB2_negotiate |
cifs_send_recv |
compound_send_recv |
smb_send_rqst |
wait_for_response |
wait_event_state [1] |
| standard_receive3
| cifs_handle_standard
| handle_mid
| mid->resp_buf = buf; [2]
| dequeue_mid [3]
KILL the process [4] |
resp_iov[i].iov_base = buf |
free_rsp_buf [5] |
| is_network_name_deleted [6]
| callback
1. After send request to server, wait the response until
mid->mid_state != SUBMITTED;
2. Receive response from server, and set it to mid;
3. Set the mid state to RECEIVED;
4. Kill the process, the mid state already RECEIVED, get 0;
5. Handle and release the negotiate response;
6. UAF.
It can be easily reproduce with add some delay in [3] - [6].
Only sync call has the problem since async call's callback is
executed in cifsd process.
Add an extra state to mark the mid state to READY before wakeup the
waitter, then it can get the resp safely.
Fixes: ec637e3ffb6b ("[CIFS] Avoid extra large buffer allocation (and memcpy) in cifs_readpages")
Reviewed-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com>
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com>
Signed-off-by: Steve French <stfrench(a)microsoft.com>
Conflicts:
fs/cifs/transport.c
Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com>
---
fs/cifs/cifsglob.h | 1 +
fs/cifs/transport.c | 34 +++++++++++++++++++++++-----------
2 files changed, 24 insertions(+), 11 deletions(-)
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 92a7628560cc..a6697954fd68 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -1768,6 +1768,7 @@ static inline bool is_retryable_error(int error)
#define MID_RETRY_NEEDED 8 /* session closed while this request out */
#define MID_RESPONSE_MALFORMED 0x10
#define MID_SHUTDOWN 0x20
+#define MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */
/* Flags */
#define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 4409f56fc37e..488893962708 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -47,6 +47,8 @@
void
cifs_wake_up_task(struct mid_q_entry *mid)
{
+ if (mid->mid_state == MID_RESPONSE_RECEIVED)
+ mid->mid_state = MID_RESPONSE_READY;
wake_up_process(mid->callback_data);
}
@@ -99,7 +101,8 @@ static void _cifs_mid_q_entry_release(struct kref *refcount)
struct TCP_Server_Info *server = midEntry->server;
if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) &&
- midEntry->mid_state == MID_RESPONSE_RECEIVED &&
+ (midEntry->mid_state == MID_RESPONSE_RECEIVED ||
+ midEntry->mid_state == MID_RESPONSE_READY) &&
server->ops->handle_cancelled_mid)
server->ops->handle_cancelled_mid(midEntry, server);
@@ -733,7 +736,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ)
int error;
error = wait_event_freezekillable_unsafe(server->response_q,
- midQ->mid_state != MID_REQUEST_SUBMITTED);
+ midQ->mid_state != MID_REQUEST_SUBMITTED &&
+ midQ->mid_state != MID_RESPONSE_RECEIVED);
if (error < 0)
return -ERESTARTSYS;
@@ -885,7 +889,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server)
spin_lock(&GlobalMid_Lock);
switch (mid->mid_state) {
- case MID_RESPONSE_RECEIVED:
+ case MID_RESPONSE_READY:
spin_unlock(&GlobalMid_Lock);
return rc;
case MID_RETRY_NEEDED:
@@ -984,6 +988,9 @@ cifs_compound_callback(struct mid_q_entry *mid)
credits.instance = server->reconnect_instance;
add_credits(server, &credits, mid->optype);
+
+ if (mid->mid_state == MID_RESPONSE_RECEIVED)
+ mid->mid_state = MID_RESPONSE_READY;
}
static void
@@ -1172,7 +1179,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
send_cancel(server, &rqst[i], midQ[i]);
spin_lock(&GlobalMid_Lock);
midQ[i]->mid_flags |= MID_WAIT_CANCELLED;
- if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) {
+ if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED ||
+ midQ[i]->mid_state == MID_RESPONSE_RECEIVED) {
midQ[i]->callback = cifs_cancelled_callback;
cancelled_mid[i] = true;
credits[i].value = 0;
@@ -1193,7 +1201,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
}
if (!midQ[i]->resp_buf ||
- midQ[i]->mid_state != MID_RESPONSE_RECEIVED) {
+ midQ[i]->mid_state != MID_RESPONSE_READY) {
rc = -EIO;
cifs_dbg(FYI, "Bad MID state?\n");
goto out;
@@ -1372,7 +1380,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses,
if (rc != 0) {
send_cancel(server, &rqst, midQ);
spin_lock(&GlobalMid_Lock);
- if (midQ->mid_state == MID_REQUEST_SUBMITTED) {
+ if (midQ->mid_state == MID_REQUEST_SUBMITTED ||
+ midQ->mid_state == MID_RESPONSE_RECEIVED) {
/* no longer considered to be "in-flight" */
midQ->callback = DeleteMidQEntry;
spin_unlock(&GlobalMid_Lock);
@@ -1389,7 +1398,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses,
}
if (!midQ->resp_buf || !out_buf ||
- midQ->mid_state != MID_RESPONSE_RECEIVED) {
+ midQ->mid_state != MID_RESPONSE_READY) {
rc = -EIO;
cifs_server_dbg(VFS, "Bad MID state?\n");
goto out;
@@ -1509,13 +1518,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
/* Wait for a reply - allow signals to interrupt. */
rc = wait_event_interruptible(server->response_q,
- (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) ||
+ (!(midQ->mid_state == MID_REQUEST_SUBMITTED ||
+ midQ->mid_state == MID_RESPONSE_RECEIVED)) ||
((server->tcpStatus != CifsGood) &&
(server->tcpStatus != CifsNew)));
/* Were we interrupted by a signal ? */
if ((rc == -ERESTARTSYS) &&
- (midQ->mid_state == MID_REQUEST_SUBMITTED) &&
+ (midQ->mid_state == MID_REQUEST_SUBMITTED ||
+ midQ->mid_state == MID_RESPONSE_RECEIVED) &&
((server->tcpStatus == CifsGood) ||
(server->tcpStatus == CifsNew))) {
@@ -1545,7 +1556,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
if (rc) {
send_cancel(server, &rqst, midQ);
spin_lock(&GlobalMid_Lock);
- if (midQ->mid_state == MID_REQUEST_SUBMITTED) {
+ if (midQ->mid_state == MID_REQUEST_SUBMITTED ||
+ midQ->mid_state == MID_RESPONSE_RECEIVED) {
/* no longer considered to be "in-flight" */
midQ->callback = DeleteMidQEntry;
spin_unlock(&GlobalMid_Lock);
@@ -1563,7 +1575,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
return rc;
/* rcvd frame is ok */
- if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) {
+ if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) {
rc = -EIO;
cifs_tcon_dbg(VFS, "Bad MID state?\n");
goto out;
--
2.39.2
2
1
[PATCH openEuler-22.03-LTS-SP1] dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
by Jinjiang Tu 15 Apr '24
by Jinjiang Tu 15 Apr '24
15 Apr '24
From: Sergey Senozhatsky <senozhatsky(a)chromium.org>
stable inclusion
from stable-v5.10.198
commit c79300599923daaa30f417c75555d5566b3d31ae
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I987V5
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit fb5a4315591dae307a65fc246ca80b5159d296e1 ]
__dma_entry_alloc_check_leak() calls into printk -> serial console
output (qcom geni) and grabs port->lock under free_entries_lock
spin lock, which is a reverse locking dependency chain as qcom_geni
IRQ handler can call into dma-debug code and grab free_entries_lock
under port->lock.
Move __dma_entry_alloc_check_leak() call out of free_entries_lock
scope so that we don't acquire serial console's port->lock under it.
Trimmed-down lockdep splat:
The existing dependency chain (in reverse order) is:
-> #2 (free_entries_lock){-.-.}-{2:2}:
_raw_spin_lock_irqsave+0x60/0x80
dma_entry_alloc+0x38/0x110
debug_dma_map_page+0x60/0xf8
dma_map_page_attrs+0x1e0/0x230
dma_map_single_attrs.constprop.0+0x6c/0xc8
geni_se_rx_dma_prep+0x40/0xcc
qcom_geni_serial_isr+0x310/0x510
__handle_irq_event_percpu+0x110/0x244
handle_irq_event_percpu+0x20/0x54
handle_irq_event+0x50/0x88
handle_fasteoi_irq+0xa4/0xcc
handle_irq_desc+0x28/0x40
generic_handle_domain_irq+0x24/0x30
gic_handle_irq+0xc4/0x148
do_interrupt_handler+0xa4/0xb0
el1_interrupt+0x34/0x64
el1h_64_irq_handler+0x18/0x24
el1h_64_irq+0x64/0x68
arch_local_irq_enable+0x4/0x8
____do_softirq+0x18/0x24
...
-> #1 (&port_lock_key){-.-.}-{2:2}:
_raw_spin_lock_irqsave+0x60/0x80
qcom_geni_serial_console_write+0x184/0x1dc
console_flush_all+0x344/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
register_console+0x230/0x38c
uart_add_one_port+0x338/0x494
qcom_geni_serial_probe+0x390/0x424
platform_probe+0x70/0xc0
really_probe+0x148/0x280
__driver_probe_device+0xfc/0x114
driver_probe_device+0x44/0x100
__device_attach_driver+0x64/0xdc
bus_for_each_drv+0xb0/0xd8
__device_attach+0xe4/0x140
device_initial_probe+0x1c/0x28
bus_probe_device+0x44/0xb0
device_add+0x538/0x668
of_device_add+0x44/0x50
of_platform_device_create_pdata+0x94/0xc8
of_platform_bus_create+0x270/0x304
of_platform_populate+0xac/0xc4
devm_of_platform_populate+0x60/0xac
geni_se_probe+0x154/0x160
platform_probe+0x70/0xc0
...
-> #0 (console_owner){-...}-{0:0}:
__lock_acquire+0xdf8/0x109c
lock_acquire+0x234/0x284
console_flush_all+0x330/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
dma_entry_alloc+0xb4/0x110
debug_dma_map_sg+0xdc/0x2f8
__dma_map_sg_attrs+0xac/0xe4
dma_map_sgtable+0x30/0x4c
get_pages+0x1d4/0x1e4 [msm]
msm_gem_pin_pages_locked+0x38/0xac [msm]
msm_gem_pin_vma_locked+0x58/0x88 [msm]
msm_ioctl_gem_submit+0xde4/0x13ac [msm]
drm_ioctl_kernel+0xe0/0x15c
drm_ioctl+0x2e8/0x3f4
vfs_ioctl+0x30/0x50
...
Chain exists of:
console_owner --> &port_lock_key --> free_entries_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(free_entries_lock);
lock(&port_lock_key);
lock(free_entries_lock);
lock(console_owner);
*** DEADLOCK ***
Call trace:
dump_backtrace+0xb4/0xf0
show_stack+0x20/0x30
dump_stack_lvl+0x60/0x84
dump_stack+0x18/0x24
print_circular_bug+0x1cc/0x234
check_noncircular+0x78/0xac
__lock_acquire+0xdf8/0x109c
lock_acquire+0x234/0x284
console_flush_all+0x330/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
dma_entry_alloc+0xb4/0x110
debug_dma_map_sg+0xdc/0x2f8
__dma_map_sg_attrs+0xac/0xe4
dma_map_sgtable+0x30/0x4c
get_pages+0x1d4/0x1e4 [msm]
msm_gem_pin_pages_locked+0x38/0xac [msm]
msm_gem_pin_vma_locked+0x58/0x88 [msm]
msm_ioctl_gem_submit+0xde4/0x13ac [msm]
drm_ioctl_kernel+0xe0/0x15c
drm_ioctl+0x2e8/0x3f4
vfs_ioctl+0x30/0x50
...
Reported-by: Rob Clark <robdclark(a)chromium.org>
Signed-off-by: Sergey Senozhatsky <senozhatsky(a)chromium.org>
Acked-by: Robin Murphy <robin.murphy(a)arm.com>
Signed-off-by: Christoph Hellwig <hch(a)lst.de>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: sanglipeng <sanglipeng1(a)jd.com>
---
kernel/dma/debug.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
index ae9fc1ee6d20..026398308909 100644
--- a/kernel/dma/debug.c
+++ b/kernel/dma/debug.c
@@ -606,15 +606,19 @@ static struct dma_debug_entry *__dma_entry_alloc(void)
return entry;
}
-static void __dma_entry_alloc_check_leak(void)
+/*
+ * This should be called outside of free_entries_lock scope to avoid potential
+ * deadlocks with serial consoles that use DMA.
+ */
+static void __dma_entry_alloc_check_leak(u32 nr_entries)
{
- u32 tmp = nr_total_entries % nr_prealloc_entries;
+ u32 tmp = nr_entries % nr_prealloc_entries;
/* Shout each time we tick over some multiple of the initial pool */
if (tmp < DMA_DEBUG_DYNAMIC_ENTRIES) {
pr_info("dma_debug_entry pool grown to %u (%u00%%)\n",
- nr_total_entries,
- (nr_total_entries / nr_prealloc_entries));
+ nr_entries,
+ (nr_entries / nr_prealloc_entries));
}
}
@@ -625,8 +629,10 @@ static void __dma_entry_alloc_check_leak(void)
*/
static struct dma_debug_entry *dma_entry_alloc(void)
{
+ bool alloc_check_leak = false;
struct dma_debug_entry *entry;
unsigned long flags;
+ u32 nr_entries;
spin_lock_irqsave(&free_entries_lock, flags);
if (num_free_entries == 0) {
@@ -636,13 +642,17 @@ static struct dma_debug_entry *dma_entry_alloc(void)
pr_err("debugging out of memory - disabling\n");
return NULL;
}
- __dma_entry_alloc_check_leak();
+ alloc_check_leak = true;
+ nr_entries = nr_total_entries;
}
entry = __dma_entry_alloc();
spin_unlock_irqrestore(&free_entries_lock, flags);
+ if (alloc_check_leak)
+ __dma_entry_alloc_check_leak(nr_entries);
+
#ifdef CONFIG_STACKTRACE
entry->stack_len = stack_trace_save(entry->stack_entries,
ARRAY_SIZE(entry->stack_entries),
--
2.25.1
2
1
[PATCH openEuler-22.03-LTS] dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
by Jinjiang Tu 15 Apr '24
by Jinjiang Tu 15 Apr '24
15 Apr '24
From: Sergey Senozhatsky <senozhatsky(a)chromium.org>
stable inclusion
from stable-v5.10.198
commit c79300599923daaa30f417c75555d5566b3d31ae
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I987V5
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit fb5a4315591dae307a65fc246ca80b5159d296e1 ]
__dma_entry_alloc_check_leak() calls into printk -> serial console
output (qcom geni) and grabs port->lock under free_entries_lock
spin lock, which is a reverse locking dependency chain as qcom_geni
IRQ handler can call into dma-debug code and grab free_entries_lock
under port->lock.
Move __dma_entry_alloc_check_leak() call out of free_entries_lock
scope so that we don't acquire serial console's port->lock under it.
Trimmed-down lockdep splat:
The existing dependency chain (in reverse order) is:
-> #2 (free_entries_lock){-.-.}-{2:2}:
_raw_spin_lock_irqsave+0x60/0x80
dma_entry_alloc+0x38/0x110
debug_dma_map_page+0x60/0xf8
dma_map_page_attrs+0x1e0/0x230
dma_map_single_attrs.constprop.0+0x6c/0xc8
geni_se_rx_dma_prep+0x40/0xcc
qcom_geni_serial_isr+0x310/0x510
__handle_irq_event_percpu+0x110/0x244
handle_irq_event_percpu+0x20/0x54
handle_irq_event+0x50/0x88
handle_fasteoi_irq+0xa4/0xcc
handle_irq_desc+0x28/0x40
generic_handle_domain_irq+0x24/0x30
gic_handle_irq+0xc4/0x148
do_interrupt_handler+0xa4/0xb0
el1_interrupt+0x34/0x64
el1h_64_irq_handler+0x18/0x24
el1h_64_irq+0x64/0x68
arch_local_irq_enable+0x4/0x8
____do_softirq+0x18/0x24
...
-> #1 (&port_lock_key){-.-.}-{2:2}:
_raw_spin_lock_irqsave+0x60/0x80
qcom_geni_serial_console_write+0x184/0x1dc
console_flush_all+0x344/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
register_console+0x230/0x38c
uart_add_one_port+0x338/0x494
qcom_geni_serial_probe+0x390/0x424
platform_probe+0x70/0xc0
really_probe+0x148/0x280
__driver_probe_device+0xfc/0x114
driver_probe_device+0x44/0x100
__device_attach_driver+0x64/0xdc
bus_for_each_drv+0xb0/0xd8
__device_attach+0xe4/0x140
device_initial_probe+0x1c/0x28
bus_probe_device+0x44/0xb0
device_add+0x538/0x668
of_device_add+0x44/0x50
of_platform_device_create_pdata+0x94/0xc8
of_platform_bus_create+0x270/0x304
of_platform_populate+0xac/0xc4
devm_of_platform_populate+0x60/0xac
geni_se_probe+0x154/0x160
platform_probe+0x70/0xc0
...
-> #0 (console_owner){-...}-{0:0}:
__lock_acquire+0xdf8/0x109c
lock_acquire+0x234/0x284
console_flush_all+0x330/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
dma_entry_alloc+0xb4/0x110
debug_dma_map_sg+0xdc/0x2f8
__dma_map_sg_attrs+0xac/0xe4
dma_map_sgtable+0x30/0x4c
get_pages+0x1d4/0x1e4 [msm]
msm_gem_pin_pages_locked+0x38/0xac [msm]
msm_gem_pin_vma_locked+0x58/0x88 [msm]
msm_ioctl_gem_submit+0xde4/0x13ac [msm]
drm_ioctl_kernel+0xe0/0x15c
drm_ioctl+0x2e8/0x3f4
vfs_ioctl+0x30/0x50
...
Chain exists of:
console_owner --> &port_lock_key --> free_entries_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(free_entries_lock);
lock(&port_lock_key);
lock(free_entries_lock);
lock(console_owner);
*** DEADLOCK ***
Call trace:
dump_backtrace+0xb4/0xf0
show_stack+0x20/0x30
dump_stack_lvl+0x60/0x84
dump_stack+0x18/0x24
print_circular_bug+0x1cc/0x234
check_noncircular+0x78/0xac
__lock_acquire+0xdf8/0x109c
lock_acquire+0x234/0x284
console_flush_all+0x330/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
dma_entry_alloc+0xb4/0x110
debug_dma_map_sg+0xdc/0x2f8
__dma_map_sg_attrs+0xac/0xe4
dma_map_sgtable+0x30/0x4c
get_pages+0x1d4/0x1e4 [msm]
msm_gem_pin_pages_locked+0x38/0xac [msm]
msm_gem_pin_vma_locked+0x58/0x88 [msm]
msm_ioctl_gem_submit+0xde4/0x13ac [msm]
drm_ioctl_kernel+0xe0/0x15c
drm_ioctl+0x2e8/0x3f4
vfs_ioctl+0x30/0x50
...
Reported-by: Rob Clark <robdclark(a)chromium.org>
Signed-off-by: Sergey Senozhatsky <senozhatsky(a)chromium.org>
Acked-by: Robin Murphy <robin.murphy(a)arm.com>
Signed-off-by: Christoph Hellwig <hch(a)lst.de>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: sanglipeng <sanglipeng1(a)jd.com>
---
kernel/dma/debug.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
index ae9fc1ee6d20..026398308909 100644
--- a/kernel/dma/debug.c
+++ b/kernel/dma/debug.c
@@ -606,15 +606,19 @@ static struct dma_debug_entry *__dma_entry_alloc(void)
return entry;
}
-static void __dma_entry_alloc_check_leak(void)
+/*
+ * This should be called outside of free_entries_lock scope to avoid potential
+ * deadlocks with serial consoles that use DMA.
+ */
+static void __dma_entry_alloc_check_leak(u32 nr_entries)
{
- u32 tmp = nr_total_entries % nr_prealloc_entries;
+ u32 tmp = nr_entries % nr_prealloc_entries;
/* Shout each time we tick over some multiple of the initial pool */
if (tmp < DMA_DEBUG_DYNAMIC_ENTRIES) {
pr_info("dma_debug_entry pool grown to %u (%u00%%)\n",
- nr_total_entries,
- (nr_total_entries / nr_prealloc_entries));
+ nr_entries,
+ (nr_entries / nr_prealloc_entries));
}
}
@@ -625,8 +629,10 @@ static void __dma_entry_alloc_check_leak(void)
*/
static struct dma_debug_entry *dma_entry_alloc(void)
{
+ bool alloc_check_leak = false;
struct dma_debug_entry *entry;
unsigned long flags;
+ u32 nr_entries;
spin_lock_irqsave(&free_entries_lock, flags);
if (num_free_entries == 0) {
@@ -636,13 +642,17 @@ static struct dma_debug_entry *dma_entry_alloc(void)
pr_err("debugging out of memory - disabling\n");
return NULL;
}
- __dma_entry_alloc_check_leak();
+ alloc_check_leak = true;
+ nr_entries = nr_total_entries;
}
entry = __dma_entry_alloc();
spin_unlock_irqrestore(&free_entries_lock, flags);
+ if (alloc_check_leak)
+ __dma_entry_alloc_check_leak(nr_entries);
+
#ifdef CONFIG_STACKTRACE
entry->stack_len = stack_trace_save(entry->stack_entries,
ARRAY_SIZE(entry->stack_entries),
--
2.25.1
2
1
[PATCH openEuler-22.03-LTS-SP2] dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
by Jinjiang Tu 15 Apr '24
by Jinjiang Tu 15 Apr '24
15 Apr '24
From: Sergey Senozhatsky <senozhatsky(a)chromium.org>
stable inclusion
from stable-v5.10.198
commit c79300599923daaa30f417c75555d5566b3d31ae
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I987V5
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit fb5a4315591dae307a65fc246ca80b5159d296e1 ]
__dma_entry_alloc_check_leak() calls into printk -> serial console
output (qcom geni) and grabs port->lock under free_entries_lock
spin lock, which is a reverse locking dependency chain as qcom_geni
IRQ handler can call into dma-debug code and grab free_entries_lock
under port->lock.
Move __dma_entry_alloc_check_leak() call out of free_entries_lock
scope so that we don't acquire serial console's port->lock under it.
Trimmed-down lockdep splat:
The existing dependency chain (in reverse order) is:
-> #2 (free_entries_lock){-.-.}-{2:2}:
_raw_spin_lock_irqsave+0x60/0x80
dma_entry_alloc+0x38/0x110
debug_dma_map_page+0x60/0xf8
dma_map_page_attrs+0x1e0/0x230
dma_map_single_attrs.constprop.0+0x6c/0xc8
geni_se_rx_dma_prep+0x40/0xcc
qcom_geni_serial_isr+0x310/0x510
__handle_irq_event_percpu+0x110/0x244
handle_irq_event_percpu+0x20/0x54
handle_irq_event+0x50/0x88
handle_fasteoi_irq+0xa4/0xcc
handle_irq_desc+0x28/0x40
generic_handle_domain_irq+0x24/0x30
gic_handle_irq+0xc4/0x148
do_interrupt_handler+0xa4/0xb0
el1_interrupt+0x34/0x64
el1h_64_irq_handler+0x18/0x24
el1h_64_irq+0x64/0x68
arch_local_irq_enable+0x4/0x8
____do_softirq+0x18/0x24
...
-> #1 (&port_lock_key){-.-.}-{2:2}:
_raw_spin_lock_irqsave+0x60/0x80
qcom_geni_serial_console_write+0x184/0x1dc
console_flush_all+0x344/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
register_console+0x230/0x38c
uart_add_one_port+0x338/0x494
qcom_geni_serial_probe+0x390/0x424
platform_probe+0x70/0xc0
really_probe+0x148/0x280
__driver_probe_device+0xfc/0x114
driver_probe_device+0x44/0x100
__device_attach_driver+0x64/0xdc
bus_for_each_drv+0xb0/0xd8
__device_attach+0xe4/0x140
device_initial_probe+0x1c/0x28
bus_probe_device+0x44/0xb0
device_add+0x538/0x668
of_device_add+0x44/0x50
of_platform_device_create_pdata+0x94/0xc8
of_platform_bus_create+0x270/0x304
of_platform_populate+0xac/0xc4
devm_of_platform_populate+0x60/0xac
geni_se_probe+0x154/0x160
platform_probe+0x70/0xc0
...
-> #0 (console_owner){-...}-{0:0}:
__lock_acquire+0xdf8/0x109c
lock_acquire+0x234/0x284
console_flush_all+0x330/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
dma_entry_alloc+0xb4/0x110
debug_dma_map_sg+0xdc/0x2f8
__dma_map_sg_attrs+0xac/0xe4
dma_map_sgtable+0x30/0x4c
get_pages+0x1d4/0x1e4 [msm]
msm_gem_pin_pages_locked+0x38/0xac [msm]
msm_gem_pin_vma_locked+0x58/0x88 [msm]
msm_ioctl_gem_submit+0xde4/0x13ac [msm]
drm_ioctl_kernel+0xe0/0x15c
drm_ioctl+0x2e8/0x3f4
vfs_ioctl+0x30/0x50
...
Chain exists of:
console_owner --> &port_lock_key --> free_entries_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(free_entries_lock);
lock(&port_lock_key);
lock(free_entries_lock);
lock(console_owner);
*** DEADLOCK ***
Call trace:
dump_backtrace+0xb4/0xf0
show_stack+0x20/0x30
dump_stack_lvl+0x60/0x84
dump_stack+0x18/0x24
print_circular_bug+0x1cc/0x234
check_noncircular+0x78/0xac
__lock_acquire+0xdf8/0x109c
lock_acquire+0x234/0x284
console_flush_all+0x330/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
dma_entry_alloc+0xb4/0x110
debug_dma_map_sg+0xdc/0x2f8
__dma_map_sg_attrs+0xac/0xe4
dma_map_sgtable+0x30/0x4c
get_pages+0x1d4/0x1e4 [msm]
msm_gem_pin_pages_locked+0x38/0xac [msm]
msm_gem_pin_vma_locked+0x58/0x88 [msm]
msm_ioctl_gem_submit+0xde4/0x13ac [msm]
drm_ioctl_kernel+0xe0/0x15c
drm_ioctl+0x2e8/0x3f4
vfs_ioctl+0x30/0x50
...
Reported-by: Rob Clark <robdclark(a)chromium.org>
Signed-off-by: Sergey Senozhatsky <senozhatsky(a)chromium.org>
Acked-by: Robin Murphy <robin.murphy(a)arm.com>
Signed-off-by: Christoph Hellwig <hch(a)lst.de>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: sanglipeng <sanglipeng1(a)jd.com>
---
kernel/dma/debug.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
index ae9fc1ee6d20..026398308909 100644
--- a/kernel/dma/debug.c
+++ b/kernel/dma/debug.c
@@ -606,15 +606,19 @@ static struct dma_debug_entry *__dma_entry_alloc(void)
return entry;
}
-static void __dma_entry_alloc_check_leak(void)
+/*
+ * This should be called outside of free_entries_lock scope to avoid potential
+ * deadlocks with serial consoles that use DMA.
+ */
+static void __dma_entry_alloc_check_leak(u32 nr_entries)
{
- u32 tmp = nr_total_entries % nr_prealloc_entries;
+ u32 tmp = nr_entries % nr_prealloc_entries;
/* Shout each time we tick over some multiple of the initial pool */
if (tmp < DMA_DEBUG_DYNAMIC_ENTRIES) {
pr_info("dma_debug_entry pool grown to %u (%u00%%)\n",
- nr_total_entries,
- (nr_total_entries / nr_prealloc_entries));
+ nr_entries,
+ (nr_entries / nr_prealloc_entries));
}
}
@@ -625,8 +629,10 @@ static void __dma_entry_alloc_check_leak(void)
*/
static struct dma_debug_entry *dma_entry_alloc(void)
{
+ bool alloc_check_leak = false;
struct dma_debug_entry *entry;
unsigned long flags;
+ u32 nr_entries;
spin_lock_irqsave(&free_entries_lock, flags);
if (num_free_entries == 0) {
@@ -636,13 +642,17 @@ static struct dma_debug_entry *dma_entry_alloc(void)
pr_err("debugging out of memory - disabling\n");
return NULL;
}
- __dma_entry_alloc_check_leak();
+ alloc_check_leak = true;
+ nr_entries = nr_total_entries;
}
entry = __dma_entry_alloc();
spin_unlock_irqrestore(&free_entries_lock, flags);
+ if (alloc_check_leak)
+ __dma_entry_alloc_check_leak(nr_entries);
+
#ifdef CONFIG_STACKTRACE
entry->stack_len = stack_trace_save(entry->stack_entries,
ARRAY_SIZE(entry->stack_entries),
--
2.25.1
2
1
[PATCH OLK-6.6] mm, fs: Add BPF_READAHEAD_OPTIMIZATION option for bpf readhead
by ZhaoLong Wang 15 Apr '24
by ZhaoLong Wang 15 Apr '24
15 Apr '24
hulk inclusion
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7Y9JD
CVE: NA
---------------------------
This patch introduces a new configuration option called
BPF_READAHEAD_OPTIMIZATION, which is designed to optimize the read
performance in Spark SQL scenarios using eBPF to implement a
programmable kernel.
The changes include:
- Add CONFIG_BPF_READAHEAD_OPTIMIZATION to mm/Kconfig, which depends
on CONFIG_TRACEPOINTS.
- Add conditional compilation directives to fs/ext4/file.c, fs/read_write.c,
fs/xfs/xfs_file.c, and include/linux/fs.h to include tracepoint-related
headers and functions only when BPF_READAHEAD_OPTIMIZATION is enabled.
- Miodify page_cache_sync_ra() in mm/readahead.c to disable forced readahead
when BPF_READAHEAD_OPTIMIZATION is not enabled.
V2:
Explicitly set CONFIG_ in openeuler_defconfig.
Do not add redundant macros to mm/readahead.
V3:
Place all macro isolation switches in the .h header file.
Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com>
---
arch/arm64/configs/openeuler_defconfig | 1 +
arch/powerpc/configs/openeuler_defconfig | 1 +
arch/riscv/configs/openeuler_defconfig | 1 +
arch/x86/configs/openeuler_defconfig | 1 +
fs/read_write.c | 4 ++--
include/linux/fs.h | 18 +++++++++++++-----
include/trace/events/fs.h | 7 +++++++
mm/Kconfig | 9 +++++++++
8 files changed, 35 insertions(+), 7 deletions(-)
diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig
index ba4a04309879..a40a3daa3aa1 100644
--- a/arch/arm64/configs/openeuler_defconfig
+++ b/arch/arm64/configs/openeuler_defconfig
@@ -1192,6 +1192,7 @@ CONFIG_DYNAMIC_POOL=y
CONFIG_ETMEM_SCAN=m
CONFIG_ETMEM_SWAP=m
CONFIG_ETMEM=y
+# CONFIG_BPF_READAHEAD_OPTIMIZATION is not set
#
# Data Access Monitoring
diff --git a/arch/powerpc/configs/openeuler_defconfig b/arch/powerpc/configs/openeuler_defconfig
index 152b941da1d5..793cca85862c 100644
--- a/arch/powerpc/configs/openeuler_defconfig
+++ b/arch/powerpc/configs/openeuler_defconfig
@@ -860,6 +860,7 @@ CONFIG_ARCH_HAS_HUGEPD=y
CONFIG_USERFAULTFD=y
# CONFIG_LRU_GEN is not set
CONFIG_LOCK_MM_AND_FIND_VMA=y
+# CONFIG_BPF_READAHEAD_OPTIMIZATION is not set
#
# Data Access Monitoring
diff --git a/arch/riscv/configs/openeuler_defconfig b/arch/riscv/configs/openeuler_defconfig
index cb132f4576da..06caed7e855a 100644
--- a/arch/riscv/configs/openeuler_defconfig
+++ b/arch/riscv/configs/openeuler_defconfig
@@ -825,6 +825,7 @@ CONFIG_ARCH_SUPPORTS_PER_VMA_LOCK=y
CONFIG_PER_VMA_LOCK=y
CONFIG_LOCK_MM_AND_FIND_VMA=y
# CONFIG_PAGE_CACHE_LIMIT is not set
+# CONFIG_BPF_READAHEAD_OPTIMIZATION is not set
#
# Data Access Monitoring
diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig
index f15f089419e6..e4298be905ff 100644
--- a/arch/x86/configs/openeuler_defconfig
+++ b/arch/x86/configs/openeuler_defconfig
@@ -1179,6 +1179,7 @@ CONFIG_DYNAMIC_POOL=y
CONFIG_ETMEM_SCAN=m
CONFIG_ETMEM_SWAP=m
CONFIG_ETMEM=y
+# CONFIG_BPF_READAHEAD_OPTIMIZATION is not set
#
# Data Access Monitoring
diff --git a/fs/read_write.c b/fs/read_write.c
index 3d69fb284d10..265e40589be8 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -1721,7 +1721,7 @@ int generic_file_rw_checks(struct file *file_in, struct file *file_out)
return 0;
}
-#ifdef CONFIG_TRACEPOINTS
+#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION
static void fs_file_read_ctx_init(struct fs_file_read_ctx *ctx,
struct file *filp, loff_t pos)
{
@@ -1752,7 +1752,7 @@ void fs_file_read_update_args_by_trace(struct kiocb *iocb)
filp->f_ctl_mode &= ~(ctx.clr_f_mode & FS_FILE_READ_MODE_MASK);
}
EXPORT_SYMBOL_GPL(fs_file_read_update_args_by_trace);
-#endif
EXPORT_TRACEPOINT_SYMBOL_GPL(fs_file_read);
EXPORT_TRACEPOINT_SYMBOL_GPL(fs_file_release);
+#endif
diff --git a/include/linux/fs.h b/include/linux/fs.h
index d74314a8fa94..2702d38b57ab 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -43,7 +43,9 @@
#include <linux/cred.h>
#include <linux/mnt_idmapping.h>
#include <linux/slab.h>
+#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION
#include <linux/tracepoint-defs.h>
+#endif
#include <linux/kabi.h>
#include <asm/byteorder.h>
@@ -190,11 +192,16 @@ typedef int (dio_iodone_t)(struct kiocb *iocb, loff_t offset,
/* File supports async nowait buffered writes */
#define FMODE_BUF_WASYNC ((__force fmode_t)0x80000000)
+#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION
/* File mode control flag, expect random access pattern */
#define FMODE_CTL_RANDOM ((__force fmode_t)0x1000)
/* File mode control flag, will try to read head of the file into pagecache */
#define FMODE_CTL_WILLNEED ((__force fmode_t)0x400000)
+#else
+#define FMODE_CTL_RANDOM 0
+#define FMODE_CTL_WILLNEED 0
+#endif
/*
* Attribute flags. These should be or-ed together to figure out what
@@ -3524,16 +3531,17 @@ struct fs_file_read_ctx {
long long index;
};
-#ifdef CONFIG_TRACEPOINTS
+#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION
DECLARE_TRACEPOINT(fs_file_read);
extern void fs_file_read_update_args_by_trace(struct kiocb *iocb);
-#else
-static inline void fs_file_read_update_args_by_trace(struct kiocb *iocb) {}
-#endif
-
static inline void fs_file_read_do_trace(struct kiocb *iocb)
{
if (tracepoint_enabled(fs_file_read))
fs_file_read_update_args_by_trace(iocb);
}
+#else
+static inline void fs_file_read_update_args_by_trace(struct kiocb *iocb) {}
+static inline void fs_file_read_do_trace(struct kiocb *iocb) {}
+#endif
+
#endif /* _LINUX_FS_H */
diff --git a/include/trace/events/fs.h b/include/trace/events/fs.h
index ee82dad9d9da..5695967d4cea 100644
--- a/include/trace/events/fs.h
+++ b/include/trace/events/fs.h
@@ -1,4 +1,6 @@
/* SPDX-License-Identifier: GPL-2.0 */
+#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION
+
#undef TRACE_SYSTEM
#define TRACE_SYSTEM fs
@@ -31,3 +33,8 @@ DECLARE_TRACE(fs_file_release,
/* This part must be outside protection */
#include <trace/define_trace.h>
+#else
+#define trace_fs_file_release(...)
+#define trace_fs_file_read(...)
+#endif /* CONFIG_BPF_READAHEAD_OPTIMIZATION */
+
diff --git a/mm/Kconfig b/mm/Kconfig
index cdbb1ceaa554..0c22baa52542 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -1424,6 +1424,15 @@ config ETMEM
high-performance storage media to release memory space and reduce
memory costs.
+config BPF_READAHEAD_OPTIMIZATION
+ bool "Enable bpf readahead optimization"
+ select TRACEPOINTS
+ default n
+ help
+ EBPF is used to implement a programmable kernel. The readahead behavior
+ of the kernel is adjusted based on the application read mode to optimize
+ the read performance in the Spark SQL scenario,
+
source "mm/damon/Kconfig"
endmenu
--
2.39.2
2
1
hisiraid inclusion
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I9F23X
CVE: NA
------------------------------------------
This commit is to support sg_raw command feature
Signed-off-by: zhanglei <zhanglei48(a)huawei.com>
---
drivers/scsi/hisi_raid/hiraid.h | 4 ++
drivers/scsi/hisi_raid/hiraid_main.c | 59 +++++++++++++++++++++++-----
2 files changed, 53 insertions(+), 10 deletions(-)
diff --git a/drivers/scsi/hisi_raid/hiraid.h b/drivers/scsi/hisi_raid/hiraid.h
index 1ebc3dd3f2ec..04b2e25b3b38 100644
--- a/drivers/scsi/hisi_raid/hiraid.h
+++ b/drivers/scsi/hisi_raid/hiraid.h
@@ -72,7 +72,10 @@
#define PCI_VENDOR_ID_HUAWEI_LOGIC 0x19E5
#define HIRAID_SERVER_DEVICE_HBA_DID 0x3858
+#define HIRAID_SERVER_DEVICE_HBAS_DID 0x3918
#define HIRAID_SERVER_DEVICE_RAID_DID 0x3758
+#define HIRAID_SERVER_DEVICE_RAIDS_DID 0x38D8
+
enum {
HIRAID_SC_SUCCESS = 0x0,
@@ -694,6 +697,7 @@ struct hiraid_mapmange {
u32 sge_cnt;
u32 len;
bool use_sgl;
+ u32 cdb_data_len;
dma_addr_t first_dma;
void *sense_buffer_virt;
dma_addr_t sense_buffer_phy;
diff --git a/drivers/scsi/hisi_raid/hiraid_main.c b/drivers/scsi/hisi_raid/hiraid_main.c
index b9ffa642479c..2f333393824f 100644
--- a/drivers/scsi/hisi_raid/hiraid_main.c
+++ b/drivers/scsi/hisi_raid/hiraid_main.c
@@ -152,7 +152,7 @@ static struct workqueue_struct *work_queue;
__func__, ##__VA_ARGS__); \
} while (0)
-#define HIRAID_DRV_VERSION "1.1.0.0"
+#define HIRAID_DRV_VERSION "1.1.0.1"
#define ADMIN_TIMEOUT (admin_tmout * HZ)
#define USRCMD_TIMEOUT (180 * HZ)
@@ -750,14 +750,19 @@ static int hiraid_build_sgl(struct hiraid_dev *hdev, struct hiraid_scsi_io_cmd *
}
#define HIRAID_RW_FUA BIT(14)
+#define RW_LENGTH_ZERO (67)
static int hiraid_setup_rw_cmd(struct hiraid_dev *hdev,
struct hiraid_scsi_rw_cmd *io_cmd,
- struct scsi_cmnd *scmd)
+ struct scsi_cmnd *scmd,
+ struct hiraid_mapmange *mapbuf)
{
+ u32 ret = 0;
u32 start_lba_lo, start_lba_hi;
u32 datalength = 0;
u16 control = 0;
+ struct scsi_device *sdev = scmd->device;
+ u32 buf_len = cpu_to_le32(scsi_bufflen(scmd));
start_lba_lo = 0;
start_lba_hi = 0;
@@ -766,6 +771,8 @@ static int hiraid_setup_rw_cmd(struct hiraid_dev *hdev,
io_cmd->opcode = HIRAID_CMD_WRITE;
} else if (scmd->sc_data_direction == DMA_FROM_DEVICE) {
io_cmd->opcode = HIRAID_CMD_READ;
+ } else if (scmd->sc_data_direction == DMA_NONE) {
+ ret = RW_LENGTH_ZERO;
} else {
dev_err(hdev->dev, "invalid RW_IO for unsupported data direction[%d]\n",
scmd->sc_data_direction);
@@ -773,6 +780,9 @@ static int hiraid_setup_rw_cmd(struct hiraid_dev *hdev,
return -EINVAL;
}
+ if (ret == RW_LENGTH_ZERO)
+ return ret;
+
/* 6-byte READ(0x08) or WRITE(0x0A) cdb */
if (scmd->cmd_len == 6) {
datalength = (u32)(scmd->cmnd[4] == 0 ?
@@ -809,17 +819,30 @@ static int hiraid_setup_rw_cmd(struct hiraid_dev *hdev,
control |= HIRAID_RW_FUA;
}
- if (unlikely(datalength > U16_MAX || datalength == 0)) {
+ if (unlikely(datalength > U16_MAX)) {
dev_err(hdev->dev, "invalid IO for illegal transfer data length[%u]\n", datalength);
WARN_ON(1);
return -EINVAL;
}
+ if (unlikely(datalength == 0))
+ return RW_LENGTH_ZERO;
+
io_cmd->slba = cpu_to_le64(((u64)start_lba_hi << 32) | start_lba_lo);
/* 0base for nlb */
io_cmd->nlb = cpu_to_le16((u16)(datalength - 1));
io_cmd->control = cpu_to_le16(control);
+ mapbuf->cdb_data_len = (u32)((io_cmd->nlb + 1) * sdev->sector_size);
+ if (mapbuf->cdb_data_len > buf_len) {
+ /* return DID_ERROR */
+ dev_err(hdev->dev, "error: buf len[0x%x] is smaller than actual length[0x%x] sectorsize[0x%x]\n",
+ buf_len, mapbuf->cdb_data_len, sdev->sector_size);
+ return -EINVAL;
+ } else if (mapbuf->cdb_data_len < buf_len) {
+ dev_warn(hdev->dev, "warn: buf_len[0x%x] cdb_data_len[0x%x] nlb[0x%x] sectorsize[0x%x]\n",
+ buf_len, mapbuf->cdb_data_len, io_cmd->nlb, sdev->sector_size);
+ }
return 0;
}
@@ -849,13 +872,17 @@ static int hiraid_setup_nonrw_cmd(struct hiraid_dev *hdev,
}
static int hiraid_setup_io_cmd(struct hiraid_dev *hdev,
- struct hiraid_scsi_io_cmd *io_cmd, struct scsi_cmnd *scmd)
+ struct hiraid_scsi_io_cmd *io_cmd, struct scsi_cmnd *scmd,
+ struct hiraid_mapmange *mapbuf)
{
memcpy(io_cmd->common.cdb, scmd->cmnd, scmd->cmd_len);
io_cmd->common.cdb_len = scmd->cmd_len;
+ /* init cdb_data_len */
+ mapbuf->cdb_data_len = cpu_to_le32(scsi_bufflen(scmd));
+
if (hiraid_is_rw_scmd(scmd))
- return hiraid_setup_rw_cmd(hdev, &io_cmd->rw, scmd);
+ return hiraid_setup_rw_cmd(hdev, &io_cmd->rw, scmd, mapbuf);
else
return hiraid_setup_nonrw_cmd(hdev, &io_cmd->nonrw, scmd);
}
@@ -938,7 +965,12 @@ static int hiraid_io_map_data(struct hiraid_dev *hdev, struct hiraid_mapmange *m
static void hiraid_check_status(struct hiraid_mapmange *mapbuf, struct scsi_cmnd *scmd,
struct hiraid_completion *cqe)
{
- scsi_set_resid(scmd, 0);
+ u32 datalength = cpu_to_le32(scsi_bufflen(scmd));
+
+ if (datalength > mapbuf->cdb_data_len)
+ scsi_set_resid(scmd, datalength - mapbuf->cdb_data_len);
+ else
+ scsi_set_resid(scmd, 0);
switch ((le16_to_cpu(cqe->status) >> 1) & 0x7f) {
case SENSE_STATE_OK:
@@ -1022,9 +1054,14 @@ static int hiraid_queue_command(struct Scsi_Host *shost, struct scsi_cmnd *scmd)
io_cmd.rw.hdid = cpu_to_le32(hostdata->hdid);
io_cmd.rw.cmd_id = cpu_to_le16(cid);
- ret = hiraid_setup_io_cmd(hdev, &io_cmd, scmd);
+ ret = hiraid_setup_io_cmd(hdev, &io_cmd, scmd, mapbuf);
if (unlikely(ret)) {
- set_host_byte(scmd, DID_ERROR);
+ if (ret == RW_LENGTH_ZERO) {
+ scsi_set_resid(scmd, scsi_bufflen(scmd));
+ set_host_byte(scmd, DID_OK);
+ } else {
+ set_host_byte(scmd, DID_ERROR);
+ }
scmd->scsi_done(scmd);
atomic_dec(&ioq->inflight);
return 0;
@@ -2541,12 +2578,12 @@ static int hiraid_bsg_buf_map(struct hiraid_dev *hdev, struct bsg_job *job,
if (unlikely(mapbuf->sge_cnt == 0))
goto out;
- mapbuf->use_sgl = !hiraid_is_prp(hdev, mapbuf->sgl, mapbuf->sge_cnt);
-
ret = dma_map_sg_attrs(hdev->dev, mapbuf->sgl, mapbuf->sge_cnt, dma_dir, DMA_ATTR_NO_WARN);
if (!ret)
goto out;
+ mapbuf->use_sgl = !hiraid_is_prp(hdev, mapbuf->sgl, mapbuf->sge_cnt);
+
if ((mapbuf->use_sgl == (bool)true) && (bsg_req->msgcode == HIRAID_BSG_IOPTHRU) &&
(hdev->ctrl_info->pt_use_sgl != (bool)false)) {
ret = hiraid_build_passthru_sgl(hdev, cmd, mapbuf);
@@ -3925,7 +3962,9 @@ static void hiraid_remove(struct pci_dev *pdev)
static const struct pci_device_id hiraid_hw_card_ids[] = {
{ PCI_DEVICE(PCI_VENDOR_ID_HUAWEI_LOGIC, HIRAID_SERVER_DEVICE_HBA_DID) },
+ { PCI_DEVICE(PCI_VENDOR_ID_HUAWEI_LOGIC, HIRAID_SERVER_DEVICE_HBAS_DID) },
{ PCI_DEVICE(PCI_VENDOR_ID_HUAWEI_LOGIC, HIRAID_SERVER_DEVICE_RAID_DID) },
+ { PCI_DEVICE(PCI_VENDOR_ID_HUAWEI_LOGIC, HIRAID_SERVER_DEVICE_RAIDS_DID) },
{ 0, }
};
MODULE_DEVICE_TABLE(pci, hiraid_hw_card_ids);
--
2.22.0.windows.1
2
1
15 Apr '24
The following optimization are made for feature "arm64: add machine
check safe support":
1. Optimize do_sea() processing logic.
2. Add new fixup type of the copy_to/from_user() memory error.
3. Optimize repeated assembly codes in copy_mc_page.S and memcpy_mc.S.
4. The below mailist patch hardening feature is incorporated:
https://lore.kernel.org/lkml/20240204080144.7977-1-xueshuai@linux.alibaba.c…
Marc Zyngier (1):
arm64: Get rid of ARM64_HAS_NO_HW_PREFETCH
Shuai Xue (3):
ACPI: APEI: send SIGBUS to current task if synchronous memory error
not recovered
mm: memory-failure: move return value documentation to function
declaration
ACPI: APEI: handle synchronous exceptions in task work to send correct
SIGBUS si_code
Tong Tiangen (12):
Revert "kasan: fix the compilation error for memcpy_mcs()"
Revert "arm64: add machine check safe sysctl interface"
Revert "arm64: introduce copy_mc_to_kernel() implementation"
Revert "arm64: support copy_mc_[user]_highpage()"
Revert "mm/hwpoison: return -EFAULT when copy fail in
copy_mc_[user]_highpage()"
Revert "arm64: add uaccess to machine check safe"
Revert "arm64: add support for machine check error safe"
arm64: add support for ARCH_HAS_COPY_MC
mm/hwpoison: return -EFAULT when copy fail in
copy_mc_[user]_highpage()
arm64: support copy_mc_[user]_highpage()
arm64: introduce copy_mc_to_kernel() implementation
arm64: add machine check safe sysctl interface
arch/arm64/include/asm/asm-extable.h | 34 +--
arch/arm64/include/asm/asm-uaccess.h | 4 +
arch/arm64/include/asm/assembler.h | 4 -
arch/arm64/include/asm/extable.h | 2 +-
arch/arm64/include/asm/mte.h | 4 +
arch/arm64/include/asm/string.h | 6 +-
arch/arm64/include/asm/uaccess.h | 13 +-
arch/arm64/kernel/cpufeature.c | 16 --
arch/arm64/lib/Makefile | 4 +-
arch/arm64/lib/copy_from_user.S | 10 +-
arch/arm64/lib/copy_mc_page.S | 63 +-----
arch/arm64/lib/copy_page.S | 61 +-----
arch/arm64/lib/copy_page_template.S | 56 +++++
arch/arm64/lib/copy_to_user.S | 10 +-
arch/arm64/lib/memcpy_mc.S | 304 ++++++---------------------
arch/arm64/lib/mte.S | 6 +-
arch/arm64/mm/copypage.c | 39 ++--
arch/arm64/mm/extable.c | 12 +-
arch/arm64/mm/fault.c | 53 ++---
arch/arm64/tools/cpucaps | 1 -
arch/x86/kernel/cpu/mce/core.c | 7 -
drivers/acpi/apei/ghes.c | 84 +++++---
include/acpi/ghes.h | 3 -
mm/kasan/shadow.c | 6 +-
mm/memory-failure.c | 22 +-
25 files changed, 282 insertions(+), 542 deletions(-)
create mode 100644 arch/arm64/lib/copy_page_template.S
--
2.25.1
2
17
15 Apr '24
From: Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com>
stable inclusion
from stable-v6.7.3
commit 2ef98c6d753a744e333b7e34b9cf687040fba57d
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV4C
CVE: CVE-2023-52624
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
[ Upstream commit e5ffd1263dd5b44929c676171802e7b6af483f21 ]
[Why]
DMCUB can be in idle when we attempt to interface with the HW through
the GPINT mailbox resulting in a system hang.
[How]
Add dc_wake_and_execute_gpint() to wrap the wake, execute, sleep
sequence.
If the GPINT executes successfully then DMCUB will be put back into
sleep after the optional response is returned.
It functions similar to the inbox command interface.
Cc: Mario Limonciello <mario.limonciello(a)amd.com>
Cc: Alex Deucher <alexander.deucher(a)amd.com>
Cc: stable(a)vger.kernel.org
Reviewed-by: Hansen Dsouza <hansen.dsouza(a)amd.com>
Acked-by: Wayne Lin <wayne.lin(a)amd.com>
Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com>
Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com>
This fix requires:
115c7e7f0501 ("drm/amd/display: Add psr get_state call")
0825d9658b5e ("drm/amd/display: implement notify stream mask")
1d496907f1c5 ("drm/amd/display: Engage PSR synchronously")
34ba432c946d ("drm/amd/display: [FW Promotion] Release 0.0.44")
672251b223c1 ("drm/amd/display: [FW Promotion] Release 0.0.40")
04f3c88f0955 ("drm/amd/display: Retry getting PSR state if command times out")
b30eda8d416c ("drm/amd/display: Add ETW log to dmub_psr_get_state")
f59a66c1915e ("drm/amd/display: use do-while-0 for DC_TRACE_LEVEL_MESSAGE()")
e97cc04fe0fb ("drm/amd/display: refactor dmub commands into single function")
522b9a5d5852 ("drm/amd/display: drain dmub inbox if queue is full")
9dce8c2a5f1b ("drm/amd/display: [FW Promotion] Release 0.0.161.0")
276641775848 ("drm/amd/display: [FW Promotion] Release 0.0.162.0")
65138eb72e1f ("drm/amd/display: Add DCN35 DMUB")
dc01c4b79bfe ("drm/amd/display: Update driver and IPS interop")
5b7954272ae9 ("drm/amd/display: [FW Promotion] Release 0.0.183.0")
da2d16fcdda3 ("drm/amd/display: Fix IPS handshake for idle optimizations")
5e8a0d3598b4 ("drm/amd/display: Negate IPS allow and commit bits")
820c3870c491 ("drm/amd/display: Refactor DMCUB enter/exit idle interface")
2ef98c6d753a ("drm/amd/display: Wake DMCUB before executing GPINT commands")
Signed-off-by: Zhu Wang <wangzhu9(a)huawei.com>
---
.../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 16 +-
.../amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 6 +-
.../gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c | 5 +-
drivers/gpu/drm/amd/display/dc/core/dc.c | 4 +-
drivers/gpu/drm/amd/display/dc/core/dc_link.c | 19 +-
.../gpu/drm/amd/display/dc/core/dc_link_dp.c | 4 +-
drivers/gpu/drm/amd/display/dc/dc.h | 4 +-
drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 265 +++++++++++++++++-
drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h | 31 ++
drivers/gpu/drm/amd/display/dc/dc_link.h | 5 +-
drivers/gpu/drm/amd/display/dc/dc_types.h | 20 ++
drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c | 24 +-
drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c | 140 +++++----
drivers/gpu/drm/amd/display/dc/dce/dmub_psr.h | 3 +-
drivers/gpu/drm/amd/display/dc/dm_services.h | 9 +
.../drm/amd/display/dc/dm_services_types.h | 6 +
.../gpu/drm/amd/display/dc/inc/hw/clk_mgr.h | 1 +
drivers/gpu/drm/amd/display/dc/inc/hw/dmcu.h | 2 +-
.../gpu/drm/amd/display/dc/inc/hw_sequencer.h | 3 +-
drivers/gpu/drm/amd/display/dmub/dmub_srv.h | 20 ++
.../gpu/drm/amd/display/dmub/inc/dmub_cmd.h | 100 ++++++-
.../gpu/drm/amd/display/dmub/src/dmub_srv.c | 27 ++
22 files changed, 615 insertions(+), 99 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 652ddec18838..924d643a37ae 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -9308,7 +9308,7 @@ bool amdgpu_dm_psr_enable(struct dc_stream_state *stream)
&stream, 1,
¶ms);
- return dc_link_set_psr_allow_active(link, true, false);
+ return dc_link_set_psr_allow_active(link, true, false, false);
}
/*
@@ -9322,7 +9322,7 @@ static bool amdgpu_dm_psr_disable(struct dc_stream_state *stream)
DRM_DEBUG_DRIVER("Disabling psr...\n");
- return dc_link_set_psr_allow_active(stream->link, false, true);
+ return dc_link_set_psr_allow_active(stream->link, false, true, false);
}
/*
@@ -9355,3 +9355,15 @@ void amdgpu_dm_trigger_timing_sync(struct drm_device *dev)
}
mutex_unlock(&adev->dm.dc_lock);
}
+
+bool dm_execute_dmub_cmd(const struct dc_context *ctx, union dmub_rb_cmd *cmd,
+ enum dm_dmub_wait_type wait_type)
+{
+ return dc_dmub_srv_cmd_run(ctx->dmub_srv, cmd, wait_type);
+}
+
+bool dm_execute_dmub_cmd_list(const struct dc_context *ctx, unsigned int count,
+ union dmub_rb_cmd *cmd, enum dm_dmub_wait_type wait_type)
+{
+ return dc_dmub_srv_cmd_run_list(ctx->dmub_srv, count, cmd, wait_type);
+}
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
index e43f82bcb231..9dee30fc4d1c 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
@@ -2210,11 +2210,11 @@ static int psr_get(void *data, u64 *val)
{
struct amdgpu_dm_connector *connector = data;
struct dc_link *link = connector->dc_link;
- uint32_t psr_state = 0;
+ enum dc_psr_state state = PSR_STATE0;
- dc_link_get_psr_state(link, &psr_state);
+ dc_link_get_psr_state(link, &state);
- *val = psr_state;
+ *val = state;
return 0;
}
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c
index 857f156e4985..4a408cbb9363 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c
@@ -95,7 +95,7 @@ void clk_mgr_exit_optimized_pwr_state(const struct dc *dc, struct clk_mgr *clk_m
if (edp_link) {
clk_mgr->psr_allow_active_cache = edp_link->psr_settings.psr_allow_active;
- dc_link_set_psr_allow_active(edp_link, false, false);
+ dc_link_set_psr_allow_active(edp_link, false, false, false);
}
}
@@ -105,7 +105,8 @@ void clk_mgr_optimize_pwr_state(const struct dc *dc, struct clk_mgr *clk_mgr)
struct dc_link *edp_link = get_edp_link(dc);
if (edp_link)
- dc_link_set_psr_allow_active(edp_link, clk_mgr->psr_allow_active_cache, false);
+ dc_link_set_psr_allow_active(edp_link,
+ clk_mgr->psr_allow_active_cache, false, false);
if (dc->hwss.optimize_pwr_state)
dc->hwss.optimize_pwr_state(dc, dc->current_state);
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 099542dd3154..384c077e15fc 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -3052,9 +3052,9 @@ bool dc_set_psr_allow_active(struct dc *dc, bool enable)
if (link->psr_settings.psr_feature_enabled) {
if (enable && !link->psr_settings.psr_allow_active)
- return dc_link_set_psr_allow_active(link, true, false);
+ return dc_link_set_psr_allow_active(link, true, false, false);
else if (!enable && link->psr_settings.psr_allow_active)
- return dc_link_set_psr_allow_active(link, false, true);
+ return dc_link_set_psr_allow_active(link, false, true, false);
}
}
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index 62778ccea055..0292a21ac365 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -2584,17 +2584,23 @@ bool dc_link_set_backlight_level(const struct dc_link *link,
return true;
}
-bool dc_link_set_psr_allow_active(struct dc_link *link, bool allow_active, bool wait)
+bool dc_link_set_psr_allow_active(struct dc_link *link, bool allow_active,
+ bool wait, bool force_static)
{
struct dc *dc = link->ctx->dc;
struct dmcu *dmcu = dc->res_pool->dmcu;
struct dmub_psr *psr = dc->res_pool->psr;
+ if (psr == NULL && force_static)
+ return false;
+
link->psr_settings.psr_allow_active = allow_active;
- if (psr != NULL && link->psr_settings.psr_feature_enabled)
+ if (psr != NULL && link->psr_settings.psr_feature_enabled) {
+ if (force_static && psr->funcs->psr_force_static)
+ psr->funcs->psr_force_static(psr);
psr->funcs->psr_enable(psr, allow_active, wait);
- else if ((dmcu != NULL && dmcu->funcs->is_dmcu_initialized(dmcu)) && link->psr_settings.psr_feature_enabled)
+ } else if ((dmcu != NULL && dmcu->funcs->is_dmcu_initialized(dmcu)) && link->psr_settings.psr_feature_enabled)
dmcu->funcs->set_psr_enable(dmcu, allow_active, wait);
else
return false;
@@ -2602,16 +2608,16 @@ bool dc_link_set_psr_allow_active(struct dc_link *link, bool allow_active, bool
return true;
}
-bool dc_link_get_psr_state(const struct dc_link *link, uint32_t *psr_state)
+bool dc_link_get_psr_state(const struct dc_link *link, enum dc_psr_state *state)
{
struct dc *dc = link->ctx->dc;
struct dmcu *dmcu = dc->res_pool->dmcu;
struct dmub_psr *psr = dc->res_pool->psr;
if (psr != NULL && link->psr_settings.psr_feature_enabled)
- psr->funcs->psr_get_state(psr, psr_state);
+ psr->funcs->psr_get_state(psr, state);
else if (dmcu != NULL && link->psr_settings.psr_feature_enabled)
- dmcu->funcs->get_psr_state(dmcu, psr_state);
+ dmcu->funcs->get_psr_state(dmcu, state);
return true;
}
@@ -2674,7 +2680,6 @@ bool dc_link_setup_psr(struct dc_link *link,
if (!dmcu && !psr)
return false;
-
memset(&psr_configuration, 0, sizeof(psr_configuration));
psr_configuration.bits.ENABLE = 1;
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
index 3f4403e77814..4bb052142fc3 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
@@ -2570,8 +2570,8 @@ static bool handle_hpd_irq_psr_sink(struct dc_link *link)
sizeof(psr_error_status.raw));
/* PSR error, disable and re-enable PSR */
- dc_link_set_psr_allow_active(link, false, true);
- dc_link_set_psr_allow_active(link, true, true);
+ dc_link_set_psr_allow_active(link, false, true, false);
+ dc_link_set_psr_allow_active(link, true, true, false);
return true;
} else if (psr_sink_psr_status.bits.SINK_SELF_REFRESH_STATUS ==
diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h
index 82fe0ab56e3a..4434498363bc 100644
--- a/drivers/gpu/drm/amd/display/dc/dc.h
+++ b/drivers/gpu/drm/amd/display/dc/dc.h
@@ -504,6 +504,8 @@ struct dc_debug_options {
bool disable_dsc;
bool enable_dram_clock_change_one_display_vactive;
bool force_ignore_link_settings;
+ unsigned int ips2_eval_delay_us;
+ unsigned int ips2_entry_delay_us;
};
struct dc_debug_data {
@@ -599,9 +601,7 @@ struct dc {
/* Require to optimize clocks and bandwidth for added/removed planes */
bool optimized_required;
bool wm_optimized_required;
-#if defined(CONFIG_DRM_AMD_DC_DCN3_0)
bool idle_optimizations_allowed;
-#endif
/* Require to maintain clocks and bandwidth for UEFI enabled HW */
int optimize_seamless_boot_streams;
diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
index b98754811977..2cbd5c6d9518 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
+++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
@@ -26,6 +26,7 @@
#include "dc.h"
#include "dc_dmub_srv.h"
#include "../dmub/dmub_srv.h"
+#include "clk_mgr.h"
static void dc_dmub_srv_construct(struct dc_dmub_srv *dc_srv, struct dc *dc,
struct dmub_srv *dmub)
@@ -84,6 +85,66 @@ void dc_dmub_srv_cmd_queue(struct dc_dmub_srv *dc_dmub_srv,
DC_ERROR("Error queuing DMUB command: status=%d\n", status);
}
+bool dc_dmub_srv_cmd_run(struct dc_dmub_srv *dc_dmub_srv, union dmub_rb_cmd *cmd,
+ enum dm_dmub_wait_type wait_type)
+{
+ return dc_dmub_srv_cmd_run_list(dc_dmub_srv, 1, cmd, wait_type);
+}
+
+bool dc_dmub_srv_cmd_run_list(struct dc_dmub_srv *dc_dmub_srv, unsigned int count,
+ union dmub_rb_cmd *cmd_list, enum dm_dmub_wait_type wait_type)
+{
+ struct dc_context *dc_ctx;
+ struct dmub_srv *dmub;
+ enum dmub_status status;
+ int i;
+
+ if (!dc_dmub_srv || !dc_dmub_srv->dmub)
+ return false;
+
+ dc_ctx = dc_dmub_srv->ctx;
+ dmub = dc_dmub_srv->dmub;
+
+ for (i = 0 ; i < count; i++) {
+ // Queue command
+ status = dmub_srv_cmd_queue(dmub, &cmd_list[i]);
+ if (status == DMUB_STATUS_QUEUE_FULL) {
+ /* Execute and wait for queue to become empty again. */
+ dmub_srv_cmd_execute(dmub);
+ dmub_srv_wait_for_idle(dmub, 100000);
+
+ /* Requeue the command. */
+ status = dmub_srv_cmd_queue(dmub, &cmd_list[i]);
+ }
+
+ if (status != DMUB_STATUS_OK) {
+ DC_ERROR("Error queueing DMUB command: status=%d\n", status);
+ return false;
+ }
+ }
+
+ status = dmub_srv_cmd_execute(dmub);
+ if (status != DMUB_STATUS_OK) {
+ DC_ERROR("Error starting DMUB execution: status=%d\n", status);
+ return false;
+ }
+
+ // Wait for DMUB to process command
+ if (wait_type != DM_DMUB_WAIT_TYPE_NO_WAIT) {
+ status = dmub_srv_wait_for_idle(dmub, 100000);
+ if (status != DMUB_STATUS_OK) {
+ DC_LOG_DEBUG("No reply for DMUB command: status=%d\n", status);
+ return false;
+ }
+
+ // Copy data back from ring buffer into command
+ if (wait_type == DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY)
+ dmub_rb_get_return_data(&dmub->inbox1_rb, cmd_list);
+ }
+
+ return true;
+}
+
void dc_dmub_srv_cmd_execute(struct dc_dmub_srv *dc_dmub_srv)
{
struct dmub_srv *dmub = dc_dmub_srv->dmub;
@@ -136,15 +197,207 @@ void dc_dmub_srv_wait_phy_init(struct dc_dmub_srv *dc_dmub_srv)
bool dc_dmub_srv_notify_stream_mask(struct dc_dmub_srv *dc_dmub_srv,
unsigned int stream_mask)
{
- struct dmub_srv *dmub;
- const uint32_t timeout = 30;
+ if (!dc_dmub_srv || !dc_dmub_srv->dmub)
+ return false;
+
+ return dc_wake_and_execute_gpint(dc_dmub_srv->ctx, DMUB_GPINT__IDLE_OPT_NOTIFY_STREAM_MASK,
+ stream_mask, NULL, DM_DMUB_WAIT_TYPE_WAIT);
+}
+
+bool dc_dmub_srv_is_hw_pwr_up(struct dc_dmub_srv *dc_dmub_srv, bool wait)
+{
+ struct dc_context *dc_ctx;
+ enum dmub_status status;
+
+ if (!dc_dmub_srv || !dc_dmub_srv->dmub)
+ return true;
+
+ if (dc_dmub_srv->ctx->dc->debug.dmcub_emulation)
+ return true;
+
+ dc_ctx = dc_dmub_srv->ctx;
+
+ if (wait) {
+ status = dmub_srv_wait_for_hw_pwr_up(dc_dmub_srv->dmub, 500000);
+ if (status != DMUB_STATUS_OK) {
+ DC_ERROR("Error querying DMUB hw power up status: error=%d\n", status);
+ return false;
+ }
+ } else {
+ return dmub_srv_is_hw_pwr_up(dc_dmub_srv->dmub);
+ }
+
+ return true;
+}
+
+static void dc_dmub_srv_notify_idle(const struct dc *dc, bool allow_idle)
+{
+ union dmub_rb_cmd cmd = {0};
+
+ if (dc->debug.dmcub_emulation)
+ return;
+
+ memset(&cmd, 0, sizeof(cmd));
+ cmd.idle_opt_notify_idle.header.type = DMUB_CMD__IDLE_OPT;
+ cmd.idle_opt_notify_idle.header.sub_type = DMUB_CMD__IDLE_OPT_DCN_NOTIFY_IDLE;
+ cmd.idle_opt_notify_idle.header.payload_bytes =
+ sizeof(cmd.idle_opt_notify_idle) -
+ sizeof(cmd.idle_opt_notify_idle.header);
+
+ cmd.idle_opt_notify_idle.cntl_data.driver_idle = allow_idle;
+
+ if (allow_idle) {
+ if (dc->hwss.set_idle_state)
+ dc->hwss.set_idle_state(dc, true);
+ }
+
+ /* NOTE: This does not use the "wake" interface since this is part of the wake path. */
+ dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT);
+}
+
+static void dc_dmub_srv_exit_low_power_state(const struct dc *dc)
+{
+ const uint32_t max_num_polls = 10000;
+ uint32_t allow_state = 0;
+ uint32_t commit_state = 0;
+ uint32_t i;
+
+ if (dc->debug.dmcub_emulation)
+ return;
+
+ if (!dc->idle_optimizations_allowed)
+ return;
+
+ if (!dc->ctx->dmub_srv || !dc->ctx->dmub_srv->dmub)
+ return;
+
+ if (dc->hwss.get_idle_state &&
+ dc->hwss.set_idle_state &&
+ dc->clk_mgr->funcs->exit_low_power_state) {
+ allow_state = dc->hwss.get_idle_state(dc);
+ dc->hwss.set_idle_state(dc, false);
+
+ if (!(allow_state & DMUB_IPS2_ALLOW_MASK)) {
+ // Wait for evaluation time
+ udelay(dc->debug.ips2_eval_delay_us);
+ commit_state = dc->hwss.get_idle_state(dc);
+ if (!(commit_state & DMUB_IPS2_COMMIT_MASK)) {
+ // Tell PMFW to exit low power state
+ dc->clk_mgr->funcs->exit_low_power_state(dc->clk_mgr);
+
+ // Wait for IPS2 entry upper bound
+ udelay(dc->debug.ips2_entry_delay_us);
+ dc->clk_mgr->funcs->exit_low_power_state(dc->clk_mgr);
+
+ for (i = 0; i < max_num_polls; ++i) {
+ commit_state = dc->hwss.get_idle_state(dc);
+ if (commit_state & DMUB_IPS2_COMMIT_MASK)
+ break;
+
+ udelay(1);
+ }
+ ASSERT(i < max_num_polls);
+
+ if (!dc_dmub_srv_is_hw_pwr_up(dc->ctx->dmub_srv, true))
+ ASSERT(0);
+
+ /* TODO: See if we can return early here - IPS2 should go
+ * back directly to IPS0 and clear the flags, but it will
+ * be safer to directly notify DMCUB of this.
+ */
+ allow_state = dc->hwss.get_idle_state(dc);
+ }
+ }
+
+ dc_dmub_srv_notify_idle(dc, false);
+ if (!(allow_state & DMUB_IPS1_ALLOW_MASK)) {
+ for (i = 0; i < max_num_polls; ++i) {
+ commit_state = dc->hwss.get_idle_state(dc);
+ if (commit_state & DMUB_IPS1_COMMIT_MASK)
+ break;
+
+ udelay(1);
+ }
+ ASSERT(i < max_num_polls);
+ }
+ }
+
+ if (!dc_dmub_srv_is_hw_pwr_up(dc->ctx->dmub_srv, true))
+ ASSERT(0);
+}
+
+void dc_dmub_srv_apply_idle_power_optimizations(const struct dc *dc, bool allow_idle)
+{
+ struct dc_dmub_srv *dc_dmub_srv = dc->ctx->dmub_srv;
+
+ if (!dc_dmub_srv || !dc_dmub_srv->dmub)
+ return;
+
+ if (dc_dmub_srv->idle_allowed == allow_idle)
+ return;
+
+ /*
+ * Entering a low power state requires a driver notification.
+ * Powering up the hardware requires notifying PMFW and DMCUB.
+ * Clearing the driver idle allow requires a DMCUB command.
+ * DMCUB commands requires the DMCUB to be powered up and restored.
+ *
+ * Exit out early to prevent an infinite loop of DMCUB commands
+ * triggering exit low power - use software state to track this.
+ */
+ dc_dmub_srv->idle_allowed = allow_idle;
+
+ if (!allow_idle)
+ dc_dmub_srv_exit_low_power_state(dc);
+ else
+ dc_dmub_srv_notify_idle(dc, allow_idle);
+}
+
+static bool dc_dmub_execute_gpint(const struct dc_context *ctx,
+ enum dmub_gpint_command command_code, uint16_t param,
+ uint32_t *response, enum dm_dmub_wait_type wait_type)
+{
+ struct dc_dmub_srv *dc_dmub_srv = ctx->dmub_srv;
+ const uint32_t wait_us = wait_type == DM_DMUB_WAIT_TYPE_NO_WAIT ? 0 : 30;
+ enum dmub_status status;
+
+ if (response)
+ *response = 0;
if (!dc_dmub_srv || !dc_dmub_srv->dmub)
return false;
- dmub = dc_dmub_srv->dmub;
+ status = dmub_srv_send_gpint_command(dc_dmub_srv->dmub, command_code, param, wait_us);
+ if (status != DMUB_STATUS_OK) {
+ if (status == DMUB_STATUS_TIMEOUT && wait_type == DM_DMUB_WAIT_TYPE_NO_WAIT)
+ return true;
+
+ return false;
+ }
+
+ if (response && wait_type == DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY)
+ dmub_srv_get_gpint_response(dc_dmub_srv->dmub, response);
+
+ return true;
+}
+
+bool dc_wake_and_execute_gpint(const struct dc_context *ctx, enum dmub_gpint_command command_code,
+ uint16_t param, uint32_t *response, enum dm_dmub_wait_type wait_type)
+{
+ struct dc_dmub_srv *dc_dmub_srv = ctx->dmub_srv;
+ bool result = false, reallow_idle = false;
+
+ if (!dc_dmub_srv || !dc_dmub_srv->dmub)
+ return false;
+
+ if (dc_dmub_srv->idle_allowed) {
+ dc_dmub_srv_apply_idle_power_optimizations(ctx->dc, false);
+ reallow_idle = true;
+ }
+
+ result = dc_dmub_execute_gpint(ctx, command_code, param, response, wait_type);
+ if (result && reallow_idle)
+ dc_dmub_srv_apply_idle_power_optimizations(ctx->dc, true);
- return dmub_srv_send_gpint_command(
- dmub, DMUB_GPINT__IDLE_OPT_NOTIFY_STREAM_MASK,
- stream_mask, timeout) == DMUB_STATUS_OK;
+ return result;
}
diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h
index bb4ab61887e4..d8d4b02c5ace 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h
@@ -27,6 +27,7 @@
#define _DMUB_DC_SRV_H_
#include "os_types.h"
+#include "dm_services_types.h"
#include "dmub/dmub_srv.h"
struct dmub_srv;
@@ -45,6 +46,8 @@ struct dc_dmub_srv {
struct dc_context *ctx;
void *dm;
+
+ bool idle_allowed;
};
void dc_dmub_srv_cmd_queue(struct dc_dmub_srv *dc_dmub_srv,
@@ -56,6 +59,34 @@ void dc_dmub_srv_wait_idle(struct dc_dmub_srv *dc_dmub_srv);
void dc_dmub_srv_wait_phy_init(struct dc_dmub_srv *dc_dmub_srv);
+bool dc_dmub_srv_cmd_run(struct dc_dmub_srv *dc_dmub_srv, union dmub_rb_cmd *cmd,
+ enum dm_dmub_wait_type wait_type);
+
+bool dc_dmub_srv_cmd_run_list(struct dc_dmub_srv *dc_dmub_srv, unsigned int count,
+ union dmub_rb_cmd *cmd_list, enum dm_dmub_wait_type wait_type);
+
bool dc_dmub_srv_notify_stream_mask(struct dc_dmub_srv *dc_dmub_srv,
unsigned int stream_mask);
+
+bool dc_wake_and_execute_dmub_cmd(const struct dc_context *ctx, union dmub_rb_cmd *cmd,
+ enum dm_dmub_wait_type wait_type);
+
+bool dc_wake_and_execute_dmub_cmd_list(const struct dc_context *ctx, unsigned int count,
+ union dmub_rb_cmd *cmd, enum dm_dmub_wait_type wait_type);
+
+void dc_dmub_srv_apply_idle_power_optimizations(const struct dc *dc, bool allow_idle);
+
+/**
+ * dc_wake_and_execute_gpint()
+ *
+ * @ctx: DC context
+ * @command_code: The command ID to send to DMCUB
+ * @param: The parameter to message DMCUB
+ * @response: Optional response out value - may be NULL.
+ * @wait_type: The wait behavior for the execution
+ */
+bool dc_wake_and_execute_gpint(const struct dc_context *ctx, enum dmub_gpint_command command_code,
+ uint16_t param, uint32_t *response,
+ enum dm_dmub_wait_type wait_type);
+
#endif /* _DMUB_DC_SRV_H_ */
diff --git a/drivers/gpu/drm/amd/display/dc/dc_link.h b/drivers/gpu/drm/amd/display/dc/dc_link.h
index 266b93a705d5..39277aaa3e62 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_link.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_link.h
@@ -219,9 +219,10 @@ int dc_link_get_backlight_level(const struct dc_link *dc_link);
int dc_link_get_target_backlight_pwm(const struct dc_link *link);
-bool dc_link_set_psr_allow_active(struct dc_link *dc_link, bool enable, bool wait);
+bool dc_link_set_psr_allow_active(struct dc_link *dc_link, bool enable,
+ bool wait, bool force_static);
-bool dc_link_get_psr_state(const struct dc_link *dc_link, uint32_t *psr_state);
+bool dc_link_get_psr_state(const struct dc_link *dc_link, enum dc_psr_state *state);
bool dc_link_setup_psr(struct dc_link *dc_link,
const struct dc_stream_state *stream, struct psr_config *psr_config,
diff --git a/drivers/gpu/drm/amd/display/dc/dc_types.h b/drivers/gpu/drm/amd/display/dc/dc_types.h
index c47a19719de2..bf8283ce7527 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_types.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_types.h
@@ -674,6 +674,26 @@ struct dc_plane_flip_time {
unsigned int prev_update_time_in_us;
};
+enum dc_psr_state {
+ PSR_STATE0 = 0x0,
+ PSR_STATE1,
+ PSR_STATE1a,
+ PSR_STATE2,
+ PSR_STATE2a,
+ PSR_STATE3,
+ PSR_STATE3Init,
+ PSR_STATE4,
+ PSR_STATE4a,
+ PSR_STATE4b,
+ PSR_STATE4c,
+ PSR_STATE4d,
+ PSR_STATE5,
+ PSR_STATE5a,
+ PSR_STATE5b,
+ PSR_STATE5c,
+ PSR_STATE_INVALID = 0xFF
+};
+
struct psr_config {
unsigned char psr_version;
unsigned int psr_rfb_setup_time;
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c b/drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c
index 4216419503af..4c397a099e07 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c
@@ -99,7 +99,7 @@ bool dce_dmcu_load_iram(struct dmcu *dmcu,
return true;
}
-static void dce_get_dmcu_psr_state(struct dmcu *dmcu, uint32_t *psr_state)
+static void dce_get_dmcu_psr_state(struct dmcu *dmcu, enum dc_psr_state *state)
{
struct dce_dmcu *dmcu_dce = TO_DCE_DMCU(dmcu);
@@ -114,7 +114,7 @@ static void dce_get_dmcu_psr_state(struct dmcu *dmcu, uint32_t *psr_state)
REG_WRITE(DMCU_IRAM_RD_CTRL, psr_state_offset);
/* Read data from IRAM_RD_DATA in DMCU_IRAM_RD_DATA*/
- *psr_state = REG_READ(DMCU_IRAM_RD_DATA);
+ *state = (enum dc_psr_state)REG_READ(DMCU_IRAM_RD_DATA);
/* Disable write access to IRAM after finished using IRAM
* in order to allow dynamic sleep state
@@ -129,7 +129,7 @@ static void dce_dmcu_set_psr_enable(struct dmcu *dmcu, bool enable, bool wait)
unsigned int dmcu_wait_reg_ready_interval = 100;
unsigned int retryCount;
- uint32_t psr_state = 0;
+ enum dc_psr_state state = PSR_STATE0;
/* waitDMCUReadyForCmd */
REG_WAIT(MASTER_COMM_CNTL_REG, MASTER_COMM_INTERRUPT, 0,
@@ -148,12 +148,12 @@ static void dce_dmcu_set_psr_enable(struct dmcu *dmcu, bool enable, bool wait)
REG_UPDATE(MASTER_COMM_CNTL_REG, MASTER_COMM_INTERRUPT, 1);
if (wait == true) {
for (retryCount = 0; retryCount <= 100; retryCount++) {
- dce_get_dmcu_psr_state(dmcu, &psr_state);
+ dce_get_dmcu_psr_state(dmcu, &state);
if (enable) {
- if (psr_state != 0)
+ if (state != PSR_STATE0)
break;
} else {
- if (psr_state == 0)
+ if (state == PSR_STATE0)
break;
}
udelay(10);
@@ -513,7 +513,7 @@ static bool dcn10_dmcu_load_iram(struct dmcu *dmcu,
return true;
}
-static void dcn10_get_dmcu_psr_state(struct dmcu *dmcu, uint32_t *psr_state)
+static void dcn10_get_dmcu_psr_state(struct dmcu *dmcu, enum dc_psr_state *state)
{
struct dce_dmcu *dmcu_dce = TO_DCE_DMCU(dmcu);
@@ -532,7 +532,7 @@ static void dcn10_get_dmcu_psr_state(struct dmcu *dmcu, uint32_t *psr_state)
REG_WRITE(DMCU_IRAM_RD_CTRL, psr_state_offset);
/* Read data from IRAM_RD_DATA in DMCU_IRAM_RD_DATA*/
- *psr_state = REG_READ(DMCU_IRAM_RD_DATA);
+ *state = (enum dc_psr_state)REG_READ(DMCU_IRAM_RD_DATA);
/* Disable write access to IRAM after finished using IRAM
* in order to allow dynamic sleep state
@@ -547,7 +547,7 @@ static void dcn10_dmcu_set_psr_enable(struct dmcu *dmcu, bool enable, bool wait)
unsigned int dmcu_wait_reg_ready_interval = 100;
unsigned int retryCount;
- uint32_t psr_state = 0;
+ enum dc_psr_state state = PSR_STATE0;
/* If microcontroller is not running, do nothing */
if (dmcu->dmcu_state != DMCU_RUNNING)
@@ -575,12 +575,12 @@ static void dcn10_dmcu_set_psr_enable(struct dmcu *dmcu, bool enable, bool wait)
*/
if (wait == true) {
for (retryCount = 0; retryCount <= 1000; retryCount++) {
- dcn10_get_dmcu_psr_state(dmcu, &psr_state);
+ dcn10_get_dmcu_psr_state(dmcu, &state);
if (enable) {
- if (psr_state != 0)
+ if (state != PSR_STATE0)
break;
} else {
- if (psr_state == 0)
+ if (state == PSR_STATE0)
break;
}
udelay(500);
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c
index 67af67ef2865..f93be6477538 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c
@@ -29,60 +29,83 @@
#include "dmub/dmub_srv.h"
#include "core_types.h"
+#define DC_TRACE_LEVEL_MESSAGE(...) do {} while (0) /* do nothing */
+
#define MAX_PIPES 6
/**
* Convert dmcub psr state to dmcu psr state.
*/
-static void convert_psr_state(uint32_t *psr_state)
+static enum dc_psr_state convert_psr_state(uint32_t raw_state)
{
- if (*psr_state == 0)
- *psr_state = 0;
- else if (*psr_state == 0x10)
- *psr_state = 1;
- else if (*psr_state == 0x11)
- *psr_state = 2;
- else if (*psr_state == 0x20)
- *psr_state = 3;
- else if (*psr_state == 0x21)
- *psr_state = 4;
- else if (*psr_state == 0x30)
- *psr_state = 5;
- else if (*psr_state == 0x31)
- *psr_state = 6;
- else if (*psr_state == 0x40)
- *psr_state = 7;
- else if (*psr_state == 0x41)
- *psr_state = 8;
- else if (*psr_state == 0x42)
- *psr_state = 9;
- else if (*psr_state == 0x43)
- *psr_state = 10;
- else if (*psr_state == 0x44)
- *psr_state = 11;
- else if (*psr_state == 0x50)
- *psr_state = 12;
- else if (*psr_state == 0x51)
- *psr_state = 13;
- else if (*psr_state == 0x52)
- *psr_state = 14;
- else if (*psr_state == 0x53)
- *psr_state = 15;
+ enum dc_psr_state state = PSR_STATE0;
+
+ if (raw_state == 0)
+ state = PSR_STATE0;
+ else if (raw_state == 0x10)
+ state = PSR_STATE1;
+ else if (raw_state == 0x11)
+ state = PSR_STATE1a;
+ else if (raw_state == 0x20)
+ state = PSR_STATE2;
+ else if (raw_state == 0x21)
+ state = PSR_STATE2a;
+ else if (raw_state == 0x30)
+ state = PSR_STATE3;
+ else if (raw_state == 0x31)
+ state = PSR_STATE3Init;
+ else if (raw_state == 0x40)
+ state = PSR_STATE4;
+ else if (raw_state == 0x41)
+ state = PSR_STATE4a;
+ else if (raw_state == 0x42)
+ state = PSR_STATE4b;
+ else if (raw_state == 0x43)
+ state = PSR_STATE4c;
+ else if (raw_state == 0x44)
+ state = PSR_STATE4d;
+ else if (raw_state == 0x50)
+ state = PSR_STATE5;
+ else if (raw_state == 0x51)
+ state = PSR_STATE5a;
+ else if (raw_state == 0x52)
+ state = PSR_STATE5b;
+ else if (raw_state == 0x53)
+ state = PSR_STATE5c;
+
+ return state;
}
/**
* Get PSR state from firmware.
*/
-static void dmub_psr_get_state(struct dmub_psr *dmub, uint32_t *psr_state)
+static void dmub_psr_get_state(struct dmub_psr *dmub, enum dc_psr_state *state)
{
- struct dmub_srv *srv = dmub->ctx->dmub_srv->dmub;
-
- // Send gpint command and wait for ack
- dmub_srv_send_gpint_command(srv, DMUB_GPINT__GET_PSR_STATE, 0, 30);
-
- dmub_srv_get_gpint_response(srv, psr_state);
-
- convert_psr_state(psr_state);
+ uint32_t raw_state = 0;
+ uint32_t retry_count = 0;
+
+ do {
+ // Send gpint command and wait for ack
+ if (dc_wake_and_execute_gpint(dmub->ctx, DMUB_GPINT__GET_PSR_STATE, 0,
+ &raw_state, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY)) {
+ *state = convert_psr_state(raw_state);
+ } else {
+ // Return invalid state when GPINT times out
+ *state = PSR_STATE_INVALID;
+ }
+ } while (++retry_count <= 1000 && *state == PSR_STATE_INVALID);
+
+ // Assert if max retry hit
+ if (retry_count >= 1000 && *state == PSR_STATE_INVALID) {
+ ASSERT(0);
+ DC_TRACE_LEVEL_MESSAGE(DAL_TRACE_LEVEL_ERROR,
+ WPP_BIT_FLAG_Firmware_PsrState,
+ "Unable to get PSR state from FW.");
+ } else
+ DC_TRACE_LEVEL_MESSAGE(DAL_TRACE_LEVEL_VERBOSE,
+ WPP_BIT_FLAG_Firmware_PsrState,
+ "Got PSR state from FW. PSR state: %d, Retry count: %d",
+ *state, retry_count);
}
/**
@@ -123,7 +146,8 @@ static void dmub_psr_enable(struct dmub_psr *dmub, bool enable, bool wait)
{
union dmub_rb_cmd cmd;
struct dc_context *dc = dmub->ctx;
- uint32_t retry_count, psr_state = 0;
+ uint32_t retry_count;
+ enum dc_psr_state state = PSR_STATE0;
cmd.psr_enable.header.type = DMUB_CMD__PSR;
@@ -144,13 +168,13 @@ static void dmub_psr_enable(struct dmub_psr *dmub, bool enable, bool wait)
*/
if (wait) {
for (retry_count = 0; retry_count <= 1000; retry_count++) {
- dmub_psr_get_state(dmub, &psr_state);
+ dmub_psr_get_state(dmub, &state);
if (enable) {
- if (psr_state != 0)
+ if (state != PSR_STATE0)
break;
} else {
- if (psr_state == 0)
+ if (state == PSR_STATE0)
break;
}
@@ -169,12 +193,12 @@ static void dmub_psr_enable(struct dmub_psr *dmub, bool enable, bool wait)
static void dmub_psr_set_level(struct dmub_psr *dmub, uint16_t psr_level)
{
union dmub_rb_cmd cmd;
- uint32_t psr_state = 0;
+ enum dc_psr_state state = PSR_STATE0;
struct dc_context *dc = dmub->ctx;
- dmub_psr_get_state(dmub, &psr_state);
+ dmub_psr_get_state(dmub, &state);
- if (psr_state == 0)
+ if (state == PSR_STATE0)
return;
cmd.psr_set_level.header.type = DMUB_CMD__PSR;
@@ -269,11 +293,29 @@ static bool dmub_psr_copy_settings(struct dmub_psr *dmub,
return true;
}
+/**
+ * Send command to PSR to force static ENTER and ignore all state changes until exit
+ */
+static void dmub_psr_force_static(struct dmub_psr *dmub)
+{
+ union dmub_rb_cmd cmd;
+ struct dc_context *dc = dmub->ctx;
+
+ cmd.psr_force_static.header.type = DMUB_CMD__PSR;
+ cmd.psr_force_static.header.sub_type = DMUB_CMD__PSR_FORCE_STATIC;
+ cmd.psr_enable.header.payload_bytes = 0;
+
+ dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd);
+ dc_dmub_srv_cmd_execute(dc->dmub_srv);
+ dc_dmub_srv_wait_idle(dc->dmub_srv);
+}
+
static const struct dmub_psr_funcs psr_funcs = {
.psr_copy_settings = dmub_psr_copy_settings,
.psr_enable = dmub_psr_enable,
.psr_get_state = dmub_psr_get_state,
.psr_set_level = dmub_psr_set_level,
+ .psr_force_static = dmub_psr_force_static,
};
/**
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.h b/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.h
index dc121ed92d2e..4e113ac5a56b 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.h
+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.h
@@ -37,8 +37,9 @@ struct dmub_psr {
struct dmub_psr_funcs {
bool (*psr_copy_settings)(struct dmub_psr *dmub, struct dc_link *link, struct psr_context *psr_context);
void (*psr_enable)(struct dmub_psr *dmub, bool enable, bool wait);
- void (*psr_get_state)(struct dmub_psr *dmub, uint32_t *psr_state);
+ void (*psr_get_state)(struct dmub_psr *dmub, enum dc_psr_state *dc_psr_state);
void (*psr_set_level)(struct dmub_psr *dmub, uint16_t psr_level);
+ void (*psr_force_static)(struct dmub_psr *dmub);
};
struct dmub_psr *dmub_psr_create(struct dc_context *ctx);
diff --git a/drivers/gpu/drm/amd/display/dc/dm_services.h b/drivers/gpu/drm/amd/display/dc/dm_services.h
index fdd1943c828d..569cdbdc4746 100644
--- a/drivers/gpu/drm/amd/display/dc/dm_services.h
+++ b/drivers/gpu/drm/amd/display/dc/dm_services.h
@@ -42,6 +42,7 @@
struct dmub_srv;
struct dc_dmub_srv;
+union dmub_rb_cmd;
irq_handler_idx dm_register_interrupt(
struct dc_context *ctx,
@@ -294,6 +295,14 @@ unsigned long long dm_get_elapse_time_in_ns(struct dc_context *ctx,
__CTX->perf_trace->write_count, &__CTX->perf_trace->last_entry_read,\
&__CTX->perf_trace->last_entry_write, __func__, __LINE__)
+/*
+ * DMUB Interfaces
+ */
+bool dm_execute_dmub_cmd(const struct dc_context *ctx, union dmub_rb_cmd *cmd,
+ enum dm_dmub_wait_type wait_type);
+
+bool dm_execute_dmub_cmd_list(const struct dc_context *ctx, unsigned int count,
+ union dmub_rb_cmd *cmd, enum dm_dmub_wait_type wait_type);
/*
* Debug and verification hooks
diff --git a/drivers/gpu/drm/amd/display/dc/dm_services_types.h b/drivers/gpu/drm/amd/display/dc/dm_services_types.h
index b52ba6ffabe1..facf269c4326 100644
--- a/drivers/gpu/drm/amd/display/dc/dm_services_types.h
+++ b/drivers/gpu/drm/amd/display/dc/dm_services_types.h
@@ -269,4 +269,10 @@ struct dtn_min_clk_info {
uint32_t min_memory_clock_khz;
};
+enum dm_dmub_wait_type {
+ DM_DMUB_WAIT_TYPE_NO_WAIT,
+ DM_DMUB_WAIT_TYPE_WAIT,
+ DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY,
+};
+
#endif
diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr.h b/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr.h
index 947d6106f341..c22d6dd9dfec 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr.h
@@ -231,6 +231,7 @@ struct clk_mgr_funcs {
int (*get_dp_ref_clk_frequency)(struct clk_mgr *clk_mgr);
void (*set_low_power_state)(struct clk_mgr *clk_mgr);
+ void (*exit_low_power_state)(struct clk_mgr *clk_mgr);
void (*init_clocks)(struct clk_mgr *clk_mgr);
diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/dmcu.h b/drivers/gpu/drm/amd/display/dc/inc/hw/dmcu.h
index 5315f1f86b21..69d9fbfb4bec 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw/dmcu.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/dmcu.h
@@ -66,7 +66,7 @@ struct dmcu_funcs {
bool (*setup_psr)(struct dmcu *dmcu,
struct dc_link *link,
struct psr_context *psr_context);
- void (*get_psr_state)(struct dmcu *dmcu, uint32_t *psr_state);
+ void (*get_psr_state)(struct dmcu *dmcu, enum dc_psr_state *dc_psr_state);
void (*set_psr_wait_loop)(struct dmcu *dmcu,
unsigned int wait_loop_number);
void (*get_psr_wait_loop)(struct dmcu *dmcu,
diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h b/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h
index 3165a66c5362..03c075ea5fc1 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h
@@ -213,7 +213,8 @@ struct hw_sequencer_funcs {
/* Idle Optimization Related */
bool (*apply_idle_power_optimizations)(struct dc *dc, bool enable);
#endif
-
+ void (*set_idle_state)(const struct dc *dc, bool allow_idle);
+ uint32_t (*get_idle_state)(const struct dc *dc);
};
void color_space_to_black_color(
diff --git a/drivers/gpu/drm/amd/display/dmub/dmub_srv.h b/drivers/gpu/drm/amd/display/dmub/dmub_srv.h
index 882b4e2816b5..9ff364c6353d 100644
--- a/drivers/gpu/drm/amd/display/dmub/dmub_srv.h
+++ b/drivers/gpu/drm/amd/display/dmub/dmub_srv.h
@@ -264,6 +264,8 @@ struct dmub_srv_hw_funcs {
bool (*is_hw_init)(struct dmub_srv *dmub);
+ bool (*is_hw_powered_up)(struct dmub_srv *dmub);
+
bool (*is_phy_init)(struct dmub_srv *dmub);
bool (*is_auto_load_done)(struct dmub_srv *dmub);
@@ -486,6 +488,24 @@ enum dmub_status dmub_srv_cmd_queue(struct dmub_srv *dmub,
*/
enum dmub_status dmub_srv_cmd_execute(struct dmub_srv *dmub);
+/**
+ * dmub_srv_wait_for_hw_pwr_up() - Waits for firmware hardware power up is completed
+ * @dmub: the dmub service
+ * @timeout_us: the maximum number of microseconds to wait
+ *
+ * Waits until firmware hardware is powered up. The maximum
+ * wait time is given in microseconds to prevent spinning forever.
+ *
+ * Return:
+ * DMUB_STATUS_OK - success
+ * DMUB_STATUS_TIMEOUT - timed out
+ * DMUB_STATUS_INVALID - unspecified error
+ */
+enum dmub_status dmub_srv_wait_for_hw_pwr_up(struct dmub_srv *dmub,
+ uint32_t timeout_us);
+
+bool dmub_srv_is_hw_pwr_up(struct dmub_srv *dmub);
+
/**
* dmub_srv_wait_for_auto_load() - Waits for firmware auto load to complete
* @dmub: the dmub service
diff --git a/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h b/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
index d103ec1eaa73..c741aaa7cd34 100644
--- a/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
+++ b/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
@@ -104,6 +104,11 @@ union dmub_psr_debug_flags {
uint32_t u32All;
};
+struct dmub_feature_caps {
+ uint8_t psr;
+ uint8_t reserved[7];
+};
+
#if defined(__cplusplus)
}
#endif
@@ -123,6 +128,17 @@ union dmub_psr_debug_flags {
/* Offset from the end of the file to the dmub_fw_meta_info */
#define DMUB_FW_META_OFFSET 0x24
+/**
+ *
+ * PSR control version legacy
+ */
+#define DMUB_CMD_PSR_CONTROL_VERSION_UNKNOWN 0x0
+/**
+ * PSR control version with multi edp support
+ */
+#define DMUB_CMD_PSR_CONTROL_VERSION_1 0x1
+
+
/**
* struct dmub_fw_meta_info - metadata associated with fw binary
*
@@ -183,6 +199,11 @@ enum dmub_fw_boot_status_bit {
DMUB_FW_BOOT_STATUS_BIT_RESTORE_REQUIRED = (1 << 3),
};
+#define DMUB_IPS1_ALLOW_MASK 0x00000001
+#define DMUB_IPS2_ALLOW_MASK 0x00000002
+#define DMUB_IPS1_COMMIT_MASK 0x00000004
+#define DMUB_IPS2_COMMIT_MASK 0x00000008
+
/* Register bit definition for SCRATCH15 */
union dmub_fw_boot_options {
struct {
@@ -272,6 +293,7 @@ enum dmub_gpint_command {
* ARGS: Stream mask, 1 bit per active stream index.
*/
DMUB_GPINT__IDLE_OPT_NOTIFY_STREAM_MASK = 8,
+ DMUB_GPINT__PSR_RESIDENCY = 9,
};
//==============================================================================
@@ -297,11 +319,13 @@ enum dmub_cmd_type {
DMUB_CMD__REG_SEQ_BURST_WRITE = 3,
DMUB_CMD__REG_REG_WAIT = 4,
DMUB_CMD__PLAT_54186_WA = 5,
+ DMUB_CMD__QUERY_FEATURE_CAPS = 6,
DMUB_CMD__PSR = 64,
DMUB_CMD__ABM = 66,
DMUB_CMD__HW_LOCK = 69,
DMUB_CMD__DP_AUX_ACCESS = 70,
DMUB_CMD__OUTBOX1_ENABLE = 71,
+ DMUB_CMD__IDLE_OPT = 72,
DMUB_CMD__VBIOS = 128,
};
@@ -316,7 +340,8 @@ enum dmub_out_cmd_type {
struct dmub_cmd_header {
unsigned int type : 8;
unsigned int sub_type : 8;
- unsigned int reserved0 : 8;
+ unsigned int ret_status : 1;
+ unsigned int reserved0 : 7;
unsigned int payload_bytes : 6; /* up to 60 bytes */
unsigned int reserved1 : 2;
};
@@ -549,6 +574,7 @@ enum dmub_cmd_psr_type {
DMUB_CMD__PSR_ENABLE = 2,
DMUB_CMD__PSR_DISABLE = 3,
DMUB_CMD__PSR_SET_LEVEL = 4,
+ DMUB_CMD__PSR_FORCE_STATIC = 5,
};
enum psr_version {
@@ -560,6 +586,9 @@ struct dmub_cmd_psr_copy_settings_data {
union dmub_psr_debug_flags debug;
uint16_t psr_level;
uint8_t dpp_inst;
+ /* opp_inst and mpcc_inst will not be used in dmub fw,
+ * dmub fw will get active opp by reading odm registers.
+ */
uint8_t mpcc_inst;
uint8_t opp_inst;
uint8_t otg_inst;
@@ -603,6 +632,10 @@ struct dmub_rb_cmd_psr_set_version {
struct dmub_cmd_psr_set_version_data psr_set_version_data;
};
+struct dmub_rb_cmd_psr_force_static {
+ struct dmub_cmd_header header;
+};
+
union dmub_hw_lock_flags {
struct {
uint8_t lock_pipe : 1;
@@ -744,6 +777,45 @@ struct dmub_rb_cmd_abm_init_config {
struct dmub_cmd_abm_init_config_data abm_init_config_data;
};
+/**
+ * enum dmub_cmd_idle_opt_type - Idle optimization command type.
+ */
+enum dmub_cmd_idle_opt_type {
+ /**
+ * DCN hardware restore.
+ */
+ DMUB_CMD__IDLE_OPT_DCN_RESTORE = 0,
+
+ /**
+ * DCN hardware save.
+ */
+ DMUB_CMD__IDLE_OPT_DCN_SAVE_INIT = 1,
+
+ /**
+ * DCN hardware notify idle.
+ */
+ DMUB_CMD__IDLE_OPT_DCN_NOTIFY_IDLE = 2
+};
+
+struct dmub_dcn_notify_idle_cntl_data {
+ uint8_t driver_idle;
+ uint8_t pad[1];
+};
+
+struct dmub_rb_cmd_idle_opt_dcn_notify_idle {
+ struct dmub_cmd_header header; /**< header */
+ struct dmub_dcn_notify_idle_cntl_data cntl_data;
+};
+
+struct dmub_cmd_query_feature_caps_data {
+ struct dmub_feature_caps feature_caps;
+};
+
+struct dmub_rb_cmd_query_feature_caps {
+ struct dmub_cmd_header header;
+ struct dmub_cmd_query_feature_caps_data query_feature_caps_data;
+};
+
union dmub_rb_cmd {
struct dmub_rb_cmd_lock_hw lock_hw;
struct dmub_rb_cmd_read_modify_write read_modify_write;
@@ -760,6 +832,7 @@ union dmub_rb_cmd {
struct dmub_rb_cmd_psr_copy_settings psr_copy_settings;
struct dmub_rb_cmd_psr_enable psr_enable;
struct dmub_rb_cmd_psr_set_level psr_set_level;
+ struct dmub_rb_cmd_psr_force_static psr_force_static;
struct dmub_rb_cmd_PLAT_54186_wa PLAT_54186_wa;
struct dmub_rb_cmd_abm_set_pipe abm_set_pipe;
struct dmub_rb_cmd_abm_set_backlight abm_set_backlight;
@@ -769,6 +842,8 @@ union dmub_rb_cmd {
struct dmub_rb_cmd_abm_init_config abm_init_config;
struct dmub_rb_cmd_dp_aux_access dp_aux_access;
struct dmub_rb_cmd_outbox1_enable outbox1_enable;
+ struct dmub_rb_cmd_query_feature_caps query_feature_caps;
+ struct dmub_rb_cmd_idle_opt_dcn_notify_idle idle_opt_notify_idle;
};
union dmub_rb_out_cmd {
@@ -831,7 +906,7 @@ static inline bool dmub_rb_push_front(struct dmub_rb *rb,
{
uint64_t volatile *dst = (uint64_t volatile *)(rb->base_address) + rb->wrpt / sizeof(uint64_t);
const uint64_t *src = (const uint64_t *)cmd;
- int i;
+ uint8_t i;
if (dmub_rb_full(rb))
return false;
@@ -868,14 +943,14 @@ static inline bool dmub_rb_out_push_front(struct dmub_rb *rb,
}
static inline bool dmub_rb_front(struct dmub_rb *rb,
- union dmub_rb_cmd *cmd)
+ union dmub_rb_cmd **cmd)
{
- uint8_t *rd_ptr = (uint8_t *)rb->base_address + rb->rptr;
+ uint8_t *rb_cmd = (uint8_t *)(rb->base_address) + rb->rptr;
if (dmub_rb_empty(rb))
return false;
- dmub_memcpy(cmd, rd_ptr, DMUB_RB_CMD_SIZE);
+ *cmd = (union dmub_rb_cmd *)rb_cmd;
return true;
}
@@ -885,7 +960,7 @@ static inline bool dmub_rb_out_front(struct dmub_rb *rb,
{
const uint64_t volatile *src = (const uint64_t volatile *)(rb->base_address) + rb->rptr / sizeof(uint64_t);
uint64_t *dst = (uint64_t *)cmd;
- int i;
+ uint8_t i;
if (dmub_rb_empty(rb))
return false;
@@ -917,7 +992,7 @@ static inline void dmub_rb_flush_pending(const struct dmub_rb *rb)
while (rptr != wptr) {
uint64_t volatile *data = (uint64_t volatile *)rb->base_address + rptr / sizeof(uint64_t);
- int i;
+ uint8_t i;
for (i = 0; i < DMUB_RB_CMD_SIZE / sizeof(uint64_t); i++)
*data++;
@@ -937,6 +1012,17 @@ static inline void dmub_rb_init(struct dmub_rb *rb,
rb->wrpt = init_params->write_ptr;
}
+static inline void dmub_rb_get_return_data(struct dmub_rb *rb,
+ union dmub_rb_cmd *cmd)
+{
+ // Copy rb entry back into command
+ uint8_t *rd_ptr = (rb->rptr == 0) ?
+ (uint8_t *)rb->base_address + rb->capacity - DMUB_RB_CMD_SIZE :
+ (uint8_t *)rb->base_address + rb->rptr - DMUB_RB_CMD_SIZE;
+
+ dmub_memcpy(cmd, rd_ptr, DMUB_RB_CMD_SIZE);
+}
+
#if defined(__cplusplus)
}
#endif
diff --git a/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c b/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c
index 08da423b24a1..b2f909d58a05 100644
--- a/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c
+++ b/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c
@@ -516,6 +516,33 @@ enum dmub_status dmub_srv_cmd_execute(struct dmub_srv *dmub)
return DMUB_STATUS_OK;
}
+bool dmub_srv_is_hw_pwr_up(struct dmub_srv *dmub)
+{
+ if (!dmub->hw_funcs.is_hw_powered_up)
+ return true;
+
+ return dmub->hw_funcs.is_hw_powered_up(dmub) &&
+ dmub->hw_funcs.is_hw_init(dmub);
+}
+
+enum dmub_status dmub_srv_wait_for_hw_pwr_up(struct dmub_srv *dmub,
+ uint32_t timeout_us)
+{
+ uint32_t i;
+
+ if (!dmub->hw_init)
+ return DMUB_STATUS_INVALID;
+
+ for (i = 0; i <= timeout_us; i += 100) {
+ if (dmub_srv_is_hw_pwr_up(dmub))
+ return DMUB_STATUS_OK;
+
+ udelay(100);
+ }
+
+ return DMUB_STATUS_TIMEOUT;
+}
+
enum dmub_status dmub_srv_wait_for_auto_load(struct dmub_srv *dmub,
uint32_t timeout_us)
{
--
2.34.1
2
1
15 Apr '24
From: Dimitris Vlachos <dvlachos(a)ics.forth.gr>
stable inclusion
from stable-v5.10.212
commit 8af1c121b0102041809bc137ec600d1865eaeedd
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E466
CVE: CVE-2024-26795
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit a11dd49dcb9376776193e15641f84fcc1e5980c9 ]
Offset vmemmap so that the first page of vmemmap will be mapped
to the first page of physical memory in order to ensure that
vmemmap’s bounds will be respected during
pfn_to_page()/page_to_pfn() operations.
The conversion macros will produce correct SV39/48/57 addresses
for every possible/valid DRAM_BASE inside the physical memory limits.
v2:Address Alex's comments
Suggested-by: Alexandre Ghiti <alexghiti(a)rivosinc.com>
Signed-off-by: Dimitris Vlachos <dvlachos(a)ics.forth.gr>
Reported-by: Dimitris Vlachos <dvlachos(a)ics.forth.gr>
Closes: https://lore.kernel.org/linux-riscv/20240202135030.42265-1-csd4492@csd.uoc.…
Fixes: d95f1a542c3d ("RISC-V: Implement sparsemem")
Reviewed-by: Alexandre Ghiti <alexghiti(a)rivosinc.com>
Link: https://lore.kernel.org/r/20240229191723.32779-1-dvlachos@ics.forth.gr
Signed-off-by: Palmer Dabbelt <palmer(a)rivosinc.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com>
---
arch/riscv/include/asm/pgtable.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
index b16304fdf448..5ab13570daa5 100644
--- a/arch/riscv/include/asm/pgtable.h
+++ b/arch/riscv/include/asm/pgtable.h
@@ -44,7 +44,7 @@
* Define vmemmap for pfn_to_page & page_to_pfn calls. Needed if kernel
* is configured with CONFIG_SPARSEMEM_VMEMMAP enabled.
*/
-#define vmemmap ((struct page *)VMEMMAP_START)
+#define vmemmap ((struct page *)VMEMMAP_START - (phys_ram_base >> PAGE_SHIFT))
#define PCI_IO_SIZE SZ_16M
#define PCI_IO_END VMEMMAP_START
--
2.34.1
2
1
[openeuler:OLK-5.10 19114/30000] drivers/scsi/sssraid/sssraid_os.c:1568:2: error: implicit declaration of function 'for_each_pci_msi_entry'
by kernel test robot 15 Apr '24
by kernel test robot 15 Apr '24
15 Apr '24
tree: https://gitee.com/openeuler/kernel.git OLK-5.10
head: 9a6863f4e4a4271bdb5b3a1e955bcd851d81c27a
commit: bbae0ca11850da2793282896206974656859a73e [19114/30000] SCSI: SSSRAID: Introduce map_queue in sssraid module
config: x86_64-randconfig-122-20240413 (https://download.01.org/0day-ci/archive/20240415/202404151411.qh3ixZhW-lkp@…)
compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240415/202404151411.qh3ixZhW-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202404151411.qh3ixZhW-lkp@intel.com/
All errors (new ones prefixed by >>):
>> drivers/scsi/sssraid/sssraid_os.c:1568:2: error: implicit declaration of function 'for_each_pci_msi_entry' [-Werror,-Wimplicit-function-declaration]
1568 | for_each_pci_msi_entry(entry, pdev) {
| ^
>> drivers/scsi/sssraid/sssraid_os.c:1568:37: error: expected ';' after expression
1568 | for_each_pci_msi_entry(entry, pdev) {
| ^
| ;
>> drivers/scsi/sssraid/sssraid_os.c:1569:43: error: no member named 'msi_list' in 'struct device'
1569 | struct list_head *msi_list = &pdev->dev.msi_list;
| ~~~~~~~~~ ^
>> drivers/scsi/sssraid/sssraid_os.c:1581:5: error: 'continue' statement not in loop statement
1581 | continue;
| ^
drivers/scsi/sssraid/sssraid_os.c:1591:3: error: 'continue' statement not in loop statement
1591 | continue;
| ^
5 errors generated.
vim +/for_each_pci_msi_entry +1568 drivers/scsi/sssraid/sssraid_os.c
1550
1551 static int sssraid_map_queues(struct Scsi_Host *shost)
1552 {
1553 struct sssraid_ioc *sdioc = shost_priv(shost);
1554 struct pci_dev *pdev = sdioc->pdev;
1555 struct msi_desc *entry = NULL;
1556 struct irq_affinity_desc *affinity = NULL;
1557 struct blk_mq_tag_set *tag_set = &shost->tag_set;
1558 struct blk_mq_queue_map *queue_map = &tag_set->map[HCTX_TYPE_DEFAULT];
1559 const struct cpumask *node_mask = NULL;
1560 unsigned int queue_offset = queue_map->queue_offset;
1561 unsigned int *map = queue_map->mq_map;
1562 unsigned int nr_queues = queue_map->nr_queues;
1563 unsigned int node_id, node_id_last = 0xFFFFFFFF;
1564 int cpu, first_sibling, cpu_index = 0;
1565 u8 node_count = 0, i;
1566 unsigned int node_id_array[100];
1567
> 1568 for_each_pci_msi_entry(entry, pdev) {
> 1569 struct list_head *msi_list = &pdev->dev.msi_list;
1570
1571 if (list_is_last(msi_list, &entry->list))
1572 goto get_next_numa_node;
1573
1574 if (entry->irq) {
1575 affinity = entry->affinity;
1576 node_mask = &affinity->mask;
1577
1578 cpu = cpumask_first(node_mask);
1579 node_id = cpu_to_node(cpu);
1580 if (node_id_last == node_id)
> 1581 continue;
1582
1583 for (i = 0; i < node_count; i++) {
1584 if (node_id == node_id_array[i])
1585 goto get_next_numa_node;
1586 }
1587 node_id_array[node_count++] = node_id;
1588 node_id_last = node_id;
1589 }
1590 get_next_numa_node:
1591 continue;
1592 }
1593
1594 for (i = 0; i < node_count; i++) {
1595 node_mask = cpumask_of_node(node_id_array[i]);
1596 dbgprint(sdioc, "NUMA_node = %d\n", node_id_array[i]);
1597 for_each_cpu(cpu, node_mask) {
1598 if (cpu_index < nr_queues) {
1599 map[cpu_index++] = queue_offset + (cpu % nr_queues);
1600 } else {
1601 first_sibling = sssraid_get_first_sibling(cpu);
1602 if (first_sibling == cpu)
1603 map[cpu_index++] = queue_offset + (cpu % nr_queues);
1604 else
1605 map[cpu_index++] = map[first_sibling];
1606 }
1607 dbgprint(sdioc, "map[%d] = %d\n", cpu_index - 1, map[cpu_index - 1]);
1608 }
1609 }
1610
1611 return 0;
1612 }
1613
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
1
0
CVE-2024-27437
Alex Williamson (1):
vfio/pci: Disable auto-enable of exclusive INTx IRQ
Barry Song (1):
genirq: Add IRQF_NO_AUTOEN for request_irq/nmi()
drivers/vfio/pci/vfio_pci_intrs.c | 17 ++++++++++-------
include/linux/interrupt.h | 4 ++++
kernel/irq/manage.c | 11 +++++++++--
3 files changed, 23 insertions(+), 9 deletions(-)
--
2.34.1
2
3
[openeuler:openEuler-1.0-LTS 17814/22098] drivers/edac/.tmp_skx_common.o: warning: objtool: missing symbol for section .text
by kernel test robot 15 Apr '24
by kernel test robot 15 Apr '24
15 Apr '24
tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS
head: ff773a407598b9c693c9dc10e0dc587828127aa6
commit: e34047f6dc606c123911c6db8fa424bb4a035262 [17814/22098] EDAC, skx_edac: Delete duplicated code
config: x86_64-buildonly-randconfig-005-20240415 (https://download.01.org/0day-ci/archive/20240415/202404151440.syDdJhZl-lkp@…)
compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240415/202404151440.syDdJhZl-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202404151440.syDdJhZl-lkp@intel.com/
All warnings (new ones prefixed by >>):
drivers/edac/skx_common.c: In function 'skx_mce_output_error':
drivers/edac/skx_common.c:470:15: warning: variable 'type' set but not used [-Wunused-but-set-variable]
470 | char *type, *optype;
| ^~~~
drivers/edac/skx_common.c: In function 'skx_get_dimm_info':
drivers/edac/skx_common.c:309:79: warning: '_DIMM#' directive output may be truncated writing 6 bytes into a region of size between 0 and 9 [-Wformat-truncation=]
309 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u",
| ^~~~~~
drivers/edac/skx_common.c:309:52: note: using the range [0, 4294967295] for directive argument
309 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/edac/skx_common.c:309:9: note: 'snprintf' output between 31 and 53 bytes into a destination of size 32
309 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
310 | imc->src_id, imc->lmc, chan, dimmno);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/edac/skx_common.c: In function 'skx_get_nvdimm_info':
drivers/edac/skx_common.c:357:79: warning: '_DIMM#' directive output may be truncated writing 6 bytes into a region of size between 0 and 9 [-Wformat-truncation=]
357 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u",
| ^~~~~~
drivers/edac/skx_common.c:357:52: note: using the range [0, 4294967295] for directive argument
357 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/edac/skx_common.c:357:9: note: 'snprintf' output between 31 and 53 bytes into a destination of size 32
357 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
358 | imc->src_id, imc->lmc, chan, dimmno);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> drivers/edac/.tmp_skx_common.o: warning: objtool: missing symbol for section .text
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
1
0
[openeuler:openEuler-1.0-LTS 5421/22098] include/linux/uaccess.h:112:17: warning: 'uf' may be used uninitialized
by kernel test robot 15 Apr '24
by kernel test robot 15 Apr '24
15 Apr '24
tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS
head: ff773a407598b9c693c9dc10e0dc587828127aa6
commit: 71e217e85c3dff8a9151707ed3afc7b4b054a2d4 [5421/22098] selinux: use kernel linux/socket.h for genheaders and mdp
config: arm64-randconfig-002-20240415 (https://download.01.org/0day-ci/archive/20240415/202404151325.D66sRhzh-lkp@…)
compiler: aarch64-linux-gcc (GCC) 13.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240415/202404151325.D66sRhzh-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202404151325.D66sRhzh-lkp@intel.com/
Note: it may well be a FALSE warning. FWIW you are at least aware of it now.
http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings
All warnings (new ones prefixed by >>):
In file included from drivers/net/tun.c:53:
In function '__skb_queue_splice',
inlined from 'skb_queue_splice_tail_init' at include/linux/skbuff.h:1801:3,
inlined from 'tun_napi_receive' at drivers/net/tun.c:287:2:
include/linux/skbuff.h:1741:20: warning: array subscript 'struct sk_buff[0]' is partly outside array bounds of 'struct sk_buff_head[1]' [-Warray-bounds=]
1741 | next->prev = last;
| ~~~~~~~~~~~^~~~~~
drivers/net/tun.c: In function 'tun_napi_receive':
drivers/net/tun.c:280:29: note: object 'process_queue' of size 24
280 | struct sk_buff_head process_queue;
| ^~~~~~~~~~~~~
In file included from include/linux/poll.h:12,
from drivers/net/tun.c:50:
In function '_copy_from_user',
inlined from 'copy_from_user' at include/linux/uaccess.h:144:7,
inlined from 'update_filter' at drivers/net/tun.c:923:6:
>> include/linux/uaccess.h:112:17: warning: 'uf' may be used uninitialized [-Wmaybe-uninitialized]
112 | kasan_check_write(to, n);
| ^~~~~~~~~~~~~~~~~~~~~~~~
In file included from include/linux/compiler.h:251,
from include/linux/kernel.h:10,
from include/linux/list.h:9,
from include/linux/module.h:10,
from drivers/net/tun.c:44:
include/linux/kasan-checks.h: In function 'update_filter':
include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here
7 | void kasan_check_write(const volatile void *p, unsigned int size);
| ^~~~~~~~~~~~~~~~~
drivers/net/tun.c:920:27: note: 'uf' declared here
920 | struct tun_filter uf;
| ^~
In function '_copy_from_user',
inlined from 'copy_from_user' at include/linux/uaccess.h:144:7,
inlined from 'tun_set_ebpf' at drivers/net/tun.c:2825:6:
include/linux/uaccess.h:112:17: warning: 'fd' may be used uninitialized [-Wmaybe-uninitialized]
112 | kasan_check_write(to, n);
| ^~~~~~~~~~~~~~~~~~~~~~~~
include/linux/kasan-checks.h: In function 'tun_set_ebpf':
include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here
7 | void kasan_check_write(const volatile void *p, unsigned int size);
| ^~~~~~~~~~~~~~~~~
drivers/net/tun.c:2823:13: note: 'fd' declared here
2823 | int fd;
| ^~
In function '__skb_queue_splice',
inlined from 'skb_queue_splice_tail_init' at include/linux/skbuff.h:1801:3,
inlined from 'tun_rx_batched.isra' at drivers/net/tun.c:1538:3:
include/linux/skbuff.h:1738:20: warning: array subscript 'struct sk_buff[0]' is partly outside array bounds of 'struct sk_buff_head[1]' [-Warray-bounds=]
1738 | prev->next = first;
| ~~~~~~~~~~~^~~~~~~
drivers/net/tun.c: In function 'tun_rx_batched.isra':
drivers/net/tun.c:1523:29: note: object 'process_queue' of size 24
1523 | struct sk_buff_head process_queue;
| ^~~~~~~~~~~~~
In function '__skb_queue_splice',
inlined from 'skb_queue_splice_tail_init' at include/linux/skbuff.h:1801:3,
inlined from 'tun_rx_batched.isra' at drivers/net/tun.c:1538:3:
include/linux/skbuff.h:1741:20: warning: array subscript 'struct sk_buff[0]' is partly outside array bounds of 'struct sk_buff_head[1]' [-Warray-bounds=]
1741 | next->prev = last;
| ~~~~~~~~~~~^~~~~~
drivers/net/tun.c: In function 'tun_rx_batched.isra':
drivers/net/tun.c:1523:29: note: object 'process_queue' of size 24
1523 | struct sk_buff_head process_queue;
| ^~~~~~~~~~~~~
In file included from drivers/net/tun.c:54:
In function 'rps_record_sock_flow',
inlined from 'sock_rps_record_flow_hash' at include/net/sock.h:977:2,
inlined from 'tun_flow_update' at drivers/net/tun.c:540:3:
include/linux/netdevice.h:717:32: warning: array subscript index is outside array bounds of 'u32[0]' {aka 'unsigned int[]'} [-Warray-bounds=]
717 | if (table->ents[index] != val)
| ~~~~~~~~~~~^~~~~~~
include/linux/netdevice.h: In function 'tun_flow_update':
include/linux/netdevice.h:698:17: note: while referencing 'ents'
698 | u32 ents[0] ____cacheline_aligned_in_smp;
| ^~~~
In function 'rps_record_sock_flow',
inlined from 'sock_rps_record_flow_hash' at include/net/sock.h:977:2,
inlined from 'tun_flow_update' at drivers/net/tun.c:540:3:
include/linux/netdevice.h:718:36: warning: array subscript index is outside array bounds of 'u32[0]' {aka 'unsigned int[]'} [-Warray-bounds=]
718 | table->ents[index] = val;
| ~~~~~~~~~~~^~~~~~~
include/linux/netdevice.h: In function 'tun_flow_update':
include/linux/netdevice.h:698:17: note: while referencing 'ents'
698 | u32 ents[0] ____cacheline_aligned_in_smp;
| ^~~~
In file included from include/asm-generic/preempt.h:5,
from ./arch/arm64/include/generated/asm/preempt.h:1,
from include/linux/preempt.h:81,
from include/linux/rcupdate.h:40,
from include/linux/rculist.h:11,
from include/linux/pid.h:5,
from include/linux/sched.h:14,
from arch/arm64/include/asm/compat.h:25,
from arch/arm64/include/asm/stat.h:24,
from include/linux/stat.h:6,
from include/linux/module.h:11:
In function 'check_object_size',
inlined from 'check_copy_size' at include/linux/thread_info.h:150:2,
inlined from 'copy_from_user' at include/linux/uaccess.h:143:6,
inlined from '__tun_chr_ioctl' at drivers/net/tun.c:2858:7:
include/linux/thread_info.h:119:17: warning: 'ifr' may be used uninitialized [-Wmaybe-uninitialized]
119 | __check_object_size(ptr, n, to_user);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/thread_info.h: In function '__tun_chr_ioctl':
include/linux/thread_info.h:112:13: note: by argument 1 of type 'const void *' to '__check_object_size' declared here
112 | extern void __check_object_size(const void *ptr, unsigned long n,
| ^~~~~~~~~~~~~~~~~~~
drivers/net/tun.c:2846:22: note: 'ifr' declared here
2846 | struct ifreq ifr;
| ^~~
drivers/net/tun.c:561: warning: Function parameter or member 'e' not described in 'tun_flow_save_rps_rxhash'
drivers/net/tun.c:561: warning: Function parameter or member 'hash' not described in 'tun_flow_save_rps_rxhash'
--
from net/bridge/netfilter/ebtables.c:21:
In function '_copy_from_user',
inlined from 'copy_from_user' at include/linux/uaccess.h:144:7,
inlined from 'compat_copy_ebt_replace_from_user' at net/bridge/netfilter/ebtables.c:2175:6:
include/linux/uaccess.h:112:17: warning: 'tmp' may be used uninitialized [-Wmaybe-uninitialized]
112 | kasan_check_write(to, n);
| ^~~~~~~~~~~~~~~~~~~~~~~~
In file included from include/linux/compiler.h:251,
from include/asm-generic/bug.h:5,
from arch/arm64/include/asm/bug.h:37,
from include/linux/bug.h:5,
from include/linux/mmdebug.h:5,
from include/linux/gfp.h:5,
from include/linux/umh.h:4,
from include/linux/kmod.h:22,
from net/bridge/netfilter/ebtables.c:18:
include/linux/kasan-checks.h: In function 'compat_copy_ebt_replace_from_user':
include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here
7 | void kasan_check_write(const volatile void *p, unsigned int size);
| ^~~~~~~~~~~~~~~~~
net/bridge/netfilter/ebtables.c:2169:35: note: 'tmp' declared here
2169 | struct compat_ebt_replace tmp;
| ^~~
In function '_copy_from_user',
inlined from 'copy_from_user' at include/linux/uaccess.h:144:7,
inlined from 'copy_everything_to_user' at net/bridge/netfilter/ebtables.c:1444:6:
include/linux/uaccess.h:112:17: warning: 'tmp' may be used uninitialized [-Wmaybe-uninitialized]
112 | kasan_check_write(to, n);
| ^~~~~~~~~~~~~~~~~~~~~~~~
include/linux/kasan-checks.h: In function 'copy_everything_to_user':
include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here
7 | void kasan_check_write(const volatile void *p, unsigned int size);
| ^~~~~~~~~~~~~~~~~
net/bridge/netfilter/ebtables.c:1426:28: note: 'tmp' declared here
1426 | struct ebt_replace tmp;
| ^~~
In function '_copy_from_user',
inlined from 'copy_from_user' at include/linux/uaccess.h:144:7,
inlined from 'do_replace' at net/bridge/netfilter/ebtables.c:1083:6:
include/linux/uaccess.h:112:17: warning: 'tmp' may be used uninitialized [-Wmaybe-uninitialized]
112 | kasan_check_write(to, n);
| ^~~~~~~~~~~~~~~~~~~~~~~~
include/linux/kasan-checks.h: In function 'do_replace':
include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here
7 | void kasan_check_write(const volatile void *p, unsigned int size);
| ^~~~~~~~~~~~~~~~~
net/bridge/netfilter/ebtables.c:1081:28: note: 'tmp' declared here
1081 | struct ebt_replace tmp;
| ^~~
In function '_copy_from_user',
inlined from 'copy_from_user' at include/linux/uaccess.h:144:7,
inlined from 'compat_copy_everything_to_user' at net/bridge/netfilter/ebtables.c:1824:6:
include/linux/uaccess.h:112:17: warning: 'tmp' may be used uninitialized [-Wmaybe-uninitialized]
112 | kasan_check_write(to, n);
| ^~~~~~~~~~~~~~~~~~~~~~~~
include/linux/kasan-checks.h: In function 'compat_copy_everything_to_user':
include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here
7 | void kasan_check_write(const volatile void *p, unsigned int size);
| ^~~~~~~~~~~~~~~~~
net/bridge/netfilter/ebtables.c:1804:41: note: 'tmp' declared here
1804 | struct compat_ebt_replace repl, tmp;
| ^~~
In file included from include/linux/netfilter/x_tables.h:9:
net/bridge/netfilter/ebtables.c: In function 'do_update_counters.isra':
net/bridge/netfilter/ebtables.c:1292:49: warning: array subscript i is outside array bounds of 'struct ebt_counter[0]' [-Warray-bounds=]
1292 | ADD_COUNTER(t->private->counters[i], tmp[i].pcnt, tmp[i].bcnt);
include/uapi/linux/netfilter/x_tables.h:108:34: note: in definition of macro 'ADD_COUNTER'
108 | #define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)
| ^
In file included from net/bridge/netfilter/ebtables.c:22:
include/linux/netfilter_bridge/ebtables.h:88:28: note: while referencing 'counters'
88 | struct ebt_counter counters[0] ____cacheline_aligned;
| ^~~~~~~~
net/bridge/netfilter/ebtables.c:1292:49: warning: array subscript i is outside array bounds of 'struct ebt_counter[0]' [-Warray-bounds=]
1292 | ADD_COUNTER(t->private->counters[i], tmp[i].pcnt, tmp[i].bcnt);
include/uapi/linux/netfilter/x_tables.h:108:34: note: in definition of macro 'ADD_COUNTER'
108 | #define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)
| ^
include/linux/netfilter_bridge/ebtables.h:88:28: note: while referencing 'counters'
88 | struct ebt_counter counters[0] ____cacheline_aligned;
| ^~~~~~~~
net/bridge/netfilter/ebtables.c:1292:49: warning: array subscript i is outside array bounds of 'struct ebt_counter[0]' [-Warray-bounds=]
1292 | ADD_COUNTER(t->private->counters[i], tmp[i].pcnt, tmp[i].bcnt);
include/uapi/linux/netfilter/x_tables.h:108:51: note: in definition of macro 'ADD_COUNTER'
108 | #define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)
| ^
include/linux/netfilter_bridge/ebtables.h:88:28: note: while referencing 'counters'
88 | struct ebt_counter counters[0] ____cacheline_aligned;
| ^~~~~~~~
net/bridge/netfilter/ebtables.c:1292:49: warning: array subscript i is outside array bounds of 'struct ebt_counter[0]' [-Warray-bounds=]
1292 | ADD_COUNTER(t->private->counters[i], tmp[i].pcnt, tmp[i].bcnt);
include/uapi/linux/netfilter/x_tables.h:108:51: note: in definition of macro 'ADD_COUNTER'
108 | #define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)
| ^
include/linux/netfilter_bridge/ebtables.h:88:28: note: while referencing 'counters'
88 | struct ebt_counter counters[0] ____cacheline_aligned;
| ^~~~~~~~
In function '_copy_from_user',
inlined from 'copy_from_user' at include/linux/uaccess.h:144:7,
inlined from 'update_counters' at net/bridge/netfilter/ebtables.c:1308:6:
>> include/linux/uaccess.h:112:17: warning: 'hlp' may be used uninitialized [-Wmaybe-uninitialized]
112 | kasan_check_write(to, n);
| ^~~~~~~~~~~~~~~~~~~~~~~~
include/linux/kasan-checks.h: In function 'update_counters':
include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here
7 | void kasan_check_write(const volatile void *p, unsigned int size);
| ^~~~~~~~~~~~~~~~~
net/bridge/netfilter/ebtables.c:1306:28: note: 'hlp' declared here
1306 | struct ebt_replace hlp;
| ^~~
vim +/uf +112 include/linux/uaccess.h
d597580d373774 Al Viro 2017-03-20 104
d597580d373774 Al Viro 2017-03-20 105 #ifdef INLINE_COPY_FROM_USER
d597580d373774 Al Viro 2017-03-20 106 static inline unsigned long
d597580d373774 Al Viro 2017-03-20 107 _copy_from_user(void *to, const void __user *from, unsigned long n)
d597580d373774 Al Viro 2017-03-20 108 {
d597580d373774 Al Viro 2017-03-20 109 unsigned long res = n;
9c5f6908de03a4 Al Viro 2017-06-29 110 might_fault();
4983cb67a383a7 Linus Torvalds 2019-02-14 111 if (likely(access_ok(from, n))) {
9c5f6908de03a4 Al Viro 2017-06-29 @112 kasan_check_write(to, n);
d597580d373774 Al Viro 2017-03-20 113 res = raw_copy_from_user(to, from, n);
9c5f6908de03a4 Al Viro 2017-06-29 114 }
d597580d373774 Al Viro 2017-03-20 115 if (unlikely(res))
d597580d373774 Al Viro 2017-03-20 116 memset(to + (n - res), 0, res);
d597580d373774 Al Viro 2017-03-20 117 return res;
d597580d373774 Al Viro 2017-03-20 118 }
d597580d373774 Al Viro 2017-03-20 119 #else
d597580d373774 Al Viro 2017-03-20 120 extern unsigned long
d597580d373774 Al Viro 2017-03-20 121 _copy_from_user(void *, const void __user *, unsigned long);
d597580d373774 Al Viro 2017-03-20 122 #endif
d597580d373774 Al Viro 2017-03-20 123
:::::: The code at line 112 was first introduced by commit
:::::: 9c5f6908de03a4f52ba7364b11fcd6116225480c copy_{from,to}_user(): move kasan checks and might_fault() out-of-line
:::::: TO: Al Viro <viro(a)zeniv.linux.org.uk>
:::::: CC: Al Viro <viro(a)zeniv.linux.org.uk>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
1
0
15 Apr '24
From: Alex Williamson <alex.williamson(a)redhat.com>
stable inclusion
from stable-v5.15.154
commit b7a2f0955ffceffadfe098b40b50307431f45438
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E6TU
CVE: CVE-2024-27437
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit fe9a7082684eb059b925c535682e68c34d487d43 ]
Currently for devices requiring masking at the irqchip for INTx, ie.
devices without DisINTx support, the IRQ is enabled in request_irq()
and subsequently disabled as necessary to align with the masked status
flag. This presents a window where the interrupt could fire between
these events, resulting in the IRQ incrementing the disable depth twice.
This would be unrecoverable for a user since the masked flag prevents
nested enables through vfio.
Instead, invert the logic using IRQF_NO_AUTOEN such that exclusive INTx
is never auto-enabled, then unmask as required.
Cc: <stable(a)vger.kernel.org>
Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver")
Reviewed-by: Kevin Tian <kevin.tian(a)intel.com>
Reviewed-by: Eric Auger <eric.auger(a)redhat.com>
Link: https://lore.kernel.org/r/20240308230557.805580-2-alex.williamson@redhat.com
Signed-off-by: Alex Williamson <alex.williamson(a)redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com>
---
drivers/vfio/pci/vfio_pci_intrs.c | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)
diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
index 869dce5f134d..9e002214a45c 100644
--- a/drivers/vfio/pci/vfio_pci_intrs.c
+++ b/drivers/vfio/pci/vfio_pci_intrs.c
@@ -199,8 +199,15 @@ static int vfio_intx_set_signal(struct vfio_pci_device *vdev, int fd)
vdev->ctx[0].trigger = trigger;
+ /*
+ * Devices without DisINTx support require an exclusive interrupt,
+ * IRQ masking is performed at the IRQ chip. The masked status is
+ * protected by vdev->irqlock. Setup the IRQ without auto-enable and
+ * unmask as necessary below under lock. DisINTx is unmodified by
+ * the IRQ configuration and may therefore use auto-enable.
+ */
if (!vdev->pci_2_3)
- irqflags = 0;
+ irqflags = IRQF_NO_AUTOEN;
ret = request_irq(pdev->irq, vfio_intx_handler,
irqflags, vdev->ctx[0].name, vdev);
@@ -211,13 +218,9 @@ static int vfio_intx_set_signal(struct vfio_pci_device *vdev, int fd)
return ret;
}
- /*
- * INTx disable will stick across the new irq setup,
- * disable_irq won't.
- */
spin_lock_irqsave(&vdev->irqlock, flags);
- if (!vdev->pci_2_3 && vdev->ctx[0].masked)
- disable_irq_nosync(pdev->irq);
+ if (!vdev->pci_2_3 && !vdev->ctx[0].masked)
+ enable_irq(pdev->irq);
spin_unlock_irqrestore(&vdev->irqlock, flags);
return 0;
--
2.34.1
2
1
15 Apr '24
From: Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com>
stable inclusion
from stable-v6.7.3
commit 2ef98c6d753a744e333b7e34b9cf687040fba57d
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV4C
CVE: CVE-2023-52624
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
[ Upstream commit e5ffd1263dd5b44929c676171802e7b6af483f21 ]
[Why]
DMCUB can be in idle when we attempt to interface with the HW through
the GPINT mailbox resulting in a system hang.
[How]
Add dc_wake_and_execute_gpint() to wrap the wake, execute, sleep
sequence.
If the GPINT executes successfully then DMCUB will be put back into
sleep after the optional response is returned.
It functions similar to the inbox command interface.
Cc: Mario Limonciello <mario.limonciello(a)amd.com>
Cc: Alex Deucher <alexander.deucher(a)amd.com>
Cc: stable(a)vger.kernel.org
Reviewed-by: Hansen Dsouza <hansen.dsouza(a)amd.com>
Acked-by: Wayne Lin <wayne.lin(a)amd.com>
Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com>
Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com>
This fix requires:
115c7e7f0501 ("drm/amd/display: Add psr get_state call")
0825d9658b5e ("drm/amd/display: implement notify stream mask")
1d496907f1c5 ("drm/amd/display: Engage PSR synchronously")
34ba432c946d ("drm/amd/display: [FW Promotion] Release 0.0.44")
672251b223c1 ("drm/amd/display: [FW Promotion] Release 0.0.40")
04f3c88f0955 ("drm/amd/display: Retry getting PSR state if command times out")
e97cc04fe0fb ("drm/amd/display: refactor dmub commands into single function")
522b9a5d5852 ("drm/amd/display: drain dmub inbox if queue is full")
9dce8c2a5f1b ("drm/amd/display: [FW Promotion] Release 0.0.161.0")
276641775848 ("drm/amd/display: [FW Promotion] Release 0.0.162.0")
65138eb72e1f ("drm/amd/display: Add DCN35 DMUB")
dc01c4b79bfe ("drm/amd/display: Update driver and IPS interop")
5b7954272ae9 ("drm/amd/display: [FW Promotion] Release 0.0.183.0")
da2d16fcdda3 ("drm/amd/display: Fix IPS handshake for idle optimizations")
5e8a0d3598b4 ("drm/amd/display: Negate IPS allow and commit bits")
820c3870c491 ("drm/amd/display: Refactor DMCUB enter/exit idle interface")
2ef98c6d753a ("drm/amd/display: Wake DMCUB before executing GPINT commands")
Signed-off-by: Zhu Wang <wangzhu9(a)huawei.com>
---
.../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 16 +-
.../amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 6 +-
.../gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c | 5 +-
drivers/gpu/drm/amd/display/dc/core/dc.c | 4 +-
drivers/gpu/drm/amd/display/dc/core/dc_link.c | 19 +-
.../gpu/drm/amd/display/dc/core/dc_link_dp.c | 4 +-
drivers/gpu/drm/amd/display/dc/dc.h | 4 +-
drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 265 +++++++++++++++++-
drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h | 31 ++
drivers/gpu/drm/amd/display/dc/dc_link.h | 5 +-
drivers/gpu/drm/amd/display/dc/dc_types.h | 20 ++
drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c | 24 +-
drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c | 127 ++++++---
drivers/gpu/drm/amd/display/dc/dce/dmub_psr.h | 3 +-
drivers/gpu/drm/amd/display/dc/dm_services.h | 9 +
.../drm/amd/display/dc/dm_services_types.h | 6 +
.../gpu/drm/amd/display/dc/inc/hw/clk_mgr.h | 1 +
drivers/gpu/drm/amd/display/dc/inc/hw/dmcu.h | 2 +-
.../gpu/drm/amd/display/dc/inc/hw_sequencer.h | 3 +-
drivers/gpu/drm/amd/display/dmub/dmub_srv.h | 20 ++
.../gpu/drm/amd/display/dmub/inc/dmub_cmd.h | 100 ++++++-
.../gpu/drm/amd/display/dmub/src/dmub_srv.c | 27 ++
22 files changed, 605 insertions(+), 96 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 652ddec18838..924d643a37ae 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -9308,7 +9308,7 @@ bool amdgpu_dm_psr_enable(struct dc_stream_state *stream)
&stream, 1,
¶ms);
- return dc_link_set_psr_allow_active(link, true, false);
+ return dc_link_set_psr_allow_active(link, true, false, false);
}
/*
@@ -9322,7 +9322,7 @@ static bool amdgpu_dm_psr_disable(struct dc_stream_state *stream)
DRM_DEBUG_DRIVER("Disabling psr...\n");
- return dc_link_set_psr_allow_active(stream->link, false, true);
+ return dc_link_set_psr_allow_active(stream->link, false, true, false);
}
/*
@@ -9355,3 +9355,15 @@ void amdgpu_dm_trigger_timing_sync(struct drm_device *dev)
}
mutex_unlock(&adev->dm.dc_lock);
}
+
+bool dm_execute_dmub_cmd(const struct dc_context *ctx, union dmub_rb_cmd *cmd,
+ enum dm_dmub_wait_type wait_type)
+{
+ return dc_dmub_srv_cmd_run(ctx->dmub_srv, cmd, wait_type);
+}
+
+bool dm_execute_dmub_cmd_list(const struct dc_context *ctx, unsigned int count,
+ union dmub_rb_cmd *cmd, enum dm_dmub_wait_type wait_type)
+{
+ return dc_dmub_srv_cmd_run_list(ctx->dmub_srv, count, cmd, wait_type);
+}
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
index e43f82bcb231..9dee30fc4d1c 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
@@ -2210,11 +2210,11 @@ static int psr_get(void *data, u64 *val)
{
struct amdgpu_dm_connector *connector = data;
struct dc_link *link = connector->dc_link;
- uint32_t psr_state = 0;
+ enum dc_psr_state state = PSR_STATE0;
- dc_link_get_psr_state(link, &psr_state);
+ dc_link_get_psr_state(link, &state);
- *val = psr_state;
+ *val = state;
return 0;
}
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c
index 857f156e4985..4a408cbb9363 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c
@@ -95,7 +95,7 @@ void clk_mgr_exit_optimized_pwr_state(const struct dc *dc, struct clk_mgr *clk_m
if (edp_link) {
clk_mgr->psr_allow_active_cache = edp_link->psr_settings.psr_allow_active;
- dc_link_set_psr_allow_active(edp_link, false, false);
+ dc_link_set_psr_allow_active(edp_link, false, false, false);
}
}
@@ -105,7 +105,8 @@ void clk_mgr_optimize_pwr_state(const struct dc *dc, struct clk_mgr *clk_mgr)
struct dc_link *edp_link = get_edp_link(dc);
if (edp_link)
- dc_link_set_psr_allow_active(edp_link, clk_mgr->psr_allow_active_cache, false);
+ dc_link_set_psr_allow_active(edp_link,
+ clk_mgr->psr_allow_active_cache, false, false);
if (dc->hwss.optimize_pwr_state)
dc->hwss.optimize_pwr_state(dc, dc->current_state);
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 099542dd3154..384c077e15fc 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -3052,9 +3052,9 @@ bool dc_set_psr_allow_active(struct dc *dc, bool enable)
if (link->psr_settings.psr_feature_enabled) {
if (enable && !link->psr_settings.psr_allow_active)
- return dc_link_set_psr_allow_active(link, true, false);
+ return dc_link_set_psr_allow_active(link, true, false, false);
else if (!enable && link->psr_settings.psr_allow_active)
- return dc_link_set_psr_allow_active(link, false, true);
+ return dc_link_set_psr_allow_active(link, false, true, false);
}
}
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index 62778ccea055..0292a21ac365 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -2584,17 +2584,23 @@ bool dc_link_set_backlight_level(const struct dc_link *link,
return true;
}
-bool dc_link_set_psr_allow_active(struct dc_link *link, bool allow_active, bool wait)
+bool dc_link_set_psr_allow_active(struct dc_link *link, bool allow_active,
+ bool wait, bool force_static)
{
struct dc *dc = link->ctx->dc;
struct dmcu *dmcu = dc->res_pool->dmcu;
struct dmub_psr *psr = dc->res_pool->psr;
+ if (psr == NULL && force_static)
+ return false;
+
link->psr_settings.psr_allow_active = allow_active;
- if (psr != NULL && link->psr_settings.psr_feature_enabled)
+ if (psr != NULL && link->psr_settings.psr_feature_enabled) {
+ if (force_static && psr->funcs->psr_force_static)
+ psr->funcs->psr_force_static(psr);
psr->funcs->psr_enable(psr, allow_active, wait);
- else if ((dmcu != NULL && dmcu->funcs->is_dmcu_initialized(dmcu)) && link->psr_settings.psr_feature_enabled)
+ } else if ((dmcu != NULL && dmcu->funcs->is_dmcu_initialized(dmcu)) && link->psr_settings.psr_feature_enabled)
dmcu->funcs->set_psr_enable(dmcu, allow_active, wait);
else
return false;
@@ -2602,16 +2608,16 @@ bool dc_link_set_psr_allow_active(struct dc_link *link, bool allow_active, bool
return true;
}
-bool dc_link_get_psr_state(const struct dc_link *link, uint32_t *psr_state)
+bool dc_link_get_psr_state(const struct dc_link *link, enum dc_psr_state *state)
{
struct dc *dc = link->ctx->dc;
struct dmcu *dmcu = dc->res_pool->dmcu;
struct dmub_psr *psr = dc->res_pool->psr;
if (psr != NULL && link->psr_settings.psr_feature_enabled)
- psr->funcs->psr_get_state(psr, psr_state);
+ psr->funcs->psr_get_state(psr, state);
else if (dmcu != NULL && link->psr_settings.psr_feature_enabled)
- dmcu->funcs->get_psr_state(dmcu, psr_state);
+ dmcu->funcs->get_psr_state(dmcu, state);
return true;
}
@@ -2674,7 +2680,6 @@ bool dc_link_setup_psr(struct dc_link *link,
if (!dmcu && !psr)
return false;
-
memset(&psr_configuration, 0, sizeof(psr_configuration));
psr_configuration.bits.ENABLE = 1;
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
index 3f4403e77814..4bb052142fc3 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
@@ -2570,8 +2570,8 @@ static bool handle_hpd_irq_psr_sink(struct dc_link *link)
sizeof(psr_error_status.raw));
/* PSR error, disable and re-enable PSR */
- dc_link_set_psr_allow_active(link, false, true);
- dc_link_set_psr_allow_active(link, true, true);
+ dc_link_set_psr_allow_active(link, false, true, false);
+ dc_link_set_psr_allow_active(link, true, true, false);
return true;
} else if (psr_sink_psr_status.bits.SINK_SELF_REFRESH_STATUS ==
diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h
index 82fe0ab56e3a..4434498363bc 100644
--- a/drivers/gpu/drm/amd/display/dc/dc.h
+++ b/drivers/gpu/drm/amd/display/dc/dc.h
@@ -504,6 +504,8 @@ struct dc_debug_options {
bool disable_dsc;
bool enable_dram_clock_change_one_display_vactive;
bool force_ignore_link_settings;
+ unsigned int ips2_eval_delay_us;
+ unsigned int ips2_entry_delay_us;
};
struct dc_debug_data {
@@ -599,9 +601,7 @@ struct dc {
/* Require to optimize clocks and bandwidth for added/removed planes */
bool optimized_required;
bool wm_optimized_required;
-#if defined(CONFIG_DRM_AMD_DC_DCN3_0)
bool idle_optimizations_allowed;
-#endif
/* Require to maintain clocks and bandwidth for UEFI enabled HW */
int optimize_seamless_boot_streams;
diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
index b98754811977..2cbd5c6d9518 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
+++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
@@ -26,6 +26,7 @@
#include "dc.h"
#include "dc_dmub_srv.h"
#include "../dmub/dmub_srv.h"
+#include "clk_mgr.h"
static void dc_dmub_srv_construct(struct dc_dmub_srv *dc_srv, struct dc *dc,
struct dmub_srv *dmub)
@@ -84,6 +85,66 @@ void dc_dmub_srv_cmd_queue(struct dc_dmub_srv *dc_dmub_srv,
DC_ERROR("Error queuing DMUB command: status=%d\n", status);
}
+bool dc_dmub_srv_cmd_run(struct dc_dmub_srv *dc_dmub_srv, union dmub_rb_cmd *cmd,
+ enum dm_dmub_wait_type wait_type)
+{
+ return dc_dmub_srv_cmd_run_list(dc_dmub_srv, 1, cmd, wait_type);
+}
+
+bool dc_dmub_srv_cmd_run_list(struct dc_dmub_srv *dc_dmub_srv, unsigned int count,
+ union dmub_rb_cmd *cmd_list, enum dm_dmub_wait_type wait_type)
+{
+ struct dc_context *dc_ctx;
+ struct dmub_srv *dmub;
+ enum dmub_status status;
+ int i;
+
+ if (!dc_dmub_srv || !dc_dmub_srv->dmub)
+ return false;
+
+ dc_ctx = dc_dmub_srv->ctx;
+ dmub = dc_dmub_srv->dmub;
+
+ for (i = 0 ; i < count; i++) {
+ // Queue command
+ status = dmub_srv_cmd_queue(dmub, &cmd_list[i]);
+ if (status == DMUB_STATUS_QUEUE_FULL) {
+ /* Execute and wait for queue to become empty again. */
+ dmub_srv_cmd_execute(dmub);
+ dmub_srv_wait_for_idle(dmub, 100000);
+
+ /* Requeue the command. */
+ status = dmub_srv_cmd_queue(dmub, &cmd_list[i]);
+ }
+
+ if (status != DMUB_STATUS_OK) {
+ DC_ERROR("Error queueing DMUB command: status=%d\n", status);
+ return false;
+ }
+ }
+
+ status = dmub_srv_cmd_execute(dmub);
+ if (status != DMUB_STATUS_OK) {
+ DC_ERROR("Error starting DMUB execution: status=%d\n", status);
+ return false;
+ }
+
+ // Wait for DMUB to process command
+ if (wait_type != DM_DMUB_WAIT_TYPE_NO_WAIT) {
+ status = dmub_srv_wait_for_idle(dmub, 100000);
+ if (status != DMUB_STATUS_OK) {
+ DC_LOG_DEBUG("No reply for DMUB command: status=%d\n", status);
+ return false;
+ }
+
+ // Copy data back from ring buffer into command
+ if (wait_type == DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY)
+ dmub_rb_get_return_data(&dmub->inbox1_rb, cmd_list);
+ }
+
+ return true;
+}
+
void dc_dmub_srv_cmd_execute(struct dc_dmub_srv *dc_dmub_srv)
{
struct dmub_srv *dmub = dc_dmub_srv->dmub;
@@ -136,15 +197,207 @@ void dc_dmub_srv_wait_phy_init(struct dc_dmub_srv *dc_dmub_srv)
bool dc_dmub_srv_notify_stream_mask(struct dc_dmub_srv *dc_dmub_srv,
unsigned int stream_mask)
{
- struct dmub_srv *dmub;
- const uint32_t timeout = 30;
+ if (!dc_dmub_srv || !dc_dmub_srv->dmub)
+ return false;
+
+ return dc_wake_and_execute_gpint(dc_dmub_srv->ctx, DMUB_GPINT__IDLE_OPT_NOTIFY_STREAM_MASK,
+ stream_mask, NULL, DM_DMUB_WAIT_TYPE_WAIT);
+}
+
+bool dc_dmub_srv_is_hw_pwr_up(struct dc_dmub_srv *dc_dmub_srv, bool wait)
+{
+ struct dc_context *dc_ctx;
+ enum dmub_status status;
+
+ if (!dc_dmub_srv || !dc_dmub_srv->dmub)
+ return true;
+
+ if (dc_dmub_srv->ctx->dc->debug.dmcub_emulation)
+ return true;
+
+ dc_ctx = dc_dmub_srv->ctx;
+
+ if (wait) {
+ status = dmub_srv_wait_for_hw_pwr_up(dc_dmub_srv->dmub, 500000);
+ if (status != DMUB_STATUS_OK) {
+ DC_ERROR("Error querying DMUB hw power up status: error=%d\n", status);
+ return false;
+ }
+ } else {
+ return dmub_srv_is_hw_pwr_up(dc_dmub_srv->dmub);
+ }
+
+ return true;
+}
+
+static void dc_dmub_srv_notify_idle(const struct dc *dc, bool allow_idle)
+{
+ union dmub_rb_cmd cmd = {0};
+
+ if (dc->debug.dmcub_emulation)
+ return;
+
+ memset(&cmd, 0, sizeof(cmd));
+ cmd.idle_opt_notify_idle.header.type = DMUB_CMD__IDLE_OPT;
+ cmd.idle_opt_notify_idle.header.sub_type = DMUB_CMD__IDLE_OPT_DCN_NOTIFY_IDLE;
+ cmd.idle_opt_notify_idle.header.payload_bytes =
+ sizeof(cmd.idle_opt_notify_idle) -
+ sizeof(cmd.idle_opt_notify_idle.header);
+
+ cmd.idle_opt_notify_idle.cntl_data.driver_idle = allow_idle;
+
+ if (allow_idle) {
+ if (dc->hwss.set_idle_state)
+ dc->hwss.set_idle_state(dc, true);
+ }
+
+ /* NOTE: This does not use the "wake" interface since this is part of the wake path. */
+ dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT);
+}
+
+static void dc_dmub_srv_exit_low_power_state(const struct dc *dc)
+{
+ const uint32_t max_num_polls = 10000;
+ uint32_t allow_state = 0;
+ uint32_t commit_state = 0;
+ uint32_t i;
+
+ if (dc->debug.dmcub_emulation)
+ return;
+
+ if (!dc->idle_optimizations_allowed)
+ return;
+
+ if (!dc->ctx->dmub_srv || !dc->ctx->dmub_srv->dmub)
+ return;
+
+ if (dc->hwss.get_idle_state &&
+ dc->hwss.set_idle_state &&
+ dc->clk_mgr->funcs->exit_low_power_state) {
+ allow_state = dc->hwss.get_idle_state(dc);
+ dc->hwss.set_idle_state(dc, false);
+
+ if (!(allow_state & DMUB_IPS2_ALLOW_MASK)) {
+ // Wait for evaluation time
+ udelay(dc->debug.ips2_eval_delay_us);
+ commit_state = dc->hwss.get_idle_state(dc);
+ if (!(commit_state & DMUB_IPS2_COMMIT_MASK)) {
+ // Tell PMFW to exit low power state
+ dc->clk_mgr->funcs->exit_low_power_state(dc->clk_mgr);
+
+ // Wait for IPS2 entry upper bound
+ udelay(dc->debug.ips2_entry_delay_us);
+ dc->clk_mgr->funcs->exit_low_power_state(dc->clk_mgr);
+
+ for (i = 0; i < max_num_polls; ++i) {
+ commit_state = dc->hwss.get_idle_state(dc);
+ if (commit_state & DMUB_IPS2_COMMIT_MASK)
+ break;
+
+ udelay(1);
+ }
+ ASSERT(i < max_num_polls);
+
+ if (!dc_dmub_srv_is_hw_pwr_up(dc->ctx->dmub_srv, true))
+ ASSERT(0);
+
+ /* TODO: See if we can return early here - IPS2 should go
+ * back directly to IPS0 and clear the flags, but it will
+ * be safer to directly notify DMCUB of this.
+ */
+ allow_state = dc->hwss.get_idle_state(dc);
+ }
+ }
+
+ dc_dmub_srv_notify_idle(dc, false);
+ if (!(allow_state & DMUB_IPS1_ALLOW_MASK)) {
+ for (i = 0; i < max_num_polls; ++i) {
+ commit_state = dc->hwss.get_idle_state(dc);
+ if (commit_state & DMUB_IPS1_COMMIT_MASK)
+ break;
+
+ udelay(1);
+ }
+ ASSERT(i < max_num_polls);
+ }
+ }
+
+ if (!dc_dmub_srv_is_hw_pwr_up(dc->ctx->dmub_srv, true))
+ ASSERT(0);
+}
+
+void dc_dmub_srv_apply_idle_power_optimizations(const struct dc *dc, bool allow_idle)
+{
+ struct dc_dmub_srv *dc_dmub_srv = dc->ctx->dmub_srv;
+
+ if (!dc_dmub_srv || !dc_dmub_srv->dmub)
+ return;
+
+ if (dc_dmub_srv->idle_allowed == allow_idle)
+ return;
+
+ /*
+ * Entering a low power state requires a driver notification.
+ * Powering up the hardware requires notifying PMFW and DMCUB.
+ * Clearing the driver idle allow requires a DMCUB command.
+ * DMCUB commands requires the DMCUB to be powered up and restored.
+ *
+ * Exit out early to prevent an infinite loop of DMCUB commands
+ * triggering exit low power - use software state to track this.
+ */
+ dc_dmub_srv->idle_allowed = allow_idle;
+
+ if (!allow_idle)
+ dc_dmub_srv_exit_low_power_state(dc);
+ else
+ dc_dmub_srv_notify_idle(dc, allow_idle);
+}
+
+static bool dc_dmub_execute_gpint(const struct dc_context *ctx,
+ enum dmub_gpint_command command_code, uint16_t param,
+ uint32_t *response, enum dm_dmub_wait_type wait_type)
+{
+ struct dc_dmub_srv *dc_dmub_srv = ctx->dmub_srv;
+ const uint32_t wait_us = wait_type == DM_DMUB_WAIT_TYPE_NO_WAIT ? 0 : 30;
+ enum dmub_status status;
+
+ if (response)
+ *response = 0;
if (!dc_dmub_srv || !dc_dmub_srv->dmub)
return false;
- dmub = dc_dmub_srv->dmub;
+ status = dmub_srv_send_gpint_command(dc_dmub_srv->dmub, command_code, param, wait_us);
+ if (status != DMUB_STATUS_OK) {
+ if (status == DMUB_STATUS_TIMEOUT && wait_type == DM_DMUB_WAIT_TYPE_NO_WAIT)
+ return true;
+
+ return false;
+ }
+
+ if (response && wait_type == DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY)
+ dmub_srv_get_gpint_response(dc_dmub_srv->dmub, response);
+
+ return true;
+}
+
+bool dc_wake_and_execute_gpint(const struct dc_context *ctx, enum dmub_gpint_command command_code,
+ uint16_t param, uint32_t *response, enum dm_dmub_wait_type wait_type)
+{
+ struct dc_dmub_srv *dc_dmub_srv = ctx->dmub_srv;
+ bool result = false, reallow_idle = false;
+
+ if (!dc_dmub_srv || !dc_dmub_srv->dmub)
+ return false;
+
+ if (dc_dmub_srv->idle_allowed) {
+ dc_dmub_srv_apply_idle_power_optimizations(ctx->dc, false);
+ reallow_idle = true;
+ }
+
+ result = dc_dmub_execute_gpint(ctx, command_code, param, response, wait_type);
+ if (result && reallow_idle)
+ dc_dmub_srv_apply_idle_power_optimizations(ctx->dc, true);
- return dmub_srv_send_gpint_command(
- dmub, DMUB_GPINT__IDLE_OPT_NOTIFY_STREAM_MASK,
- stream_mask, timeout) == DMUB_STATUS_OK;
+ return result;
}
diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h
index bb4ab61887e4..d8d4b02c5ace 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h
@@ -27,6 +27,7 @@
#define _DMUB_DC_SRV_H_
#include "os_types.h"
+#include "dm_services_types.h"
#include "dmub/dmub_srv.h"
struct dmub_srv;
@@ -45,6 +46,8 @@ struct dc_dmub_srv {
struct dc_context *ctx;
void *dm;
+
+ bool idle_allowed;
};
void dc_dmub_srv_cmd_queue(struct dc_dmub_srv *dc_dmub_srv,
@@ -56,6 +59,34 @@ void dc_dmub_srv_wait_idle(struct dc_dmub_srv *dc_dmub_srv);
void dc_dmub_srv_wait_phy_init(struct dc_dmub_srv *dc_dmub_srv);
+bool dc_dmub_srv_cmd_run(struct dc_dmub_srv *dc_dmub_srv, union dmub_rb_cmd *cmd,
+ enum dm_dmub_wait_type wait_type);
+
+bool dc_dmub_srv_cmd_run_list(struct dc_dmub_srv *dc_dmub_srv, unsigned int count,
+ union dmub_rb_cmd *cmd_list, enum dm_dmub_wait_type wait_type);
+
bool dc_dmub_srv_notify_stream_mask(struct dc_dmub_srv *dc_dmub_srv,
unsigned int stream_mask);
+
+bool dc_wake_and_execute_dmub_cmd(const struct dc_context *ctx, union dmub_rb_cmd *cmd,
+ enum dm_dmub_wait_type wait_type);
+
+bool dc_wake_and_execute_dmub_cmd_list(const struct dc_context *ctx, unsigned int count,
+ union dmub_rb_cmd *cmd, enum dm_dmub_wait_type wait_type);
+
+void dc_dmub_srv_apply_idle_power_optimizations(const struct dc *dc, bool allow_idle);
+
+/**
+ * dc_wake_and_execute_gpint()
+ *
+ * @ctx: DC context
+ * @command_code: The command ID to send to DMCUB
+ * @param: The parameter to message DMCUB
+ * @response: Optional response out value - may be NULL.
+ * @wait_type: The wait behavior for the execution
+ */
+bool dc_wake_and_execute_gpint(const struct dc_context *ctx, enum dmub_gpint_command command_code,
+ uint16_t param, uint32_t *response,
+ enum dm_dmub_wait_type wait_type);
+
#endif /* _DMUB_DC_SRV_H_ */
diff --git a/drivers/gpu/drm/amd/display/dc/dc_link.h b/drivers/gpu/drm/amd/display/dc/dc_link.h
index 266b93a705d5..39277aaa3e62 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_link.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_link.h
@@ -219,9 +219,10 @@ int dc_link_get_backlight_level(const struct dc_link *dc_link);
int dc_link_get_target_backlight_pwm(const struct dc_link *link);
-bool dc_link_set_psr_allow_active(struct dc_link *dc_link, bool enable, bool wait);
+bool dc_link_set_psr_allow_active(struct dc_link *dc_link, bool enable,
+ bool wait, bool force_static);
-bool dc_link_get_psr_state(const struct dc_link *dc_link, uint32_t *psr_state);
+bool dc_link_get_psr_state(const struct dc_link *dc_link, enum dc_psr_state *state);
bool dc_link_setup_psr(struct dc_link *dc_link,
const struct dc_stream_state *stream, struct psr_config *psr_config,
diff --git a/drivers/gpu/drm/amd/display/dc/dc_types.h b/drivers/gpu/drm/amd/display/dc/dc_types.h
index c47a19719de2..bf8283ce7527 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_types.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_types.h
@@ -674,6 +674,26 @@ struct dc_plane_flip_time {
unsigned int prev_update_time_in_us;
};
+enum dc_psr_state {
+ PSR_STATE0 = 0x0,
+ PSR_STATE1,
+ PSR_STATE1a,
+ PSR_STATE2,
+ PSR_STATE2a,
+ PSR_STATE3,
+ PSR_STATE3Init,
+ PSR_STATE4,
+ PSR_STATE4a,
+ PSR_STATE4b,
+ PSR_STATE4c,
+ PSR_STATE4d,
+ PSR_STATE5,
+ PSR_STATE5a,
+ PSR_STATE5b,
+ PSR_STATE5c,
+ PSR_STATE_INVALID = 0xFF
+};
+
struct psr_config {
unsigned char psr_version;
unsigned int psr_rfb_setup_time;
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c b/drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c
index 4216419503af..4c397a099e07 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c
@@ -99,7 +99,7 @@ bool dce_dmcu_load_iram(struct dmcu *dmcu,
return true;
}
-static void dce_get_dmcu_psr_state(struct dmcu *dmcu, uint32_t *psr_state)
+static void dce_get_dmcu_psr_state(struct dmcu *dmcu, enum dc_psr_state *state)
{
struct dce_dmcu *dmcu_dce = TO_DCE_DMCU(dmcu);
@@ -114,7 +114,7 @@ static void dce_get_dmcu_psr_state(struct dmcu *dmcu, uint32_t *psr_state)
REG_WRITE(DMCU_IRAM_RD_CTRL, psr_state_offset);
/* Read data from IRAM_RD_DATA in DMCU_IRAM_RD_DATA*/
- *psr_state = REG_READ(DMCU_IRAM_RD_DATA);
+ *state = (enum dc_psr_state)REG_READ(DMCU_IRAM_RD_DATA);
/* Disable write access to IRAM after finished using IRAM
* in order to allow dynamic sleep state
@@ -129,7 +129,7 @@ static void dce_dmcu_set_psr_enable(struct dmcu *dmcu, bool enable, bool wait)
unsigned int dmcu_wait_reg_ready_interval = 100;
unsigned int retryCount;
- uint32_t psr_state = 0;
+ enum dc_psr_state state = PSR_STATE0;
/* waitDMCUReadyForCmd */
REG_WAIT(MASTER_COMM_CNTL_REG, MASTER_COMM_INTERRUPT, 0,
@@ -148,12 +148,12 @@ static void dce_dmcu_set_psr_enable(struct dmcu *dmcu, bool enable, bool wait)
REG_UPDATE(MASTER_COMM_CNTL_REG, MASTER_COMM_INTERRUPT, 1);
if (wait == true) {
for (retryCount = 0; retryCount <= 100; retryCount++) {
- dce_get_dmcu_psr_state(dmcu, &psr_state);
+ dce_get_dmcu_psr_state(dmcu, &state);
if (enable) {
- if (psr_state != 0)
+ if (state != PSR_STATE0)
break;
} else {
- if (psr_state == 0)
+ if (state == PSR_STATE0)
break;
}
udelay(10);
@@ -513,7 +513,7 @@ static bool dcn10_dmcu_load_iram(struct dmcu *dmcu,
return true;
}
-static void dcn10_get_dmcu_psr_state(struct dmcu *dmcu, uint32_t *psr_state)
+static void dcn10_get_dmcu_psr_state(struct dmcu *dmcu, enum dc_psr_state *state)
{
struct dce_dmcu *dmcu_dce = TO_DCE_DMCU(dmcu);
@@ -532,7 +532,7 @@ static void dcn10_get_dmcu_psr_state(struct dmcu *dmcu, uint32_t *psr_state)
REG_WRITE(DMCU_IRAM_RD_CTRL, psr_state_offset);
/* Read data from IRAM_RD_DATA in DMCU_IRAM_RD_DATA*/
- *psr_state = REG_READ(DMCU_IRAM_RD_DATA);
+ *state = (enum dc_psr_state)REG_READ(DMCU_IRAM_RD_DATA);
/* Disable write access to IRAM after finished using IRAM
* in order to allow dynamic sleep state
@@ -547,7 +547,7 @@ static void dcn10_dmcu_set_psr_enable(struct dmcu *dmcu, bool enable, bool wait)
unsigned int dmcu_wait_reg_ready_interval = 100;
unsigned int retryCount;
- uint32_t psr_state = 0;
+ enum dc_psr_state state = PSR_STATE0;
/* If microcontroller is not running, do nothing */
if (dmcu->dmcu_state != DMCU_RUNNING)
@@ -575,12 +575,12 @@ static void dcn10_dmcu_set_psr_enable(struct dmcu *dmcu, bool enable, bool wait)
*/
if (wait == true) {
for (retryCount = 0; retryCount <= 1000; retryCount++) {
- dcn10_get_dmcu_psr_state(dmcu, &psr_state);
+ dcn10_get_dmcu_psr_state(dmcu, &state);
if (enable) {
- if (psr_state != 0)
+ if (state != PSR_STATE0)
break;
} else {
- if (psr_state == 0)
+ if (state == PSR_STATE0)
break;
}
udelay(500);
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c
index 67af67ef2865..17aceacb726b 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c
@@ -34,55 +34,71 @@
/**
* Convert dmcub psr state to dmcu psr state.
*/
-static void convert_psr_state(uint32_t *psr_state)
+static enum dc_psr_state convert_psr_state(uint32_t raw_state)
{
- if (*psr_state == 0)
- *psr_state = 0;
- else if (*psr_state == 0x10)
- *psr_state = 1;
- else if (*psr_state == 0x11)
- *psr_state = 2;
- else if (*psr_state == 0x20)
- *psr_state = 3;
- else if (*psr_state == 0x21)
- *psr_state = 4;
- else if (*psr_state == 0x30)
- *psr_state = 5;
- else if (*psr_state == 0x31)
- *psr_state = 6;
- else if (*psr_state == 0x40)
- *psr_state = 7;
- else if (*psr_state == 0x41)
- *psr_state = 8;
- else if (*psr_state == 0x42)
- *psr_state = 9;
- else if (*psr_state == 0x43)
- *psr_state = 10;
- else if (*psr_state == 0x44)
- *psr_state = 11;
- else if (*psr_state == 0x50)
- *psr_state = 12;
- else if (*psr_state == 0x51)
- *psr_state = 13;
- else if (*psr_state == 0x52)
- *psr_state = 14;
- else if (*psr_state == 0x53)
- *psr_state = 15;
+ enum dc_psr_state state = PSR_STATE0;
+
+ if (raw_state == 0)
+ state = PSR_STATE0;
+ else if (raw_state == 0x10)
+ state = PSR_STATE1;
+ else if (raw_state == 0x11)
+ state = PSR_STATE1a;
+ else if (raw_state == 0x20)
+ state = PSR_STATE2;
+ else if (raw_state == 0x21)
+ state = PSR_STATE2a;
+ else if (raw_state == 0x30)
+ state = PSR_STATE3;
+ else if (raw_state == 0x31)
+ state = PSR_STATE3Init;
+ else if (raw_state == 0x40)
+ state = PSR_STATE4;
+ else if (raw_state == 0x41)
+ state = PSR_STATE4a;
+ else if (raw_state == 0x42)
+ state = PSR_STATE4b;
+ else if (raw_state == 0x43)
+ state = PSR_STATE4c;
+ else if (raw_state == 0x44)
+ state = PSR_STATE4d;
+ else if (raw_state == 0x50)
+ state = PSR_STATE5;
+ else if (raw_state == 0x51)
+ state = PSR_STATE5a;
+ else if (raw_state == 0x52)
+ state = PSR_STATE5b;
+ else if (raw_state == 0x53)
+ state = PSR_STATE5c;
+
+ return state;
}
/**
* Get PSR state from firmware.
*/
-static void dmub_psr_get_state(struct dmub_psr *dmub, uint32_t *psr_state)
+static void dmub_psr_get_state(struct dmub_psr *dmub, enum dc_psr_state *state)
{
struct dmub_srv *srv = dmub->ctx->dmub_srv->dmub;
+ uint32_t raw_state = 0;
+ uint32_t retry_count = 0;
+ enum dmub_status status;
+
+ do {
+ // Send gpint command and wait for ack
+ if (dc_wake_and_execute_gpint(dmub->ctx, DMUB_GPINT__GET_PSR_STATE, 0,
+ &raw_state, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY)) {
+ *state = convert_psr_state(raw_state);
+ } else {
+ // Return invalid state when GPINT times out
+ *state = PSR_STATE_INVALID;
+ }
- // Send gpint command and wait for ack
- dmub_srv_send_gpint_command(srv, DMUB_GPINT__GET_PSR_STATE, 0, 30);
-
- dmub_srv_get_gpint_response(srv, psr_state);
+ // Assert if max retry hit
+ if (retry_count >= 1000)
+ ASSERT(0);
+ } while (++retry_count <= 1000 && *state == PSR_STATE_INVALID);
- convert_psr_state(psr_state);
}
/**
@@ -123,7 +139,8 @@ static void dmub_psr_enable(struct dmub_psr *dmub, bool enable, bool wait)
{
union dmub_rb_cmd cmd;
struct dc_context *dc = dmub->ctx;
- uint32_t retry_count, psr_state = 0;
+ uint32_t retry_count;
+ enum dc_psr_state state = PSR_STATE0;
cmd.psr_enable.header.type = DMUB_CMD__PSR;
@@ -144,13 +161,13 @@ static void dmub_psr_enable(struct dmub_psr *dmub, bool enable, bool wait)
*/
if (wait) {
for (retry_count = 0; retry_count <= 1000; retry_count++) {
- dmub_psr_get_state(dmub, &psr_state);
+ dmub_psr_get_state(dmub, &state);
if (enable) {
- if (psr_state != 0)
+ if (state != PSR_STATE0)
break;
} else {
- if (psr_state == 0)
+ if (state == PSR_STATE0)
break;
}
@@ -169,12 +186,12 @@ static void dmub_psr_enable(struct dmub_psr *dmub, bool enable, bool wait)
static void dmub_psr_set_level(struct dmub_psr *dmub, uint16_t psr_level)
{
union dmub_rb_cmd cmd;
- uint32_t psr_state = 0;
+ enum dc_psr_state state = PSR_STATE0;
struct dc_context *dc = dmub->ctx;
- dmub_psr_get_state(dmub, &psr_state);
+ dmub_psr_get_state(dmub, &state);
- if (psr_state == 0)
+ if (state == PSR_STATE0)
return;
cmd.psr_set_level.header.type = DMUB_CMD__PSR;
@@ -269,11 +286,29 @@ static bool dmub_psr_copy_settings(struct dmub_psr *dmub,
return true;
}
+/**
+ * Send command to PSR to force static ENTER and ignore all state changes until exit
+ */
+static void dmub_psr_force_static(struct dmub_psr *dmub)
+{
+ union dmub_rb_cmd cmd;
+ struct dc_context *dc = dmub->ctx;
+
+ cmd.psr_force_static.header.type = DMUB_CMD__PSR;
+ cmd.psr_force_static.header.sub_type = DMUB_CMD__PSR_FORCE_STATIC;
+ cmd.psr_enable.header.payload_bytes = 0;
+
+ dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd);
+ dc_dmub_srv_cmd_execute(dc->dmub_srv);
+ dc_dmub_srv_wait_idle(dc->dmub_srv);
+}
+
static const struct dmub_psr_funcs psr_funcs = {
.psr_copy_settings = dmub_psr_copy_settings,
.psr_enable = dmub_psr_enable,
.psr_get_state = dmub_psr_get_state,
.psr_set_level = dmub_psr_set_level,
+ .psr_force_static = dmub_psr_force_static,
};
/**
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.h b/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.h
index dc121ed92d2e..4e113ac5a56b 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.h
+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.h
@@ -37,8 +37,9 @@ struct dmub_psr {
struct dmub_psr_funcs {
bool (*psr_copy_settings)(struct dmub_psr *dmub, struct dc_link *link, struct psr_context *psr_context);
void (*psr_enable)(struct dmub_psr *dmub, bool enable, bool wait);
- void (*psr_get_state)(struct dmub_psr *dmub, uint32_t *psr_state);
+ void (*psr_get_state)(struct dmub_psr *dmub, enum dc_psr_state *dc_psr_state);
void (*psr_set_level)(struct dmub_psr *dmub, uint16_t psr_level);
+ void (*psr_force_static)(struct dmub_psr *dmub);
};
struct dmub_psr *dmub_psr_create(struct dc_context *ctx);
diff --git a/drivers/gpu/drm/amd/display/dc/dm_services.h b/drivers/gpu/drm/amd/display/dc/dm_services.h
index fdd1943c828d..569cdbdc4746 100644
--- a/drivers/gpu/drm/amd/display/dc/dm_services.h
+++ b/drivers/gpu/drm/amd/display/dc/dm_services.h
@@ -42,6 +42,7 @@
struct dmub_srv;
struct dc_dmub_srv;
+union dmub_rb_cmd;
irq_handler_idx dm_register_interrupt(
struct dc_context *ctx,
@@ -294,6 +295,14 @@ unsigned long long dm_get_elapse_time_in_ns(struct dc_context *ctx,
__CTX->perf_trace->write_count, &__CTX->perf_trace->last_entry_read,\
&__CTX->perf_trace->last_entry_write, __func__, __LINE__)
+/*
+ * DMUB Interfaces
+ */
+bool dm_execute_dmub_cmd(const struct dc_context *ctx, union dmub_rb_cmd *cmd,
+ enum dm_dmub_wait_type wait_type);
+
+bool dm_execute_dmub_cmd_list(const struct dc_context *ctx, unsigned int count,
+ union dmub_rb_cmd *cmd, enum dm_dmub_wait_type wait_type);
/*
* Debug and verification hooks
diff --git a/drivers/gpu/drm/amd/display/dc/dm_services_types.h b/drivers/gpu/drm/amd/display/dc/dm_services_types.h
index b52ba6ffabe1..facf269c4326 100644
--- a/drivers/gpu/drm/amd/display/dc/dm_services_types.h
+++ b/drivers/gpu/drm/amd/display/dc/dm_services_types.h
@@ -269,4 +269,10 @@ struct dtn_min_clk_info {
uint32_t min_memory_clock_khz;
};
+enum dm_dmub_wait_type {
+ DM_DMUB_WAIT_TYPE_NO_WAIT,
+ DM_DMUB_WAIT_TYPE_WAIT,
+ DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY,
+};
+
#endif
diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr.h b/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr.h
index 947d6106f341..c22d6dd9dfec 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr.h
@@ -231,6 +231,7 @@ struct clk_mgr_funcs {
int (*get_dp_ref_clk_frequency)(struct clk_mgr *clk_mgr);
void (*set_low_power_state)(struct clk_mgr *clk_mgr);
+ void (*exit_low_power_state)(struct clk_mgr *clk_mgr);
void (*init_clocks)(struct clk_mgr *clk_mgr);
diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/dmcu.h b/drivers/gpu/drm/amd/display/dc/inc/hw/dmcu.h
index 5315f1f86b21..69d9fbfb4bec 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw/dmcu.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/dmcu.h
@@ -66,7 +66,7 @@ struct dmcu_funcs {
bool (*setup_psr)(struct dmcu *dmcu,
struct dc_link *link,
struct psr_context *psr_context);
- void (*get_psr_state)(struct dmcu *dmcu, uint32_t *psr_state);
+ void (*get_psr_state)(struct dmcu *dmcu, enum dc_psr_state *dc_psr_state);
void (*set_psr_wait_loop)(struct dmcu *dmcu,
unsigned int wait_loop_number);
void (*get_psr_wait_loop)(struct dmcu *dmcu,
diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h b/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h
index 3165a66c5362..03c075ea5fc1 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h
@@ -213,7 +213,8 @@ struct hw_sequencer_funcs {
/* Idle Optimization Related */
bool (*apply_idle_power_optimizations)(struct dc *dc, bool enable);
#endif
-
+ void (*set_idle_state)(const struct dc *dc, bool allow_idle);
+ uint32_t (*get_idle_state)(const struct dc *dc);
};
void color_space_to_black_color(
diff --git a/drivers/gpu/drm/amd/display/dmub/dmub_srv.h b/drivers/gpu/drm/amd/display/dmub/dmub_srv.h
index 882b4e2816b5..9ff364c6353d 100644
--- a/drivers/gpu/drm/amd/display/dmub/dmub_srv.h
+++ b/drivers/gpu/drm/amd/display/dmub/dmub_srv.h
@@ -264,6 +264,8 @@ struct dmub_srv_hw_funcs {
bool (*is_hw_init)(struct dmub_srv *dmub);
+ bool (*is_hw_powered_up)(struct dmub_srv *dmub);
+
bool (*is_phy_init)(struct dmub_srv *dmub);
bool (*is_auto_load_done)(struct dmub_srv *dmub);
@@ -486,6 +488,24 @@ enum dmub_status dmub_srv_cmd_queue(struct dmub_srv *dmub,
*/
enum dmub_status dmub_srv_cmd_execute(struct dmub_srv *dmub);
+/**
+ * dmub_srv_wait_for_hw_pwr_up() - Waits for firmware hardware power up is completed
+ * @dmub: the dmub service
+ * @timeout_us: the maximum number of microseconds to wait
+ *
+ * Waits until firmware hardware is powered up. The maximum
+ * wait time is given in microseconds to prevent spinning forever.
+ *
+ * Return:
+ * DMUB_STATUS_OK - success
+ * DMUB_STATUS_TIMEOUT - timed out
+ * DMUB_STATUS_INVALID - unspecified error
+ */
+enum dmub_status dmub_srv_wait_for_hw_pwr_up(struct dmub_srv *dmub,
+ uint32_t timeout_us);
+
+bool dmub_srv_is_hw_pwr_up(struct dmub_srv *dmub);
+
/**
* dmub_srv_wait_for_auto_load() - Waits for firmware auto load to complete
* @dmub: the dmub service
diff --git a/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h b/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
index d103ec1eaa73..c741aaa7cd34 100644
--- a/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
+++ b/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
@@ -104,6 +104,11 @@ union dmub_psr_debug_flags {
uint32_t u32All;
};
+struct dmub_feature_caps {
+ uint8_t psr;
+ uint8_t reserved[7];
+};
+
#if defined(__cplusplus)
}
#endif
@@ -123,6 +128,17 @@ union dmub_psr_debug_flags {
/* Offset from the end of the file to the dmub_fw_meta_info */
#define DMUB_FW_META_OFFSET 0x24
+/**
+ *
+ * PSR control version legacy
+ */
+#define DMUB_CMD_PSR_CONTROL_VERSION_UNKNOWN 0x0
+/**
+ * PSR control version with multi edp support
+ */
+#define DMUB_CMD_PSR_CONTROL_VERSION_1 0x1
+
+
/**
* struct dmub_fw_meta_info - metadata associated with fw binary
*
@@ -183,6 +199,11 @@ enum dmub_fw_boot_status_bit {
DMUB_FW_BOOT_STATUS_BIT_RESTORE_REQUIRED = (1 << 3),
};
+#define DMUB_IPS1_ALLOW_MASK 0x00000001
+#define DMUB_IPS2_ALLOW_MASK 0x00000002
+#define DMUB_IPS1_COMMIT_MASK 0x00000004
+#define DMUB_IPS2_COMMIT_MASK 0x00000008
+
/* Register bit definition for SCRATCH15 */
union dmub_fw_boot_options {
struct {
@@ -272,6 +293,7 @@ enum dmub_gpint_command {
* ARGS: Stream mask, 1 bit per active stream index.
*/
DMUB_GPINT__IDLE_OPT_NOTIFY_STREAM_MASK = 8,
+ DMUB_GPINT__PSR_RESIDENCY = 9,
};
//==============================================================================
@@ -297,11 +319,13 @@ enum dmub_cmd_type {
DMUB_CMD__REG_SEQ_BURST_WRITE = 3,
DMUB_CMD__REG_REG_WAIT = 4,
DMUB_CMD__PLAT_54186_WA = 5,
+ DMUB_CMD__QUERY_FEATURE_CAPS = 6,
DMUB_CMD__PSR = 64,
DMUB_CMD__ABM = 66,
DMUB_CMD__HW_LOCK = 69,
DMUB_CMD__DP_AUX_ACCESS = 70,
DMUB_CMD__OUTBOX1_ENABLE = 71,
+ DMUB_CMD__IDLE_OPT = 72,
DMUB_CMD__VBIOS = 128,
};
@@ -316,7 +340,8 @@ enum dmub_out_cmd_type {
struct dmub_cmd_header {
unsigned int type : 8;
unsigned int sub_type : 8;
- unsigned int reserved0 : 8;
+ unsigned int ret_status : 1;
+ unsigned int reserved0 : 7;
unsigned int payload_bytes : 6; /* up to 60 bytes */
unsigned int reserved1 : 2;
};
@@ -549,6 +574,7 @@ enum dmub_cmd_psr_type {
DMUB_CMD__PSR_ENABLE = 2,
DMUB_CMD__PSR_DISABLE = 3,
DMUB_CMD__PSR_SET_LEVEL = 4,
+ DMUB_CMD__PSR_FORCE_STATIC = 5,
};
enum psr_version {
@@ -560,6 +586,9 @@ struct dmub_cmd_psr_copy_settings_data {
union dmub_psr_debug_flags debug;
uint16_t psr_level;
uint8_t dpp_inst;
+ /* opp_inst and mpcc_inst will not be used in dmub fw,
+ * dmub fw will get active opp by reading odm registers.
+ */
uint8_t mpcc_inst;
uint8_t opp_inst;
uint8_t otg_inst;
@@ -603,6 +632,10 @@ struct dmub_rb_cmd_psr_set_version {
struct dmub_cmd_psr_set_version_data psr_set_version_data;
};
+struct dmub_rb_cmd_psr_force_static {
+ struct dmub_cmd_header header;
+};
+
union dmub_hw_lock_flags {
struct {
uint8_t lock_pipe : 1;
@@ -744,6 +777,45 @@ struct dmub_rb_cmd_abm_init_config {
struct dmub_cmd_abm_init_config_data abm_init_config_data;
};
+/**
+ * enum dmub_cmd_idle_opt_type - Idle optimization command type.
+ */
+enum dmub_cmd_idle_opt_type {
+ /**
+ * DCN hardware restore.
+ */
+ DMUB_CMD__IDLE_OPT_DCN_RESTORE = 0,
+
+ /**
+ * DCN hardware save.
+ */
+ DMUB_CMD__IDLE_OPT_DCN_SAVE_INIT = 1,
+
+ /**
+ * DCN hardware notify idle.
+ */
+ DMUB_CMD__IDLE_OPT_DCN_NOTIFY_IDLE = 2
+};
+
+struct dmub_dcn_notify_idle_cntl_data {
+ uint8_t driver_idle;
+ uint8_t pad[1];
+};
+
+struct dmub_rb_cmd_idle_opt_dcn_notify_idle {
+ struct dmub_cmd_header header; /**< header */
+ struct dmub_dcn_notify_idle_cntl_data cntl_data;
+};
+
+struct dmub_cmd_query_feature_caps_data {
+ struct dmub_feature_caps feature_caps;
+};
+
+struct dmub_rb_cmd_query_feature_caps {
+ struct dmub_cmd_header header;
+ struct dmub_cmd_query_feature_caps_data query_feature_caps_data;
+};
+
union dmub_rb_cmd {
struct dmub_rb_cmd_lock_hw lock_hw;
struct dmub_rb_cmd_read_modify_write read_modify_write;
@@ -760,6 +832,7 @@ union dmub_rb_cmd {
struct dmub_rb_cmd_psr_copy_settings psr_copy_settings;
struct dmub_rb_cmd_psr_enable psr_enable;
struct dmub_rb_cmd_psr_set_level psr_set_level;
+ struct dmub_rb_cmd_psr_force_static psr_force_static;
struct dmub_rb_cmd_PLAT_54186_wa PLAT_54186_wa;
struct dmub_rb_cmd_abm_set_pipe abm_set_pipe;
struct dmub_rb_cmd_abm_set_backlight abm_set_backlight;
@@ -769,6 +842,8 @@ union dmub_rb_cmd {
struct dmub_rb_cmd_abm_init_config abm_init_config;
struct dmub_rb_cmd_dp_aux_access dp_aux_access;
struct dmub_rb_cmd_outbox1_enable outbox1_enable;
+ struct dmub_rb_cmd_query_feature_caps query_feature_caps;
+ struct dmub_rb_cmd_idle_opt_dcn_notify_idle idle_opt_notify_idle;
};
union dmub_rb_out_cmd {
@@ -831,7 +906,7 @@ static inline bool dmub_rb_push_front(struct dmub_rb *rb,
{
uint64_t volatile *dst = (uint64_t volatile *)(rb->base_address) + rb->wrpt / sizeof(uint64_t);
const uint64_t *src = (const uint64_t *)cmd;
- int i;
+ uint8_t i;
if (dmub_rb_full(rb))
return false;
@@ -868,14 +943,14 @@ static inline bool dmub_rb_out_push_front(struct dmub_rb *rb,
}
static inline bool dmub_rb_front(struct dmub_rb *rb,
- union dmub_rb_cmd *cmd)
+ union dmub_rb_cmd **cmd)
{
- uint8_t *rd_ptr = (uint8_t *)rb->base_address + rb->rptr;
+ uint8_t *rb_cmd = (uint8_t *)(rb->base_address) + rb->rptr;
if (dmub_rb_empty(rb))
return false;
- dmub_memcpy(cmd, rd_ptr, DMUB_RB_CMD_SIZE);
+ *cmd = (union dmub_rb_cmd *)rb_cmd;
return true;
}
@@ -885,7 +960,7 @@ static inline bool dmub_rb_out_front(struct dmub_rb *rb,
{
const uint64_t volatile *src = (const uint64_t volatile *)(rb->base_address) + rb->rptr / sizeof(uint64_t);
uint64_t *dst = (uint64_t *)cmd;
- int i;
+ uint8_t i;
if (dmub_rb_empty(rb))
return false;
@@ -917,7 +992,7 @@ static inline void dmub_rb_flush_pending(const struct dmub_rb *rb)
while (rptr != wptr) {
uint64_t volatile *data = (uint64_t volatile *)rb->base_address + rptr / sizeof(uint64_t);
- int i;
+ uint8_t i;
for (i = 0; i < DMUB_RB_CMD_SIZE / sizeof(uint64_t); i++)
*data++;
@@ -937,6 +1012,17 @@ static inline void dmub_rb_init(struct dmub_rb *rb,
rb->wrpt = init_params->write_ptr;
}
+static inline void dmub_rb_get_return_data(struct dmub_rb *rb,
+ union dmub_rb_cmd *cmd)
+{
+ // Copy rb entry back into command
+ uint8_t *rd_ptr = (rb->rptr == 0) ?
+ (uint8_t *)rb->base_address + rb->capacity - DMUB_RB_CMD_SIZE :
+ (uint8_t *)rb->base_address + rb->rptr - DMUB_RB_CMD_SIZE;
+
+ dmub_memcpy(cmd, rd_ptr, DMUB_RB_CMD_SIZE);
+}
+
#if defined(__cplusplus)
}
#endif
diff --git a/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c b/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c
index 08da423b24a1..b2f909d58a05 100644
--- a/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c
+++ b/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c
@@ -516,6 +516,33 @@ enum dmub_status dmub_srv_cmd_execute(struct dmub_srv *dmub)
return DMUB_STATUS_OK;
}
+bool dmub_srv_is_hw_pwr_up(struct dmub_srv *dmub)
+{
+ if (!dmub->hw_funcs.is_hw_powered_up)
+ return true;
+
+ return dmub->hw_funcs.is_hw_powered_up(dmub) &&
+ dmub->hw_funcs.is_hw_init(dmub);
+}
+
+enum dmub_status dmub_srv_wait_for_hw_pwr_up(struct dmub_srv *dmub,
+ uint32_t timeout_us)
+{
+ uint32_t i;
+
+ if (!dmub->hw_init)
+ return DMUB_STATUS_INVALID;
+
+ for (i = 0; i <= timeout_us; i += 100) {
+ if (dmub_srv_is_hw_pwr_up(dmub))
+ return DMUB_STATUS_OK;
+
+ udelay(100);
+ }
+
+ return DMUB_STATUS_TIMEOUT;
+}
+
enum dmub_status dmub_srv_wait_for_auto_load(struct dmub_srv *dmub,
uint32_t timeout_us)
{
--
2.34.1
2
1
15 Apr '24
From: Alex Williamson <alex.williamson(a)redhat.com>
mainline inclusion
from mainline-v6.9-rc1
commit 810cd4bb53456d0503cc4e7934e063835152c1b7
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E6TS
CVE: CVE-2024-26810
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
-------------------------------------------
Mask operations through config space changes to DisINTx may race INTx
configuration changes via ioctl. Create wrappers that add locking for
paths outside of the core interrupt code.
In particular, irq_type is updated holding igate, therefore testing
is_intx() requires holding igate. For example clearing DisINTx from
config space can otherwise race changes of the interrupt configuration.
This aligns interfaces which may trigger the INTx eventfd into two
camps, one side serialized by igate and the other only enabled while
INTx is configured. A subsequent patch introduces synchronization for
the latter flows.
Cc: <stable(a)vger.kernel.org>
Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver")
Reported-by: Reinette Chatre <reinette.chatre(a)intel.com>
Reviewed-by: Kevin Tian <kevin.tian(a)intel.com>
Reviewed-by: Reinette Chatre <reinette.chatre(a)intel.com>
Reviewed-by: Eric Auger <eric.auger(a)redhat.com>
Link: https://lore.kernel.org/r/20240308230557.805580-3-alex.williamson@redhat.com
Signed-off-by: Alex Williamson <alex.williamson(a)redhat.com>
Conflicts:
drivers/vfio/pci/vfio_pci_intrs.c
Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com>
---
drivers/vfio/pci/vfio_pci_intrs.c | 30 ++++++++++++++++++++++++------
1 file changed, 24 insertions(+), 6 deletions(-)
diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
index c989f777bf77..31206ed12cd2 100644
--- a/drivers/vfio/pci/vfio_pci_intrs.c
+++ b/drivers/vfio/pci/vfio_pci_intrs.c
@@ -36,11 +36,13 @@ static void vfio_send_intx_eventfd(void *opaque, void *unused)
eventfd_signal(vdev->ctx[0].trigger, 1);
}
-void vfio_pci_intx_mask(struct vfio_pci_device *vdev)
+static void __vfio_pci_intx_mask(struct vfio_pci_device *vdev)
{
struct pci_dev *pdev = vdev->pdev;
unsigned long flags;
+ lockdep_assert_held(&vdev->igate);
+
spin_lock_irqsave(&vdev->irqlock, flags);
/*
@@ -68,6 +70,13 @@ void vfio_pci_intx_mask(struct vfio_pci_device *vdev)
spin_unlock_irqrestore(&vdev->irqlock, flags);
}
+void vfio_pci_intx_mask(struct vfio_pci_device *vdev)
+{
+ mutex_lock(&vdev->igate);
+ __vfio_pci_intx_mask(vdev);
+ mutex_unlock(&vdev->igate);
+}
+
/*
* If this is triggered by an eventfd, we can't call eventfd_signal
* or else we'll deadlock on the eventfd wait queue. Return >0 when
@@ -110,12 +119,21 @@ static int vfio_pci_intx_unmask_handler(void *opaque, void *unused)
return ret;
}
-void vfio_pci_intx_unmask(struct vfio_pci_device *vdev)
+static void __vfio_pci_intx_unmask(struct vfio_pci_device *vdev)
{
+ lockdep_assert_held(&vdev->igate);
+
if (vfio_pci_intx_unmask_handler(vdev, NULL) > 0)
vfio_send_intx_eventfd(vdev, NULL);
}
+void vfio_pci_intx_unmask(struct vfio_pci_device *vdev)
+{
+ mutex_lock(&vdev->igate);
+ __vfio_pci_intx_unmask(vdev);
+ mutex_unlock(&vdev->igate);
+}
+
static irqreturn_t vfio_intx_handler(int irq, void *dev_id)
{
struct vfio_pci_device *vdev = dev_id;
@@ -428,11 +446,11 @@ static int vfio_pci_set_intx_unmask(struct vfio_pci_device *vdev,
return -EINVAL;
if (flags & VFIO_IRQ_SET_DATA_NONE) {
- vfio_pci_intx_unmask(vdev);
+ __vfio_pci_intx_unmask(vdev);
} else if (flags & VFIO_IRQ_SET_DATA_BOOL) {
uint8_t unmask = *(uint8_t *)data;
if (unmask)
- vfio_pci_intx_unmask(vdev);
+ __vfio_pci_intx_unmask(vdev);
} else if (flags & VFIO_IRQ_SET_DATA_EVENTFD) {
int32_t fd = *(int32_t *)data;
if (fd >= 0)
@@ -455,11 +473,11 @@ static int vfio_pci_set_intx_mask(struct vfio_pci_device *vdev,
return -EINVAL;
if (flags & VFIO_IRQ_SET_DATA_NONE) {
- vfio_pci_intx_mask(vdev);
+ __vfio_pci_intx_mask(vdev);
} else if (flags & VFIO_IRQ_SET_DATA_BOOL) {
uint8_t mask = *(uint8_t *)data;
if (mask)
- vfio_pci_intx_mask(vdev);
+ __vfio_pci_intx_mask(vdev);
} else if (flags & VFIO_IRQ_SET_DATA_EVENTFD) {
return -ENOTTY; /* XXX implement me */
}
--
2.25.1
2
1
[PATCH openEuler-1.0-LTS] vfio/pci: Disable auto-enable of exclusive INTx IRQ
by Jinjie Ruan 15 Apr '24
by Jinjie Ruan 15 Apr '24
15 Apr '24
From: Alex Williamson <alex.williamson(a)redhat.com>
stable inclusion
from stable-v5.15.154
commit b7a2f0955ffceffadfe098b40b50307431f45438
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E6TU
CVE: CVE-2024-27437
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit fe9a7082684eb059b925c535682e68c34d487d43 ]
Currently for devices requiring masking at the irqchip for INTx, ie.
devices without DisINTx support, the IRQ is enabled in request_irq()
and subsequently disabled as necessary to align with the masked status
flag. This presents a window where the interrupt could fire between
these events, resulting in the IRQ incrementing the disable depth twice.
This would be unrecoverable for a user since the masked flag prevents
nested enables through vfio.
Instead, invert the logic using IRQF_NO_AUTOEN such that exclusive INTx
is never auto-enabled, then unmask as required.
Cc: <stable(a)vger.kernel.org>
Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver")
Reviewed-by: Kevin Tian <kevin.tian(a)intel.com>
Reviewed-by: Eric Auger <eric.auger(a)redhat.com>
Link: https://lore.kernel.org/r/20240308230557.805580-2-alex.williamson@redhat.com
Signed-off-by: Alex Williamson <alex.williamson(a)redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com>
---
drivers/vfio/pci/vfio_pci_intrs.c | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)
diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
index c989f777bf77..75d9bb39d07f 100644
--- a/drivers/vfio/pci/vfio_pci_intrs.c
+++ b/drivers/vfio/pci/vfio_pci_intrs.c
@@ -202,8 +202,15 @@ static int vfio_intx_set_signal(struct vfio_pci_device *vdev, int fd)
vdev->ctx[0].trigger = trigger;
+ /*
+ * Devices without DisINTx support require an exclusive interrupt,
+ * IRQ masking is performed at the IRQ chip. The masked status is
+ * protected by vdev->irqlock. Setup the IRQ without auto-enable and
+ * unmask as necessary below under lock. DisINTx is unmodified by
+ * the IRQ configuration and may therefore use auto-enable.
+ */
if (!vdev->pci_2_3)
- irqflags = 0;
+ irqflags = IRQF_NO_AUTOEN;
ret = request_irq(pdev->irq, vfio_intx_handler,
irqflags, vdev->ctx[0].name, vdev);
@@ -214,13 +221,9 @@ static int vfio_intx_set_signal(struct vfio_pci_device *vdev, int fd)
return ret;
}
- /*
- * INTx disable will stick across the new irq setup,
- * disable_irq won't.
- */
spin_lock_irqsave(&vdev->irqlock, flags);
- if (!vdev->pci_2_3 && vdev->ctx[0].masked)
- disable_irq_nosync(pdev->irq);
+ if (!vdev->pci_2_3 && !vdev->ctx[0].masked)
+ enable_irq(pdev->irq);
spin_unlock_irqrestore(&vdev->irqlock, flags);
return 0;
--
2.34.1
2
1
15 Apr '24
From: Alex Williamson <alex.williamson(a)redhat.com>
mainline inclusion
from mainline-v6.9-rc1
commit 810cd4bb53456d0503cc4e7934e063835152c1b7
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E6TS
CVE: CVE-2024-26810
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
-------------------------------------------
Mask operations through config space changes to DisINTx may race INTx
configuration changes via ioctl. Create wrappers that add locking for
paths outside of the core interrupt code.
In particular, irq_type is updated holding igate, therefore testing
is_intx() requires holding igate. For example clearing DisINTx from
config space can otherwise race changes of the interrupt configuration.
This aligns interfaces which may trigger the INTx eventfd into two
camps, one side serialized by igate and the other only enabled while
INTx is configured. A subsequent patch introduces synchronization for
the latter flows.
Cc: <stable(a)vger.kernel.org>
Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver")
Reported-by: Reinette Chatre <reinette.chatre(a)intel.com>
Reviewed-by: Kevin Tian <kevin.tian(a)intel.com>
Reviewed-by: Reinette Chatre <reinette.chatre(a)intel.com>
Reviewed-by: Eric Auger <eric.auger(a)redhat.com>
Link: https://lore.kernel.org/r/20240308230557.805580-3-alex.williamson@redhat.com
Signed-off-by: Alex Williamson <alex.williamson(a)redhat.com>
Conflicts:
drivers/vfio/pci/vfio_pci_intrs.c
Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com>
---
drivers/vfio/pci/vfio_pci_intrs.c | 30 ++++++++++++++++++++++++------
1 file changed, 24 insertions(+), 6 deletions(-)
diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
index c989f777bf77..31206ed12cd2 100644
--- a/drivers/vfio/pci/vfio_pci_intrs.c
+++ b/drivers/vfio/pci/vfio_pci_intrs.c
@@ -36,11 +36,13 @@ static void vfio_send_intx_eventfd(void *opaque, void *unused)
eventfd_signal(vdev->ctx[0].trigger, 1);
}
-void vfio_pci_intx_mask(struct vfio_pci_device *vdev)
+static void __vfio_pci_intx_mask(struct vfio_pci_device *vdev)
{
struct pci_dev *pdev = vdev->pdev;
unsigned long flags;
+ lockdep_assert_held(&vdev->igate);
+
spin_lock_irqsave(&vdev->irqlock, flags);
/*
@@ -68,6 +70,13 @@ void vfio_pci_intx_mask(struct vfio_pci_device *vdev)
spin_unlock_irqrestore(&vdev->irqlock, flags);
}
+void vfio_pci_intx_mask(struct vfio_pci_device *vdev)
+{
+ mutex_lock(&vdev->igate);
+ __vfio_pci_intx_mask(vdev);
+ mutex_unlock(&vdev->igate);
+}
+
/*
* If this is triggered by an eventfd, we can't call eventfd_signal
* or else we'll deadlock on the eventfd wait queue. Return >0 when
@@ -110,12 +119,21 @@ static int vfio_pci_intx_unmask_handler(void *opaque, void *unused)
return ret;
}
-void vfio_pci_intx_unmask(struct vfio_pci_device *vdev)
+static void __vfio_pci_intx_unmask(struct vfio_pci_device *vdev)
{
+ lockdep_assert_held(&vdev->igate);
+
if (vfio_pci_intx_unmask_handler(vdev, NULL) > 0)
vfio_send_intx_eventfd(vdev, NULL);
}
+void vfio_pci_intx_unmask(struct vfio_pci_device *vdev)
+{
+ mutex_lock(&vdev->igate);
+ __vfio_pci_intx_unmask(vdev);
+ mutex_unlock(&vdev->igate);
+}
+
static irqreturn_t vfio_intx_handler(int irq, void *dev_id)
{
struct vfio_pci_device *vdev = dev_id;
@@ -428,11 +446,11 @@ static int vfio_pci_set_intx_unmask(struct vfio_pci_device *vdev,
return -EINVAL;
if (flags & VFIO_IRQ_SET_DATA_NONE) {
- vfio_pci_intx_unmask(vdev);
+ __vfio_pci_intx_unmask(vdev);
} else if (flags & VFIO_IRQ_SET_DATA_BOOL) {
uint8_t unmask = *(uint8_t *)data;
if (unmask)
- vfio_pci_intx_unmask(vdev);
+ __vfio_pci_intx_unmask(vdev);
} else if (flags & VFIO_IRQ_SET_DATA_EVENTFD) {
int32_t fd = *(int32_t *)data;
if (fd >= 0)
@@ -455,11 +473,11 @@ static int vfio_pci_set_intx_mask(struct vfio_pci_device *vdev,
return -EINVAL;
if (flags & VFIO_IRQ_SET_DATA_NONE) {
- vfio_pci_intx_mask(vdev);
+ __vfio_pci_intx_mask(vdev);
} else if (flags & VFIO_IRQ_SET_DATA_BOOL) {
uint8_t mask = *(uint8_t *)data;
if (mask)
- vfio_pci_intx_mask(vdev);
+ __vfio_pci_intx_mask(vdev);
} else if (flags & VFIO_IRQ_SET_DATA_EVENTFD) {
return -ENOTTY; /* XXX implement me */
}
--
2.25.1
2
1
Bart Van Assche (2):
fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
fs/aio.c | 17 ++++++++++++++---
include/linux/fs.h | 2 ++
2 files changed, 16 insertions(+), 3 deletions(-)
--
2.39.2
2
3
[PATCH OLK-5.10] net/sched: act_mirred: don't override retval if we already lost the skb
by Zhengchao Shao 15 Apr '24
by Zhengchao Shao 15 Apr '24
15 Apr '24
From: Jakub Kicinski <kuba(a)kernel.org>
mainline inclusion
from mainline-v6.8-rc6
commit 166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2LZ
CVE: CVE-2024-26739
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
If we're redirecting the skb, and haven't called tcf_mirred_forward(),
yet, we need to tell the core to drop the skb by setting the retcode
to SHOT. If we have called tcf_mirred_forward(), however, the skb
is out of our hands and returning SHOT will lead to UaF.
Move the retval override to the error path which actually need it.
Reviewed-by: Michal Swiatkowski <michal.swiatkowski(a)linux.intel.com>
Fixes: e5cf1baf92cb ("act_mirred: use TC_ACT_REINSERT when possible")
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Conflicts:
net/sched/act_mirred.c
Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com>
---
net/sched/act_mirred.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 66c9f356a876..3af7e5e15c30 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -319,15 +319,19 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a,
}
err = tcf_mirred_forward(at_ingress, want_ingress, skb2);
- if (err) {
-out:
+ if (err)
tcf_action_inc_overlimit_qstats(&m->common);
- if (tcf_mirred_is_act_redirect(m_eaction))
- retval = TC_ACT_SHOT;
- }
+
__this_cpu_dec(mirred_nest_level);
return retval;
+
+out:
+ tcf_action_inc_overlimit_qstats(&m->common);
+ if (tcf_mirred_is_act_redirect(m_eaction))
+ retval = TC_ACT_SHOT;
+ __this_cpu_dec(mirred_nest_level);
+ return retval;
}
static void tcf_stats_update(struct tc_action *a, u64 bytes, u64 packets,
--
2.34.1
2
1
[PATCH OLK-5.10] netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
by Zhengchao Shao 15 Apr '24
by Zhengchao Shao 15 Apr '24
15 Apr '24
From: Pablo Neira Ayuso <pablo(a)netfilter.org>
stable inclusion
from stable-v5.10.210
commit 9489e214ea8f2a90345516016aa51f2db3a8cc2f
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E49K
CVE: CVE-2024-26808
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit 01acb2e8666a6529697141a6017edbf206921913 upstream.
Remove netdevice from inet/ingress basechain in case NETDEV_UNREGISTER
event is reported, otherwise a stale reference to netdevice remains in
the hook list.
Fixes: 60a3815da702 ("netfilter: add inet ingress support")
Cc: stable(a)vger.kernel.org
Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com>
---
net/netfilter/nft_chain_filter.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nft_chain_filter.c b/net/netfilter/nft_chain_filter.c
index 7a9aa57b195b..a18582a4ecf3 100644
--- a/net/netfilter/nft_chain_filter.c
+++ b/net/netfilter/nft_chain_filter.c
@@ -358,9 +358,10 @@ static int nf_tables_netdev_event(struct notifier_block *this,
unsigned long event, void *ptr)
{
struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+ struct nft_base_chain *basechain;
struct nftables_pernet *nft_net;
- struct nft_table *table;
struct nft_chain *chain, *nr;
+ struct nft_table *table;
struct nft_ctx ctx = {
.net = dev_net(dev),
};
@@ -372,7 +373,8 @@ static int nf_tables_netdev_event(struct notifier_block *this,
nft_net = net_generic(ctx.net, nf_tables_net_id);
mutex_lock(&nft_net->commit_mutex);
list_for_each_entry(table, &nft_net->tables, list) {
- if (table->family != NFPROTO_NETDEV)
+ if (table->family != NFPROTO_NETDEV &&
+ table->family != NFPROTO_INET)
continue;
ctx.family = table->family;
@@ -381,6 +383,11 @@ static int nf_tables_netdev_event(struct notifier_block *this,
if (!nft_is_base_chain(chain))
continue;
+ basechain = nft_base_chain(chain);
+ if (table->family == NFPROTO_INET &&
+ basechain->ops.hooknum != NF_INET_INGRESS)
+ continue;
+
ctx.chain = chain;
nft_netdev_event(event, dev, &ctx);
}
--
2.34.1
2
1
[PATCH OLK-5.10] netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
by Zhengchao Shao 15 Apr '24
by Zhengchao Shao 15 Apr '24
15 Apr '24
From: Ryosuke Yasuoka <ryasuoka(a)redhat.com>
stable inclusion
from stable-v5.10.212
commit f19d1f98e60e68b11fc60839105dd02a30ec0d77
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E46W
CVE: CVE-2024-26805
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 661779e1fcafe1b74b3f3fe8e980c1e207fea1fd ]
syzbot reported the following uninit-value access issue [1]:
netlink_to_full_skb() creates a new `skb` and puts the `skb->data`
passed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data
size is specified as `len` and passed to skb_put_data(). This `len`
is based on `skb->end` that is not data offset but buffer offset. The
`skb->end` contains data and tailroom. Since the tailroom is not
initialized when the new `skb` created, KMSAN detects uninitialized
memory area when copying the data.
This patch resolved this issue by correct the len from `skb->end` to
`skb->len`, which is the actual data offset.
BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline]
BUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:29 [inline]
BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline]
BUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186
instrument_copy_to_user include/linux/instrumented.h:114 [inline]
copy_to_user_iter lib/iov_iter.c:24 [inline]
iterate_ubuf include/linux/iov_iter.h:29 [inline]
iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
iterate_and_advance include/linux/iov_iter.h:271 [inline]
_copy_to_iter+0x364/0x2520 lib/iov_iter.c:186
copy_to_iter include/linux/uio.h:197 [inline]
simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532
__skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420
skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546
skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline]
packet_recvmsg+0xd9c/0x2000 net/packet/af_packet.c:3482
sock_recvmsg_nosec net/socket.c:1044 [inline]
sock_recvmsg net/socket.c:1066 [inline]
sock_read_iter+0x467/0x580 net/socket.c:1136
call_read_iter include/linux/fs.h:2014 [inline]
new_sync_read fs/read_write.c:389 [inline]
vfs_read+0x8f6/0xe00 fs/read_write.c:470
ksys_read+0x20f/0x4c0 fs/read_write.c:613
__do_sys_read fs/read_write.c:623 [inline]
__se_sys_read fs/read_write.c:621 [inline]
__x64_sys_read+0x93/0xd0 fs/read_write.c:621
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was stored to memory at:
skb_put_data include/linux/skbuff.h:2622 [inline]
netlink_to_full_skb net/netlink/af_netlink.c:181 [inline]
__netlink_deliver_tap_skb net/netlink/af_netlink.c:298 [inline]
__netlink_deliver_tap+0x5be/0xc90 net/netlink/af_netlink.c:325
netlink_deliver_tap net/netlink/af_netlink.c:338 [inline]
netlink_deliver_tap_kernel net/netlink/af_netlink.c:347 [inline]
netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
netlink_unicast+0x10f1/0x1250 net/netlink/af_netlink.c:1368
netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
__sys_sendmsg net/socket.c:2667 [inline]
__do_sys_sendmsg net/socket.c:2676 [inline]
__se_sys_sendmsg net/socket.c:2674 [inline]
__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was created at:
free_pages_prepare mm/page_alloc.c:1087 [inline]
free_unref_page_prepare+0xb0/0xa40 mm/page_alloc.c:2347
free_unref_page_list+0xeb/0x1100 mm/page_alloc.c:2533
release_pages+0x23d3/0x2410 mm/swap.c:1042
free_pages_and_swap_cache+0xd9/0xf0 mm/swap_state.c:316
tlb_batch_pages_flush mm/mmu_gather.c:98 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:293 [inline]
tlb_flush_mmu+0x6f5/0x980 mm/mmu_gather.c:300
tlb_finish_mmu+0x101/0x260 mm/mmu_gather.c:392
exit_mmap+0x49e/0xd30 mm/mmap.c:3321
__mmput+0x13f/0x530 kernel/fork.c:1349
mmput+0x8a/0xa0 kernel/fork.c:1371
exit_mm+0x1b8/0x360 kernel/exit.c:567
do_exit+0xd57/0x4080 kernel/exit.c:858
do_group_exit+0x2fd/0x390 kernel/exit.c:1021
__do_sys_exit_group kernel/exit.c:1032 [inline]
__se_sys_exit_group kernel/exit.c:1030 [inline]
__x64_sys_exit_group+0x3c/0x50 kernel/exit.c:1030
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Bytes 3852-3903 of 3904 are uninitialized
Memory access of size 3904 starts at ffff88812ea1e000
Data copied to user address 0000000020003280
CPU: 1 PID: 5043 Comm: syz-executor297 Not tainted 6.7.0-rc5-syzkaller-00047-g5bd7ef53ffe5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
Fixes: 1853c9496460 ("netlink, mmap: transform mmap skb into full skb on taps")
Reported-and-tested-by: syzbot+34ad5fab48f7bf510349(a)syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=34ad5fab48f7bf510349 [1]
Signed-off-by: Ryosuke Yasuoka <ryasuoka(a)redhat.com>
Reviewed-by: Eric Dumazet <edumazet(a)google.com>
Link: https://lore.kernel.org/r/20240221074053.1794118-1-ryasuoka@redhat.com
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com>
---
net/netlink/af_netlink.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index e3f34dccc97a..b1e2d3fa522e 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -157,7 +157,7 @@ static inline u32 netlink_group_mask(u32 group)
static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb,
gfp_t gfp_mask)
{
- unsigned int len = skb_end_offset(skb);
+ unsigned int len = skb->len;
struct sk_buff *new;
new = alloc_skb(len, gfp_mask);
--
2.34.1
2
1
[PATCH openEuler-1.0-LTS] netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
by Zhengchao Shao 15 Apr '24
by Zhengchao Shao 15 Apr '24
15 Apr '24
From: Ryosuke Yasuoka <ryasuoka(a)redhat.com>
stable inclusion
from stable-v4.19.309
commit ec343a55b687a452f5e87f3b52bf9f155864df65
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E46W
CVE: CVE-2024-26805
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 661779e1fcafe1b74b3f3fe8e980c1e207fea1fd ]
syzbot reported the following uninit-value access issue [1]:
netlink_to_full_skb() creates a new `skb` and puts the `skb->data`
passed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data
size is specified as `len` and passed to skb_put_data(). This `len`
is based on `skb->end` that is not data offset but buffer offset. The
`skb->end` contains data and tailroom. Since the tailroom is not
initialized when the new `skb` created, KMSAN detects uninitialized
memory area when copying the data.
This patch resolved this issue by correct the len from `skb->end` to
`skb->len`, which is the actual data offset.
BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline]
BUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:29 [inline]
BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline]
BUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186
instrument_copy_to_user include/linux/instrumented.h:114 [inline]
copy_to_user_iter lib/iov_iter.c:24 [inline]
iterate_ubuf include/linux/iov_iter.h:29 [inline]
iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
iterate_and_advance include/linux/iov_iter.h:271 [inline]
_copy_to_iter+0x364/0x2520 lib/iov_iter.c:186
copy_to_iter include/linux/uio.h:197 [inline]
simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532
__skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420
skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546
skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline]
packet_recvmsg+0xd9c/0x2000 net/packet/af_packet.c:3482
sock_recvmsg_nosec net/socket.c:1044 [inline]
sock_recvmsg net/socket.c:1066 [inline]
sock_read_iter+0x467/0x580 net/socket.c:1136
call_read_iter include/linux/fs.h:2014 [inline]
new_sync_read fs/read_write.c:389 [inline]
vfs_read+0x8f6/0xe00 fs/read_write.c:470
ksys_read+0x20f/0x4c0 fs/read_write.c:613
__do_sys_read fs/read_write.c:623 [inline]
__se_sys_read fs/read_write.c:621 [inline]
__x64_sys_read+0x93/0xd0 fs/read_write.c:621
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was stored to memory at:
skb_put_data include/linux/skbuff.h:2622 [inline]
netlink_to_full_skb net/netlink/af_netlink.c:181 [inline]
__netlink_deliver_tap_skb net/netlink/af_netlink.c:298 [inline]
__netlink_deliver_tap+0x5be/0xc90 net/netlink/af_netlink.c:325
netlink_deliver_tap net/netlink/af_netlink.c:338 [inline]
netlink_deliver_tap_kernel net/netlink/af_netlink.c:347 [inline]
netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
netlink_unicast+0x10f1/0x1250 net/netlink/af_netlink.c:1368
netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
__sys_sendmsg net/socket.c:2667 [inline]
__do_sys_sendmsg net/socket.c:2676 [inline]
__se_sys_sendmsg net/socket.c:2674 [inline]
__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was created at:
free_pages_prepare mm/page_alloc.c:1087 [inline]
free_unref_page_prepare+0xb0/0xa40 mm/page_alloc.c:2347
free_unref_page_list+0xeb/0x1100 mm/page_alloc.c:2533
release_pages+0x23d3/0x2410 mm/swap.c:1042
free_pages_and_swap_cache+0xd9/0xf0 mm/swap_state.c:316
tlb_batch_pages_flush mm/mmu_gather.c:98 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:293 [inline]
tlb_flush_mmu+0x6f5/0x980 mm/mmu_gather.c:300
tlb_finish_mmu+0x101/0x260 mm/mmu_gather.c:392
exit_mmap+0x49e/0xd30 mm/mmap.c:3321
__mmput+0x13f/0x530 kernel/fork.c:1349
mmput+0x8a/0xa0 kernel/fork.c:1371
exit_mm+0x1b8/0x360 kernel/exit.c:567
do_exit+0xd57/0x4080 kernel/exit.c:858
do_group_exit+0x2fd/0x390 kernel/exit.c:1021
__do_sys_exit_group kernel/exit.c:1032 [inline]
__se_sys_exit_group kernel/exit.c:1030 [inline]
__x64_sys_exit_group+0x3c/0x50 kernel/exit.c:1030
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Bytes 3852-3903 of 3904 are uninitialized
Memory access of size 3904 starts at ffff88812ea1e000
Data copied to user address 0000000020003280
CPU: 1 PID: 5043 Comm: syz-executor297 Not tainted 6.7.0-rc5-syzkaller-00047-g5bd7ef53ffe5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
Fixes: 1853c9496460 ("netlink, mmap: transform mmap skb into full skb on taps")
Reported-and-tested-by: syzbot+34ad5fab48f7bf510349(a)syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=34ad5fab48f7bf510349 [1]
Signed-off-by: Ryosuke Yasuoka <ryasuoka(a)redhat.com>
Reviewed-by: Eric Dumazet <edumazet(a)google.com>
Link: https://lore.kernel.org/r/20240221074053.1794118-1-ryasuoka@redhat.com
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com>
---
net/netlink/af_netlink.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index fd0fa4c37a3b..766096493494 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -160,7 +160,7 @@ static inline u32 netlink_group_mask(u32 group)
static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb,
gfp_t gfp_mask)
{
- unsigned int len = skb_end_offset(skb);
+ unsigned int len = skb->len;
struct sk_buff *new;
new = alloc_skb(len, gfp_mask);
--
2.34.1
2
1
[openeuler:OLK-6.6] BUILD REGRESSION 96c1e1c4f86852c5ad4cd22d5a9091cfc0855ea4
by kernel test robot 14 Apr '24
by kernel test robot 14 Apr '24
14 Apr '24
tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6
branch HEAD: 96c1e1c4f86852c5ad4cd22d5a9091cfc0855ea4 !6069 RDMA/hns: support roh
Error/Warning ids grouped by kconfigs:
gcc_recent_errors
|-- loongarch-allmodconfig
| |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-netdev-not-described-in-rnp_netpoll
| |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-Polling-interrupt-().-Prototype-was-for-rnp_netpoll()-instead
| |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_ethtool.c:warning:no-previous-prototype-for-rnpgbevf_get_ringparam
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_ethtool.c:warning:no-previous-prototype-for-rnpgbevf_set_ringparam
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_ethtool.c:warning:rnp_gstrings_test-defined-but-not-used
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_alloc_rx_buffers
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_assign_netdev_ops
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_configure_rx_ring
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_configure_tx_ring
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_disable_rx_queue
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_enable_rx_queue
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_maybe_tx_ctxtdesc
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_tx_ctxtdesc
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_unmap_and_free_tx_resource
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_write_eitr_rx
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_xmit_frame_ring
| |-- drivers-net-ethernet-mucse-rnpgbevf-vf.c:warning:no-previous-prototype-for-rnpgbevf_addr_list_itr
| |-- drivers-net-ethernet-mucse-rnpgbevf-vf.c:warning:no-previous-prototype-for-rnpgbevf_get_queues
| |-- drivers-net-ethernet-mucse-rnpgbevf-vf.c:warning:no-previous-prototype-for-rnpgbevf_negotiate_api_version
| |-- drivers-net-ethernet-mucse-rnpgbevf-vf.c:warning:no-previous-prototype-for-rnpgbevf_set_veb_mac_n500
| |-- drivers-net-ethernet-mucse-rnpgbevf-vf.c:warning:no-previous-prototype-for-rnpgbevf_set_vlan_n500
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-rnpm_get_phy_statistics
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-rnpm_setup_layer2_remapping
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-rnpm_setup_tuple5_remapping
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-rnpm_setup_tuple5_remapping_tcam
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-clean_all_port_resetting
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-control_mac_rx
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_assign_netdev_ops
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_can_rpu_start
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_check_mc_addr
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_clear_udp_tunnel_port
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_fix_queue_number
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_pf_service_event_schedule
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_pf_service_task
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_pf_service_timer
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_rx_ring_reinit
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_service_timer
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_vlan_stags_flag
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_write_eitr
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_xmit_nop_frame_ring
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_xmit_nop_frame_ring_temp
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-update_pf_vlan
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-wait_all_port_resetting
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed:
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:build_writereg_req-accessing-bytes-in-a-region-of-size
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-mbx_cookie_zalloc
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_fw_get_capablity
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_fw_reg_read
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_fw_send_cmd_wait
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_get_port_stats2
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_link_stat_mark_disable
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_fw_post_req
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_lldp_all_ports_enable
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_pluginout_evt_en
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_write_posted_locked
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:no-previous-prototype-for-rnpm_reset_pipeline_n10
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:no-previous-prototype-for-rnpm_ptp_setup_ptp
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:suggest-braces-around-empty-body-in-an-if-statement
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-rnpm_get_vf_ringnum
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-rnpm_setup_ring_maxrate
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_sysfs.c:warning:no-previous-prototype-for-rnpm_mbx_get_pn_sn
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_tc_u32_parse.h:warning:rnpm_ipv4_parser-defined-but-not-used
| |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:no-previous-prototype-for-rnpvf_get_ringparam
| |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:rnp_gstrings_test-defined-but-not-used
| |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-queue_idx-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_ack_vf
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_msg_vf
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_rst_msg_vf
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_obtain_mbx_lock_vf
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_poll_for_ack
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_poll_for_msg
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_read_mbx_vf
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_read_posted_mbx
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_write_mbx_vf
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_write_posted_mbx
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-data-description-in-rnpvf_watchdog
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-rx_ring-description-in-rnpvf_pull_tail
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-skb-description-in-rnpvf_is_non_eop
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-rnpvf_msix_vector-not-described-in-rnpvf_set_ring_vector
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-rnpvf_queue-not-described-in-rnpvf_set_ring_vector
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpvf_watchdog
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-type-not-described-in-rnpvf_update_itr
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnp_clean_rx_irq().-Prototype-was-for-rnpvf_clean_rx_irq()-instead
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnp_clean_rx_ring().-Prototype-was-for-rnpvf_clean_rx_ring()-instead
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnpvf_set_ivar().-Prototype-was-for-rnpvf_set_ring_vector()-instead
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnpvf_write_eitr().-Prototype-was-for-rnpvf_write_eitr_rx()-instead
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_alloc_rx_buffers
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_assign_netdev_ops
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_configure_rx_ring
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_configure_tx_ring
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_disable_rx_queue
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_enable_rx_queue
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_maybe_tx_ctxtdesc
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_tx_ctxtdesc
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_unmap_and_free_tx_resource
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_write_eitr_rx
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_xmit_frame_ring
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-update_rx_count
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-err-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-hw-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-vector_threshold-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:Excess-function-parameter-mac_addr-description-in-rnpvf_get_queues_vf
| |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-rnpvf_addr_list_itr
| |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-rnpvf_get_queues
| |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-rnpvf_negotiate_api_version
| |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-rnpvf_set_veb_mac_n10
| |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-rnpvf_set_vlan_n10
| `-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:variable-number_of_queues-set-but-not-used
|-- loongarch-allyesconfig
| |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-netdev-not-described-in-rnp_netpoll
| |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-Polling-interrupt-().-Prototype-was-for-rnp_netpoll()-instead
| |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_ethtool.c:warning:no-previous-prototype-for-rnpgbevf_get_ringparam
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_ethtool.c:warning:no-previous-prototype-for-rnpgbevf_set_ringparam
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_ethtool.c:warning:rnp_gstrings_test-defined-but-not-used
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_alloc_rx_buffers
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_assign_netdev_ops
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_configure_rx_ring
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_configure_tx_ring
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_disable_rx_queue
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_enable_rx_queue
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_maybe_tx_ctxtdesc
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_tx_ctxtdesc
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_unmap_and_free_tx_resource
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_write_eitr_rx
| |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_xmit_frame_ring
| |-- drivers-net-ethernet-mucse-rnpgbevf-vf.c:warning:no-previous-prototype-for-rnpgbevf_addr_list_itr
| |-- drivers-net-ethernet-mucse-rnpgbevf-vf.c:warning:no-previous-prototype-for-rnpgbevf_get_queues
| |-- drivers-net-ethernet-mucse-rnpgbevf-vf.c:warning:no-previous-prototype-for-rnpgbevf_negotiate_api_version
| |-- drivers-net-ethernet-mucse-rnpgbevf-vf.c:warning:no-previous-prototype-for-rnpgbevf_set_veb_mac_n500
| |-- drivers-net-ethernet-mucse-rnpgbevf-vf.c:warning:no-previous-prototype-for-rnpgbevf_set_vlan_n500
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-rnpm_get_phy_statistics
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-rnpm_setup_layer2_remapping
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-rnpm_setup_tuple5_remapping
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-rnpm_setup_tuple5_remapping_tcam
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-clean_all_port_resetting
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-control_mac_rx
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_assign_netdev_ops
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_can_rpu_start
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_check_mc_addr
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_clear_udp_tunnel_port
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_fix_queue_number
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_pf_service_event_schedule
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_pf_service_task
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_pf_service_timer
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_rx_ring_reinit
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_service_timer
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_vlan_stags_flag
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_write_eitr
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_xmit_nop_frame_ring
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_xmit_nop_frame_ring_temp
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-update_pf_vlan
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-wait_all_port_resetting
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed:
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:build_writereg_req-accessing-bytes-in-a-region-of-size
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-mbx_cookie_zalloc
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_fw_get_capablity
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_fw_reg_read
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_fw_send_cmd_wait
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_get_port_stats2
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_link_stat_mark_disable
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_fw_post_req
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_lldp_all_ports_enable
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_pluginout_evt_en
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_write_posted_locked
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:no-previous-prototype-for-rnpm_reset_pipeline_n10
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:no-previous-prototype-for-rnpm_ptp_setup_ptp
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:suggest-braces-around-empty-body-in-an-if-statement
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-rnpm_get_vf_ringnum
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-rnpm_setup_ring_maxrate
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_sysfs.c:warning:no-previous-prototype-for-rnpm_mbx_get_pn_sn
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_tc_u32_parse.h:warning:rnpm_ipv4_parser-defined-but-not-used
| |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:no-previous-prototype-for-rnpvf_get_ringparam
| |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:rnp_gstrings_test-defined-but-not-used
| |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-queue_idx-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_ack_vf
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_msg_vf
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_rst_msg_vf
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_obtain_mbx_lock_vf
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_poll_for_ack
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_poll_for_msg
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_read_mbx_vf
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_read_posted_mbx
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_write_mbx_vf
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_write_posted_mbx
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-data-description-in-rnpvf_watchdog
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-rx_ring-description-in-rnpvf_pull_tail
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-skb-description-in-rnpvf_is_non_eop
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-rnpvf_msix_vector-not-described-in-rnpvf_set_ring_vector
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-rnpvf_queue-not-described-in-rnpvf_set_ring_vector
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpvf_watchdog
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-type-not-described-in-rnpvf_update_itr
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnp_clean_rx_irq().-Prototype-was-for-rnpvf_clean_rx_irq()-instead
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnp_clean_rx_ring().-Prototype-was-for-rnpvf_clean_rx_ring()-instead
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnpvf_set_ivar().-Prototype-was-for-rnpvf_set_ring_vector()-instead
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnpvf_write_eitr().-Prototype-was-for-rnpvf_write_eitr_rx()-instead
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_alloc_rx_buffers
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_assign_netdev_ops
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_configure_rx_ring
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_configure_tx_ring
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_disable_rx_queue
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_enable_rx_queue
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_maybe_tx_ctxtdesc
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_tx_ctxtdesc
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_unmap_and_free_tx_resource
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_write_eitr_rx
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_xmit_frame_ring
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-update_rx_count
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-err-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-hw-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-vector_threshold-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:Excess-function-parameter-mac_addr-description-in-rnpvf_get_queues_vf
| |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-rnpvf_addr_list_itr
| |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-rnpvf_get_queues
| |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-rnpvf_negotiate_api_version
| |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-rnpvf_set_veb_mac_n10
| |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-rnpvf_set_vlan_n10
| `-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:variable-number_of_queues-set-but-not-used
|-- loongarch-randconfig-001-20240414
| |-- arch-loongarch-kvm-exit.c:error:struct-sched_info-has-no-member-named-run_delay
| `-- arch-loongarch-kvm-vcpu.c:error:struct-sched_info-has-no-member-named-run_delay
|-- x86_64-randconfig-015-20240414
| |-- drivers-net-ethernet-huawei-hinic-hinic_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead
| |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_register_sw_cb().-Prototype-was-for-hinic_aeq_register_swe_cb()-instead
| |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_unregister_sw_cb().-Prototype-was-for-hinic_aeq_unregister_swe_cb()-instead
| |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_ceq_register_sw_cb().-Prototype-was-for-hinic_ceq_register_cb()-instead
| |-- drivers-net-ethernet-huawei-hinic-hinic_hwif.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst
| |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_pf_mbox_cb()-instead
| |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_ppf_to_pf_mbox_cb()-instead
| `-- drivers-net-ethernet-huawei-hinic-hinic_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst
`-- x86_64-randconfig-123-20240414
|-- drivers-net-ethernet-huawei-hinic-hinic_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead
|-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_register_sw_cb().-Prototype-was-for-hinic_aeq_register_swe_cb()-instead
|-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_unregister_sw_cb().-Prototype-was-for-hinic_aeq_unregister_swe_cb()-instead
|-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_ceq_register_sw_cb().-Prototype-was-for-hinic_ceq_register_cb()-instead
|-- drivers-net-ethernet-huawei-hinic-hinic_hwif.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst
|-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_pf_mbox_cb()-instead
|-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_ppf_to_pf_mbox_cb()-instead
`-- drivers-net-ethernet-huawei-hinic-hinic_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst
clang_recent_errors
|-- arm64-allmodconfig
| |-- drivers-net-ethernet-huawei-hinic-hinic_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead
| |-- drivers-net-ethernet-huawei-hinic-hinic_cfg.c:warning:arithmetic-between-different-enumeration-types-(-enum-hinic_node_id-and-enum-hinic_fault_err_level-)
| |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_register_sw_cb().-Prototype-was-for-hinic_aeq_register_swe_cb()-instead
| |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_unregister_sw_cb().-Prototype-was-for-hinic_aeq_unregister_swe_cb()-instead
| |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_ceq_register_sw_cb().-Prototype-was-for-hinic_ceq_register_cb()-instead
| |-- drivers-net-ethernet-huawei-hinic-hinic_hwdev.c:warning:arithmetic-between-different-enumeration-types-(-enum-hinic_node_id-and-enum-hinic_fault_err_level-)
| |-- drivers-net-ethernet-huawei-hinic-hinic_hwif.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst
| |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_pf_mbox_cb()-instead
| |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_ppf_to_pf_mbox_cb()-instead
| |-- drivers-net-ethernet-huawei-hinic-hinic_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst
| |-- drivers-net-ethernet-huawei-hinic-hinic_nic_dbg.c:warning:arithmetic-between-different-enumeration-types-(-enum-hinic_node_id-and-enum-hinic_fault_err_level-)
| |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_api_cmd.c:warning:expecting-prototype-for-alloc_cmd_buf().-Prototype-was-for-alloc_resp_buf()-instead
| |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead
| |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_devlink.c:warning:variable-pdev-set-but-not-used
| |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mbox.c:warning:expecting-prototype-for-hinic3_unregister_ppf_mbox_cb().-Prototype-was-for-hinic3_unregister_pf_mbox_cb()-instead
| |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mbox.c:warning:expecting-prototype-for-hinic3_unregister_ppf_mbox_cb().-Prototype-was-for-hinic3_unregister_ppf_to_pf_mbox_cb()-instead
| |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst
| |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:expecting-prototype-for-hinic_pf_to_mgmt_free().-Prototype-was-for-hinic3_pf_to_mgmt_free()-instead
| |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:expecting-prototype-for-hinic_pf_to_mgmt_init().-Prototype-was-for-hinic3_pf_to_mgmt_init()-instead
| |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-netdev-not-described-in-rnp_netpoll
| |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-Polling-interrupt-().-Prototype-was-for-rnp_netpoll()-instead
| |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-function-rnpm_get_phy_statistics
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed:
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_get_vf_ringnum
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_setup_ring_maxrate
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:no-previous-prototype-for-function-rnpvf_get_ringparam
| |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:unused-variable-rnp_gstrings_test
| |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-advertising-is-uninitialized-when-used-here
| |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-advertising-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-queue_idx-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_ack_vf
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_msg_vf
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_rst_msg_vf
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_obtain_mbx_lock_vf
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_poll_for_ack
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_poll_for_msg
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_read_mbx_vf
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_read_posted_mbx
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_write_mbx_vf
| |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_write_posted_mbx
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-data-description-in-rnpvf_watchdog
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-rx_ring-description-in-rnpvf_pull_tail
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-skb-description-in-rnpvf_is_non_eop
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-rnpvf_msix_vector-not-described-in-rnpvf_set_ring_vector
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-rnpvf_queue-not-described-in-rnpvf_set_ring_vector
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpvf_watchdog
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-type-not-described-in-rnpvf_update_itr
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnp_clean_rx_irq().-Prototype-was-for-rnpvf_clean_rx_irq()-instead
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnp_clean_rx_ring().-Prototype-was-for-rnpvf_clean_rx_ring()-instead
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnpvf_set_ivar().-Prototype-was-for-rnpvf_set_ring_vector()-instead
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnpvf_write_eitr().-Prototype-was-for-rnpvf_write_eitr_rx()-instead
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_alloc_rx_buffers
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_assign_netdev_ops
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_configure_rx_ring
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_configure_tx_ring
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_disable_rx_queue
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_enable_rx_queue
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_maybe_tx_ctxtdesc
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_tx_ctxtdesc
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_unmap_and_free_tx_resource
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_write_eitr_rx
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_xmit_frame_ring
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-update_rx_count
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-err-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-hw-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-ring_csum_err-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-ring_csum_good-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-vector_threshold-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-xdp_xmit-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:Excess-function-parameter-mac_addr-description-in-rnpvf_get_queues_vf
| |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_addr_list_itr
| |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_get_queues
| |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_negotiate_api_version
| |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_set_veb_mac_n10
| |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_set_vlan_n10
| |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:variable-number_of_queues-set-but-not-used
| |-- drivers-scsi-hisi_raid-hiraid_main.c:warning:expecting-prototype-for-hiraid_create_cq().-Prototype-was-for-hiraid_create_complete_queue()-instead
| `-- drivers-scsi-hisi_raid-hiraid_main.c:warning:expecting-prototype-for-hiraid_create_sq().-Prototype-was-for-hiraid_create_send_queue()-instead
`-- x86_64-allyesconfig
|-- drivers-net-ethernet-huawei-hinic-hinic_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead
|-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_register_sw_cb().-Prototype-was-for-hinic_aeq_register_swe_cb()-instead
|-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_unregister_sw_cb().-Prototype-was-for-hinic_aeq_unregister_swe_cb()-instead
|-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_ceq_register_sw_cb().-Prototype-was-for-hinic_ceq_register_cb()-instead
|-- drivers-net-ethernet-huawei-hinic-hinic_hwif.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst
|-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_pf_mbox_cb()-instead
|-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_ppf_to_pf_mbox_cb()-instead
|-- drivers-net-ethernet-huawei-hinic-hinic_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst
|-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_api_cmd.c:warning:expecting-prototype-for-alloc_cmd_buf().-Prototype-was-for-alloc_resp_buf()-instead
|-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead
|-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_devlink.c:warning:variable-pdev-set-but-not-used
|-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mbox.c:warning:expecting-prototype-for-hinic3_unregister_ppf_mbox_cb().-Prototype-was-for-hinic3_unregister_pf_mbox_cb()-instead
|-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mbox.c:warning:expecting-prototype-for-hinic3_unregister_ppf_mbox_cb().-Prototype-was-for-hinic3_unregister_ppf_to_pf_mbox_cb()-instead
|-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst
|-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:expecting-prototype-for-hinic_pf_to_mgmt_free().-Prototype-was-for-hinic3_pf_to_mgmt_free()-instead
|-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:expecting-prototype-for-hinic_pf_to_mgmt_init().-Prototype-was-for-hinic3_pf_to_mgmt_init()-instead
|-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-netdev-not-described-in-rnp_netpoll
|-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-Polling-interrupt-().-Prototype-was-for-rnp_netpoll()-instead
|-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst
|-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead
|-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead
|-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead
|-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-function-rnpm_get_phy_statistics
|-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead
|-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead
|-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead
|-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead
|-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead
|-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed:
|-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead
|-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_get_vf_ringnum
|-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_setup_ring_maxrate
|-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used
|-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:no-previous-prototype-for-function-rnpvf_get_ringparam
|-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:unused-variable-rnp_gstrings_test
|-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-advertising-is-uninitialized-when-used-here
|-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-advertising-set-but-not-used
|-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-queue_idx-set-but-not-used
|-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_ack_vf
|-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_msg_vf
|-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_rst_msg_vf
|-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_obtain_mbx_lock_vf
|-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_poll_for_ack
|-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_poll_for_msg
|-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_read_mbx_vf
|-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_read_posted_mbx
|-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_write_mbx_vf
|-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_write_posted_mbx
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-data-description-in-rnpvf_watchdog
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-rx_ring-description-in-rnpvf_pull_tail
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-skb-description-in-rnpvf_is_non_eop
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-rnpvf_msix_vector-not-described-in-rnpvf_set_ring_vector
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-rnpvf_queue-not-described-in-rnpvf_set_ring_vector
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpvf_watchdog
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-type-not-described-in-rnpvf_update_itr
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnp_clean_rx_irq().-Prototype-was-for-rnpvf_clean_rx_irq()-instead
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnp_clean_rx_ring().-Prototype-was-for-rnpvf_clean_rx_ring()-instead
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnpvf_set_ivar().-Prototype-was-for-rnpvf_set_ring_vector()-instead
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnpvf_write_eitr().-Prototype-was-for-rnpvf_write_eitr_rx()-instead
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_alloc_rx_buffers
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_assign_netdev_ops
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_configure_rx_ring
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_configure_tx_ring
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_disable_rx_queue
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_enable_rx_queue
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_maybe_tx_ctxtdesc
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_tx_ctxtdesc
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_unmap_and_free_tx_resource
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_write_eitr_rx
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_xmit_frame_ring
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-update_rx_count
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-err-set-but-not-used
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-hw-set-but-not-used
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-ring_csum_err-set-but-not-used
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-ring_csum_good-set-but-not-used
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-vector_threshold-set-but-not-used
|-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-xdp_xmit-set-but-not-used
|-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:Excess-function-parameter-mac_addr-description-in-rnpvf_get_queues_vf
|-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_addr_list_itr
|-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_get_queues
|-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_negotiate_api_version
|-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_set_veb_mac_n10
|-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_set_vlan_n10
|-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:variable-number_of_queues-set-but-not-used
|-- drivers-scsi-hisi_raid-hiraid_main.c:warning:expecting-prototype-for-hiraid_create_cq().-Prototype-was-for-hiraid_create_complete_queue()-instead
|-- drivers-scsi-hisi_raid-hiraid_main.c:warning:expecting-prototype-for-hiraid_create_sq().-Prototype-was-for-hiraid_create_send_queue()-instead
|-- ld.lld:error:duplicate-symbol:__cfi_register_mbx_irq
|-- ld.lld:error:duplicate-symbol:__cfi_remove_mbx_irq
|-- ld.lld:error:duplicate-symbol:register_mbx_irq
|-- ld.lld:error:duplicate-symbol:remove_mbx_irq
`-- ld.lld:error:duplicate-symbol:rnp10_netdev_ops
elapsed time: 721m
configs tested: 41
configs skipped: 141
tested configs:
arm64 allmodconfig clang
arm64 allnoconfig gcc
arm64 defconfig gcc
arm64 randconfig-001-20240414 gcc
arm64 randconfig-002-20240414 clang
arm64 randconfig-003-20240414 gcc
arm64 randconfig-004-20240414 gcc
loongarch allmodconfig gcc
loongarch allnoconfig gcc
loongarch defconfig gcc
loongarch loongson3_defconfig gcc
loongarch randconfig-001-20240414 gcc
loongarch randconfig-002-20240414 gcc
x86_64 allnoconfig clang
x86_64 allyesconfig clang
x86_64 buildonly-randconfig-001-20240414 clang
x86_64 buildonly-randconfig-002-20240414 clang
x86_64 buildonly-randconfig-003-20240414 clang
x86_64 buildonly-randconfig-004-20240414 clang
x86_64 buildonly-randconfig-005-20240414 gcc
x86_64 buildonly-randconfig-006-20240414 clang
x86_64 defconfig gcc
x86_64 randconfig-001-20240414 gcc
x86_64 randconfig-002-20240414 clang
x86_64 randconfig-003-20240414 gcc
x86_64 randconfig-004-20240414 gcc
x86_64 randconfig-005-20240414 clang
x86_64 randconfig-006-20240414 clang
x86_64 randconfig-011-20240414 clang
x86_64 randconfig-012-20240414 gcc
x86_64 randconfig-013-20240414 gcc
x86_64 randconfig-014-20240414 gcc
x86_64 randconfig-015-20240414 gcc
x86_64 randconfig-016-20240414 gcc
x86_64 randconfig-071-20240414 gcc
x86_64 randconfig-072-20240414 clang
x86_64 randconfig-073-20240414 clang
x86_64 randconfig-074-20240414 gcc
x86_64 randconfig-075-20240414 clang
x86_64 randconfig-076-20240414 clang
x86_64 rhel-8.3-rust clang
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
1
0
[openeuler:OLK-5.10 18207/30000] drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2877: multiple definition of `fmgr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_type.h:3165: first defined here
by kernel test robot 14 Apr '24
by kernel test robot 14 Apr '24
14 Apr '24
tree: https://gitee.com/openeuler/kernel.git OLK-5.10
head: 4134526a9cfd552230ec7a66a1738a9066d9a0c6
commit: 3ddd74dceeba1f4ea8b20db59276ea3c6eded3d5 [18207/30000] openeuler: net: txgbe: Fix some known bugs, merge net-swift txgbe-1.2.3 out-of-tree
config: x86_64-randconfig-123-20240414 (https://download.01.org/0day-ci/archive/20240414/202404142149.v0MRewcl-lkp@…)
compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240414/202404142149.v0MRewcl-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202404142149.v0MRewcl-lkp@intel.com/
All errors (new ones prefixed by >>):
ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `wr32':
>> drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2877: multiple definition of `fmgr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_type.h:3165: first defined here
ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `wr32':
>> drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2877: multiple definition of `fmgr_usr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_type.h:3165: first defined here
ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `wr32':
>> drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2877: multiple definition of `flash_erase_chip'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_type.h:3165: first defined here
ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `flash_erase_sector':
drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2377: multiple definition of `flash_erase_sector'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2891: first defined here
ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `wr32':
>> drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2877: multiple definition of `flash_write_dword'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_type.h:3165: first defined here
vim +2877 drivers/net/ethernet/netswift/ngbe/ngbe_type.h
a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2873
a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2874 static inline void
a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2875 wr32(struct ngbe_hw *hw, u32 reg, u32 val)
a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2876 {
a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2877 u8 __iomem *base = READ_ONCE(hw->hw_addr);
a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2878
a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2879 if (unlikely(!base))
a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2880 return;
a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2881
a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2882 ngbe_wr32(base + reg, val);
a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2883 }
a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2884
:::::: The code at line 2877 was first introduced by commit
:::::: a5961b4bc6ce09a70902686ecc848a47493a9251 openeuler: net: ngbe: add ngbe module support
:::::: TO: Duanqiang Wen <duanqiangwen(a)net-swift.com>
:::::: CC: Duanqiang Wen <duanqiangwen(a)net-swift.com>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
1
0
From: Jingxian He <hejingxian(a)huawei.com>
Add cvm feature patches:
1. add cvm host feature
2. enable pmu phys irq inject for cvm
3. add bounce buffer feature for cvm guest
4. add lpi support for cvm guest
5. fix kabi for cvm host
arch/arm64/configs/defconfig | 2 +
arch/arm64/configs/openeuler_defconfig | 2 +
arch/arm64/include/asm/cvm_guest.h | 21 +
arch/arm64/include/asm/kvm_emulate.h | 18 +
arch/arm64/include/asm/kvm_host.h | 28 +-
arch/arm64/include/asm/kvm_tmi.h | 377 +++++++++++
arch/arm64/include/asm/kvm_tmm.h | 73 +++
arch/arm64/kvm/Kconfig | 16 +
arch/arm64/kvm/Makefile | 5 +
arch/arm64/kvm/arch_timer.c | 104 ++-
arch/arm64/kvm/arm.c | 157 ++++-
arch/arm64/kvm/cvm.c | 869 +++++++++++++++++++++++++
arch/arm64/kvm/cvm_exit.c | 240 +++++++
arch/arm64/kvm/cvm_guest.c | 91 +++
arch/arm64/kvm/guest.c | 8 +
arch/arm64/kvm/hisilicon/hisi_virt.c | 7 +
arch/arm64/kvm/hyp/vgic-v3-sr.c | 19 +
arch/arm64/kvm/mmio.c | 19 +
arch/arm64/kvm/mmu.c | 7 +
arch/arm64/kvm/pmu-emul.c | 10 +
arch/arm64/kvm/psci.c | 12 +-
arch/arm64/kvm/reset.c | 10 +
arch/arm64/kvm/tmi.c | 168 +++++
arch/arm64/kvm/vgic/vgic-v3.c | 18 +-
arch/arm64/kvm/vgic/vgic.c | 59 +-
arch/arm64/mm/mmu.c | 11 +
arch/arm64/mm/pageattr.c | 9 +-
drivers/irqchip/irq-gic-v3-its.c | 229 ++++++-
drivers/perf/arm_pmu.c | 17 +
include/kvm/arm_arch_timer.h | 4 +
include/linux/kvm_host.h | 23 +
include/linux/perf/arm_pmu.h | 3 +
include/linux/swiotlb.h | 13 +
include/uapi/linux/kvm.h | 27 +
kernel/dma/direct.c | 39 ++
kernel/dma/swiotlb.c | 86 ++-
virt/kvm/kvm_main.c | 7 +-
37 files changed, 2765 insertions(+), 43 deletions(-)
create mode 100644 arch/arm64/include/asm/cvm_guest.h
create mode 100644 arch/arm64/include/asm/kvm_tmi.h
create mode 100644 arch/arm64/include/asm/kvm_tmm.h
create mode 100644 arch/arm64/kvm/cvm.c
create mode 100644 arch/arm64/kvm/cvm_exit.c
create mode 100644 arch/arm64/kvm/cvm_guest.c
create mode 100644 arch/arm64/kvm/tmi.c
--
2.33.0
3
7
[openeuler:OLK-5.10 20421/30000] drivers/net/ethernet/nebula-matrix/m1600/debug.c:267:21: sparse: sparse: cast removes address space '__iomem' of expression
by kernel test robot 14 Apr '24
by kernel test robot 14 Apr '24
14 Apr '24
tree: https://gitee.com/openeuler/kernel.git OLK-5.10
head: 4134526a9cfd552230ec7a66a1738a9066d9a0c6
commit: 01e6e2075c432fde7fb5a66202b41bbd469de620 [20421/30000] Net: m1600: Add m1600-driver for nebula-matrix m1600 series smart NIC.
config: x86_64-randconfig-122-20240413 (https://download.01.org/0day-ci/archive/20240414/202404141531.eh0C6OjT-lkp@…)
compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240414/202404141531.eh0C6OjT-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202404141531.eh0C6OjT-lkp@intel.com/
sparse warnings: (new ones prefixed by >>)
>> drivers/net/ethernet/nebula-matrix/m1600/debug.c:267:21: sparse: sparse: cast removes address space '__iomem' of expression
drivers/net/ethernet/nebula-matrix/m1600/debug.c:440:21: sparse: sparse: cast removes address space '__iomem' of expression
drivers/net/ethernet/nebula-matrix/m1600/debug.c:444:21: sparse: sparse: cast removes address space '__iomem' of expression
--
>> drivers/net/ethernet/nebula-matrix/m1600/ethtool.c:507:5: sparse: sparse: symbol 'nbl_get_eeprom_len' was not declared. Should it be static?
>> drivers/net/ethernet/nebula-matrix/m1600/ethtool.c:643:5: sparse: sparse: symbol 'nbl_query_link_speed' was not declared. Should it be static?
--
>> drivers/net/ethernet/nebula-matrix/m1600/main.c:155:6: sparse: sparse: symbol 'nbl_service_task2_schedule' was not declared. Should it be static?
>> drivers/net/ethernet/nebula-matrix/m1600/main.c:436:6: sparse: sparse: symbol 'nbl_check_and_set_module_info' was not declared. Should it be static?
--
>> drivers/net/ethernet/nebula-matrix/m1600/txrx.c:822:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] buffer_addr @@ got restricted __le64 [usertype] @@
drivers/net/ethernet/nebula-matrix/m1600/txrx.c:822:38: sparse: expected unsigned long long [usertype] buffer_addr
drivers/net/ethernet/nebula-matrix/m1600/txrx.c:822:38: sparse: got restricted __le64 [usertype]
vim +/__iomem +267 drivers/net/ethernet/nebula-matrix/m1600/debug.c
251
252 /* ring */
253 static int ring_seq_show(struct seq_file *m, void *v)
254 {
255 int i, j, n;
256 struct nbl_rx_desc *rx_desc;
257 struct nbl_tx_desc *tx_desc;
258 struct nbl_ring *ring = m->private;
259
260 seq_printf(m, "size=%d\n", ring->size);
261 seq_printf(m, "dma=0x%llX\n", (unsigned long long)ring->dma);
262 seq_printf(m, "desc=0x%llX\n", (unsigned long long)ring->desc);
263 seq_printf(m, "desc_num=%d\n", ring->desc_num);
264 seq_printf(m, "local_qid=%d\n", ring->local_qid);
265 seq_printf(m, "queue_index=%d\n", ring->queue_index);
266 seq_printf(m, "notify_addr=0x%llX\n",
> 267 (unsigned long long)ring->notify_addr);
268 seq_printf(m, "buf_len=%d\n", ring->buf_len);
269 seq_printf(m, "next_to_use=%d\n", ring->next_to_use);
270 seq_printf(m, "next_to_clean=%d\n", ring->next_to_clean);
271 seq_printf(m, "next_to_alloc=%d\n", ring->next_to_alloc);
272 seq_printf(m, "tail_ptr=%d\n", ring->tail_ptr);
273 if (!ring->desc) {
274 seq_puts(m, "[Unallocated]\n");
275 return 0;
276 }
277
278 if (ring->local_qid & 1) {
279 tx_desc = (struct nbl_tx_desc *)ring->desc;
280 n = sizeof(struct nbl_tx_desc) / sizeof(u32);
281 for (i = 0; i < ring->desc_num; i++) {
282 seq_printf(m, "[desc-%03d]: ", i);
283 for (j = 0; j < n; j++)
284 seq_printf(m, "%08X ", ((u32 *)tx_desc)[j]);
285 seq_printf(m, "dlen:%d ", tx_desc->data_len);
286 seq_printf(m, "plen:%d ", tx_desc->pkt_len);
287 seq_printf(m, "dd:%d ", tx_desc->dd);
288 seq_printf(m, "eop:%d ", tx_desc->eop);
289 seq_printf(m, "sop:%d ", tx_desc->sop);
290 seq_printf(m, "fwd:%d ", tx_desc->fwd);
291 seq_printf(m, "dp:%d ", tx_desc->dport);
292 seq_printf(m, "dpi:%d ", tx_desc->dport_id);
293 seq_printf(m, "l3c:%d ", tx_desc->l3_checksum);
294 seq_printf(m, "l4c:%d ", tx_desc->l4_checksum);
295 seq_printf(m, "rsslag:%d ", tx_desc->rss_lag);
296 seq_printf(m, "l3_off:%d\n", tx_desc->l3_start_offset);
297 tx_desc++;
298 }
299 } else {
300 rx_desc = (struct nbl_rx_desc *)ring->desc;
301 n = sizeof(struct nbl_rx_desc) / sizeof(u32);
302 for (i = 0; i < ring->desc_num; i++) {
303 seq_printf(m, "[desc-%03d]: ", i);
304 for (j = 0; j < n; j++)
305 seq_printf(m, "%08X ", ((u32 *)rx_desc)[j]);
306 seq_printf(m, "dlen:%d ", rx_desc->data_len);
307 seq_printf(m, "dd:%d ", rx_desc->dd);
308 seq_printf(m, "eop:%d ", rx_desc->eop);
309 seq_printf(m, "sop:%d ", rx_desc->sop);
310 seq_printf(m, "fwd:%d ", rx_desc->fwd);
311 seq_printf(m, "sp:%d ", rx_desc->sport);
312 seq_printf(m, "spi:%d ", rx_desc->sport_id);
313 seq_printf(m, "cks:%d ", rx_desc->checksum_status);
314 seq_printf(m, "ptype:%d ", rx_desc->ptype);
315 seq_printf(m, "lag:%d ", rx_desc->lag);
316 seq_printf(m, "lagid:%d\n", rx_desc->lag_id);
317 rx_desc++;
318 }
319 }
320
321 return 0;
322 }
323
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
1
0
[openeuler:OLK-5.10 11501/30000] arch/arm64/kernel/ipi_nmi.c:38:9: error: implicit declaration of function 'printk_safe_enter'; did you mean 'printk_nmi_enter'?
by kernel test robot 14 Apr '24
by kernel test robot 14 Apr '24
14 Apr '24
Hi Li,
FYI, the error/warning still remains.
tree: https://gitee.com/openeuler/kernel.git OLK-5.10
head: 4134526a9cfd552230ec7a66a1738a9066d9a0c6
commit: f86d165bfe5f6248743774bb07af0bd7cff12443 [11501/30000] arm64: Add non nmi ipi backtrace support
config: arm64-randconfig-004-20240414 (https://download.01.org/0day-ci/archive/20240414/202404141450.VgXyPZBP-lkp@…)
compiler: aarch64-linux-gcc (GCC) 13.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240414/202404141450.VgXyPZBP-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202404141450.VgXyPZBP-lkp@intel.com/
All errors (new ones prefixed by >>):
arch/arm64/kernel/ipi_nmi.c: In function 'ipi_cpu_backtrace':
>> arch/arm64/kernel/ipi_nmi.c:38:9: error: implicit declaration of function 'printk_safe_enter'; did you mean 'printk_nmi_enter'? [-Werror=implicit-function-declaration]
38 | printk_safe_enter();
| ^~~~~~~~~~~~~~~~~
| printk_nmi_enter
>> arch/arm64/kernel/ipi_nmi.c:40:9: error: implicit declaration of function 'printk_safe_exit'; did you mean 'printk_nmi_exit'? [-Werror=implicit-function-declaration]
40 | printk_safe_exit();
| ^~~~~~~~~~~~~~~~
| printk_nmi_exit
cc1: some warnings being treated as errors
vim +38 arch/arm64/kernel/ipi_nmi.c
35
36 static void ipi_cpu_backtrace(void *info)
37 {
> 38 printk_safe_enter();
39 nmi_cpu_backtrace(get_irq_regs());
> 40 printk_safe_exit();
41 }
42
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
1
0
[openeuler:openEuler-1.0-LTS 20812/22089] include/linux/compiler.h:271:34: warning: array subscript <unknown> is outside array bounds of 'const u32[0]' {aka 'const unsigned int[]'}
by kernel test robot 14 Apr '24
by kernel test robot 14 Apr '24
14 Apr '24
tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS
head: ab9b23cd7b3e05b3fc38df24e070593493e1d8e2
commit: f26f5f07f639bba2e12d72fb1cac16f5d1d18efc [20812/22089] rfs: annotate lockless accesses to RFS sock flow table
config: x86_64-randconfig-102-20240413 (https://download.01.org/0day-ci/archive/20240414/202404141254.h8C8BQzT-lkp@…)
compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240414/202404141254.h8C8BQzT-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202404141254.h8C8BQzT-lkp@intel.com/
All warnings (new ones prefixed by >>):
net/core/dev.c:2287:49: warning: array subscript i is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=]
2287 | new_map->queues[i] = map->queues[i];
| ~~~~~~~~~~~^~~
include/linux/netdevice.h:770:13: note: while referencing 'queues'
770 | u16 queues[0];
| ^~~~~~
net/core/dev.c:2287:32: warning: array subscript i is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=]
2287 | new_map->queues[i] = map->queues[i];
| ~~~~~~~~~~~~~~~^~~
include/linux/netdevice.h:770:13: note: while referencing 'queues'
770 | u16 queues[0];
| ^~~~~~
In file included from net/core/dev.c:137:
In function 'cpu_rmap_lookup_index',
inlined from 'set_rps_cpu' at net/core/dev.c:3989:15:
include/linux/cpu_rmap.h:47:26: warning: array subscript <unknown> is outside array bounds of 'struct <anonymous>[0]' [-Warray-bounds=]
47 | return rmap->near[cpu].index;
| ~~~~~~~~~~^~~~~
include/linux/cpu_rmap.h: In function 'set_rps_cpu':
include/linux/cpu_rmap.h:34:25: note: while referencing 'near'
34 | } near[0];
| ^~~~
net/core/dev.c:4003:25: warning: array subscript flow_id is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=]
4003 | rflow = &flow_table->flows[flow_id];
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/netdevice.h:680:29: note: while referencing 'flows'
680 | struct rps_dev_flow flows[0];
| ^~~~~
net/core/dev.c:4003:43: warning: array subscript flow_id is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=]
4003 | rflow = &flow_table->flows[flow_id];
| ~~~~~~~~~~~~~~~~~^~~~~~~~~
include/linux/netdevice.h:680:29: note: while referencing 'flows'
680 | struct rps_dev_flow flows[0];
| ^~~~~
In file included from arch/x86/include/asm/current.h:5,
from include/linux/sched.h:12,
from include/linux/uaccess.h:5,
from net/core/dev.c:75:
net/core/dev.c: In function '__get_xps_queue_idx':
include/linux/compiler.h:271:34: warning: array subscript tci is outside array bounds of 'struct xps_map *[0]' [-Warray-bounds=]
271 | __read_once_size(&(x), __u.__c, sizeof(x)); \
| ^~~~
include/linux/compiler.h:277:22: note: in expansion of macro '__READ_ONCE'
277 | #define READ_ONCE(x) __READ_ONCE(x, 1)
| ^~~~~~~~~~~
include/linux/rcupdate.h:347:55: note: in expansion of macro 'READ_ONCE'
347 | typeof(*p) *________p1 = (typeof(*p) *__force)READ_ONCE(p); \
| ^~~~~~~~~
include/linux/rcupdate.h:502:9: note: in expansion of macro '__rcu_dereference_check'
502 | __rcu_dereference_check((p), (c) || rcu_read_lock_held(), __rcu)
| ^~~~~~~~~~~~~~~~~~~~~~~
include/linux/rcupdate.h:560:28: note: in expansion of macro 'rcu_dereference_check'
560 | #define rcu_dereference(p) rcu_dereference_check(p, 0)
| ^~~~~~~~~~~~~~~~~~~~~
net/core/dev.c:3618:15: note: in expansion of macro 'rcu_dereference'
3618 | map = rcu_dereference(dev_maps->attr_map[tci]);
| ^~~~~~~~~~~~~~~
include/linux/netdevice.h:781:31: note: while referencing 'attr_map'
781 | struct xps_map __rcu *attr_map[0]; /* Either CPUs map or RXQs map */
| ^~~~~~~~
net/core/dev.c:3623:50: warning: array subscript <unknown> is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=]
3623 | queue_index = map->queues[reciprocal_scale(
| ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~
3624 | skb_get_hash(skb), map->len)];
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/netdevice.h:770:13: note: while referencing 'queues'
770 | u16 queues[0];
| ^~~~~~
net/core/dev.c:3621:50: warning: array subscript 0 is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=]
3621 | queue_index = map->queues[0];
| ~~~~~~~~~~~^~~
include/linux/netdevice.h:770:13: note: while referencing 'queues'
770 | u16 queues[0];
| ^~~~~~
net/core/dev.c: In function 'rps_may_expire_flow':
net/core/dev.c:4144:25: warning: array subscript flow_id is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=]
4144 | rflow = &flow_table->flows[flow_id];
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/netdevice.h:680:29: note: while referencing 'flows'
680 | struct rps_dev_flow flows[0];
| ^~~~~
net/core/dev.c:4144:43: warning: array subscript flow_id is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=]
4144 | rflow = &flow_table->flows[flow_id];
| ~~~~~~~~~~~~~~~~~^~~~~~~~~
include/linux/netdevice.h:680:29: note: while referencing 'flows'
680 | struct rps_dev_flow flows[0];
| ^~~~~
net/core/dev.c:4144:43: warning: array subscript flow_id is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=]
4144 | rflow = &flow_table->flows[flow_id];
| ~~~~~~~~~~~~~~~~~^~~~~~~~~
include/linux/netdevice.h:680:29: note: while referencing 'flows'
680 | struct rps_dev_flow flows[0];
| ^~~~~
net/core/dev.c:4144:43: warning: array subscript flow_id is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=]
4144 | rflow = &flow_table->flows[flow_id];
| ~~~~~~~~~~~~~~~~~^~~~~~~~~
include/linux/netdevice.h:680:29: note: while referencing 'flows'
680 | struct rps_dev_flow flows[0];
| ^~~~~
net/core/dev.c: In function 'get_rps_cpu':
>> include/linux/compiler.h:271:34: warning: array subscript <unknown> is outside array bounds of 'const u32[0]' {aka 'const unsigned int[]'} [-Warray-bounds=]
271 | __read_once_size(&(x), __u.__c, sizeof(x)); \
| ^~~~
include/linux/compiler.h:277:22: note: in expansion of macro '__READ_ONCE'
277 | #define READ_ONCE(x) __READ_ONCE(x, 1)
| ^~~~~~~~~~~
net/core/dev.c:4067:25: note: in expansion of macro 'READ_ONCE'
4067 | ident = READ_ONCE(sock_flow_table->ents[hash & sock_flow_table->mask]);
| ^~~~~~~~~
include/linux/netdevice.h:698:17: note: while referencing 'ents'
698 | u32 ents[0] ____cacheline_aligned_in_smp;
| ^~~~
net/core/dev.c:4067:56: warning: array subscript <unknown> is outside array bounds of 'const u32[0]' {aka 'const unsigned int[]'} [-Warray-bounds=]
4067 | ident = READ_ONCE(sock_flow_table->ents[hash & sock_flow_table->mask]);
include/linux/compiler.h:271:36: note: in definition of macro '__READ_ONCE'
271 | __read_once_size(&(x), __u.__c, sizeof(x)); \
| ^
net/core/dev.c:4067:25: note: in expansion of macro 'READ_ONCE'
4067 | ident = READ_ONCE(sock_flow_table->ents[hash & sock_flow_table->mask]);
| ^~~~~~~~~
include/linux/netdevice.h:698:17: note: while referencing 'ents'
698 | u32 ents[0] ____cacheline_aligned_in_smp;
| ^~~~
net/core/dev.c:4076:25: warning: array subscript <unknown> is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=]
4076 | rflow = &flow_table->flows[hash & flow_table->mask];
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/netdevice.h:680:29: note: while referencing 'flows'
680 | struct rps_dev_flow flows[0];
| ^~~~~
net/core/dev.c:4076:43: warning: array subscript <unknown> is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=]
4076 | rflow = &flow_table->flows[hash & flow_table->mask];
| ~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/netdevice.h:680:29: note: while referencing 'flows'
680 | struct rps_dev_flow flows[0];
| ^~~~~
net/core/dev.c:4076:43: warning: array subscript <unknown> is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=]
4076 | rflow = &flow_table->flows[hash & flow_table->mask];
| ~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/netdevice.h:680:29: note: while referencing 'flows'
680 | struct rps_dev_flow flows[0];
| ^~~~~
net/core/dev.c:4108:33: warning: array subscript <unknown> is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=]
4108 | tcpu = map->cpus[reciprocal_scale(hash, map->len)];
| ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/netdevice.h:658:13: note: while referencing 'cpus'
658 | u16 cpus[0];
| ^~~~
In file included from include/linux/rculist.h:11,
from include/linux/pid.h:5,
from include/linux/sched.h:14:
net/core/dev.c: In function 'remove_xps_queue':
include/linux/rcupdate.h:356:10: warning: array subscript tci is outside array bounds of 'struct xps_map *[0]' [-Warray-bounds=]
356 | ((typeof(*p) __force __kernel *)(p)); \
| ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/rcupdate.h:551:9: note: in expansion of macro '__rcu_dereference_protected'
551 | __rcu_dereference_protected((p), (c), __rcu)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
net/core/dev.c:2123:9: note: in expansion of macro 'rcu_dereference_protected'
2123 | rcu_dereference_protected((P), lockdep_is_held(&xps_map_mutex))
| ^~~~~~~~~~~~~~~~~~~~~~~~~
net/core/dev.c:2132:23: note: in expansion of macro 'xmap_dereference'
2132 | map = xmap_dereference(dev_maps->attr_map[tci]);
| ^~~~~~~~~~~~~~~~
include/linux/netdevice.h:781:31: note: while referencing 'attr_map'
781 | struct xps_map __rcu *attr_map[0]; /* Either CPUs map or RXQs map */
| ^~~~~~~~
net/core/dev.c:2137:32: warning: array subscript pos is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=]
2137 | if (map->queues[pos] != index)
| ~~~~~~~~~~~^~~~~
include/linux/netdevice.h:770:13: note: while referencing 'queues'
770 | u16 queues[0];
| ^~~~~~
net/core/dev.c:2141:55: warning: array subscript <unknown> is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=]
2141 | map->queues[pos] = map->queues[--map->len];
| ~~~~~~~~~~~^~~~~~~~~~~~
include/linux/netdevice.h:770:13: note: while referencing 'queues'
770 | u16 queues[0];
| ^~~~~~
net/core/dev.c:2141:36: warning: array subscript pos is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=]
2141 | map->queues[pos] = map->queues[--map->len];
| ~~~~~~~~~~~^~~~~
include/linux/netdevice.h:770:13: note: while referencing 'queues'
770 | u16 queues[0];
| ^~~~~~
net/core/dev.c: In function '__netif_set_xps_queue':
include/linux/rcupdate.h:356:10: warning: array subscript tci is outside array bounds of 'struct xps_map *[0]' [-Warray-bounds=]
356 | ((typeof(*p) __force __kernel *)(p)); \
| ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/rcupdate.h:551:9: note: in expansion of macro '__rcu_dereference_protected'
551 | __rcu_dereference_protected((p), (c), __rcu)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
net/core/dev.c:2123:9: note: in expansion of macro 'rcu_dereference_protected'
2123 | rcu_dereference_protected((P), lockdep_is_held(&xps_map_mutex))
| ^~~~~~~~~~~~~~~~~~~~~~~~~
net/core/dev.c:2430:35: note: in expansion of macro 'xmap_dereference'
2430 | new_map = xmap_dereference(new_dev_maps->attr_map[tci]);
| ^~~~~~~~~~~~~~~~
include/linux/netdevice.h:781:31: note: while referencing 'attr_map'
781 | struct xps_map __rcu *attr_map[0]; /* Either CPUs map or RXQs map */
| ^~~~~~~~
include/linux/rcupdate.h:356:10: warning: array subscript tci is outside array bounds of 'struct xps_map *[0]' [-Warray-bounds=]
--
In file included from arch/x86/include/asm/atomic.h:5,
from include/linux/atomic.h:7,
from include/linux/crypto.h:20,
from include/crypto/hash.h:16,
from net/ipv4/tcp.c:250:
In function 'rps_record_sock_flow',
inlined from 'sock_rps_record_flow_hash' at include/net/sock.h:1002:2,
inlined from 'sock_rps_record_flow' at include/net/sock.h:1025:4,
inlined from 'tcp_splice_read' at net/ipv4/tcp.c:803:2:
>> include/linux/compiler.h:271:34: warning: array subscript index is outside array bounds of 'u32[0]' {aka 'unsigned int[]'} [-Warray-bounds=]
271 | __read_once_size(&(x), __u.__c, sizeof(x)); \
| ^~~~
include/linux/compiler.h:277:22: note: in expansion of macro '__READ_ONCE'
277 | #define READ_ONCE(x) __READ_ONCE(x, 1)
| ^~~~~~~~~~~
include/linux/netdevice.h:720:21: note: in expansion of macro 'READ_ONCE'
720 | if (READ_ONCE(table->ents[index]) != val)
| ^~~~~~~~~
In file included from include/net/inet_sock.h:23,
from include/net/ip.h:31,
from include/linux/errqueue.h:6,
from net/ipv4/tcp.c:272:
include/linux/netdevice.h: In function 'tcp_splice_read':
include/linux/netdevice.h:698:17: note: while referencing 'ents'
698 | u32 ents[0] ____cacheline_aligned_in_smp;
| ^~~~
In function 'rps_record_sock_flow',
inlined from 'sock_rps_record_flow_hash' at include/net/sock.h:1002:2,
inlined from 'sock_rps_record_flow' at include/net/sock.h:1025:4,
inlined from 'tcp_splice_read' at net/ipv4/tcp.c:803:2:
include/linux/netdevice.h:720:42: warning: array subscript index is outside array bounds of 'u32[0]' {aka 'unsigned int[]'} [-Warray-bounds=]
720 | if (READ_ONCE(table->ents[index]) != val)
include/linux/compiler.h:271:36: note: in definition of macro '__READ_ONCE'
271 | __read_once_size(&(x), __u.__c, sizeof(x)); \
| ^
include/linux/netdevice.h:720:21: note: in expansion of macro 'READ_ONCE'
720 | if (READ_ONCE(table->ents[index]) != val)
| ^~~~~~~~~
include/linux/netdevice.h: In function 'tcp_splice_read':
include/linux/netdevice.h:698:17: note: while referencing 'ents'
698 | u32 ents[0] ____cacheline_aligned_in_smp;
| ^~~~
In function 'rps_record_sock_flow',
inlined from 'sock_rps_record_flow_hash' at include/net/sock.h:1002:2,
inlined from 'sock_rps_record_flow' at include/net/sock.h:1025:4,
inlined from 'tcp_splice_read' at net/ipv4/tcp.c:803:2:
include/linux/netdevice.h:721:47: warning: array subscript index is outside array bounds of 'u32[0]' {aka 'unsigned int[]'} [-Warray-bounds=]
721 | WRITE_ONCE(table->ents[index], val);
include/linux/compiler.h:296:29: note: in definition of macro 'WRITE_ONCE'
296 | __write_once_size(&(x), __u.__c, sizeof(x)); \
| ^
include/linux/netdevice.h: In function 'tcp_splice_read':
include/linux/netdevice.h:698:17: note: while referencing 'ents'
698 | u32 ents[0] ____cacheline_aligned_in_smp;
| ^~~~
In function 'rps_record_sock_flow',
inlined from 'sock_rps_record_flow_hash' at include/net/sock.h:1002:2,
inlined from 'sock_rps_record_flow' at include/net/sock.h:1025:4,
inlined from 'tcp_zerocopy_receive' at net/ipv4/tcp.c:1791:2:
>> include/linux/compiler.h:271:34: warning: array subscript index is outside array bounds of 'u32[0]' {aka 'unsigned int[]'} [-Warray-bounds=]
271 | __read_once_size(&(x), __u.__c, sizeof(x)); \
| ^~~~
include/linux/compiler.h:277:22: note: in expansion of macro '__READ_ONCE'
277 | #define READ_ONCE(x) __READ_ONCE(x, 1)
| ^~~~~~~~~~~
include/linux/netdevice.h:720:21: note: in expansion of macro 'READ_ONCE'
720 | if (READ_ONCE(table->ents[index]) != val)
| ^~~~~~~~~
include/linux/netdevice.h: In function 'tcp_zerocopy_receive':
include/linux/netdevice.h:698:17: note: while referencing 'ents'
698 | u32 ents[0] ____cacheline_aligned_in_smp;
| ^~~~
In function 'rps_record_sock_flow',
inlined from 'sock_rps_record_flow_hash' at include/net/sock.h:1002:2,
inlined from 'sock_rps_record_flow' at include/net/sock.h:1025:4,
inlined from 'tcp_zerocopy_receive' at net/ipv4/tcp.c:1791:2:
include/linux/netdevice.h:720:42: warning: array subscript index is outside array bounds of 'u32[0]' {aka 'unsigned int[]'} [-Warray-bounds=]
720 | if (READ_ONCE(table->ents[index]) != val)
include/linux/compiler.h:271:36: note: in definition of macro '__READ_ONCE'
271 | __read_once_size(&(x), __u.__c, sizeof(x)); \
| ^
include/linux/netdevice.h:720:21: note: in expansion of macro 'READ_ONCE'
720 | if (READ_ONCE(table->ents[index]) != val)
| ^~~~~~~~~
include/linux/netdevice.h: In function 'tcp_zerocopy_receive':
include/linux/netdevice.h:698:17: note: while referencing 'ents'
698 | u32 ents[0] ____cacheline_aligned_in_smp;
| ^~~~
In function 'rps_record_sock_flow',
inlined from 'sock_rps_record_flow_hash' at include/net/sock.h:1002:2,
inlined from 'sock_rps_record_flow' at include/net/sock.h:1025:4,
inlined from 'tcp_zerocopy_receive' at net/ipv4/tcp.c:1791:2:
include/linux/netdevice.h:721:47: warning: array subscript index is outside array bounds of 'u32[0]' {aka 'unsigned int[]'} [-Warray-bounds=]
721 | WRITE_ONCE(table->ents[index], val);
include/linux/compiler.h:296:29: note: in definition of macro 'WRITE_ONCE'
296 | __write_once_size(&(x), __u.__c, sizeof(x)); \
| ^
include/linux/netdevice.h: In function 'tcp_zerocopy_receive':
include/linux/netdevice.h:698:17: note: while referencing 'ents'
698 | u32 ents[0] ____cacheline_aligned_in_smp;
| ^~~~
..
vim +271 include/linux/compiler.h
230fa253df6352 Christian Borntraeger 2014-11-25 266
d976441f44bc5d Andrey Ryabinin 2015-10-19 267 #define __READ_ONCE(x, check) \
d976441f44bc5d Andrey Ryabinin 2015-10-19 268 ({ \
d976441f44bc5d Andrey Ryabinin 2015-10-19 269 union { typeof(x) __val; char __c[1]; } __u; \
d976441f44bc5d Andrey Ryabinin 2015-10-19 270 if (check) \
d976441f44bc5d Andrey Ryabinin 2015-10-19 @271 __read_once_size(&(x), __u.__c, sizeof(x)); \
d976441f44bc5d Andrey Ryabinin 2015-10-19 272 else \
d976441f44bc5d Andrey Ryabinin 2015-10-19 273 __read_once_size_nocheck(&(x), __u.__c, sizeof(x)); \
76ebbe78f7390a Will Deacon 2017-10-24 274 smp_read_barrier_depends(); /* Enforce dependency ordering from x */ \
d976441f44bc5d Andrey Ryabinin 2015-10-19 275 __u.__val; \
d976441f44bc5d Andrey Ryabinin 2015-10-19 276 })
d976441f44bc5d Andrey Ryabinin 2015-10-19 277 #define READ_ONCE(x) __READ_ONCE(x, 1)
d976441f44bc5d Andrey Ryabinin 2015-10-19 278
:::::: The code at line 271 was first introduced by commit
:::::: d976441f44bc5d48635d081d277aa76556ffbf8b compiler, atomics, kasan: Provide READ_ONCE_NOCHECK()
:::::: TO: Andrey Ryabinin <aryabinin(a)virtuozzo.com>
:::::: CC: Ingo Molnar <mingo(a)kernel.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
1
0
[PATCH openEuler-1.0-LTS] netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
by Zhengchao Shao 14 Apr '24
by Zhengchao Shao 14 Apr '24
14 Apr '24
From: Ryosuke Yasuoka <ryasuoka(a)redhat.com>
stable inclusion
from stable-v4.19.309
commit ec343a55b687a452f5e87f3b52bf9f155864df65
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E46W
CVE: CVE-2024-26805
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 661779e1fcafe1b74b3f3fe8e980c1e207fea1fd ]
syzbot reported the following uninit-value access issue [1]:
netlink_to_full_skb() creates a new `skb` and puts the `skb->data`
passed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data
size is specified as `len` and passed to skb_put_data(). This `len`
is based on `skb->end` that is not data offset but buffer offset. The
`skb->end` contains data and tailroom. Since the tailroom is not
initialized when the new `skb` created, KMSAN detects uninitialized
memory area when copying the data.
This patch resolved this issue by correct the len from `skb->end` to
`skb->len`, which is the actual data offset.
BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline]
BUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:29 [inline]
BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline]
BUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186
instrument_copy_to_user include/linux/instrumented.h:114 [inline]
copy_to_user_iter lib/iov_iter.c:24 [inline]
iterate_ubuf include/linux/iov_iter.h:29 [inline]
iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
iterate_and_advance include/linux/iov_iter.h:271 [inline]
_copy_to_iter+0x364/0x2520 lib/iov_iter.c:186
copy_to_iter include/linux/uio.h:197 [inline]
simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532
__skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420
skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546
skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline]
packet_recvmsg+0xd9c/0x2000 net/packet/af_packet.c:3482
sock_recvmsg_nosec net/socket.c:1044 [inline]
sock_recvmsg net/socket.c:1066 [inline]
sock_read_iter+0x467/0x580 net/socket.c:1136
call_read_iter include/linux/fs.h:2014 [inline]
new_sync_read fs/read_write.c:389 [inline]
vfs_read+0x8f6/0xe00 fs/read_write.c:470
ksys_read+0x20f/0x4c0 fs/read_write.c:613
__do_sys_read fs/read_write.c:623 [inline]
__se_sys_read fs/read_write.c:621 [inline]
__x64_sys_read+0x93/0xd0 fs/read_write.c:621
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was stored to memory at:
skb_put_data include/linux/skbuff.h:2622 [inline]
netlink_to_full_skb net/netlink/af_netlink.c:181 [inline]
__netlink_deliver_tap_skb net/netlink/af_netlink.c:298 [inline]
__netlink_deliver_tap+0x5be/0xc90 net/netlink/af_netlink.c:325
netlink_deliver_tap net/netlink/af_netlink.c:338 [inline]
netlink_deliver_tap_kernel net/netlink/af_netlink.c:347 [inline]
netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
netlink_unicast+0x10f1/0x1250 net/netlink/af_netlink.c:1368
netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
__sys_sendmsg net/socket.c:2667 [inline]
__do_sys_sendmsg net/socket.c:2676 [inline]
__se_sys_sendmsg net/socket.c:2674 [inline]
__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was created at:
free_pages_prepare mm/page_alloc.c:1087 [inline]
free_unref_page_prepare+0xb0/0xa40 mm/page_alloc.c:2347
free_unref_page_list+0xeb/0x1100 mm/page_alloc.c:2533
release_pages+0x23d3/0x2410 mm/swap.c:1042
free_pages_and_swap_cache+0xd9/0xf0 mm/swap_state.c:316
tlb_batch_pages_flush mm/mmu_gather.c:98 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:293 [inline]
tlb_flush_mmu+0x6f5/0x980 mm/mmu_gather.c:300
tlb_finish_mmu+0x101/0x260 mm/mmu_gather.c:392
exit_mmap+0x49e/0xd30 mm/mmap.c:3321
__mmput+0x13f/0x530 kernel/fork.c:1349
mmput+0x8a/0xa0 kernel/fork.c:1371
exit_mm+0x1b8/0x360 kernel/exit.c:567
do_exit+0xd57/0x4080 kernel/exit.c:858
do_group_exit+0x2fd/0x390 kernel/exit.c:1021
__do_sys_exit_group kernel/exit.c:1032 [inline]
__se_sys_exit_group kernel/exit.c:1030 [inline]
__x64_sys_exit_group+0x3c/0x50 kernel/exit.c:1030
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Bytes 3852-3903 of 3904 are uninitialized
Memory access of size 3904 starts at ffff88812ea1e000
Data copied to user address 0000000020003280
CPU: 1 PID: 5043 Comm: syz-executor297 Not tainted 6.7.0-rc5-syzkaller-00047-g5bd7ef53ffe5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
Fixes: 1853c9496460 ("netlink, mmap: transform mmap skb into full skb on taps")
Reported-and-tested-by: syzbot+34ad5fab48f7bf510349(a)syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=34ad5fab48f7bf510349 [1]
Signed-off-by: Ryosuke Yasuoka <ryasuoka(a)redhat.com>
Reviewed-by: Eric Dumazet <edumazet(a)google.com>
Link: https://lore.kernel.org/r/20240221074053.1794118-1-ryasuoka@redhat.com
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com>
---
net/netlink/af_netlink.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index fd0fa4c37a3b..766096493494 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -160,7 +160,7 @@ static inline u32 netlink_group_mask(u32 group)
static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb,
gfp_t gfp_mask)
{
- unsigned int len = skb_end_offset(skb);
+ unsigned int len = skb->len;
struct sk_buff *new;
new = alloc_skb(len, gfp_mask);
--
2.34.1
2
1
[PATCH OLK-5.10] netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
by Zhengchao Shao 14 Apr '24
by Zhengchao Shao 14 Apr '24
14 Apr '24
From: Ryosuke Yasuoka <ryasuoka(a)redhat.com>
stable inclusion
from stable-v5.10.212
commit f19d1f98e60e68b11fc60839105dd02a30ec0d77
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E46W
CVE: CVE-2024-26805
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 661779e1fcafe1b74b3f3fe8e980c1e207fea1fd ]
syzbot reported the following uninit-value access issue [1]:
netlink_to_full_skb() creates a new `skb` and puts the `skb->data`
passed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data
size is specified as `len` and passed to skb_put_data(). This `len`
is based on `skb->end` that is not data offset but buffer offset. The
`skb->end` contains data and tailroom. Since the tailroom is not
initialized when the new `skb` created, KMSAN detects uninitialized
memory area when copying the data.
This patch resolved this issue by correct the len from `skb->end` to
`skb->len`, which is the actual data offset.
BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline]
BUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:29 [inline]
BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline]
BUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186
instrument_copy_to_user include/linux/instrumented.h:114 [inline]
copy_to_user_iter lib/iov_iter.c:24 [inline]
iterate_ubuf include/linux/iov_iter.h:29 [inline]
iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
iterate_and_advance include/linux/iov_iter.h:271 [inline]
_copy_to_iter+0x364/0x2520 lib/iov_iter.c:186
copy_to_iter include/linux/uio.h:197 [inline]
simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532
__skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420
skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546
skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline]
packet_recvmsg+0xd9c/0x2000 net/packet/af_packet.c:3482
sock_recvmsg_nosec net/socket.c:1044 [inline]
sock_recvmsg net/socket.c:1066 [inline]
sock_read_iter+0x467/0x580 net/socket.c:1136
call_read_iter include/linux/fs.h:2014 [inline]
new_sync_read fs/read_write.c:389 [inline]
vfs_read+0x8f6/0xe00 fs/read_write.c:470
ksys_read+0x20f/0x4c0 fs/read_write.c:613
__do_sys_read fs/read_write.c:623 [inline]
__se_sys_read fs/read_write.c:621 [inline]
__x64_sys_read+0x93/0xd0 fs/read_write.c:621
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was stored to memory at:
skb_put_data include/linux/skbuff.h:2622 [inline]
netlink_to_full_skb net/netlink/af_netlink.c:181 [inline]
__netlink_deliver_tap_skb net/netlink/af_netlink.c:298 [inline]
__netlink_deliver_tap+0x5be/0xc90 net/netlink/af_netlink.c:325
netlink_deliver_tap net/netlink/af_netlink.c:338 [inline]
netlink_deliver_tap_kernel net/netlink/af_netlink.c:347 [inline]
netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
netlink_unicast+0x10f1/0x1250 net/netlink/af_netlink.c:1368
netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
__sys_sendmsg net/socket.c:2667 [inline]
__do_sys_sendmsg net/socket.c:2676 [inline]
__se_sys_sendmsg net/socket.c:2674 [inline]
__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was created at:
free_pages_prepare mm/page_alloc.c:1087 [inline]
free_unref_page_prepare+0xb0/0xa40 mm/page_alloc.c:2347
free_unref_page_list+0xeb/0x1100 mm/page_alloc.c:2533
release_pages+0x23d3/0x2410 mm/swap.c:1042
free_pages_and_swap_cache+0xd9/0xf0 mm/swap_state.c:316
tlb_batch_pages_flush mm/mmu_gather.c:98 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:293 [inline]
tlb_flush_mmu+0x6f5/0x980 mm/mmu_gather.c:300
tlb_finish_mmu+0x101/0x260 mm/mmu_gather.c:392
exit_mmap+0x49e/0xd30 mm/mmap.c:3321
__mmput+0x13f/0x530 kernel/fork.c:1349
mmput+0x8a/0xa0 kernel/fork.c:1371
exit_mm+0x1b8/0x360 kernel/exit.c:567
do_exit+0xd57/0x4080 kernel/exit.c:858
do_group_exit+0x2fd/0x390 kernel/exit.c:1021
__do_sys_exit_group kernel/exit.c:1032 [inline]
__se_sys_exit_group kernel/exit.c:1030 [inline]
__x64_sys_exit_group+0x3c/0x50 kernel/exit.c:1030
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Bytes 3852-3903 of 3904 are uninitialized
Memory access of size 3904 starts at ffff88812ea1e000
Data copied to user address 0000000020003280
CPU: 1 PID: 5043 Comm: syz-executor297 Not tainted 6.7.0-rc5-syzkaller-00047-g5bd7ef53ffe5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
Fixes: 1853c9496460 ("netlink, mmap: transform mmap skb into full skb on taps")
Reported-and-tested-by: syzbot+34ad5fab48f7bf510349(a)syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=34ad5fab48f7bf510349 [1]
Signed-off-by: Ryosuke Yasuoka <ryasuoka(a)redhat.com>
Reviewed-by: Eric Dumazet <edumazet(a)google.com>
Link: https://lore.kernel.org/r/20240221074053.1794118-1-ryasuoka@redhat.com
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com>
---
net/netlink/af_netlink.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index e3f34dccc97a..b1e2d3fa522e 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -157,7 +157,7 @@ static inline u32 netlink_group_mask(u32 group)
static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb,
gfp_t gfp_mask)
{
- unsigned int len = skb_end_offset(skb);
+ unsigned int len = skb->len;
struct sk_buff *new;
new = alloc_skb(len, gfp_mask);
--
2.34.1
2
1
[PATCH OLK-5.10] netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
by Zhengchao Shao 14 Apr '24
by Zhengchao Shao 14 Apr '24
14 Apr '24
From: Pablo Neira Ayuso <pablo(a)netfilter.org>
stable inclusion
from stable-v5.10.210
commit 9489e214ea8f2a90345516016aa51f2db3a8cc2f
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E49K
CVE: CVE-2024-26808
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit 01acb2e8666a6529697141a6017edbf206921913 upstream.
Remove netdevice from inet/ingress basechain in case NETDEV_UNREGISTER
event is reported, otherwise a stale reference to netdevice remains in
the hook list.
Fixes: 60a3815da702 ("netfilter: add inet ingress support")
Cc: stable(a)vger.kernel.org
Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com>
---
net/netfilter/nft_chain_filter.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nft_chain_filter.c b/net/netfilter/nft_chain_filter.c
index 7a9aa57b195b..a18582a4ecf3 100644
--- a/net/netfilter/nft_chain_filter.c
+++ b/net/netfilter/nft_chain_filter.c
@@ -358,9 +358,10 @@ static int nf_tables_netdev_event(struct notifier_block *this,
unsigned long event, void *ptr)
{
struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+ struct nft_base_chain *basechain;
struct nftables_pernet *nft_net;
- struct nft_table *table;
struct nft_chain *chain, *nr;
+ struct nft_table *table;
struct nft_ctx ctx = {
.net = dev_net(dev),
};
@@ -372,7 +373,8 @@ static int nf_tables_netdev_event(struct notifier_block *this,
nft_net = net_generic(ctx.net, nf_tables_net_id);
mutex_lock(&nft_net->commit_mutex);
list_for_each_entry(table, &nft_net->tables, list) {
- if (table->family != NFPROTO_NETDEV)
+ if (table->family != NFPROTO_NETDEV &&
+ table->family != NFPROTO_INET)
continue;
ctx.family = table->family;
@@ -381,6 +383,11 @@ static int nf_tables_netdev_event(struct notifier_block *this,
if (!nft_is_base_chain(chain))
continue;
+ basechain = nft_base_chain(chain);
+ if (table->family == NFPROTO_INET &&
+ basechain->ops.hooknum != NF_INET_INGRESS)
+ continue;
+
ctx.chain = chain;
nft_netdev_event(event, dev, &ctx);
}
--
2.34.1
2
1
[openeuler:openEuler-1.0-LTS 2211/22089] mm/swapfile.c:970:81: warning: array subscript pfo_ret__ is outside array bounds of 'struct plist_node[0]'
by kernel test robot 14 Apr '24
by kernel test robot 14 Apr '24
14 Apr '24
tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS
head: ab9b23cd7b3e05b3fc38df24e070593493e1d8e2
commit: 08c9196f65d268e1f8dccde138d4644c427bde76 [2211/22089] mm/swap: use nr_node_ids for avail_lists in swap_info_struct
config: x86_64-randconfig-102-20240413 (https://download.01.org/0day-ci/archive/20240414/202404140751.A9FJ6Yan-lkp@…)
compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240414/202404140751.A9FJ6Yan-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202404140751.A9FJ6Yan-lkp@intel.com/
All warnings (new ones prefixed by >>):
mm/swapfile.c: In function '__del_from_avail_list':
mm/swapfile.c:615:17: warning: array subscript nid is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=]
615 | plist_del(&p->avail_lists[nid], &swap_avail_heads[nid]);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from mm/swapfile.c:15:
include/linux/swap.h:275:27: note: while referencing 'avail_lists'
275 | struct plist_node avail_lists[0]; /*
| ^~~~~~~~~~~
In file included from arch/x86/include/asm/bug.h:83,
from include/linux/bug.h:5,
from include/linux/mmdebug.h:5,
from include/linux/mm.h:9,
from mm/swapfile.c:8:
mm/swapfile.c: In function 'add_to_avail_list':
mm/swapfile.c:648:43: warning: array subscript nid is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=]
648 | WARN_ON(!plist_node_empty(&p->avail_lists[nid]));
| ^~~~~~~~~~~~~~~~~~~~
include/asm-generic/bug.h:122:32: note: in definition of macro 'WARN_ON'
122 | int __ret_warn_on = !!(condition); \
| ^~~~~~~~~
include/linux/swap.h:275:27: note: while referencing 'avail_lists'
275 | struct plist_node avail_lists[0]; /*
| ^~~~~~~~~~~
In file included from include/linux/sched.h:19,
from include/linux/ioprio.h:5,
from include/linux/fs.h:39,
from include/linux/huge_mm.h:8,
from include/linux/mm.h:499:
In function 'plist_node_empty',
inlined from 'add_to_avail_list' at mm/swapfile.c:648:3:
include/linux/plist.h:223:16: warning: array subscript nid is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=]
223 | return list_empty(&node->node_list);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/swap.h: In function 'add_to_avail_list':
include/linux/swap.h:275:27: note: while referencing 'avail_lists'
275 | struct plist_node avail_lists[0]; /*
| ^~~~~~~~~~~
mm/swapfile.c: In function '_enable_swap_info':
mm/swapfile.c:2460:47: warning: array subscript i is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=]
2460 | p->avail_lists[i].prio = -p->prio;
| ~~~~~~~~~~~~~~^~~
include/linux/swap.h:275:27: note: while referencing 'avail_lists'
275 | struct plist_node avail_lists[0]; /*
| ^~~~~~~~~~~
mm/swapfile.c:2458:47: warning: array subscript i is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=]
2458 | p->avail_lists[i].prio = 1;
| ~~~~~~~~~~~~~~^~~
include/linux/swap.h:275:27: note: while referencing 'avail_lists'
275 | struct plist_node avail_lists[0]; /*
| ^~~~~~~~~~~
mm/swapfile.c:2455:39: warning: array subscript i is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=]
2455 | p->avail_lists[i].prio = -p->prio;
| ~~~~~~~~~~~~~~^~~
include/linux/swap.h:275:27: note: while referencing 'avail_lists'
275 | struct plist_node avail_lists[0]; /*
| ^~~~~~~~~~~
mm/swapfile.c: In function 'alloc_swap_info':
mm/swapfile.c:2860:17: warning: array subscript i is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=]
2860 | plist_node_init(&p->avail_lists[i], 0);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/swap.h:275:27: note: while referencing 'avail_lists'
275 | struct plist_node avail_lists[0]; /*
| ^~~~~~~~~~~
mm/swapfile.c:2860:48: warning: array subscript i is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=]
2860 | plist_node_init(&p->avail_lists[i], 0);
| ~~~~~~~~~~~~~~^~~
include/linux/swap.h:275:27: note: while referencing 'avail_lists'
275 | struct plist_node avail_lists[0]; /*
| ^~~~~~~~~~~
In function 'plist_node_init',
inlined from 'alloc_swap_info' at mm/swapfile.c:2860:3:
include/linux/plist.h:137:9: warning: array subscript i is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=]
137 | INIT_LIST_HEAD(&node->prio_list);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/swap.h: In function 'alloc_swap_info':
include/linux/swap.h:275:27: note: while referencing 'avail_lists'
275 | struct plist_node avail_lists[0]; /*
| ^~~~~~~~~~~
In function 'plist_node_init',
inlined from 'alloc_swap_info' at mm/swapfile.c:2860:3:
include/linux/plist.h:138:9: warning: array subscript i is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=]
138 | INIT_LIST_HEAD(&node->node_list);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/swap.h: In function 'alloc_swap_info':
include/linux/swap.h:275:27: note: while referencing 'avail_lists'
275 | struct plist_node avail_lists[0]; /*
| ^~~~~~~~~~~
In file included from include/asm-generic/bug.h:18:
mm/swapfile.c: In function 'get_swap_pages':
>> mm/swapfile.c:970:81: warning: array subscript pfo_ret__ is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=]
970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) {
include/linux/kernel.h:996:33: note: in definition of macro 'container_of'
996 | void *__mptr = (void *)(ptr); \
| ^~~
include/linux/list.h:440:9: note: in expansion of macro 'list_entry'
440 | list_entry((pos)->member.next, typeof(*(pos)), member)
| ^~~~~~~~~~
include/linux/list.h:582:21: note: in expansion of macro 'list_next_entry'
582 | n = list_next_entry(pos, member); \
| ^~~~~~~~~~~~~~~
include/linux/plist.h:206:9: note: in expansion of macro 'list_for_each_entry_safe'
206 | list_for_each_entry_safe(pos, n, &(head)->node_list, m.node_list)
| ^~~~~~~~~~~~~~~~~~~~~~~~
mm/swapfile.c:970:9: note: in expansion of macro 'plist_for_each_entry_safe'
970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) {
| ^~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/swap.h:275:27: note: while referencing 'avail_lists'
275 | struct plist_node avail_lists[0]; /*
| ^~~~~~~~~~~
In file included from include/linux/preempt.h:11,
from include/linux/spinlock.h:51,
from include/linux/mmzone.h:8,
from include/linux/gfp.h:6,
from include/linux/mm.h:10:
>> include/linux/list.h:583:14: warning: array subscript pfo_ret__ is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=]
583 | &pos->member != (head); \
include/linux/plist.h:206:9: note: in expansion of macro 'list_for_each_entry_safe'
206 | list_for_each_entry_safe(pos, n, &(head)->node_list, m.node_list)
| ^~~~~~~~~~~~~~~~~~~~~~~~
mm/swapfile.c:970:9: note: in expansion of macro 'plist_for_each_entry_safe'
970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) {
| ^~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/swap.h:275:27: note: while referencing 'avail_lists'
275 | struct plist_node avail_lists[0]; /*
| ^~~~~~~~~~~
mm/swapfile.c:972:17: warning: array subscript pfo_ret__ is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=]
972 | plist_requeue(&si->avail_lists[node], &swap_avail_heads[node]);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/swap.h:275:27: note: while referencing 'avail_lists'
275 | struct plist_node avail_lists[0]; /*
| ^~~~~~~~~~~
mm/swapfile.c:1016:38: warning: array subscript pfo_ret__ is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=]
1016 | if (plist_node_empty(&next->avail_lists[node]))
| ^~~~~~~~~~~~~~~~~~~~~~~~
include/linux/swap.h:275:27: note: while referencing 'avail_lists'
275 | struct plist_node avail_lists[0]; /*
| ^~~~~~~~~~~
In function 'plist_node_empty',
inlined from 'get_swap_pages' at mm/swapfile.c:1016:7:
>> include/linux/plist.h:223:16: warning: array subscript pfo_ret__ is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=]
223 | return list_empty(&node->node_list);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/swap.h: In function 'get_swap_pages':
include/linux/swap.h:275:27: note: while referencing 'avail_lists'
275 | struct plist_node avail_lists[0]; /*
| ^~~~~~~~~~~
>> mm/swapfile.c:970:81: warning: array subscript pfo_ret__ is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=]
970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) {
include/linux/kernel.h:996:33: note: in definition of macro 'container_of'
996 | void *__mptr = (void *)(ptr); \
| ^~~
include/linux/list.h:440:9: note: in expansion of macro 'list_entry'
440 | list_entry((pos)->member.next, typeof(*(pos)), member)
| ^~~~~~~~~~
include/linux/list.h:584:27: note: in expansion of macro 'list_next_entry'
584 | pos = n, n = list_next_entry(n, member))
| ^~~~~~~~~~~~~~~
include/linux/plist.h:206:9: note: in expansion of macro 'list_for_each_entry_safe'
206 | list_for_each_entry_safe(pos, n, &(head)->node_list, m.node_list)
| ^~~~~~~~~~~~~~~~~~~~~~~~
mm/swapfile.c:970:9: note: in expansion of macro 'plist_for_each_entry_safe'
970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) {
| ^~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/swap.h:275:27: note: while referencing 'avail_lists'
275 | struct plist_node avail_lists[0]; /*
| ^~~~~~~~~~~
In function '__do_sys_swapoff',
inlined from '__se_sys_swapoff' at mm/swapfile.c:2517:1:
mm/swapfile.c:2576:52: warning: array subscript nid is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=]
2576 | if (si->avail_lists[nid].prio != 1)
| ~~~~~~~~~~~~~~~^~~~~
include/linux/swap.h: In function '__se_sys_swapoff':
include/linux/swap.h:275:27: note: while referencing 'avail_lists'
275 | struct plist_node avail_lists[0]; /*
| ^~~~~~~~~~~
In function '__do_sys_swapoff',
inlined from '__se_sys_swapoff' at mm/swapfile.c:2517:1:
mm/swapfile.c:2577:56: warning: array subscript nid is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=]
2577 | si->avail_lists[nid].prio--;
| ~~~~~~~~~~~~~~~^~~~~
include/linux/swap.h: In function '__se_sys_swapoff':
include/linux/swap.h:275:27: note: while referencing 'avail_lists'
275 | struct plist_node avail_lists[0]; /*
| ^~~~~~~~~~~
mm/swapfile.o: warning: objtool: __swap_info_get()+0x97: sibling call from callable instruction with modified stack frame
mm/swapfile.o: warning: objtool: _swap_info_get()+0xe4: sibling call from callable instruction with modified stack frame
mm/swapfile.o: warning: objtool: __swap_duplicate()+0x92: sibling call from callable instruction with modified stack frame
mm/swapfile.o: warning: objtool: unuse_vma()+0xfe: sibling call from callable instruction with modified stack frame
mm/swapfile.o: warning: objtool: get_swap_pages()+0x55: sibling call from callable instruction with modified stack frame
mm/swapfile.o: warning: objtool: setup_swap_map_and_extents()+0x641: sibling call from callable instruction with modified stack frame
mm/swapfile.o: warning: objtool: read_swap_header()+0x196: sibling call from callable instruction with modified stack frame
mm/swapfile.o: warning: objtool: __se_sys_swapon()+0x6cb: sibling call from callable instruction with modified stack frame
vim +970 mm/swapfile.c
^1da177e4c3f41 Linus Torvalds 2005-04-16 942
5d5e8f19544a35 Huang Ying 2018-08-21 943 int get_swap_pages(int n_goal, swp_entry_t swp_entries[], int entry_size)
^1da177e4c3f41 Linus Torvalds 2005-04-16 944 {
5d5e8f19544a35 Huang Ying 2018-08-21 945 unsigned long size = swap_entry_size(entry_size);
adfab836f4908d Dan Streetman 2014-06-04 946 struct swap_info_struct *si, *next;
36005bae205da3 Tim Chen 2017-02-22 947 long avail_pgs;
36005bae205da3 Tim Chen 2017-02-22 948 int n_ret = 0;
a2468cc9bfdff6 Aaron Lu 2017-09-06 949 int node;
^1da177e4c3f41 Linus Torvalds 2005-04-16 950
38d8b4e6bdc872 Huang Ying 2017-07-06 951 /* Only single cluster request supported */
5d5e8f19544a35 Huang Ying 2018-08-21 952 WARN_ON_ONCE(n_goal > 1 && size == SWAPFILE_CLUSTER);
38d8b4e6bdc872 Huang Ying 2017-07-06 953
5d5e8f19544a35 Huang Ying 2018-08-21 954 avail_pgs = atomic_long_read(&nr_swap_pages) / size;
36005bae205da3 Tim Chen 2017-02-22 955 if (avail_pgs <= 0)
fb4f88dcabdc71 Hugh Dickins 2005-09-03 956 goto noswap;
36005bae205da3 Tim Chen 2017-02-22 957
36005bae205da3 Tim Chen 2017-02-22 958 if (n_goal > SWAP_BATCH)
36005bae205da3 Tim Chen 2017-02-22 959 n_goal = SWAP_BATCH;
36005bae205da3 Tim Chen 2017-02-22 960
36005bae205da3 Tim Chen 2017-02-22 961 if (n_goal > avail_pgs)
36005bae205da3 Tim Chen 2017-02-22 962 n_goal = avail_pgs;
36005bae205da3 Tim Chen 2017-02-22 963
5d5e8f19544a35 Huang Ying 2018-08-21 964 atomic_long_sub(n_goal * size, &nr_swap_pages);
^1da177e4c3f41 Linus Torvalds 2005-04-16 965
18ab4d4ced0817 Dan Streetman 2014-06-04 966 spin_lock(&swap_avail_lock);
18ab4d4ced0817 Dan Streetman 2014-06-04 967
18ab4d4ced0817 Dan Streetman 2014-06-04 968 start_over:
a2468cc9bfdff6 Aaron Lu 2017-09-06 969 node = numa_node_id();
a2468cc9bfdff6 Aaron Lu 2017-09-06 @970 plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) {
18ab4d4ced0817 Dan Streetman 2014-06-04 971 /* requeue si to after same-priority siblings */
a2468cc9bfdff6 Aaron Lu 2017-09-06 972 plist_requeue(&si->avail_lists[node], &swap_avail_heads[node]);
18ab4d4ced0817 Dan Streetman 2014-06-04 973 spin_unlock(&swap_avail_lock);
ec8acf20afb853 Shaohua Li 2013-02-22 974 spin_lock(&si->lock);
adfab836f4908d Dan Streetman 2014-06-04 975 if (!si->highest_bit || !(si->flags & SWP_WRITEOK)) {
18ab4d4ced0817 Dan Streetman 2014-06-04 976 spin_lock(&swap_avail_lock);
a2468cc9bfdff6 Aaron Lu 2017-09-06 977 if (plist_node_empty(&si->avail_lists[node])) {
ec8acf20afb853 Shaohua Li 2013-02-22 978 spin_unlock(&si->lock);
18ab4d4ced0817 Dan Streetman 2014-06-04 979 goto nextsi;
18ab4d4ced0817 Dan Streetman 2014-06-04 980 }
18ab4d4ced0817 Dan Streetman 2014-06-04 981 WARN(!si->highest_bit,
18ab4d4ced0817 Dan Streetman 2014-06-04 982 "swap_info %d in list but !highest_bit\n",
18ab4d4ced0817 Dan Streetman 2014-06-04 983 si->type);
18ab4d4ced0817 Dan Streetman 2014-06-04 984 WARN(!(si->flags & SWP_WRITEOK),
18ab4d4ced0817 Dan Streetman 2014-06-04 985 "swap_info %d in list but !SWP_WRITEOK\n",
18ab4d4ced0817 Dan Streetman 2014-06-04 986 si->type);
a2468cc9bfdff6 Aaron Lu 2017-09-06 987 __del_from_avail_list(si);
18ab4d4ced0817 Dan Streetman 2014-06-04 988 spin_unlock(&si->lock);
18ab4d4ced0817 Dan Streetman 2014-06-04 989 goto nextsi;
adfab836f4908d Dan Streetman 2014-06-04 990 }
5d5e8f19544a35 Huang Ying 2018-08-21 991 if (size == SWAPFILE_CLUSTER) {
f0eea189e8e969 Huang Ying 2017-09-06 992 if (!(si->flags & SWP_FILE))
38d8b4e6bdc872 Huang Ying 2017-07-06 993 n_ret = swap_alloc_cluster(si, swp_entries);
f0eea189e8e969 Huang Ying 2017-09-06 994 } else
36005bae205da3 Tim Chen 2017-02-22 995 n_ret = scan_swap_map_slots(si, SWAP_HAS_CACHE,
36005bae205da3 Tim Chen 2017-02-22 996 n_goal, swp_entries);
ec8acf20afb853 Shaohua Li 2013-02-22 997 spin_unlock(&si->lock);
5d5e8f19544a35 Huang Ying 2018-08-21 998 if (n_ret || size == SWAPFILE_CLUSTER)
36005bae205da3 Tim Chen 2017-02-22 999 goto check_out;
18ab4d4ced0817 Dan Streetman 2014-06-04 1000 pr_debug("scan_swap_map of si %d failed to find offset\n",
18ab4d4ced0817 Dan Streetman 2014-06-04 1001 si->type);
36005bae205da3 Tim Chen 2017-02-22 1002
18ab4d4ced0817 Dan Streetman 2014-06-04 1003 spin_lock(&swap_avail_lock);
18ab4d4ced0817 Dan Streetman 2014-06-04 1004 nextsi:
adfab836f4908d Dan Streetman 2014-06-04 1005 /*
adfab836f4908d Dan Streetman 2014-06-04 1006 * if we got here, it's likely that si was almost full before,
adfab836f4908d Dan Streetman 2014-06-04 1007 * and since scan_swap_map() can drop the si->lock, multiple
adfab836f4908d Dan Streetman 2014-06-04 1008 * callers probably all tried to get a page from the same si
18ab4d4ced0817 Dan Streetman 2014-06-04 1009 * and it filled up before we could get one; or, the si filled
18ab4d4ced0817 Dan Streetman 2014-06-04 1010 * up between us dropping swap_avail_lock and taking si->lock.
18ab4d4ced0817 Dan Streetman 2014-06-04 1011 * Since we dropped the swap_avail_lock, the swap_avail_head
18ab4d4ced0817 Dan Streetman 2014-06-04 1012 * list may have been modified; so if next is still in the
36005bae205da3 Tim Chen 2017-02-22 1013 * swap_avail_head list then try it, otherwise start over
36005bae205da3 Tim Chen 2017-02-22 1014 * if we have not gotten any slots.
adfab836f4908d Dan Streetman 2014-06-04 1015 */
a2468cc9bfdff6 Aaron Lu 2017-09-06 1016 if (plist_node_empty(&next->avail_lists[node]))
18ab4d4ced0817 Dan Streetman 2014-06-04 1017 goto start_over;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1018 }
fb4f88dcabdc71 Hugh Dickins 2005-09-03 1019
18ab4d4ced0817 Dan Streetman 2014-06-04 1020 spin_unlock(&swap_avail_lock);
18ab4d4ced0817 Dan Streetman 2014-06-04 1021
36005bae205da3 Tim Chen 2017-02-22 1022 check_out:
36005bae205da3 Tim Chen 2017-02-22 1023 if (n_ret < n_goal)
5d5e8f19544a35 Huang Ying 2018-08-21 1024 atomic_long_add((long)(n_goal - n_ret) * size,
38d8b4e6bdc872 Huang Ying 2017-07-06 1025 &nr_swap_pages);
fb4f88dcabdc71 Hugh Dickins 2005-09-03 1026 noswap:
36005bae205da3 Tim Chen 2017-02-22 1027 return n_ret;
36005bae205da3 Tim Chen 2017-02-22 1028 }
36005bae205da3 Tim Chen 2017-02-22 1029
:::::: The code at line 970 was first introduced by commit
:::::: a2468cc9bfdff6139f59ca896671e5819ff5f94a swap: choose swap device according to numa node
:::::: TO: Aaron Lu <aaron.lu(a)intel.com>
:::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
1
0
[openeuler:OLK-5.10 6341/30000] drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:51:28: sparse: sparse: cast removes address space '__iomem' of expression
by kernel test robot 14 Apr '24
by kernel test robot 14 Apr '24
14 Apr '24
tree: https://gitee.com/openeuler/kernel.git OLK-5.10
head: 4134526a9cfd552230ec7a66a1738a9066d9a0c6
commit: a5b9149cc6ef0e581c7289b01bf2bf3c2ad98248 [6341/30000] Huawei BMA: Adding Huawei BMA driver: host_kbox_drv
config: x86_64-randconfig-122-20240413 (https://download.01.org/0day-ci/archive/20240414/202404140648.3413VbmQ-lkp@…)
compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240414/202404140648.3413VbmQ-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202404140648.3413VbmQ-lkp@intel.com/
sparse warnings: (new ones prefixed by >>)
>> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:51:28: sparse: sparse: cast removes address space '__iomem' of expression
drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:42:6: sparse: sparse: symbol 'kbox_write_to_pci' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:120:27: sparse: sparse: cast removes address space '__iomem' of expression
drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:111:6: sparse: sparse: symbol 'kbox_read_from_pci' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:179:28: sparse: sparse: cast removes address space '__iomem' of expression
drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:172:6: sparse: sparse: symbol 'kbox_memset_pci' was not declared. Should it be static?
>> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:360:26: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char *user_buf @@ got char [noderef] __user *data @@
drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:360:26: sparse: expected char *user_buf
drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:360:26: sparse: got char [noderef] __user *data
>> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:395:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got char *user_buf @@
drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:395:34: sparse: expected void [noderef] __user *to
drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:395:34: sparse: got char *user_buf
>> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:422:32: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char const *user_buf @@ got char const [noderef] __user *data @@
drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:422:32: sparse: expected char const *user_buf
drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:422:32: sparse: got char const [noderef] __user *data
>> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:453:51: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got char const *user_buf @@
drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:453:51: sparse: expected void const [noderef] __user *from
drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:453:51: sparse: got char const *user_buf
vim +/__iomem +51 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c
41
42 void kbox_write_to_pci(void __iomem *dest, const void *src, int len,
43 unsigned long offset)
44 {
45 union char_int_transfer_u transfer = { };
46 int idx = 0;
47 int j = 0;
48 int four_byte_len = 0;
49 int left_len = 0;
50 char *src_temp = (char *)src;
> 51 char *dest_temp = (char *)dest;
52 int first_write_num = 0;
53
54 if ((offset % KBOX_RW_UNIT) != 0) {
55 transfer.data_int =
56 *(int *)(dest_temp + offset - (offset % KBOX_RW_UNIT));
57
58 rmb();/* memory barriers. */
59 first_write_num =
60 ((len + (offset % KBOX_RW_UNIT)) >
61 KBOX_RW_UNIT) ? (KBOX_RW_UNIT -
62 (offset % KBOX_RW_UNIT)) : len;
63 for (idx = (int)(offset % KBOX_RW_UNIT);
64 idx < (int)(first_write_num + (offset % KBOX_RW_UNIT));
65 idx++) {
66 if (!src_temp)
67 return;
68
69 transfer.data_char[idx] = *src_temp;
70 src_temp++;
71 }
72 *(int *)(dest_temp + offset - (offset % KBOX_RW_UNIT)) =
73 transfer.data_int;
74 wmb();/* memory barriers. */
75 len -= first_write_num;
76 offset += first_write_num;
77 }
78
79 four_byte_len = (len / KBOX_RW_UNIT);
80 left_len = (len % KBOX_RW_UNIT);
81 for (idx = 0; idx < four_byte_len; idx++) {
82 for (j = 0; j < KBOX_RW_UNIT; j++) {
83 if (!src_temp)
84 return;
85
86 transfer.data_char[j] = *src_temp;
87 src_temp++;
88 }
89 *(int *)(dest_temp + offset) = transfer.data_int;
90 wmb();/* memory barriers. */
91 offset += KBOX_RW_UNIT;
92 }
93
94 if (left_len != 0) {
95 transfer.data_int = *(int *)(dest_temp + offset);
96 rmb();/* memory barriers. */
97 for (idx = 0; idx < left_len; idx++) {
98 if (!src_temp)
99 return;
100
101 transfer.data_char[idx] = *src_temp;
102 src_temp++;
103 }
104 *(int *)(dest_temp + offset) = transfer.data_int;
105 wmb();/* memory barriers. */
106 }
107
108 udelay(1);
109 }
110
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
1
0
[openeuler:OLK-5.10] BUILD SUCCESS 4134526a9cfd552230ec7a66a1738a9066d9a0c6
by kernel test robot 14 Apr '24
by kernel test robot 14 Apr '24
14 Apr '24
tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10
branch HEAD: 4134526a9cfd552230ec7a66a1738a9066d9a0c6 !5847 ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
Warning reports:
https://lore.kernel.org/oe-kbuild-all/202404132358.tVVjLv9W-lkp@intel.com
Unverified Warning (likely false positive, please contact us if interested):
'items' is not one of ['type', 'description', 'dependencies', 'dependentRequired', 'dependentSchemas', 'properties', 'patternProperties', 'additionalProperties', 'unevaluatedProperties', 'deprecated', 'required', 'not', 'allOf', 'anyOf', 'oneOf', '$ref']
'minItems' is not one of ['type', 'description', 'dependencies', 'dependentRequired', 'dependentSchemas', 'properties', 'patternProperties', 'additionalProperties', 'unevaluatedProperties', 'deprecated', 'required', 'not', 'allOf', 'anyOf', 'oneOf', '$ref']
Documentation/devicetree/bindings/arm/cpu.yaml: properties:capacity-dmips-mhz: '$ref' should not be valid under {'const': '$ref'}
Documentation/devicetree/bindings/arm/cpu.yaml: title: 'ARM CPUs bindings' should not be valid under {'pattern': '([Bb]inding| [Ss]chema)'}
Documentation/devicetree/bindings/arm/cpus.yaml: 'maintainers' is a required property
Documentation/devicetree/bindings/arm/cpus.yaml: examples: '-| /{ cpus { arm,pbha-performance-only = /bits/ 8 <0x01 0x05 0x09>; arm,pbha-no-aliases = /bits/ 8 <0x02 0x04 0x06 0x08>;ncpu@0 { device_type = "cpu"; compatible = "arm,cortex-a57"; ... };n}; };' is not of type 'array'
['description:Display controller reference clock source'] is not of type 'object', 'boolean'
['description:Display controller reference clock source'] is too short
[{'description': 'Offset and length of the memory mapped registers'}] is too short
Warning ids grouped by kconfigs:
clang_recent_errors
|-- arm64-allyesconfig
| |-- Documentation-devicetree-bindings-arm-cpu.yaml:properties:capacity-dmips-mhz:ref-should-not-be-valid-under-const:ref
| |-- Documentation-devicetree-bindings-arm-cpu.yaml:title:ARM-CPUs-bindings-should-not-be-valid-under-pattern:(-Bb-inding-Ss-chema)
| |-- Documentation-devicetree-bindings-arm-cpus.yaml:examples:cpus-arm-pbha-performance-only-bits-arm-pbha-no-aliases-bits-ncpu-device_type-cpu-compatible-arm-cortex-a57-...-n-is-not-of-type-array
| |-- Documentation-devicetree-bindings-arm-cpus.yaml:maintainers-is-a-required-property
| |-- description:Display-controller-reference-clock-source-is-not-of-type-object-boolean
| |-- description:Display-controller-reference-clock-source-is-too-short
| |-- description:Offset-and-length-of-the-memory-mapped-registers-is-too-short
| |-- items-is-not-one-of-type-description-dependencies-dependentRequired-dependentSchemas-properties-patternProperties-additionalProperties-unevaluatedProperties-deprecated-required-not-allOf-anyOf-oneOf-r
| `-- minItems-is-not-one-of-type-description-dependencies-dependentRequired-dependentSchemas-properties-patternProperties-additionalProperties-unevaluatedProperties-deprecated-required-not-allOf-anyOf-oneO
|-- x86_64-allnoconfig
| `-- drivers-net-ethernet-mucse-rnpm-rnpm_common.h:linux-version.h-not-needed.
|-- x86_64-allyesconfig
| |-- drivers-infiniband-hw-xsc-mem.c:warning:no-previous-prototype-for-function-xsc_find_chunk_cont_0
| |-- drivers-infiniband-hw-xsc-mr.c:warning:variable-using_peer_mem-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-eecd-description-in-rnpm_lower_eeprom_clk
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-hash_value-description-in-rnpm_set_mta
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-hw-description-in-rnpm_mta_vector
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-pf-description-in-rnpm_set_vlan_anti_spoofing
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-count-not-described-in-rnpm_shift_in_eeprom_bits
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-eec-not-described-in-rnpm_lower_eeprom_clk
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-mc_addr-not-described-in-rnpm_set_mta
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-mode-not-described-in-rnpm_mta_vector
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-vf-not-described-in-rnpm_set_vlan_anti_spoofing
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:Excess-function-parameter-pf-description-in-rnpm_dbg_adapter_exit
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_dbg_adapter_exit
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-dev-description-in-rnpm_get_priv_flags
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-dev-description-in-rnpm_set_priv_flags
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-ec-description-in-rnpm_get_coalesce
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-ee-description-in-rnpm_get_module_eeprom
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-flags-description-in-rnpm_set_priv_flags
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-kec-description-in-rnpm_get_coalesce
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-kec-description-in-rnpm_set_coalesce
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnpm_get_module_eeprom
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnpm_get_module_info
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnpm_get_rxnfc
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-pf-description-in-rnpm_get_rss_hash_opts
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_get_rss_hash_opts
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-coal-not-described-in-rnpm_get_coalesce
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_get_module_eeprom
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_get_module_info
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_get_rxnfc
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-eeprom-not-described-in-rnpm_get_module_eeprom
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnpm_get_coalesce
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnpm_set_coalesce
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-netdev-not-described-in-rnpm_get_priv_flags
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-netdev-not-described-in-rnpm_set_priv_flags
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-priv_flags-not-described-in-rnpm_set_priv_flags
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:variable-autoneg_changed-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:variable-dma_ch-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:variable-duplex_changed-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-inner_vlan_tag-description-in-rnpm_tx_ctxtdesc
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-l4_hdr_len-description-in-rnpm_tx_ctxtdesc
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-mss_seg_len-description-in-rnpm_tx_ctxtdesc
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-rxr_count-description-in-rnpm_alloc_q_vector
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-rxr_idx-description-in-rnpm_alloc_q_vector
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-tunnel_hdr_len-description-in-rnpm_tx_ctxtdesc
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-txr_count-description-in-rnpm_alloc_q_vector
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-txr_idx-description-in-rnpm_alloc_q_vector
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-v_count-description-in-rnpm_alloc_q_vector
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-eth_queue_idx-not-described-in-rnpm_alloc_q_vector
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-inner_vlan_tunnel_len-not-described-in-rnpm_tx_ctxtdesc
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-mss_len_vf_num-not-described-in-rnpm_tx_ctxtdesc
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-r_count-not-described-in-rnpm_alloc_q_vector
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-r_idx-not-described-in-rnpm_alloc_q_vector
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-step-not-described-in-rnpm_alloc_q_vector
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-function-rnpm_setup_layer2_remapping
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-function-rnpm_setup_tuple5_remapping
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-function-rnpm_setup_tuple5_remapping_tcam
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-data-description-in-rnpm_pf_service_timer
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-data-description-in-rnpm_service_timer
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-ent-description-in-rnpm_probe
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-hw-description-in-rnpm_wol_supported
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-link_speed-description-in-rnpm_watchdog_update_link
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-maxrate-description-in-rnpm_tx_maxrate_own
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpm_set_ring_vector
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-netdev-description-in-rnpm_setup_tc
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-netdev-description-in-rnpm_tx_maxrate_own
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-pb-description-in-rnpm_lpbthresh
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-queue-description-in-rnpm_set_ring_vector
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-skb-description-in-rnpm_is_non_eop
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-subdev_id-description-in-rnpm_wol_supported
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_rx_ring_reinit
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_setup_rx_resources
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_setup_tx_resources
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_tx_maxrate_own
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_wol_supported
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_setup_tc
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-id-not-described-in-rnpm_probe
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-is_rxframe-not-described-in-rnpm_write_eitr
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-napi_budget-not-described-in-rnpm_clean_tx_irq
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-rnpm_msix_vector-not-described-in-rnpm_set_ring_vector
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-rnpm_queue-not-described-in-rnpm_set_ring_vector
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-subdevice_id-not-described-in-rnpm_wol_supported
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpm_pf_service_timer
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpm_service_timer
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-txqueue-not-described-in-rnpm_tx_timeout
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-clean_all_port_resetting
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-control_mac_rx
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_assign_netdev_ops
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_can_rpu_start
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_check_mc_addr
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_clear_udp_tunnel_port
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_fix_queue_number
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_pf_service_event_schedule
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_pf_service_task
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_pf_service_timer
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_rx_ring_reinit
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_service_timer
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_vlan_stags_flag
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_write_eitr
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_xmit_nop_frame_ring
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_xmit_nop_frame_ring_temp
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-update_pf_vlan
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-wait_all_port_resetting
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:variable-hw-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:variable-packets-is-used-uninitialized-whenever-if-condition-is-false
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:variable-xdp_xmit-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnpm_check_for_ack_pf
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnpm_check_for_msg_pf
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnpm_read_mbx_pf
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnpm_check_for_ack_pf
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnpm_check_for_msg_pf
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnpm_read_mbx_pf
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-mbx_cookie_zalloc
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_fw_get_capablity
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_fw_reg_read
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_fw_send_cmd_wait
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_get_port_stats2
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_link_stat_mark_disable
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_fw_post_req
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_lldp_all_ports_enable
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_pluginout_evt_en
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_write_posted_locked
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-err-is-uninitialized-when-used-here
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-err-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-hw-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-value-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Excess-function-parameter-atr_input-description-in-rnpm_atr_compute_perfect_hash_n10
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Excess-function-parameter-stream-description-in-rnpm_atr_compute_sig_hash_n10
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Function-parameter-or-member-common-not-described-in-rnpm_atr_compute_sig_hash_n10
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Function-parameter-or-member-input-not-described-in-rnpm_atr_compute_perfect_hash_n10
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Function-parameter-or-member-input-not-described-in-rnpm_atr_compute_sig_hash_n10
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:no-previous-prototype-for-function-rnpm_reset_pipeline_n10
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:variable-status-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Excess-function-parameter-eeprom_data-description-in-rnpm_read_i2c_sff8472_generic
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Excess-function-parameter-hw-description-in-rnpm_get_i2c_data
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Excess-function-parameter-hw-description-in-rnpm_get_phy_type_from_id
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-autoneg_wait_to_complete-not-described-in-rnpm_setup_phy_link_speed_generic
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-dev_addr-not-described-in-rnpm_read_i2c_byte_generic
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-dev_addr-not-described-in-rnpm_write_i2c_byte_generic
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-device_type-not-described-in-rnpm_read_phy_reg_generic
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-link_up-not-described-in-rnpm_check_phy_link_tnx
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-phy_id-not-described-in-rnpm_get_phy_type_from_id
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-sff8472_data-not-described-in-rnpm_read_i2c_sff8472_generic
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-speed-not-described-in-rnpm_check_phy_link_tnx
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:no-previous-prototype-for-function-rnpm_ptp_setup_ptp
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:variable-target-set-but-not-used
| |-- drivers-net-ethernet-mucse-rnpm-rnpm_sysfs.c:warning:no-previous-prototype-for-function-rnpm_mbx_get_pn_sn
| |-- drivers-net-ethernet-yunsilicon-xsc-common-xsc_core.h:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true
| |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_eth_change_link_status
| |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_get_vf_config
| |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_rx_get_linear_frag_sz
| |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_rx_is_linear_skb
| |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_select_queue
| |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:variable-txq_ix-is-uninitialized-when-used-here
| |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_dcbnl.c:warning:variable-buffer_size-set-but-not-used
| |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_dcbnl.c:warning:variable-curr_pfc_en-is-uninitialized-when-used-here
| |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_dcbnl.c:warning:variable-prio2buffer-set-but-not-used
| |-- drivers-net-ethernet-yunsilicon-xsc-pci-main.c:warning:no-previous-prototype-for-function-xsc_devid_to_pcie_no
| |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_pci_ctrl.c:warning:no-previous-prototype-for-function-find_kallsyms_lookup_name
| |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_pci_ctrl.c:warning:no-previous-prototype-for-function-noop_pre
| |-- drivers-net-ethernet-yusur-k2-..-platform-ys_intr.c:warning:overlapping-comparisons-always-evaluate-to-false
| `-- drivers-net-ethernet-yusur-k2-ys_k2_tx.c:warning:variable-clean_tail_ptr-set-but-not-used
`-- x86_64-randconfig-122-20240413
|-- drivers-net-ethernet-huawei-bma-kbox_drv-kbox_ram_op.c:sparse:sparse:cast-removes-address-space-__iomem-of-expression
|-- drivers-net-ethernet-huawei-bma-kbox_drv-kbox_ram_op.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-char-const-user_buf
|-- drivers-net-ethernet-huawei-bma-kbox_drv-kbox_ram_op.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-char-user_buf
|-- drivers-net-ethernet-huawei-bma-kbox_drv-kbox_ram_op.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-char-const-user_buf-got-char-const-noderef-__user-data
|-- drivers-net-ethernet-huawei-bma-kbox_drv-kbox_ram_op.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-char-user_buf-got-char-noderef-__user-data
`-- drivers-net-ethernet-huawei-bma-veth_drv-veth_hb.c:sparse:sparse:cast-removes-address-space-__iomem-of-expression
elapsed time: 757m
configs tested: 20
configs skipped: 97
The following configs have been built successfully.
More configs may be tested in the coming days.
tested configs:
arm64 allmodconfig clang
arm64 allnoconfig gcc
arm64 defconfig gcc
x86_64 allnoconfig clang
x86_64 allyesconfig clang
x86_64 buildonly-randconfig-001-20240414 clang
x86_64 buildonly-randconfig-002-20240414 clang
x86_64 buildonly-randconfig-003-20240414 clang
x86_64 buildonly-randconfig-004-20240414 clang
x86_64 buildonly-randconfig-005-20240414 gcc
x86_64 buildonly-randconfig-006-20240414 clang
x86_64 defconfig gcc
x86_64 randconfig-001-20240414 gcc
x86_64 randconfig-002-20240414 clang
x86_64 randconfig-003-20240414 gcc
x86_64 randconfig-004-20240414 gcc
x86_64 randconfig-005-20240414 clang
x86_64 randconfig-006-20240414 clang
x86_64 randconfig-011-20240414 clang
x86_64 rhel-8.3-rust clang
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
1
0
[openeuler:OLK-5.10 6340/30000] drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:2437:26: sparse: sparse: cast removes address space '__iomem' of expression
by kernel test robot 13 Apr '24
by kernel test robot 13 Apr '24
13 Apr '24
tree: https://gitee.com/openeuler/kernel.git OLK-5.10
head: 4134526a9cfd552230ec7a66a1738a9066d9a0c6
commit: 5110b9f48a67483d9b1b0946acb251a3c9fbee73 [6340/30000] Huawei BMA: Adding Huawei BMA driver: host_veth_drv
config: x86_64-randconfig-122-20240413 (https://download.01.org/0day-ci/archive/20240413/202404132358.tVVjLv9W-lkp@…)
compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240413/202404132358.tVVjLv9W-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202404132358.tVVjLv9W-lkp@intel.com/
sparse warnings: (new ones prefixed by >>)
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:88:23: sparse: sparse: symbol 'g_bspveth_dev' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:394:5: sparse: sparse: symbol 'bspveth_setup_tx_resources' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:443:6: sparse: sparse: symbol 'bspveth_free_tx_resources' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:485:5: sparse: sparse: symbol 'bspveth_setup_all_tx_resources' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:554:6: sparse: sparse: symbol 'bspveth_free_all_tx_resources' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:571:5: sparse: sparse: symbol 'veth_alloc_one_rx_skb' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:616:5: sparse: sparse: symbol 'veth_refill_rxskb' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:654:5: sparse: sparse: symbol 'bspveth_setup_rx_skb' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:685:6: sparse: sparse: symbol 'bspveth_free_rx_skb' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:718:5: sparse: sparse: symbol 'bspveth_setup_all_rx_skb' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:746:6: sparse: sparse: symbol 'bspveth_free_all_rx_skb' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:758:5: sparse: sparse: symbol 'bspveth_setup_rx_resources' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:809:6: sparse: sparse: symbol 'bspveth_free_rx_resources' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:841:5: sparse: sparse: symbol 'bspveth_setup_all_rx_resources' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:908:6: sparse: sparse: symbol 'bspveth_free_all_rx_resources' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:926:5: sparse: sparse: symbol 'bspveth_dev_install' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:961:5: sparse: sparse: symbol 'bspveth_dev_uninstall' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1046:5: sparse: sparse: symbol 'veth_config' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1063:6: sparse: sparse: symbol 'bspveth_initstatis' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1088:5: sparse: sparse: symbol 'veth_ioctl' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1093:25: sparse: sparse: symbol 'veth_stats' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1098:5: sparse: sparse: symbol 'veth_mac_set' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1234:6: sparse: sparse: symbol 'veth_netdev_func_init' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1268:5: sparse: sparse: symbol 'veth_send_one_pkt' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1544:6: sparse: sparse: symbol 'veth_skbtrtimer_do' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1591:6: sparse: sparse: symbol 'veth_netdev_exit' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1628:5: sparse: sparse: symbol 'veth_netdev_init' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1719:6: sparse: sparse: symbol 'veth_dma_tx_timer_do_H' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1769:5: sparse: sparse: symbol 'dmacmp_err_deal' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1806:5: sparse: sparse: symbol 'veth_check_dma_status' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1834:5: sparse: sparse: symbol '__check_dmacmp_H' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1906:5: sparse: sparse: symbol '__checkspace_H' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1987:5: sparse: sparse: symbol '__make_dmalistbd_h2b_H' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:2091:5: sparse: sparse: symbol '__make_dmalistbd_b2h_H' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:2194:5: sparse: sparse: symbol '__start_dmalist_H' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:2240:5: sparse: sparse: symbol 'check_dma_queue_fault' was not declared. Should it be static?
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:2388:6: sparse: sparse: symbol 'bspveth_host_exit_H' was not declared. Should it be static?
>> drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:2437:26: sparse: sparse: cast removes address space '__iomem' of expression
drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:2402:5: sparse: sparse: symbol 'bspveth_host_init_H' was not declared. Should it be static?
vim +/__iomem +2437 drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c
2401
2402 s32 bspveth_host_init_H(void)
2403 {
2404 int ret = 0;
2405 struct bma_priv_data_s *bma_priv = NULL;
2406
2407 ret = bma_intf_register_type(TYPE_VETH, 0, INTR_ENABLE,
2408 (void **)&bma_priv);
2409 if (ret) {
2410 ret = -1;
2411 goto failed;
2412 }
2413
2414 if (!bma_priv) {
2415 VETH_LOG(DLOG_ERROR, "bma_priv is NULL\n");
2416 return -1;
2417 }
2418
2419 VETH_LOG(DLOG_DEBUG,
2420 "bma_intf_register_type pdev = %p, veth_swap_addr = %p, ",
2421 bma_priv->specific.veth.pdev,
2422 bma_priv->specific.veth.veth_swap_addr);
2423
2424 VETH_LOG(DLOG_DEBUG,
2425 "veth_swap_len = 0x%lx, veth_swap_phy_addr = 0x%lx\n",
2426 bma_priv->specific.veth.veth_swap_len,
2427 bma_priv->specific.veth.veth_swap_phy_addr);
2428
2429 g_bspveth_dev.bma_priv = bma_priv;
2430 g_bspveth_dev.ppcidev = bma_priv->specific.veth.pdev;
2431
2432 /*bspveth_dev.phostrtc_p = (u8 *)bar1_base;*/
2433 /*bspveth_dev.phostrtc_v = (u8 *)bar1_remap;*/
2434 g_bspveth_dev.pshmpool_p =
2435 (u8 *)bma_priv->specific.veth.veth_swap_phy_addr;
2436 g_bspveth_dev.pshmpool_v =
> 2437 (u8 *)bma_priv->specific.veth.veth_swap_addr;
2438 g_bspveth_dev.shmpoolsize = bma_priv->specific.veth.veth_swap_len;
2439
2440 VETH_LOG(DLOG_DEBUG, "bspveth host init H OK\n");
2441
2442 return BSP_OK;
2443
2444 failed:
2445 return ret;
2446 }
2447
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
1
0
[PATCH openEuler-1.0-LTS] can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
by Zhengchao Shao 13 Apr '24
by Zhengchao Shao 13 Apr '24
13 Apr '24
From: Oleksij Rempel <o.rempel(a)pengutronix.de>
mainline inclusion
from mainline-v6.8-rc5
commit efe7cf828039aedb297c1f9920b638fffee6aabc
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2H0
CVE: CVE-2023-52637
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
Lock jsk->sk to prevent UAF when setsockopt(..., SO_J1939_FILTER, ...)
modifies jsk->filters while receiving packets.
Following trace was seen on affected system:
==================================================================
BUG: KASAN: slab-use-after-free in j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]
Read of size 4 at addr ffff888012144014 by task j1939/350
CPU: 0 PID: 350 Comm: j1939 Tainted: G W OE 6.5.0-rc5 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
print_report+0xd3/0x620
? kasan_complete_mode_report_info+0x7d/0x200
? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]
kasan_report+0xc2/0x100
? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]
__asan_load4+0x84/0xb0
j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]
j1939_sk_recv+0x20b/0x320 [can_j1939]
? __kasan_check_write+0x18/0x20
? __pfx_j1939_sk_recv+0x10/0x10 [can_j1939]
? j1939_simple_recv+0x69/0x280 [can_j1939]
? j1939_ac_recv+0x5e/0x310 [can_j1939]
j1939_can_recv+0x43f/0x580 [can_j1939]
? __pfx_j1939_can_recv+0x10/0x10 [can_j1939]
? raw_rcv+0x42/0x3c0 [can_raw]
? __pfx_j1939_can_recv+0x10/0x10 [can_j1939]
can_rcv_filter+0x11f/0x350 [can]
can_receive+0x12f/0x190 [can]
? __pfx_can_rcv+0x10/0x10 [can]
can_rcv+0xdd/0x130 [can]
? __pfx_can_rcv+0x10/0x10 [can]
__netif_receive_skb_one_core+0x13d/0x150
? __pfx___netif_receive_skb_one_core+0x10/0x10
? __kasan_check_write+0x18/0x20
? _raw_spin_lock_irq+0x8c/0xe0
__netif_receive_skb+0x23/0xb0
process_backlog+0x107/0x260
__napi_poll+0x69/0x310
net_rx_action+0x2a1/0x580
? __pfx_net_rx_action+0x10/0x10
? __pfx__raw_spin_lock+0x10/0x10
? handle_irq_event+0x7d/0xa0
__do_softirq+0xf3/0x3f8
do_softirq+0x53/0x80
</IRQ>
<TASK>
__local_bh_enable_ip+0x6e/0x70
netif_rx+0x16b/0x180
can_send+0x32b/0x520 [can]
? __pfx_can_send+0x10/0x10 [can]
? __check_object_size+0x299/0x410
raw_sendmsg+0x572/0x6d0 [can_raw]
? __pfx_raw_sendmsg+0x10/0x10 [can_raw]
? apparmor_socket_sendmsg+0x2f/0x40
? __pfx_raw_sendmsg+0x10/0x10 [can_raw]
sock_sendmsg+0xef/0x100
sock_write_iter+0x162/0x220
? __pfx_sock_write_iter+0x10/0x10
? __rtnl_unlock+0x47/0x80
? security_file_permission+0x54/0x320
vfs_write+0x6ba/0x750
? __pfx_vfs_write+0x10/0x10
? __fget_light+0x1ca/0x1f0
? __rcu_read_unlock+0x5b/0x280
ksys_write+0x143/0x170
? __pfx_ksys_write+0x10/0x10
? __kasan_check_read+0x15/0x20
? fpregs_assert_state_consistent+0x62/0x70
__x64_sys_write+0x47/0x60
do_syscall_64+0x60/0x90
? do_syscall_64+0x6d/0x90
? irqentry_exit+0x3f/0x50
? exc_page_fault+0x79/0xf0
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Allocated by task 348:
kasan_save_stack+0x2a/0x50
kasan_set_track+0x29/0x40
kasan_save_alloc_info+0x1f/0x30
__kasan_kmalloc+0xb5/0xc0
__kmalloc_node_track_caller+0x67/0x160
j1939_sk_setsockopt+0x284/0x450 [can_j1939]
__sys_setsockopt+0x15c/0x2f0
__x64_sys_setsockopt+0x6b/0x80
do_syscall_64+0x60/0x90
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Freed by task 349:
kasan_save_stack+0x2a/0x50
kasan_set_track+0x29/0x40
kasan_save_free_info+0x2f/0x50
__kasan_slab_free+0x12e/0x1c0
__kmem_cache_free+0x1b9/0x380
kfree+0x7a/0x120
j1939_sk_setsockopt+0x3b2/0x450 [can_j1939]
__sys_setsockopt+0x15c/0x2f0
__x64_sys_setsockopt+0x6b/0x80
do_syscall_64+0x60/0x90
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Fixes: 9d71dd0c70099 ("can: add support of SAE J1939 protocol")
Reported-by: Sili Luo <rootlab(a)huawei.com>
Suggested-by: Sili Luo <rootlab(a)huawei.com>
Acked-by: Oleksij Rempel <o.rempel(a)pengutronix.de>
Cc: stable(a)vger.kernel.org
Signed-off-by: Oleksij Rempel <o.rempel(a)pengutronix.de>
Link: https://lore.kernel.org/all/20231020133814.383996-1-o.rempel@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de>
Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com>
---
net/can/j1939/j1939-priv.h | 1 +
net/can/j1939/socket.c | 23 +++++++++++++++++++----
2 files changed, 20 insertions(+), 4 deletions(-)
diff --git a/net/can/j1939/j1939-priv.h b/net/can/j1939/j1939-priv.h
index 12369b604ce9..c8f469a7e7d9 100644
--- a/net/can/j1939/j1939-priv.h
+++ b/net/can/j1939/j1939-priv.h
@@ -297,6 +297,7 @@ struct j1939_sock {
int ifindex;
struct j1939_addr addr;
+ spinlock_t filters_lock;
struct j1939_filter *filters;
int nfilters;
pgn_t pgn_rx_filter;
diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c
index f7587428febd..ebff753076a9 100644
--- a/net/can/j1939/socket.c
+++ b/net/can/j1939/socket.c
@@ -258,12 +258,17 @@ static bool j1939_sk_match_dst(struct j1939_sock *jsk,
static bool j1939_sk_match_filter(struct j1939_sock *jsk,
const struct j1939_sk_buff_cb *skcb)
{
- const struct j1939_filter *f = jsk->filters;
- int nfilter = jsk->nfilters;
+ const struct j1939_filter *f;
+ int nfilter;
+
+ spin_lock_bh(&jsk->filters_lock);
+
+ f = jsk->filters;
+ nfilter = jsk->nfilters;
if (!nfilter)
/* receive all when no filters are assigned */
- return true;
+ goto filter_match_found;
for (; nfilter; ++f, --nfilter) {
if ((skcb->addr.pgn & f->pgn_mask) != f->pgn)
@@ -272,9 +277,15 @@ static bool j1939_sk_match_filter(struct j1939_sock *jsk,
continue;
if ((skcb->addr.src_name & f->name_mask) != f->name)
continue;
- return true;
+ goto filter_match_found;
}
+
+ spin_unlock_bh(&jsk->filters_lock);
return false;
+
+filter_match_found:
+ spin_unlock_bh(&jsk->filters_lock);
+ return true;
}
static bool j1939_sk_recv_match_one(struct j1939_sock *jsk,
@@ -399,6 +410,8 @@ static int j1939_sk_init(struct sock *sk)
INIT_LIST_HEAD(&jsk->sk_session_queue);
sk->sk_destruct = j1939_sk_sock_destruct;
+ spin_lock_init(&jsk->filters_lock);
+
return 0;
}
@@ -682,9 +695,11 @@ static int j1939_sk_setsockopt(struct socket *sock, int level, int optname,
}
lock_sock(&jsk->sk);
+ spin_lock_bh(&jsk->filters_lock);
ofilters = jsk->filters;
jsk->filters = filters;
jsk->nfilters = count;
+ spin_unlock_bh(&jsk->filters_lock);
release_sock(&jsk->sk);
kfree(ofilters);
return 0;
--
2.34.1
2
1
[PATCH OLK-5.10] can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
by Zhengchao Shao 13 Apr '24
by Zhengchao Shao 13 Apr '24
13 Apr '24
From: Oleksij Rempel <o.rempel(a)pengutronix.de>
stable inclusion
from stable-v5.10.210
commit 978e50ef8c38dc71bd14d1b0143d554ff5d188ba
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2H0
CVE: CVE-2023-52637
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit efe7cf828039aedb297c1f9920b638fffee6aabc upstream.
Lock jsk->sk to prevent UAF when setsockopt(..., SO_J1939_FILTER, ...)
modifies jsk->filters while receiving packets.
Following trace was seen on affected system:
==================================================================
BUG: KASAN: slab-use-after-free in j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]
Read of size 4 at addr ffff888012144014 by task j1939/350
CPU: 0 PID: 350 Comm: j1939 Tainted: G W OE 6.5.0-rc5 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
print_report+0xd3/0x620
? kasan_complete_mode_report_info+0x7d/0x200
? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]
kasan_report+0xc2/0x100
? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]
__asan_load4+0x84/0xb0
j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]
j1939_sk_recv+0x20b/0x320 [can_j1939]
? __kasan_check_write+0x18/0x20
? __pfx_j1939_sk_recv+0x10/0x10 [can_j1939]
? j1939_simple_recv+0x69/0x280 [can_j1939]
? j1939_ac_recv+0x5e/0x310 [can_j1939]
j1939_can_recv+0x43f/0x580 [can_j1939]
? __pfx_j1939_can_recv+0x10/0x10 [can_j1939]
? raw_rcv+0x42/0x3c0 [can_raw]
? __pfx_j1939_can_recv+0x10/0x10 [can_j1939]
can_rcv_filter+0x11f/0x350 [can]
can_receive+0x12f/0x190 [can]
? __pfx_can_rcv+0x10/0x10 [can]
can_rcv+0xdd/0x130 [can]
? __pfx_can_rcv+0x10/0x10 [can]
__netif_receive_skb_one_core+0x13d/0x150
? __pfx___netif_receive_skb_one_core+0x10/0x10
? __kasan_check_write+0x18/0x20
? _raw_spin_lock_irq+0x8c/0xe0
__netif_receive_skb+0x23/0xb0
process_backlog+0x107/0x260
__napi_poll+0x69/0x310
net_rx_action+0x2a1/0x580
? __pfx_net_rx_action+0x10/0x10
? __pfx__raw_spin_lock+0x10/0x10
? handle_irq_event+0x7d/0xa0
__do_softirq+0xf3/0x3f8
do_softirq+0x53/0x80
</IRQ>
<TASK>
__local_bh_enable_ip+0x6e/0x70
netif_rx+0x16b/0x180
can_send+0x32b/0x520 [can]
? __pfx_can_send+0x10/0x10 [can]
? __check_object_size+0x299/0x410
raw_sendmsg+0x572/0x6d0 [can_raw]
? __pfx_raw_sendmsg+0x10/0x10 [can_raw]
? apparmor_socket_sendmsg+0x2f/0x40
? __pfx_raw_sendmsg+0x10/0x10 [can_raw]
sock_sendmsg+0xef/0x100
sock_write_iter+0x162/0x220
? __pfx_sock_write_iter+0x10/0x10
? __rtnl_unlock+0x47/0x80
? security_file_permission+0x54/0x320
vfs_write+0x6ba/0x750
? __pfx_vfs_write+0x10/0x10
? __fget_light+0x1ca/0x1f0
? __rcu_read_unlock+0x5b/0x280
ksys_write+0x143/0x170
? __pfx_ksys_write+0x10/0x10
? __kasan_check_read+0x15/0x20
? fpregs_assert_state_consistent+0x62/0x70
__x64_sys_write+0x47/0x60
do_syscall_64+0x60/0x90
? do_syscall_64+0x6d/0x90
? irqentry_exit+0x3f/0x50
? exc_page_fault+0x79/0xf0
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Allocated by task 348:
kasan_save_stack+0x2a/0x50
kasan_set_track+0x29/0x40
kasan_save_alloc_info+0x1f/0x30
__kasan_kmalloc+0xb5/0xc0
__kmalloc_node_track_caller+0x67/0x160
j1939_sk_setsockopt+0x284/0x450 [can_j1939]
__sys_setsockopt+0x15c/0x2f0
__x64_sys_setsockopt+0x6b/0x80
do_syscall_64+0x60/0x90
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Freed by task 349:
kasan_save_stack+0x2a/0x50
kasan_set_track+0x29/0x40
kasan_save_free_info+0x2f/0x50
__kasan_slab_free+0x12e/0x1c0
__kmem_cache_free+0x1b9/0x380
kfree+0x7a/0x120
j1939_sk_setsockopt+0x3b2/0x450 [can_j1939]
__sys_setsockopt+0x15c/0x2f0
__x64_sys_setsockopt+0x6b/0x80
do_syscall_64+0x60/0x90
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Fixes: 9d71dd0c70099 ("can: add support of SAE J1939 protocol")
Reported-by: Sili Luo <rootlab(a)huawei.com>
Suggested-by: Sili Luo <rootlab(a)huawei.com>
Acked-by: Oleksij Rempel <o.rempel(a)pengutronix.de>
Cc: stable(a)vger.kernel.org
Signed-off-by: Oleksij Rempel <o.rempel(a)pengutronix.de>
Link: https://lore.kernel.org/all/20231020133814.383996-1-o.rempel@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com>
---
net/can/j1939/j1939-priv.h | 1 +
net/can/j1939/socket.c | 22 ++++++++++++++++++----
2 files changed, 19 insertions(+), 4 deletions(-)
diff --git a/net/can/j1939/j1939-priv.h b/net/can/j1939/j1939-priv.h
index cea712fb2a9e..9ac2a10b1826 100644
--- a/net/can/j1939/j1939-priv.h
+++ b/net/can/j1939/j1939-priv.h
@@ -297,6 +297,7 @@ struct j1939_sock {
int ifindex;
struct j1939_addr addr;
+ spinlock_t filters_lock;
struct j1939_filter *filters;
int nfilters;
pgn_t pgn_rx_filter;
diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c
index 906a08d38c1c..c216c60f572b 100644
--- a/net/can/j1939/socket.c
+++ b/net/can/j1939/socket.c
@@ -262,12 +262,17 @@ static bool j1939_sk_match_dst(struct j1939_sock *jsk,
static bool j1939_sk_match_filter(struct j1939_sock *jsk,
const struct j1939_sk_buff_cb *skcb)
{
- const struct j1939_filter *f = jsk->filters;
- int nfilter = jsk->nfilters;
+ const struct j1939_filter *f;
+ int nfilter;
+
+ spin_lock_bh(&jsk->filters_lock);
+
+ f = jsk->filters;
+ nfilter = jsk->nfilters;
if (!nfilter)
/* receive all when no filters are assigned */
- return true;
+ goto filter_match_found;
for (; nfilter; ++f, --nfilter) {
if ((skcb->addr.pgn & f->pgn_mask) != f->pgn)
@@ -276,9 +281,15 @@ static bool j1939_sk_match_filter(struct j1939_sock *jsk,
continue;
if ((skcb->addr.src_name & f->name_mask) != f->name)
continue;
- return true;
+ goto filter_match_found;
}
+
+ spin_unlock_bh(&jsk->filters_lock);
return false;
+
+filter_match_found:
+ spin_unlock_bh(&jsk->filters_lock);
+ return true;
}
static bool j1939_sk_recv_match_one(struct j1939_sock *jsk,
@@ -401,6 +412,7 @@ static int j1939_sk_init(struct sock *sk)
atomic_set(&jsk->skb_pending, 0);
spin_lock_init(&jsk->sk_session_queue_lock);
INIT_LIST_HEAD(&jsk->sk_session_queue);
+ spin_lock_init(&jsk->filters_lock);
/* j1939_sk_sock_destruct() depends on SOCK_RCU_FREE flag */
sock_set_flag(sk, SOCK_RCU_FREE);
@@ -703,9 +715,11 @@ static int j1939_sk_setsockopt(struct socket *sock, int level, int optname,
}
lock_sock(&jsk->sk);
+ spin_lock_bh(&jsk->filters_lock);
ofilters = jsk->filters;
jsk->filters = filters;
jsk->nfilters = count;
+ spin_unlock_bh(&jsk->filters_lock);
release_sock(&jsk->sk);
kfree(ofilters);
return 0;
--
2.34.1
2
1
Bart Van Assche (2):
fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
fs/aio.c | 17 ++++++++++++++---
include/linux/fs.h | 2 ++
2 files changed, 16 insertions(+), 3 deletions(-)
--
2.39.2
2
3