- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS v3 0/6] CVE-2023-52595
by Pu Lehui 18 Mar '24

18 Mar '24

Pu Lehui (1): rt2x00: Fix kabi breakage in struct rt2x00lib_ops Shiji Yang (1): wifi: rt2x00: restart beacon queue when hardware reset Stanislaw Gruszka (4): rt2800: do not nullify initialization vector data rt2800: add pre_reset_hw callback rt2x00: clear IV's on start to fix AP mode regression rt2x00: clear up IV's on key removal .../net/wireless/ralink/rt2x00/rt2800lib.c | 52 +++++++++++++++---- .../net/wireless/ralink/rt2x00/rt2800lib.h | 1 + .../net/wireless/ralink/rt2x00/rt2800pci.c | 5 ++ .../net/wireless/ralink/rt2x00/rt2800soc.c | 5 ++ .../net/wireless/ralink/rt2x00/rt2800usb.c | 5 ++ drivers/net/wireless/ralink/rt2x00/rt2x00.h | 2 + .../net/wireless/ralink/rt2x00/rt2x00dev.c | 30 ++++++++--- .../net/wireless/ralink/rt2x00/rt2x00mac.c | 11 ++++ 8 files changed, 94 insertions(+), 17 deletions(-) -- 2.34.1

2 7

[PATCH openEuler-22.03-LTS-SP1 00/29] fix CVE-2023-20569
by Jialin Zhang 18 Mar '24

18 Mar '24

New architectural features and CPUID bits related to the Speculative Return Stack Overflow (SRSO) vulnerability. Arnaldo Carvalho de Melo (2): tools headers cpufeatures: Sync with the kernel sources tools arch x86: Sync the msr-index.h copy with the kernel sources Borislav Petkov (AMD) (9): x86/bugs: Increase the x86 bugs vector size to two u32s x86/srso: Add a Speculative RAS Overflow mitigation x86/srso: Add IBPB_BRTYPE support x86/srso: Add SRSO_NO support x86/srso: Add IBPB x86/srso: Add IBPB on VMEXIT x86/srso: Tie SBPB bit setting to microcode patch detection x86/srso: Disable the mitigation on unaffected configurations x86/srso: Correct the mitigation status when SMT is disabled Christophe Leroy (1): objtool: Fix SEGFAULT Jialin Zhang (1): x86/cpufeatures: Fix abi breakage caused by NCAPINTS in cpufeature header file. Josh Poimboeuf (2): x86/srso: Fix return thunks in generated code objtool: Add frame-pointer-specific function ignore Kim Phillips (1): x86/cpu, kvm: Add support for CPUID_80000021_EAX Nick Desaulniers (1): x86/srso: Fix build breakage with the LLVM linker Nikolay Borisov (1): kabi: Allow extra bugsints (bsc#1213927). Peter Zijlstra (10): x86/ibt: Add ANNOTATE_NOENDBR x86/cpu: Fix __x86_return_thunk symbol type x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk() x86/alternative: Make custom return thunk unconditional x86/cpu: Clean up SRSO return thunk mess x86/cpu: Rename original retbleed methods x86/cpu: Rename srso_(.*)_alias to srso_alias_\1 x86/cpu: Cleanup the untrain mess objtool/x86: Fixup frame-pointer vs rethunk objtool/x86: Fix SRSO mess Sean Christopherson (1): x86/retpoline: Don't clobber RFLAGS during srso_safe_ret() Documentation/admin-guide/hw-vuln/index.rst | 1 + Documentation/admin-guide/hw-vuln/srso.rst | 133 ++++++++++++ .../admin-guide/kernel-parameters.txt | 11 + arch/x86/Kconfig | 7 + arch/x86/include/asm/cpufeature.h | 23 +- arch/x86/include/asm/cpufeatures.h | 15 +- arch/x86/include/asm/msr-index.h | 1 + arch/x86/include/asm/nospec-branch.h | 34 ++- arch/x86/include/asm/processor.h | 7 +- arch/x86/kernel/alternative.c | 2 +- arch/x86/kernel/cpu/amd.c | 19 ++ arch/x86/kernel/cpu/bugs.c | 197 ++++++++++++++++++ arch/x86/kernel/cpu/common.c | 17 +- arch/x86/kernel/cpu/mkcapflags.sh | 2 +- arch/x86/kernel/cpu/proc.c | 2 +- arch/x86/kernel/cpu/scattered.c | 3 + arch/x86/kernel/vmlinux.lds.S | 38 +++- arch/x86/kvm/cpuid.c | 7 + arch/x86/kvm/cpuid.h | 14 ++ arch/x86/kvm/svm/svm.c | 4 +- arch/x86/kvm/svm/vmenter.S | 3 + arch/x86/lib/retpoline.S | 135 ++++++++++-- drivers/base/cpu.c | 8 + include/linux/cpu.h | 2 + include/linux/objtool.h | 28 +++ tools/arch/x86/include/asm/cpufeatures.h | 16 +- tools/arch/x86/include/asm/msr-index.h | 1 + tools/include/linux/objtool.h | 28 +++ tools/objtool/arch.h | 1 + tools/objtool/arch/x86/decode.c | 6 + tools/objtool/check.c | 43 +++- tools/objtool/elf.h | 1 + .../perf/trace/beauty/tracepoints/x86_msr.sh | 2 +- 33 files changed, 759 insertions(+), 52 deletions(-) create mode 100644 Documentation/admin-guide/hw-vuln/srso.rst -- 2.25.1

2 30

[PATCH OLK-5.10] bus: mhi: host: Add alignment check for event ring read pointer
by Cai Xinchen 18 Mar '24

18 Mar '24

From: Krishna chaitanya chundru <quic_krichai(a)quicinc.com> mainline inclusion from mainline-v6.8-rc1 commit eff9704f5332a13b08fbdbe0f84059c9e7051d5f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I99JF1 CVE: CVE-2023-52494 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------ Though we do check the event ring read pointer by "is_valid_ring_ptr" to make sure it is in the buffer range, but there is another risk the pointer may be not aligned. Since we are expecting event ring elements are 128 bits(struct mhi_ring_element) aligned, an unaligned read pointer could lead to multiple issues like DoS or ring buffer memory corruption. So add a alignment check for event ring read pointer. Fixes: ec32332df764 ("bus: mhi: core: Sanity check values from remote device before use") cc: stable(a)vger.kernel.org Signed-off-by: Krishna chaitanya chundru <quic_krichai(a)quicinc.com> Reviewed-by: Jeffrey Hugo <quic_jhugo(a)quicinc.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Link: https://lore.kernel.org/r/20231031-alignment_check-v2-1-1441db7c5efd@quicin… Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> conflicts: drivers/bus/mhi/host/main.c Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/bus/mhi/host/main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c index 614dd287cb4f..82d6e9e8bddf 100644 --- a/drivers/bus/mhi/host/main.c +++ b/drivers/bus/mhi/host/main.c @@ -222,7 +222,8 @@ static void mhi_del_ring_element(struct mhi_controller *mhi_cntrl, static bool is_valid_ring_ptr(struct mhi_ring *ring, dma_addr_t addr) { - return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len; + return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len && + !(addr & (sizeof(struct mhi_tre) - 1)); } int mhi_destroy_device(struct device *dev, void *data) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP2] FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 18 Mar '24

18 Mar '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.210 commit 2037cb9d95f1741885f7daf50e8a028c4ade5317 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNQ CVE: CVE-2023-52604 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68 ] Syzkaller reported the following issue: UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6 index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]') CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> ================================================================================ Kernel panic - not syncing: UBSAN: panic_on_warn set ... CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 panic+0x30f/0x770 kernel/panic.c:340 check_panic_on_warn+0x82/0xa0 kernel/panic.c:236 ubsan_epilogue lib/ubsan.c:223 [inline] __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> Kernel Offset: disabled Rebooting in 86400 seconds.. The issue is caused when the value of lp becomes greater than CTLTREESIZE which is the max size of stree. Adding a simple check solves this issue. Dave: As the function returns a void, good error handling would require a more intrusive code reorganization, so I modified Osama's patch at use WARN_ON_ONCE for lack of a cleaner option. The patch is tested via syzbot. Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 2c9493011aec..72dae2623f05 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -2917,6 +2917,9 @@ static void dbAdjTree(dmtree_t * tp, int leafno, int newval) /* is the current value the same as the old value ? if so, * there is nothing to do. */ + if (WARN_ON_ONCE(lp >= CTLTREESIZE)) + return; + if (tp->dmt_stree[lp] == newval) return; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 18 Mar '24

18 Mar '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.210 commit 2037cb9d95f1741885f7daf50e8a028c4ade5317 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNQ CVE: CVE-2023-52604 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68 ] Syzkaller reported the following issue: UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6 index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]') CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> ================================================================================ Kernel panic - not syncing: UBSAN: panic_on_warn set ... CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 panic+0x30f/0x770 kernel/panic.c:340 check_panic_on_warn+0x82/0xa0 kernel/panic.c:236 ubsan_epilogue lib/ubsan.c:223 [inline] __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> Kernel Offset: disabled Rebooting in 86400 seconds.. The issue is caused when the value of lp becomes greater than CTLTREESIZE which is the max size of stree. Adding a simple check solves this issue. Dave: As the function returns a void, good error handling would require a more intrusive code reorganization, so I modified Osama's patch at use WARN_ON_ONCE for lack of a cleaner option. The patch is tested via syzbot. Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 0ce17ea8fa8a..23e51992c964 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -2902,6 +2902,9 @@ static void dbAdjTree(dmtree_t * tp, int leafno, int newval) /* is the current value the same as the old value ? if so, * there is nothing to do. */ + if (WARN_ON_ONCE(lp >= CTLTREESIZE)) + return; + if (tp->dmt_stree[lp] == newval) return; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS] FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 18 Mar '24

18 Mar '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.210 commit 2037cb9d95f1741885f7daf50e8a028c4ade5317 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNQ CVE: CVE-2023-52604 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68 ] Syzkaller reported the following issue: UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6 index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]') CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> ================================================================================ Kernel panic - not syncing: UBSAN: panic_on_warn set ... CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 panic+0x30f/0x770 kernel/panic.c:340 check_panic_on_warn+0x82/0xa0 kernel/panic.c:236 ubsan_epilogue lib/ubsan.c:223 [inline] __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> Kernel Offset: disabled Rebooting in 86400 seconds.. The issue is caused when the value of lp becomes greater than CTLTREESIZE which is the max size of stree. Adding a simple check solves this issue. Dave: As the function returns a void, good error handling would require a more intrusive code reorganization, so I modified Osama's patch at use WARN_ON_ONCE for lack of a cleaner option. The patch is tested via syzbot. Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 0ce17ea8fa8a..23e51992c964 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -2902,6 +2902,9 @@ static void dbAdjTree(dmtree_t * tp, int leafno, int newval) /* is the current value the same as the old value ? if so, * there is nothing to do. */ + if (WARN_ON_ONCE(lp >= CTLTREESIZE)) + return; + if (tp->dmt_stree[lp] == newval) return; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS V1] drm/msm/dpu: Add mutex lock in control vblank irq
by Cheng Yu 18 Mar '24

18 Mar '24

From: Paloma Arellano <quic_parellan(a)quicinc.com> stable inclusion from stable-v6.7.4 commit 14f109bf74dd67e1d0469fed859c8e506b0df53f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNY CVE: CVE-2023-52586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 45284ff733e4caf6c118aae5131eb7e7cf3eea5a ] Add a mutex lock to control vblank irq to synchronize vblank enable/disable operations happening from different threads to prevent race conditions while registering/unregistering the vblank irq callback. v4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a parameter of dpu_encoder_phys. -Switch from atomic refcnt to a simple int counter as mutex has now been added v3: Mistakenly did not change wording in last version. It is done now. v2: Slightly changed wording of commit message Signed-off-by: Paloma Arellano <quic_parellan(a)quicinc.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/571854/ Link: https://lore.kernel.org/r/20231212231101.9240-2-quic_parellan@quicinc.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h | 4 ++- .../drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 27 +++++++++++----- .../drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 32 +++++++++++++------ 3 files changed, 44 insertions(+), 19 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h index c7df8aad6613..f376e87e0768 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h @@ -215,6 +215,7 @@ struct dpu_encoder_irq { * @hw_pp: Hardware interface to the ping pong registers * @dpu_kms: Pointer to the dpu_kms top level * @cached_mode: DRM mode cached at mode_set time, acted on in enable + * @vblank_ctl_lock: Vblank ctl mutex lock to protect vblank_refcount * @enabled: Whether the encoder has enabled and running a mode * @split_role: Role to play in a split-panel configuration * @intf_mode: Interface mode @@ -246,13 +247,14 @@ struct dpu_encoder_phys { struct dpu_hw_pingpong *hw_pp; struct dpu_kms *dpu_kms; struct drm_display_mode cached_mode; + struct mutex vblank_ctl_lock; enum dpu_enc_split_role split_role; enum dpu_intf_mode intf_mode; enum dpu_intf intf_idx; enum dpu_rm_topology_name topology_name; spinlock_t *enc_spinlock; enum dpu_enc_enable_state enable_state; - atomic_t vblank_refcount; + int vblank_refcount; atomic_t vsync_cnt; atomic_t underrun_cnt; atomic_t pending_ctlstart_cnt; diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c index 3084675ed425..ec88fafc9cb3 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c @@ -316,7 +316,8 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( return -EINVAL; } - refcount = atomic_read(&phys_enc->vblank_refcount); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_cmd_is_master(phys_enc)) @@ -332,13 +333,21 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( phys_enc->hw_pp->idx - PINGPONG_0, enable ? "true" : "false", refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_RDPTR); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("vblank irq err id:%u pp:%d ret:%d, enable %s/%d\n", DRMID(phys_enc->parent), @@ -361,7 +370,7 @@ static void dpu_encoder_phys_cmd_irq_control(struct dpu_encoder_phys *phys_enc, trace_dpu_enc_phys_cmd_irq_ctrl(DRMID(phys_enc->parent), phys_enc->hw_pp->idx - PINGPONG_0, - enable, atomic_read(&phys_enc->vblank_refcount)); + enable, phys_enc->vblank_refcount); if (enable) { dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_PINGPONG); @@ -846,6 +855,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( phys_enc->hw_mdptop = hw_mdp; phys_enc->intf_idx = p->intf_idx; + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_cmd_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -887,7 +899,6 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_cmd_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); atomic_set(&phys_enc->pending_kickoff_cnt, 0); atomic_set(&phys_enc->pending_ctlstart_cnt, 0); atomic_set(&cmd_enc->pending_vblank_cnt, 0); diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c index c9962a36b86b..7173169d2f3b 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c @@ -445,9 +445,11 @@ static int dpu_encoder_phys_vid_control_vblank_irq( return -EINVAL; } - refcount = atomic_read(&phys_enc->vblank_refcount); vid_enc = to_dpu_encoder_phys_vid(phys_enc); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; + /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_vid_is_master(phys_enc)) goto end; @@ -458,16 +460,24 @@ static int dpu_encoder_phys_vid_control_vblank_irq( goto end; } - DRM_DEBUG_KMS("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, - atomic_read(&phys_enc->vblank_refcount)); + DRM_DEBUG_VBL("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, + refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_VSYNC); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("failed: id:%u intf:%d ret:%d enable:%d refcnt:%d\n", DRMID(phys_enc->parent), @@ -742,7 +752,7 @@ static void dpu_encoder_phys_vid_irq_control(struct dpu_encoder_phys *phys_enc, trace_dpu_enc_phys_vid_irq_ctrl(DRMID(phys_enc->parent), vid_enc->hw_intf->idx - INTF_0, enable, - atomic_read(&phys_enc->vblank_refcount)); + phys_enc->vblank_refcount); if (enable) { ret = dpu_encoder_phys_vid_control_vblank_irq(phys_enc, true); @@ -877,6 +887,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( DPU_DEBUG_VIDENC(vid_enc, "\n"); + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_vid_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -904,7 +917,6 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_vid_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); atomic_set(&phys_enc->pending_kickoff_cnt, 0); init_waitqueue_head(&phys_enc->pending_kickoff_wq); phys_enc->enable_state = DPU_ENC_DISABLED; -- 2.25.1

2 1

[PATCH OLK-5.10] FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 18 Mar '24

18 Mar '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.210 commit 2037cb9d95f1741885f7daf50e8a028c4ade5317 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNQ CVE: CVE-2023-52604 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68 ] Syzkaller reported the following issue: UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6 index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]') CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> ================================================================================ Kernel panic - not syncing: UBSAN: panic_on_warn set ... CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 panic+0x30f/0x770 kernel/panic.c:340 check_panic_on_warn+0x82/0xa0 kernel/panic.c:236 ubsan_epilogue lib/ubsan.c:223 [inline] __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> Kernel Offset: disabled Rebooting in 86400 seconds.. The issue is caused when the value of lp becomes greater than CTLTREESIZE which is the max size of stree. Adding a simple check solves this issue. Dave: As the function returns a void, good error handling would require a more intrusive code reorganization, so I modified Osama's patch at use WARN_ON_ONCE for lack of a cleaner option. The patch is tested via syzbot. Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index a9c078fc2302..cb31ea51a54d 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -2928,6 +2928,9 @@ static void dbAdjTree(dmtree_t * tp, int leafno, int newval) /* is the current value the same as the old value ? if so, * there is nothing to do. */ + if (WARN_ON_ONCE(lp >= CTLTREESIZE)) + return; + if (tp->dmt_stree[lp] == newval) return; -- 2.39.2

2 1

[PATCH OLK-5.10 V1] drm/msm/dpu: Add mutex lock in control vblank irq
by Cheng Yu 18 Mar '24

18 Mar '24

From: Paloma Arellano <quic_parellan(a)quicinc.com> stable inclusion from stable-v6.7.4 commit 14f109bf74dd67e1d0469fed859c8e506b0df53f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNY CVE: CVE-2023-52586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 45284ff733e4caf6c118aae5131eb7e7cf3eea5a ] Add a mutex lock to control vblank irq to synchronize vblank enable/disable operations happening from different threads to prevent race conditions while registering/unregistering the vblank irq callback. v4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a parameter of dpu_encoder_phys. -Switch from atomic refcnt to a simple int counter as mutex has now been added v3: Mistakenly did not change wording in last version. It is done now. v2: Slightly changed wording of commit message Signed-off-by: Paloma Arellano <quic_parellan(a)quicinc.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/571854/ Link: https://lore.kernel.org/r/20231212231101.9240-2-quic_parellan@quicinc.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h | 4 ++- .../drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 27 +++++++++++----- .../drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 31 +++++++++++++------ 3 files changed, 43 insertions(+), 19 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h index f8f25157f635..f32a05355e78 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h @@ -194,6 +194,7 @@ struct dpu_encoder_irq { * @hw_intf: Hardware interface to the intf registers * @dpu_kms: Pointer to the dpu_kms top level * @cached_mode: DRM mode cached at mode_set time, acted on in enable + * @vblank_ctl_lock: Vblank ctl mutex lock to protect vblank_refcount * @enabled: Whether the encoder has enabled and running a mode * @split_role: Role to play in a split-panel configuration * @intf_mode: Interface mode @@ -223,12 +224,13 @@ struct dpu_encoder_phys { struct dpu_hw_intf *hw_intf; struct dpu_kms *dpu_kms; struct drm_display_mode cached_mode; + struct mutex vblank_ctl_lock; enum dpu_enc_split_role split_role; enum dpu_intf_mode intf_mode; enum dpu_intf intf_idx; spinlock_t *enc_spinlock; enum dpu_enc_enable_state enable_state; - atomic_t vblank_refcount; + int vblank_refcount; atomic_t vsync_cnt; atomic_t underrun_cnt; atomic_t pending_ctlstart_cnt; diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c index 8493d68ad841..ce8a4db87180 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c @@ -263,7 +263,8 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( return -EINVAL; } - refcount = atomic_read(&phys_enc->vblank_refcount); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_cmd_is_master(phys_enc)) @@ -279,13 +280,21 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( phys_enc->hw_pp->idx - PINGPONG_0, enable ? "true" : "false", refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_RDPTR); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("vblank irq err id:%u pp:%d ret:%d, enable %s/%d\n", DRMID(phys_enc->parent), @@ -301,7 +310,7 @@ static void dpu_encoder_phys_cmd_irq_control(struct dpu_encoder_phys *phys_enc, { trace_dpu_enc_phys_cmd_irq_ctrl(DRMID(phys_enc->parent), phys_enc->hw_pp->idx - PINGPONG_0, - enable, atomic_read(&phys_enc->vblank_refcount)); + enable, phys_enc->vblank_refcount); if (enable) { dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_PINGPONG); @@ -724,6 +733,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( phys_enc->hw_mdptop = p->dpu_kms->hw_mdp; phys_enc->intf_idx = p->intf_idx; + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_cmd_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -765,7 +777,6 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_cmd_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); atomic_set(&phys_enc->pending_kickoff_cnt, 0); atomic_set(&phys_enc->pending_ctlstart_cnt, 0); atomic_set(&cmd_enc->pending_vblank_cnt, 0); diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c index 805e059b50b7..17da19ccc692 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c @@ -395,7 +395,8 @@ static int dpu_encoder_phys_vid_control_vblank_irq( int ret = 0; int refcount; - refcount = atomic_read(&phys_enc->vblank_refcount); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_vid_is_master(phys_enc)) @@ -407,16 +408,24 @@ static int dpu_encoder_phys_vid_control_vblank_irq( goto end; } - DRM_DEBUG_KMS("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, - atomic_read(&phys_enc->vblank_refcount)); + DRM_DEBUG_VBL("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, + refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_VSYNC); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("failed: id:%u intf:%d ret:%d enable:%d refcnt:%d\n", DRMID(phys_enc->parent), @@ -631,7 +640,7 @@ static void dpu_encoder_phys_vid_irq_control(struct dpu_encoder_phys *phys_enc, trace_dpu_enc_phys_vid_irq_ctrl(DRMID(phys_enc->parent), phys_enc->hw_intf->idx - INTF_0, enable, - atomic_read(&phys_enc->vblank_refcount)); + phys_enc->vblank_refcount); if (enable) { ret = dpu_encoder_phys_vid_control_vblank_irq(phys_enc, true); @@ -700,6 +709,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( DPU_DEBUG_VIDENC(phys_enc, "\n"); + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_vid_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -727,7 +739,6 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_vid_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); atomic_set(&phys_enc->pending_kickoff_cnt, 0); init_waitqueue_head(&phys_enc->pending_kickoff_wq); phys_enc->enable_state = DPU_ENC_DISABLED; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 18 Mar '24

18 Mar '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v4.19.307 commit e3e95c6850661c77e6dab079d9b5374a618ebb15 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNQ CVE: CVE-2023-52604 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68 ] Syzkaller reported the following issue: UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6 index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]') CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> ================================================================================ Kernel panic - not syncing: UBSAN: panic_on_warn set ... CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 panic+0x30f/0x770 kernel/panic.c:340 check_panic_on_warn+0x82/0xa0 kernel/panic.c:236 ubsan_epilogue lib/ubsan.c:223 [inline] __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> Kernel Offset: disabled Rebooting in 86400 seconds.. The issue is caused when the value of lp becomes greater than CTLTREESIZE which is the max size of stree. Adding a simple check solves this issue. Dave: As the function returns a void, good error handling would require a more intrusive code reorganization, so I modified Osama's patch at use WARN_ON_ONCE for lack of a cleaner option. The patch is tested via syzbot. Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index a5b51c2c5e32..8f856e0a85a6 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -2908,6 +2908,9 @@ static void dbAdjTree(dmtree_t * tp, int leafno, int newval) /* is the current value the same as the old value ? if so, * there is nothing to do. */ + if (WARN_ON_ONCE(lp >= CTLTREESIZE)) + return; + if (tp->dmt_stree[lp] == newval) return; -- 2.39.2

2 1

[PATCH OLK-5.10] bus: mhi: host: Add alignment check for event ring read pointer
by Cai Xinchen 18 Mar '24

18 Mar '24

From: Krishna chaitanya chundru <quic_krichai(a)quicinc.com> mainline inclusion from mainline-v6.8-rc1 commit eff9704f5332a13b08fbdbe0f84059c9e7051d5f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I96S0P CVE: CVE-2023-52494 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------ Though we do check the event ring read pointer by "is_valid_ring_ptr" to make sure it is in the buffer range, but there is another risk the pointer may be not aligned. Since we are expecting event ring elements are 128 bits(struct mhi_ring_element) aligned, an unaligned read pointer could lead to multiple issues like DoS or ring buffer memory corruption. So add a alignment check for event ring read pointer. Fixes: ec32332df764 ("bus: mhi: core: Sanity check values from remote device before use") cc: stable(a)vger.kernel.org Signed-off-by: Krishna chaitanya chundru <quic_krichai(a)quicinc.com> Reviewed-by: Jeffrey Hugo <quic_jhugo(a)quicinc.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Link: https://lore.kernel.org/r/20231031-alignment_check-v2-1-1441db7c5efd@quicin… Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> conflicts: drivers/bus/mhi/host/main.c Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/bus/mhi/host/main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c index 614dd287cb4f..82d6e9e8bddf 100644 --- a/drivers/bus/mhi/host/main.c +++ b/drivers/bus/mhi/host/main.c @@ -222,7 +222,8 @@ static void mhi_del_ring_element(struct mhi_controller *mhi_cntrl, static bool is_valid_ring_ptr(struct mhi_ring *ring, dma_addr_t addr) { - return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len; + return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len && + !(addr & (sizeof(struct mhi_tre) - 1)); } int mhi_destroy_device(struct device *dev, void *data) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS V1] drm/msm/dpu: Add mutex lock in control vblank irq
by Cheng Yu 18 Mar '24

18 Mar '24

From: Paloma Arellano <quic_parellan(a)quicinc.com> stable inclusion from stable-v6.7.4 commit 14f109bf74dd67e1d0469fed859c8e506b0df53f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNY CVE: CVE-2023-52586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 45284ff733e4caf6c118aae5131eb7e7cf3eea5a ] Add a mutex lock to control vblank irq to synchronize vblank enable/disable operations happening from different threads to prevent race conditions while registering/unregistering the vblank irq callback. v4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a parameter of dpu_encoder_phys. -Switch from atomic refcnt to a simple int counter as mutex has now been added v3: Mistakenly did not change wording in last version. It is done now. v2: Slightly changed wording of commit message Signed-off-by: Paloma Arellano <quic_parellan(a)quicinc.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/571854/ Link: https://lore.kernel.org/r/20231212231101.9240-2-quic_parellan@quicinc.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h | 4 ++- .../drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 28 +++++++++++----- .../drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 33 +++++++++++++------ 3 files changed, 46 insertions(+), 19 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h index c7df8aad6613..f376e87e0768 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h @@ -215,6 +215,7 @@ struct dpu_encoder_irq { * @hw_pp: Hardware interface to the ping pong registers * @dpu_kms: Pointer to the dpu_kms top level * @cached_mode: DRM mode cached at mode_set time, acted on in enable + * @vblank_ctl_lock: Vblank ctl mutex lock to protect vblank_refcount * @enabled: Whether the encoder has enabled and running a mode * @split_role: Role to play in a split-panel configuration * @intf_mode: Interface mode @@ -246,13 +247,14 @@ struct dpu_encoder_phys { struct dpu_hw_pingpong *hw_pp; struct dpu_kms *dpu_kms; struct drm_display_mode cached_mode; + struct mutex vblank_ctl_lock; enum dpu_enc_split_role split_role; enum dpu_intf_mode intf_mode; enum dpu_intf intf_idx; enum dpu_rm_topology_name topology_name; spinlock_t *enc_spinlock; enum dpu_enc_enable_state enable_state; - atomic_t vblank_refcount; + int vblank_refcount; atomic_t vsync_cnt; atomic_t underrun_cnt; atomic_t pending_ctlstart_cnt; diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c index 3084675ed425..b53a566f1ffc 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c @@ -316,7 +316,8 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( return -EINVAL; } - refcount = atomic_read(&phys_enc->vblank_refcount); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_cmd_is_master(phys_enc)) @@ -332,13 +333,21 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( phys_enc->hw_pp->idx - PINGPONG_0, enable ? "true" : "false", refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_RDPTR); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("vblank irq err id:%u pp:%d ret:%d, enable %s/%d\n", DRMID(phys_enc->parent), @@ -361,7 +370,7 @@ static void dpu_encoder_phys_cmd_irq_control(struct dpu_encoder_phys *phys_enc, trace_dpu_enc_phys_cmd_irq_ctrl(DRMID(phys_enc->parent), phys_enc->hw_pp->idx - PINGPONG_0, - enable, atomic_read(&phys_enc->vblank_refcount)); + enable, phys_enc->vblank_refcount); if (enable) { dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_PINGPONG); @@ -846,6 +855,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( phys_enc->hw_mdptop = hw_mdp; phys_enc->intf_idx = p->intf_idx; + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_cmd_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -887,7 +899,7 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_cmd_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); + phys_enc->vblank_refcount; atomic_set(&phys_enc->pending_kickoff_cnt, 0); atomic_set(&phys_enc->pending_ctlstart_cnt, 0); atomic_set(&cmd_enc->pending_vblank_cnt, 0); diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c index c9962a36b86b..27d283dd97aa 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c @@ -445,9 +445,11 @@ static int dpu_encoder_phys_vid_control_vblank_irq( return -EINVAL; } - refcount = atomic_read(&phys_enc->vblank_refcount); vid_enc = to_dpu_encoder_phys_vid(phys_enc); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; + /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_vid_is_master(phys_enc)) goto end; @@ -458,16 +460,24 @@ static int dpu_encoder_phys_vid_control_vblank_irq( goto end; } - DRM_DEBUG_KMS("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, - atomic_read(&phys_enc->vblank_refcount)); + DRM_DEBUG_VBL("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, + refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_VSYNC); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("failed: id:%u intf:%d ret:%d enable:%d refcnt:%d\n", DRMID(phys_enc->parent), @@ -742,7 +752,7 @@ static void dpu_encoder_phys_vid_irq_control(struct dpu_encoder_phys *phys_enc, trace_dpu_enc_phys_vid_irq_ctrl(DRMID(phys_enc->parent), vid_enc->hw_intf->idx - INTF_0, enable, - atomic_read(&phys_enc->vblank_refcount)); + phys_enc->vblank_refcount); if (enable) { ret = dpu_encoder_phys_vid_control_vblank_irq(phys_enc, true); @@ -877,6 +887,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( DPU_DEBUG_VIDENC(vid_enc, "\n"); + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_vid_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -904,7 +917,7 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_vid_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); + phys_enc->vblank_refcount = 0; atomic_set(&phys_enc->pending_kickoff_cnt, 0); init_waitqueue_head(&phys_enc->pending_kickoff_wq); phys_enc->enable_state = DPU_ENC_DISABLED; -- 2.25.1

2 1

[PATCH OLK-5.10 V1] drm/msm/dpu: Add mutex lock in control vblank irq
by Cheng Yu 18 Mar '24

18 Mar '24

From: Paloma Arellano <quic_parellan(a)quicinc.com> stable inclusion from stable-v6.7.4 commit 14f109bf74dd67e1d0469fed859c8e506b0df53f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNY CVE: CVE-2023-52586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 45284ff733e4caf6c118aae5131eb7e7cf3eea5a ] Add a mutex lock to control vblank irq to synchronize vblank enable/disable operations happening from different threads to prevent race conditions while registering/unregistering the vblank irq callback. v4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a parameter of dpu_encoder_phys. -Switch from atomic refcnt to a simple int counter as mutex has now been added v3: Mistakenly did not change wording in last version. It is done now. v2: Slightly changed wording of commit message Signed-off-by: Paloma Arellano <quic_parellan(a)quicinc.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/571854/ Link: https://lore.kernel.org/r/20231212231101.9240-2-quic_parellan@quicinc.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h | 4 ++- .../drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 28 +++++++++++----- .../drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 32 +++++++++++++------ 3 files changed, 45 insertions(+), 19 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h index f8f25157f635..f32a05355e78 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h @@ -194,6 +194,7 @@ struct dpu_encoder_irq { * @hw_intf: Hardware interface to the intf registers * @dpu_kms: Pointer to the dpu_kms top level * @cached_mode: DRM mode cached at mode_set time, acted on in enable + * @vblank_ctl_lock: Vblank ctl mutex lock to protect vblank_refcount * @enabled: Whether the encoder has enabled and running a mode * @split_role: Role to play in a split-panel configuration * @intf_mode: Interface mode @@ -223,12 +224,13 @@ struct dpu_encoder_phys { struct dpu_hw_intf *hw_intf; struct dpu_kms *dpu_kms; struct drm_display_mode cached_mode; + struct mutex vblank_ctl_lock; enum dpu_enc_split_role split_role; enum dpu_intf_mode intf_mode; enum dpu_intf intf_idx; spinlock_t *enc_spinlock; enum dpu_enc_enable_state enable_state; - atomic_t vblank_refcount; + int vblank_refcount; atomic_t vsync_cnt; atomic_t underrun_cnt; atomic_t pending_ctlstart_cnt; diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c index 8493d68ad841..cad7f5686dc0 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c @@ -263,7 +263,8 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( return -EINVAL; } - refcount = atomic_read(&phys_enc->vblank_refcount); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_cmd_is_master(phys_enc)) @@ -279,13 +280,21 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( phys_enc->hw_pp->idx - PINGPONG_0, enable ? "true" : "false", refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_RDPTR); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("vblank irq err id:%u pp:%d ret:%d, enable %s/%d\n", DRMID(phys_enc->parent), @@ -301,7 +310,7 @@ static void dpu_encoder_phys_cmd_irq_control(struct dpu_encoder_phys *phys_enc, { trace_dpu_enc_phys_cmd_irq_ctrl(DRMID(phys_enc->parent), phys_enc->hw_pp->idx - PINGPONG_0, - enable, atomic_read(&phys_enc->vblank_refcount)); + enable, phys_enc->vblank_refcount); if (enable) { dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_PINGPONG); @@ -724,6 +733,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( phys_enc->hw_mdptop = p->dpu_kms->hw_mdp; phys_enc->intf_idx = p->intf_idx; + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_cmd_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -765,7 +777,7 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_cmd_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); + phys_enc->vblank_refcount = 0; atomic_set(&phys_enc->pending_kickoff_cnt, 0); atomic_set(&phys_enc->pending_ctlstart_cnt, 0); atomic_set(&cmd_enc->pending_vblank_cnt, 0); diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c index 805e059b50b7..3aaaf58e798b 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c @@ -395,7 +395,8 @@ static int dpu_encoder_phys_vid_control_vblank_irq( int ret = 0; int refcount; - refcount = atomic_read(&phys_enc->vblank_refcount); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_vid_is_master(phys_enc)) @@ -407,16 +408,24 @@ static int dpu_encoder_phys_vid_control_vblank_irq( goto end; } - DRM_DEBUG_KMS("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, - atomic_read(&phys_enc->vblank_refcount)); + DRM_DEBUG_VBL("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, + refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_VSYNC); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("failed: id:%u intf:%d ret:%d enable:%d refcnt:%d\n", DRMID(phys_enc->parent), @@ -631,7 +640,7 @@ static void dpu_encoder_phys_vid_irq_control(struct dpu_encoder_phys *phys_enc, trace_dpu_enc_phys_vid_irq_ctrl(DRMID(phys_enc->parent), phys_enc->hw_intf->idx - INTF_0, enable, - atomic_read(&phys_enc->vblank_refcount)); + phys_enc->vblank_refcount); if (enable) { ret = dpu_encoder_phys_vid_control_vblank_irq(phys_enc, true); @@ -700,6 +709,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( DPU_DEBUG_VIDENC(phys_enc, "\n"); + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_vid_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -727,7 +739,7 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_vid_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); + phys_enc->vblank_refcount = 0; atomic_set(&phys_enc->pending_kickoff_cnt, 0); init_waitqueue_head(&phys_enc->pending_kickoff_wq); phys_enc->enable_state = DPU_ENC_DISABLED; -- 2.25.1

2 1

[PATCH OLK-5.10] bus: mhi: host: Add alignment check for event ring read pointer
by Cai Xinchen 18 Mar '24

18 Mar '24

From: Krishna chaitanya chundru <quic_krichai(a)quicinc.com> mainline inclusion from mainline-v6.8-rc1 commit eff9704f5332a13b08fbdbe0f84059c9e7051d5f category: bugfix bugzilla: 189679 CVE: CVE-2023-52494 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------ Though we do check the event ring read pointer by "is_valid_ring_ptr" to make sure it is in the buffer range, but there is another risk the pointer may be not aligned. Since we are expecting event ring elements are 128 bits(struct mhi_ring_element) aligned, an unaligned read pointer could lead to multiple issues like DoS or ring buffer memory corruption. So add a alignment check for event ring read pointer. Fixes: ec32332df764 ("bus: mhi: core: Sanity check values from remote device before use") cc: stable(a)vger.kernel.org Signed-off-by: Krishna chaitanya chundru <quic_krichai(a)quicinc.com> Reviewed-by: Jeffrey Hugo <quic_jhugo(a)quicinc.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Link: https://lore.kernel.org/r/20231031-alignment_check-v2-1-1441db7c5efd@quicin… Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> conflicts: drivers/bus/mhi/host/main.c Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/bus/mhi/host/main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c index 614dd287cb4f..82d6e9e8bddf 100644 --- a/drivers/bus/mhi/host/main.c +++ b/drivers/bus/mhi/host/main.c @@ -222,7 +222,8 @@ static void mhi_del_ring_element(struct mhi_controller *mhi_cntrl, static bool is_valid_ring_ptr(struct mhi_ring *ring, dma_addr_t addr) { - return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len; + return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len && + !(addr & (sizeof(struct mhi_tre) - 1)); } int mhi_destroy_device(struct device *dev, void *data) -- 2.34.1

2 1

[PATCH OLK-5.10 V1] drm/msm/dpu: Add mutex lock in control vblank irq
by Cheng Yu 18 Mar '24

18 Mar '24

From: Paloma Arellano <quic_parellan(a)quicinc.com> stable inclusion from stable-v6.7.4 commit 14f109bf74dd67e1d0469fed859c8e506b0df53f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNY CVE: CVE-2023-52586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 45284ff733e4caf6c118aae5131eb7e7cf3eea5a ] Add a mutex lock to control vblank irq to synchronize vblank enable/disable operations happening from different threads to prevent race conditions while registering/unregistering the vblank irq callback. v4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a parameter of dpu_encoder_phys. -Switch from atomic refcnt to a simple int counter as mutex has now been added v3: Mistakenly did not change wording in last version. It is done now. v2: Slightly changed wording of commit message Signed-off-by: Paloma Arellano <quic_parellan(a)quicinc.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/571854/ Link: https://lore.kernel.org/r/20231212231101.9240-2-quic_parellan@quicinc.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h | 4 ++- .../drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 28 +++++++++++----- .../drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 32 +++++++++++++------ 3 files changed, 45 insertions(+), 19 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h index f8f25157f635..f32a05355e78 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h @@ -194,6 +194,7 @@ struct dpu_encoder_irq { * @hw_intf: Hardware interface to the intf registers * @dpu_kms: Pointer to the dpu_kms top level * @cached_mode: DRM mode cached at mode_set time, acted on in enable + * @vblank_ctl_lock: Vblank ctl mutex lock to protect vblank_refcount * @enabled: Whether the encoder has enabled and running a mode * @split_role: Role to play in a split-panel configuration * @intf_mode: Interface mode @@ -223,12 +224,13 @@ struct dpu_encoder_phys { struct dpu_hw_intf *hw_intf; struct dpu_kms *dpu_kms; struct drm_display_mode cached_mode; + struct mutex vblank_ctl_lock; enum dpu_enc_split_role split_role; enum dpu_intf_mode intf_mode; enum dpu_intf intf_idx; spinlock_t *enc_spinlock; enum dpu_enc_enable_state enable_state; - atomic_t vblank_refcount; + int vblank_refcount; atomic_t vsync_cnt; atomic_t underrun_cnt; atomic_t pending_ctlstart_cnt; diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c index 8493d68ad841..cad7f5686dc0 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c @@ -263,7 +263,8 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( return -EINVAL; } - refcount = atomic_read(&phys_enc->vblank_refcount); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_cmd_is_master(phys_enc)) @@ -279,13 +280,21 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( phys_enc->hw_pp->idx - PINGPONG_0, enable ? "true" : "false", refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_RDPTR); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("vblank irq err id:%u pp:%d ret:%d, enable %s/%d\n", DRMID(phys_enc->parent), @@ -301,7 +310,7 @@ static void dpu_encoder_phys_cmd_irq_control(struct dpu_encoder_phys *phys_enc, { trace_dpu_enc_phys_cmd_irq_ctrl(DRMID(phys_enc->parent), phys_enc->hw_pp->idx - PINGPONG_0, - enable, atomic_read(&phys_enc->vblank_refcount)); + enable, phys_enc->vblank_refcount); if (enable) { dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_PINGPONG); @@ -724,6 +733,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( phys_enc->hw_mdptop = p->dpu_kms->hw_mdp; phys_enc->intf_idx = p->intf_idx; + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_cmd_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -765,7 +777,7 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_cmd_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); + phys_enc->vblank_refcount = 0; atomic_set(&phys_enc->pending_kickoff_cnt, 0); atomic_set(&phys_enc->pending_ctlstart_cnt, 0); atomic_set(&cmd_enc->pending_vblank_cnt, 0); diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c index 805e059b50b7..3aaaf58e798b 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c @@ -395,7 +395,8 @@ static int dpu_encoder_phys_vid_control_vblank_irq( int ret = 0; int refcount; - refcount = atomic_read(&phys_enc->vblank_refcount); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_vid_is_master(phys_enc)) @@ -407,16 +408,24 @@ static int dpu_encoder_phys_vid_control_vblank_irq( goto end; } - DRM_DEBUG_KMS("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, - atomic_read(&phys_enc->vblank_refcount)); + DRM_DEBUG_VBL("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, + refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_VSYNC); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("failed: id:%u intf:%d ret:%d enable:%d refcnt:%d\n", DRMID(phys_enc->parent), @@ -631,7 +640,7 @@ static void dpu_encoder_phys_vid_irq_control(struct dpu_encoder_phys *phys_enc, trace_dpu_enc_phys_vid_irq_ctrl(DRMID(phys_enc->parent), phys_enc->hw_intf->idx - INTF_0, enable, - atomic_read(&phys_enc->vblank_refcount)); + phys_enc->vblank_refcount); if (enable) { ret = dpu_encoder_phys_vid_control_vblank_irq(phys_enc, true); @@ -700,6 +709,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( DPU_DEBUG_VIDENC(phys_enc, "\n"); + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_vid_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -727,7 +739,7 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_vid_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); + phys_enc->vblank_refcount = 0; atomic_set(&phys_enc->pending_kickoff_cnt, 0); init_waitqueue_head(&phys_enc->pending_kickoff_wq); phys_enc->enable_state = DPU_ENC_DISABLED; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS v2 0/5] CVE-2023-52595
by Pu Lehui 18 Mar '24

18 Mar '24

Shiji Yang (1): wifi: rt2x00: restart beacon queue when hardware reset Stanislaw Gruszka (4): rt2800: do not nullify initialization vector data rt2800: add pre_reset_hw callback rt2x00: clear IV's on start to fix AP mode regression rt2x00: clear up IV's on key removal .../net/wireless/ralink/rt2x00/rt2800lib.c | 52 +++++++++++++++---- .../net/wireless/ralink/rt2x00/rt2800lib.h | 1 + .../net/wireless/ralink/rt2x00/rt2800pci.c | 1 + .../net/wireless/ralink/rt2x00/rt2800soc.c | 1 + .../net/wireless/ralink/rt2x00/rt2800usb.c | 1 + drivers/net/wireless/ralink/rt2x00/rt2x00.h | 2 + .../net/wireless/ralink/rt2x00/rt2x00dev.c | 26 +++++++--- .../net/wireless/ralink/rt2x00/rt2x00mac.c | 11 ++++ 8 files changed, 78 insertions(+), 17 deletions(-) -- 2.34.1

2 6

[PATCH OLK-5.10] bus: mhi: host: Add alignment check for event ring read pointer
by Cai Xinchen 18 Mar '24

18 Mar '24

From: Krishna chaitanya chundru <quic_krichai(a)quicinc.com> mainline inclusion from mainline-v6.8-rc1 commit eff9704f5332a13b08fbdbe0f84059c9e7051d5f category: bugfix bugzilla: 189679 CVE: CVE-2023-52494 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------ Though we do check the event ring read pointer by "is_valid_ring_ptr" to make sure it is in the buffer range, but there is another risk the pointer may be not aligned. Since we are expecting event ring elements are 128 bits(struct mhi_ring_element) aligned, an unaligned read pointer could lead to multiple issues like DoS or ring buffer memory corruption. So add a alignment check for event ring read pointer. Fixes: ec32332df764 ("bus: mhi: core: Sanity check values from remote device before use") cc: stable(a)vger.kernel.org Signed-off-by: Krishna chaitanya chundru <quic_krichai(a)quicinc.com> Reviewed-by: Jeffrey Hugo <quic_jhugo(a)quicinc.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Link: https://lore.kernel.org/r/20231031-alignment_check-v2-1-1441db7c5efd@quicin… Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> conflicts: drivers/bus/mhi/host/main.c Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/bus/mhi/host/main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c index 614dd287cb4f..a705bd78e659 100644 --- a/drivers/bus/mhi/host/main.c +++ b/drivers/bus/mhi/host/main.c @@ -222,7 +222,8 @@ static void mhi_del_ring_element(struct mhi_controller *mhi_cntrl, static bool is_valid_ring_ptr(struct mhi_ring *ring, dma_addr_t addr) { - return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len; + return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len && + !(addr & (struct mhi_tre) - 1)); } int mhi_destroy_device(struct device *dev, void *data) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] cifs: Fix UAF in cifs_demultiplex_thread()
by ZhaoLong Wang 18 Mar '24

18 Mar '24

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> mainline inclusion from mainline-v6.6-rc3 commit d527f51331cace562393a8038d870b3e9916686f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AUA CVE: CVE-2023-52572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45 ... Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 kasan_check_range+0x145/0x1a0 smb2_is_network_name_deleted+0x27/0x160 cifs_demultiplex_thread.cold+0x172/0x5a4 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 923: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x54/0x60 kmem_cache_alloc+0x147/0x320 mempool_alloc+0xe1/0x260 cifs_small_buf_get+0x24/0x60 allocate_buffers+0xa1/0x1c0 cifs_demultiplex_thread+0x199/0x10d0 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 Freed by task 921: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 kmem_cache_free+0xe3/0x4d0 cifs_small_buf_release+0x29/0x90 SMB2_negotiate+0x8b7/0x1c60 smb2_negotiate+0x51/0x70 cifs_negotiate_protocol+0xf0/0x160 cifs_get_smb_ses+0x5fa/0x13c0 mount_get_conns+0x7a/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The UAF is because: mount(pid: 921) | cifsd(pid: 923) -------------------------------|------------------------------- | cifs_demultiplex_thread SMB2_negotiate | cifs_send_recv | compound_send_recv | smb_send_rqst | wait_for_response | wait_event_state [1] | | standard_receive3 | cifs_handle_standard | handle_mid | mid->resp_buf = buf; [2] | dequeue_mid [3] KILL the process [4] | resp_iov[i].iov_base = buf | free_rsp_buf [5] | | is_network_name_deleted [6] | callback 1. After send request to server, wait the response until mid->mid_state != SUBMITTED; 2. Receive response from server, and set it to mid; 3. Set the mid state to RECEIVED; 4. Kill the process, the mid state already RECEIVED, get 0; 5. Handle and release the negotiate response; 6. UAF. It can be easily reproduce with add some delay in [3] - [6]. Only sync call has the problem since async call's callback is executed in cifsd process. Add an extra state to mark the mid state to READY before wakeup the waitter, then it can get the resp safely. Fixes: ec637e3ffb6b ("[CIFS] Avoid extra large buffer allocation (and memcpy) in cifs_readpages") Reviewed-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/transport.c fs/cifs/connect.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/cifsglob.h | 1 + fs/cifs/connect.c | 3 ++- fs/cifs/transport.c | 30 ++++++++++++++++++++---------- 3 files changed, 23 insertions(+), 11 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 71c2dd0c7f03..f9abe37c549c 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -1597,6 +1597,7 @@ static inline bool is_retryable_error(int error) #define MID_RETRY_NEEDED 8 /* session closed while this request out */ #define MID_RESPONSE_MALFORMED 0x10 #define MID_SHUTDOWN 0x20 +#define MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */ /* Flags */ #define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */ diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 4ca6fd66df03..684dbd580a27 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -1079,7 +1079,8 @@ cifs_demultiplex_thread(void *p) if (mids[i] != NULL) { mids[i]->resp_buf_size = server->pdu_size; if ((mids[i]->mid_flags & MID_WAIT_CANCELLED) && - mids[i]->mid_state == MID_RESPONSE_RECEIVED && + (mids[i]->mid_state == MID_RESPONSE_RECEIVED || + mids[i]->mid_state == MID_RESPONSE_READY) && server->ops->handle_cancelled_mid) server->ops->handle_cancelled_mid( mids[i]->resp_buf, diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index eb76f7a59e50..fa83799b3ec0 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -46,6 +46,8 @@ void cifs_wake_up_task(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; wake_up_process(mid->callback_data); } @@ -561,7 +563,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ) int error; error = wait_event_freezekillable_unsafe(server->response_q, - midQ->mid_state != MID_REQUEST_SUBMITTED); + midQ->mid_state != MID_REQUEST_SUBMITTED && + midQ->mid_state != MID_RESPONSE_RECEIVED); if (error < 0) return -ERESTARTSYS; @@ -699,7 +702,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server) spin_lock(&GlobalMid_Lock); switch (mid->mid_state) { - case MID_RESPONSE_RECEIVED: + case MID_RESPONSE_READY: spin_unlock(&GlobalMid_Lock); return rc; case MID_RETRY_NEEDED: @@ -790,6 +793,8 @@ cifs_setup_request(struct cifs_ses *ses, struct smb_rqst *rqst) static void cifs_noop_callback(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; } int @@ -912,7 +917,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, midQ[i]->mid); send_cancel(ses->server, &rqst[i], midQ[i]); spin_lock(&GlobalMid_Lock); - if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED || + midQ[i]->mid_state == MID_RESPONSE_RECEIVED) { midQ[i]->mid_flags |= MID_WAIT_CANCELLED; midQ[i]->callback = DeleteMidQEntry; cancelled_mid[i] = true; @@ -938,7 +944,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, } if (!midQ[i]->resp_buf || - midQ[i]->mid_state != MID_RESPONSE_RECEIVED) { + midQ[i]->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(FYI, "Bad MID state?\n"); goto out; @@ -1118,7 +1124,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, if (rc != 0) { send_cancel(ses->server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1135,7 +1142,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, } if (!midQ->resp_buf || !out_buf || - midQ->mid_state != MID_RESPONSE_RECEIVED) { + midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(VFS, "Bad MID state?\n"); goto out; @@ -1254,13 +1261,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, /* Wait for a reply - allow signals to interrupt. */ rc = wait_event_interruptible(ses->server->response_q, - (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) || + (!(midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED)) || ((ses->server->tcpStatus != CifsGood) && (ses->server->tcpStatus != CifsNew))); /* Were we interrupted by a signal ? */ if ((rc == -ERESTARTSYS) && - (midQ->mid_state == MID_REQUEST_SUBMITTED) && + (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) && ((ses->server->tcpStatus == CifsGood) || (ses->server->tcpStatus == CifsNew))) { @@ -1290,7 +1299,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, if (rc) { send_cancel(ses->server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1308,7 +1318,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, return rc; /* rcvd frame is ok */ - if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) { + if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(VFS, "Bad MID state?\n"); goto out; -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS V1] drm/msm/dpu: Add mutex lock in control vblank irq
by Cheng Yu 18 Mar '24

18 Mar '24

From: Paloma Arellano <quic_parellan(a)quicinc.com> stable inclusion from stable-v6.7.4 commit 14f109bf74dd67e1d0469fed859c8e506b0df53f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNY CVE: CVE-2023-52586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 45284ff733e4caf6c118aae5131eb7e7cf3eea5a ] Add a mutex lock to control vblank irq to synchronize vblank enable/disable operations happening from different threads to prevent race conditions while registering/unregistering the vblank irq callback. v4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a parameter of dpu_encoder_phys. -Switch from atomic refcnt to a simple int counter as mutex has now been added v3: Mistakenly did not change wording in last version. It is done now. v2: Slightly changed wording of commit message Signed-off-by: Paloma Arellano <quic_parellan(a)quicinc.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/571854/ Link: https://lore.kernel.org/r/20231212231101.9240-2-quic_parellan@quicinc.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h | 4 ++- .../drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 28 +++++++++++----- .../drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 33 +++++++++++++------ 3 files changed, 46 insertions(+), 19 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h index c7df8aad6613..f376e87e0768 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h @@ -215,6 +215,7 @@ struct dpu_encoder_irq { * @hw_pp: Hardware interface to the ping pong registers * @dpu_kms: Pointer to the dpu_kms top level * @cached_mode: DRM mode cached at mode_set time, acted on in enable + * @vblank_ctl_lock: Vblank ctl mutex lock to protect vblank_refcount * @enabled: Whether the encoder has enabled and running a mode * @split_role: Role to play in a split-panel configuration * @intf_mode: Interface mode @@ -246,13 +247,14 @@ struct dpu_encoder_phys { struct dpu_hw_pingpong *hw_pp; struct dpu_kms *dpu_kms; struct drm_display_mode cached_mode; + struct mutex vblank_ctl_lock; enum dpu_enc_split_role split_role; enum dpu_intf_mode intf_mode; enum dpu_intf intf_idx; enum dpu_rm_topology_name topology_name; spinlock_t *enc_spinlock; enum dpu_enc_enable_state enable_state; - atomic_t vblank_refcount; + int vblank_refcount; atomic_t vsync_cnt; atomic_t underrun_cnt; atomic_t pending_ctlstart_cnt; diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c index 3084675ed425..b53a566f1ffc 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c @@ -316,7 +316,8 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( return -EINVAL; } - refcount = atomic_read(&phys_enc->vblank_refcount); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_cmd_is_master(phys_enc)) @@ -332,13 +333,21 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( phys_enc->hw_pp->idx - PINGPONG_0, enable ? "true" : "false", refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_RDPTR); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("vblank irq err id:%u pp:%d ret:%d, enable %s/%d\n", DRMID(phys_enc->parent), @@ -361,7 +370,7 @@ static void dpu_encoder_phys_cmd_irq_control(struct dpu_encoder_phys *phys_enc, trace_dpu_enc_phys_cmd_irq_ctrl(DRMID(phys_enc->parent), phys_enc->hw_pp->idx - PINGPONG_0, - enable, atomic_read(&phys_enc->vblank_refcount)); + enable, phys_enc->vblank_refcount); if (enable) { dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_PINGPONG); @@ -846,6 +855,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( phys_enc->hw_mdptop = hw_mdp; phys_enc->intf_idx = p->intf_idx; + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_cmd_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -887,7 +899,7 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_cmd_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); + phys_enc->vblank_refcount; atomic_set(&phys_enc->pending_kickoff_cnt, 0); atomic_set(&phys_enc->pending_ctlstart_cnt, 0); atomic_set(&cmd_enc->pending_vblank_cnt, 0); diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c index c9962a36b86b..27d283dd97aa 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c @@ -445,9 +445,11 @@ static int dpu_encoder_phys_vid_control_vblank_irq( return -EINVAL; } - refcount = atomic_read(&phys_enc->vblank_refcount); vid_enc = to_dpu_encoder_phys_vid(phys_enc); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; + /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_vid_is_master(phys_enc)) goto end; @@ -458,16 +460,24 @@ static int dpu_encoder_phys_vid_control_vblank_irq( goto end; } - DRM_DEBUG_KMS("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, - atomic_read(&phys_enc->vblank_refcount)); + DRM_DEBUG_VBL("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, + refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_VSYNC); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("failed: id:%u intf:%d ret:%d enable:%d refcnt:%d\n", DRMID(phys_enc->parent), @@ -742,7 +752,7 @@ static void dpu_encoder_phys_vid_irq_control(struct dpu_encoder_phys *phys_enc, trace_dpu_enc_phys_vid_irq_ctrl(DRMID(phys_enc->parent), vid_enc->hw_intf->idx - INTF_0, enable, - atomic_read(&phys_enc->vblank_refcount)); + phys_enc->vblank_refcount); if (enable) { ret = dpu_encoder_phys_vid_control_vblank_irq(phys_enc, true); @@ -877,6 +887,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( DPU_DEBUG_VIDENC(vid_enc, "\n"); + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_vid_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -904,7 +917,7 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_vid_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); + phys_enc->vblank_refcount = 0; atomic_set(&phys_enc->pending_kickoff_cnt, 0); init_waitqueue_head(&phys_enc->pending_kickoff_wq); phys_enc->enable_state = DPU_ENC_DISABLED; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 1/5] rt2800: do not nullify initialization vector data
by Pu Lehui 18 Mar '24

18 Mar '24

From: Stanislaw Gruszka <sgruszka(a)redhat.com> mainline inclusion from mainline-v5.3-rc1 commit 710e6cc1595e25378c4b9977f7a8b4ad4a72a109 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GO9 CVE: CVE-2023-52595 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If we restart hw we should keep existing IV (initialization vector) otherwise HW encryption will be broken after restart. Also fix some coding style issues on the way. Signed-off-by: Stanislaw Gruszka <sgruszka(a)redhat.com> Signed-off-by: Kalle Valo <kvalo(a)codeaurora.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c index a567bc273ffc..e499789674ca 100644 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c @@ -1440,14 +1440,15 @@ static void rt2800_config_wcid_attr_cipher(struct rt2x00_dev *rt2x00dev, offset = MAC_IVEIV_ENTRY(key->hw_key_idx); - memset(&iveiv_entry, 0, sizeof(iveiv_entry)); + rt2800_register_multiread(rt2x00dev, offset, + &iveiv_entry, sizeof(iveiv_entry)); if ((crypto->cipher == CIPHER_TKIP) || (crypto->cipher == CIPHER_TKIP_NO_MIC) || (crypto->cipher == CIPHER_AES)) iveiv_entry.iv[3] |= 0x20; iveiv_entry.iv[3] |= key->keyidx << 6; rt2800_register_multiwrite(rt2x00dev, offset, - &iveiv_entry, sizeof(iveiv_entry)); + &iveiv_entry, sizeof(iveiv_entry)); } int rt2800_config_shared_key(struct rt2x00_dev *rt2x00dev, @@ -5546,13 +5547,11 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev) * ASIC will keep garbage value after boot, clear encryption keys. */ for (i = 0; i < 4; i++) - rt2800_register_write(rt2x00dev, - SHARED_KEY_MODE_ENTRY(i), 0); + rt2800_register_write(rt2x00dev, SHARED_KEY_MODE_ENTRY(i), 0); for (i = 0; i < 256; i++) { rt2800_config_wcid(rt2x00dev, NULL, i); rt2800_delete_wcid_attr(rt2x00dev, i); - rt2800_register_write(rt2x00dev, MAC_IVEIV_ENTRY(i), 0); } /* -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] nfsd: fix use-after-free due to delegation race
by Li Lingfeng 18 Mar '24

18 Mar '24

From: "J. Bruce Fields" <bfields(a)redhat.com> mainline inclusion from mainline-v5.16-rc5 commit 548ec0805c399c65ed66c6641be467f717833ab5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I99EU2 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A delegation break could arrive as soon as we've called vfs_setlease. A delegation break runs a callback which immediately (in nfsd4_cb_recall_prepare) adds the delegation to del_recall_lru. If we then exit nfs4_set_delegation without hashing the delegation, it will be freed as soon as the callback is done with it, without ever being removed from del_recall_lru. Symptoms show up later as use-after-free or list corruption warnings, usually in the laundromat thread. I suspect aba2072f4523 "nfsd: grant read delegations to clients holding writes" made this bug easier to hit, but I looked as far back as v3.0 and it looks to me it already had the same problem. So I'm not sure where the bug was introduced; it may have been there from the beginning. Cc: stable(a)vger.kernel.org Signed-off-by: J. Bruce Fields <bfields(a)redhat.com> Conflict: fs/nfsd/nfs4state.c Commit 20b7d86f29d3("nfsd: use boottime for lease expiry calculation") get cl_time by ktime_get_boottime_seconds() instead of get_seconds(). Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4state.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index c8ce128e0054..d5d40aefd0a6 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -971,6 +971,11 @@ hash_delegation_locked(struct nfs4_delegation *dp, struct nfs4_file *fp) return 0; } +static bool delegation_hashed(struct nfs4_delegation *dp) +{ + return !(list_empty(&dp->dl_perfile)); +} + static bool unhash_delegation_locked(struct nfs4_delegation *dp) { @@ -978,7 +983,7 @@ unhash_delegation_locked(struct nfs4_delegation *dp) lockdep_assert_held(&state_lock); - if (list_empty(&dp->dl_perfile)) + if (!delegation_hashed(dp)) return false; dp->dl_stid.sc_type = NFS4_CLOSED_DELEG_STID; @@ -3901,7 +3906,7 @@ static void nfsd4_cb_recall_prepare(struct nfsd4_callback *cb) * queued for a lease break. Don't queue it again. */ spin_lock(&state_lock); - if (dp->dl_time == 0) { + if (delegation_hashed(dp) && dp->dl_time == 0) { dp->dl_time = get_seconds(); list_add_tail(&dp->dl_recall_lru, &nn->del_recall_lru); } -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS 0/3] crypto: algif_aead - Only wake up when ctx->more is zero
by GUO Zihua 18 Mar '24

18 Mar '24

This patchset backports commit f3c802a1f300 ("crypto: algif_aead - Only wake up when ctx->more is zero") and following bugfixes. commit 21dfbcd1f5cb ("crypto: algif_aead - fix uninitialized ctx->init") is merged beforehand. Herbert Xu (3): crypto: algif_aead - Only wake up when ctx->more is zero crypto: af_alg - Fix regression on empty requests crypto: af_alg - Work around empty control messages without MSG_MORE crypto/af_alg.c | 22 +++++++++++++++++----- crypto/algif_aead.c | 4 ++-- crypto/algif_skcipher.c | 4 ++-- include/crypto/if_alg.h | 4 +++- 4 files changed, 24 insertions(+), 10 deletions(-) -- 2.34.1

2 4

[openeuler:OLK-6.6 1626/4034] drivers/char/ipmi/ipmi_si_ls2k500.c:92:5: sparse: sparse: symbol 'ipmi_si_sim_setup' was not declared. Should it be static?
by kernel test robot 18 Mar '24

18 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 23534451f50070452c470859343af52684963e9d commit: 4fbeaa84ef36adce930088074f8c088e5dd780c0 [1626/4034] ipmi: add ls2k500 bmc ipmi support. config: loongarch-randconfig-r123-20240317 (https://download.01.org/0day-ci/archive/20240318/202403181245.X9tjCWvK-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240318/202403181245.X9tjCWvK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403181245.X9tjCWvK-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/char/ipmi/ipmi_si_ls2k500.c:92:5: sparse: sparse: symbol 'ipmi_si_sim_setup' was not declared. Should it be static? >> drivers/char/ipmi/ipmi_si_ls2k500.c:116:29: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *[addressable] [assigned] addr_source_data @@ got void [noderef] __iomem * @@ drivers/char/ipmi/ipmi_si_ls2k500.c:116:29: sparse: expected void *[addressable] [assigned] addr_source_data drivers/char/ipmi/ipmi_si_ls2k500.c:116:29: sparse: got void [noderef] __iomem * >> drivers/char/ipmi/ipmi_si_ls2k500.c:148:24: sparse: sparse: symbol 'ipmi_ls2k500_platform_driver' was not declared. Should it be static? drivers/char/ipmi/ipmi_si_ls2k500.c: note: in included file (through include/linux/mmzone.h, include/linux/gfp.h, include/linux/umh.h, include/linux/kmod.h, ...): include/linux/page-flags.h:242:46: sparse: sparse: self-comparison always evaluates to false vim +/ipmi_si_sim_setup +92 drivers/char/ipmi/ipmi_si_ls2k500.c 91 > 92 int ipmi_si_sim_setup(struct si_sm_io *io) 93 { 94 io->inputb = intf_sim_inb; 95 io->outputb = intf_sim_outb; 96 io->io_cleanup = ipmi_ls2k500_cleanup; 97 return 0; 98 } 99 100 #define platform_resource_start(dev, bar) ((dev)->resource[(bar)].start) 101 #define platform_resource_end(dev, bar) ((dev)->resource[(bar)].end) 102 static int of_ipmi_ls2k500_probe(struct platform_device *pdev) 103 { 104 int rv; 105 struct si_sm_io io; 106 void **kcs_data; 107 108 memset(&io, 0, sizeof(io)); 109 io.addr_source = SI_PLATFORM; 110 dev_info(&pdev->dev, "probing via ls2k500 platform"); 111 io.si_type = SI_KCS; 112 113 io.addr_space = IPMI_MEM_ADDR_SPACE; 114 io.io_setup = ipmi_si_sim_setup; 115 io.addr_data = pdev->resource[0].start; > 116 io.addr_source_data = ioremap(pdev->resource[0].start, 117 pdev->resource[0].end - 118 pdev->resource[0].start + 1); 119 kcs_data = dev_get_platdata(&pdev->dev); 120 event_jiffies = kcs_data[0]; 121 mscycles = kcs_data[1]; 122 io.dev = &pdev->dev; 123 io.regspacing = 4; 124 io.regsize = DEFAULT_REGSIZE; 125 io.regshift = 0; 126 io.irq = 0; 127 if (io.irq) 128 io.irq_setup = ipmi_std_irq_setup; 129 130 dev_info(&pdev->dev, "%pR regsize %d spacing %d irq %d\n", 131 &pdev->resource[0], io.regsize, io.regspacing, io.irq); 132 133 rv = ipmi_si_add_smi(&io); 134 if (rv) 135 ipmi_si_remove_by_dev(&pdev->dev); 136 137 return rv; 138 } 139 140 static int ipmi_ls2k500_remove(struct platform_device *pdev) 141 { 142 ipmi_si_remove_by_dev(&pdev->dev); 143 144 return 0; 145 } 146 147 #define LS2K500_SI_DEVICE_NAME "ipmi_ls2k500_si" > 148 struct platform_driver ipmi_ls2k500_platform_driver = { 149 .driver = { 150 .name = LS2K500_SI_DEVICE_NAME, 151 }, 152 .probe = of_ipmi_ls2k500_probe, 153 .remove = ipmi_ls2k500_remove, 154 }; 155 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
by GONG, Ruiqi 18 Mar '24

18 Mar '24

From: Hugo Villeneuve <hvilleneuve(a)dimonoff.com> stable inclusion from stable-v6.1.76 commit 416b10d2817c94db86829fb92ad43ce7d002c573 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96ZNC CVE: CVE-2023-52488 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dbf4ab821804df071c8b566d9813083125e6d97b upstream. The SC16IS7XX IC supports a burst mode to access the FIFOs where the initial register address is sent ($00), followed by all the FIFO data without having to resend the register address each time. In this mode, the IC doesn't increment the register address for each R/W byte. The regmap_raw_read() and regmap_raw_write() are functions which can perform IO over multiple registers. They are currently used to read/write from/to the FIFO, and although they operate correctly in this burst mode on the SPI bus, they would corrupt the regmap cache if it was not disabled manually. The reason is that when the R/W size is more than 1 byte, these functions assume that the register address is incremented and handle the cache accordingly. Convert FIFO R/W functions to use the regmap _noinc_ versions in order to remove the manual cache control which was a workaround when using the _raw_ versions. FIFO registers are properly declared as volatile so cache will not be used/updated for FIFO accesses. Fixes: dfeae619d781 ("serial: sc16is7xx") Cc: <stable(a)vger.kernel.org> Signed-off-by: Hugo Villeneuve <hvilleneuve(a)dimonoff.com> Link: https://lore.kernel.org/r/20231211171353.2901416-6-hugo@hugovil.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/serial/sc16is7xx.c Signed-off-by: GONG, Ruiqi <gongruiqi1(a)huawei.com> --- drivers/tty/serial/sc16is7xx.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c index c681ed589303..5a08fe0df132 100644 --- a/drivers/tty/serial/sc16is7xx.c +++ b/drivers/tty/serial/sc16is7xx.c @@ -375,9 +375,7 @@ static void sc16is7xx_fifo_read(struct uart_port *port, unsigned int rxlen) const u8 line = sc16is7xx_line(port); u8 addr = (SC16IS7XX_RHR_REG << SC16IS7XX_REG_SHIFT) | line; - regcache_cache_bypass(s->regmap, true); - regmap_raw_read(s->regmap, addr, s->buf, rxlen); - regcache_cache_bypass(s->regmap, false); + regmap_noinc_read(s->regmap, addr, s->buf, rxlen); } static void sc16is7xx_fifo_write(struct uart_port *port, u8 to_send) @@ -393,9 +391,7 @@ static void sc16is7xx_fifo_write(struct uart_port *port, u8 to_send) if (unlikely(!to_send)) return; - regcache_cache_bypass(s->regmap, true); - regmap_raw_write(s->regmap, addr, s->buf, to_send); - regcache_cache_bypass(s->regmap, false); + regmap_noinc_write(s->regmap, addr, s->buf, to_send); } static void sc16is7xx_port_update(struct uart_port *port, u8 reg, @@ -488,6 +484,11 @@ static bool sc16is7xx_regmap_precious(struct device *dev, unsigned int reg) return false; } +static bool sc16is7xx_regmap_noinc(struct device *dev, unsigned int reg) +{ + return reg == SC16IS7XX_RHR_REG; +} + static int sc16is7xx_set_baud(struct uart_port *port, int baud) { struct sc16is7xx_port *s = dev_get_drvdata(port->dev); @@ -1426,6 +1427,8 @@ static struct regmap_config regcfg = { .cache_type = REGCACHE_RBTREE, .volatile_reg = sc16is7xx_regmap_volatile, .precious_reg = sc16is7xx_regmap_precious, + .writeable_noinc_reg = sc16is7xx_regmap_noinc, + .readable_noinc_reg = sc16is7xx_regmap_noinc, }; #ifdef CONFIG_SERIAL_SC16IS7XX_SPI -- 2.25.1

2 1

[PATCH OLK-6.6 v2 0/2] Fix CVE-2024-26629
by Li Lingfeng 18 Mar '24

18 Mar '24

The first patch is the fix patch of CVE. The second patch is the fix patch of the first one. NeilBrown (2): nfsd: fix RELEASE_LOCKOWNER nfsd: don't take fi_lock in nfsd_break_deleg_cb() fs/nfsd/nfs4state.c | 37 ++++++++++++++++++++----------------- 1 file changed, 20 insertions(+), 17 deletions(-) -- 2.31.1

2 3

[PATCH OLK-6.6 0/2] Fix CVE-2024-26629
by Li Lingfeng 18 Mar '24

18 Mar '24

The first patch is the fix patch of CVE. The second patch is the fix patch of the first one. NeilBrown (2): [Backport] nfsd: fix RELEASE_LOCKOWNER [Backport] nfsd: don't take fi_lock in nfsd_break_deleg_cb() fs/nfsd/nfs4state.c | 37 ++++++++++++++++++++----------------- 1 file changed, 20 insertions(+), 17 deletions(-) -- 2.31.1

2 3

[PATCH OLK-5.10 v2 0/4] Fix CVE-2024-26629
by Li Lingfeng 18 Mar '24

18 Mar '24

The first two patches are applied to reduce conflict. The third patch is the fix patch of CVE. The fourth patch is the fix patch of the third one. Chuck Lever (2): NFSD: Modernize nfsd4_release_lockowner() NFSD: Add documenting comment for nfsd4_release_lockowner() NeilBrown (2): nfsd: fix RELEASE_LOCKOWNER nfsd: don't take fi_lock in nfsd_break_deleg_cb() fs/nfsd/nfs4state.c | 76 ++++++++++++++++++++++++--------------------- 1 file changed, 41 insertions(+), 35 deletions(-) -- 2.31.1

2 5

[PATCH v3 OLK-6.6] iommu/iova: avoid softlockup in fq_flush_timeout
by Zhang Zekun 18 Mar '24

18 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8ZE0I CVE: NA -------------------------------- There is a softlockup undering cpu pressure test. ... pc : _raw_spin_unlock_irqrestore+0x14/0x78 lr : fq_flush_timeout+0x94/0x118 ... Call trace: _raw_spin_unlock_irqrestore+0x14/0x78 call_timer_fn+0x3c/0x1d0 expire_timers+0xcc/0x190 run_timer_softirq+0xfc/0x268 __do_softirq+0x128/0x3dc ____do_softirq+0x18/0x30 call_on_irq_stack+0x24/0x30 do_softirq_own_stack+0x24/0x38 irq_exit_rcu+0xc0/0xe8 el1_interrupt+0x48/0xc0 el1h_64_irq_handler+0x18/0x28 el1h_64_irq+0x78/0x80 __schedule+0xf28/0x12a0 schedule+0x3c/0x108 schedule_timeout+0xa0/0x1d0 pktgen_thread_worker+0x1180/0x15d0 kthread+0x120/0x130 ret_from_fork+0x10/0x20 This is because the timer callback fq_flush_timeout may run more than 10ms, and timer may be processed continuously in the softirq so trigger softlockup. We can use work to deal with fq_ring_free for each cpu which may take long time, that to avoid triggering softlockup. Signed-off-by: Li Bin <huawei.libin(a)huawei.com> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/dma-iommu.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c index 037fcf826407..58a90521630e 100644 --- a/drivers/iommu/dma-iommu.c +++ b/drivers/iommu/dma-iommu.c @@ -85,6 +85,8 @@ struct iommu_dma_cookie { /* Options for dma-iommu use */ struct iommu_dma_options options; struct mutex mutex; + + struct work_struct free_iova_work; }; static DEFINE_STATIC_KEY_FALSE(iommu_deferred_attach_enabled); @@ -184,17 +186,11 @@ static void fq_flush_iotlb(struct iommu_dma_cookie *cookie) static void fq_flush_timeout(struct timer_list *t) { struct iommu_dma_cookie *cookie = from_timer(cookie, t, fq_timer); - int cpu; atomic_set(&cookie->fq_timer_on, 0); fq_flush_iotlb(cookie); - if (cookie->options.qt == IOMMU_DMA_OPTS_SINGLE_QUEUE) { - fq_ring_free(cookie, cookie->single_fq); - } else { - for_each_possible_cpu(cpu) - fq_ring_free(cookie, per_cpu_ptr(cookie->percpu_fq, cpu)); - } + schedule_work(&cookie->free_iova_work); } static void queue_iova(struct iommu_dma_cookie *cookie, @@ -279,6 +275,7 @@ static void iommu_dma_free_fq(struct iommu_dma_cookie *cookie) return; del_timer_sync(&cookie->fq_timer); + flush_work(&cookie->free_iova_work); if (cookie->options.qt == IOMMU_DMA_OPTS_SINGLE_QUEUE) iommu_dma_free_fq_single(cookie->single_fq); else @@ -330,6 +327,20 @@ static int iommu_dma_init_fq_percpu(struct iommu_dma_cookie *cookie) return 0; } +static void free_iova_work_func(struct work_struct *work) +{ + struct iommu_dma_cookie *cookie = container_of(work, struct iommu_dma_cookie, free_iova_work); + int cpu; + + if (cookie->options.qt == IOMMU_DMA_OPTS_SINGLE_QUEUE) { + fq_ring_free(cookie, cookie->single_fq); + } else { + for_each_possible_cpu(cpu) + fq_ring_free(cookie, per_cpu_ptr(cookie->percpu_fq, cpu)); + } + +} + /* sysfs updates are serialised by the mutex of the group owning @domain */ int iommu_dma_init_fq(struct iommu_domain *domain) { @@ -352,6 +363,7 @@ int iommu_dma_init_fq(struct iommu_domain *domain) return -ENOMEM; } + INIT_WORK(&cookie->free_iova_work, free_iova_work_func); timer_setup(&cookie->fq_timer, fq_flush_timeout, 0); atomic_set(&cookie->fq_timer_on, 0); /* -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] printk: avoid deadlock in panic
by Ye Weihua 18 Mar '24

18 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I991OV -------------------------------- In the process of load testing against panic, a deadlock issue was discovered. The reason is that in the panic process, console_unlock doesn't handle the printk_context variable evenly, causing printk_context to overflow downwards, allowing vprintk_func to enter the nmi direct branch without disabling interrupt. Upon holding the logbuf_lock lock, an interrupt running wake_up_klogd_work_func was called, resulting in a deadlock. To avoid this issue, move printk_safe_ext_irqrestore after check abandon_console_lock_in_panic(). Fixes: 06a14c5f9e7d ("printk: Drop console_sem during panic") Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> --- kernel/printk/printk.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c index f52eceb3c48a..11ebe66c473a 100644 --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c @@ -2426,7 +2426,7 @@ void console_unlock(void) static char text[LOG_LINE_MAX + PREFIX_MAX]; static int panic_console_dropped; unsigned long flags; - bool do_cond_resched, retry; + bool do_cond_resched, retry, locked = false; if (console_suspended) { up_console_sem(); @@ -2469,6 +2469,7 @@ void console_unlock(void) printk_safe_enter_irqsave(flags); raw_spin_lock(&logbuf_lock); + locked = true; if (console_seq < log_first_seq) { len = snprintf(text, sizeof(text), "** %llu printk messages dropped **\n", @@ -2520,6 +2521,7 @@ void console_unlock(void) } console_idx = log_next(console_idx); console_seq++; + locked = false; raw_spin_unlock(&logbuf_lock); /* @@ -2539,19 +2541,20 @@ void console_unlock(void) return; } - printk_safe_exit_irqrestore(flags); - /* Allow panic_cpu to take over the consoles safely */ if (abandon_console_lock_in_panic()) break; + printk_safe_exit_irqrestore(flags); + if (do_cond_resched) cond_resched(); } console_locked = 0; - raw_spin_unlock(&logbuf_lock); + if (likely(locked)) + raw_spin_unlock(&logbuf_lock); up_console_sem(); -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] Add Huawei Intelligent Network Card Driver: hinic3
by Zhou Shuai 18 Mar '24

18 Mar '24

Update hinic3 driver, the NIC driver supports the following features: Supports IPv4/IPv6 TCP/UDP checksum offload, TSO/LRO/RSS. Supports interrupt aggregation parameter configuration and interrupt adaptation. Supports 802.1Q VLAN (Virtual Local Area Network) offloading and filtering. Supports NIC SR-IOV (Single Root I/O Virtualization). Loopback testing is supported. Support port lighting. Support Ethernet mouth self-negotiation, support pause frame. Zhou Shuai (1): net/hinic3: add huawei/hinic3 driver Documentation/networking/hinic3.rst | 128 + MAINTAINERS | 7 + arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/net/ethernet/huawei/Kconfig | 1 + drivers/net/ethernet/huawei/Makefile | 1 + drivers/net/ethernet/huawei/hinic3/Kconfig | 13 + drivers/net/ethernet/huawei/hinic3/Makefile | 45 + .../ethernet/huawei/hinic3/cfg_mgt_comm_pub.h | 212 ++ .../ethernet/huawei/hinic3/comm_cmdq_intf.h | 239 ++ .../net/ethernet/huawei/hinic3/comm_defs.h | 100 + .../ethernet/huawei/hinic3/comm_msg_intf.h | 664 +++++ .../ethernet/huawei/hinic3/hinic3_comm_cmd.h | 185 ++ .../ethernet/huawei/hinic3/hinic3_common.h | 118 + .../net/ethernet/huawei/hinic3/hinic3_crm.h | 1162 +++++++++ .../net/ethernet/huawei/hinic3/hinic3_dbg.c | 983 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_dcb.c | 405 ++++ .../net/ethernet/huawei/hinic3/hinic3_dcb.h | 78 + .../ethernet/huawei/hinic3/hinic3_ethtool.c | 1332 ++++++++++ .../huawei/hinic3/hinic3_ethtool_stats.c | 1259 ++++++++++ .../ethernet/huawei/hinic3/hinic3_filter.c | 483 ++++ .../net/ethernet/huawei/hinic3/hinic3_hw.h | 828 +++++++ .../net/ethernet/huawei/hinic3/hinic3_irq.c | 189 ++ .../net/ethernet/huawei/hinic3/hinic3_lld.h | 205 ++ .../ethernet/huawei/hinic3/hinic3_mag_cfg.c | 953 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_main.c | 1115 +++++++++ .../huawei/hinic3/hinic3_mgmt_interface.h | 1209 ++++++++++ .../net/ethernet/huawei/hinic3/hinic3_mt.h | 681 ++++++ .../huawei/hinic3/hinic3_netdev_ops.c | 1945 +++++++++++++++ .../net/ethernet/huawei/hinic3/hinic3_nic.h | 183 ++ .../ethernet/huawei/hinic3/hinic3_nic_cfg.c | 1608 +++++++++++++ .../ethernet/huawei/hinic3/hinic3_nic_cfg.h | 620 +++++ .../huawei/hinic3/hinic3_nic_cfg_vf.c | 637 +++++ .../ethernet/huawei/hinic3/hinic3_nic_cmd.h | 159 ++ .../ethernet/huawei/hinic3/hinic3_nic_dbg.c | 146 ++ .../ethernet/huawei/hinic3/hinic3_nic_dbg.h | 21 + .../ethernet/huawei/hinic3/hinic3_nic_dev.h | 387 +++ .../ethernet/huawei/hinic3/hinic3_nic_event.c | 580 +++++ .../ethernet/huawei/hinic3/hinic3_nic_io.c | 1121 +++++++++ .../ethernet/huawei/hinic3/hinic3_nic_io.h | 325 +++ .../ethernet/huawei/hinic3/hinic3_nic_prof.c | 47 + .../ethernet/huawei/hinic3/hinic3_nic_prof.h | 59 + .../ethernet/huawei/hinic3/hinic3_nic_qp.h | 384 +++ .../ethernet/huawei/hinic3/hinic3_ntuple.c | 904 +++++++ .../ethernet/huawei/hinic3/hinic3_profile.h | 146 ++ .../net/ethernet/huawei/hinic3/hinic3_rss.c | 971 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_rss.h | 95 + .../ethernet/huawei/hinic3/hinic3_rss_cfg.c | 384 +++ .../net/ethernet/huawei/hinic3/hinic3_rx.c | 1343 +++++++++++ .../net/ethernet/huawei/hinic3/hinic3_rx.h | 155 ++ .../ethernet/huawei/hinic3/hinic3_srv_nic.h | 213 ++ .../net/ethernet/huawei/hinic3/hinic3_tx.c | 1002 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_tx.h | 157 ++ .../net/ethernet/huawei/hinic3/hinic3_wq.h | 130 + .../huawei/hinic3/hw/hinic3_api_cmd.c | 1210 ++++++++++ .../huawei/hinic3/hw/hinic3_api_cmd.h | 286 +++ .../ethernet/huawei/hinic3/hw/hinic3_cmdq.c | 1540 ++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_cmdq.h | 204 ++ .../ethernet/huawei/hinic3/hw/hinic3_common.c | 93 + .../ethernet/huawei/hinic3/hw/hinic3_csr.h | 187 ++ .../huawei/hinic3/hw/hinic3_dev_mgmt.c | 802 +++++++ .../huawei/hinic3/hw/hinic3_dev_mgmt.h | 105 + .../huawei/hinic3/hw/hinic3_devlink.c | 392 +++ .../huawei/hinic3/hw/hinic3_devlink.h | 149 ++ .../ethernet/huawei/hinic3/hw/hinic3_eqs.c | 1379 +++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_eqs.h | 164 ++ .../ethernet/huawei/hinic3/hw/hinic3_hw_api.c | 453 ++++ .../ethernet/huawei/hinic3/hw/hinic3_hw_api.h | 141 ++ .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c | 1480 ++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h | 332 +++ .../huawei/hinic3/hw/hinic3_hw_comm.c | 1540 ++++++++++++ .../huawei/hinic3/hw/hinic3_hw_comm.h | 51 + .../ethernet/huawei/hinic3/hw/hinic3_hw_mt.c | 598 +++++ .../ethernet/huawei/hinic3/hw/hinic3_hw_mt.h | 49 + .../ethernet/huawei/hinic3/hw/hinic3_hwdev.c | 2133 +++++++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_hwdev.h | 175 ++ .../ethernet/huawei/hinic3/hw/hinic3_hwif.c | 994 ++++++++ .../ethernet/huawei/hinic3/hw/hinic3_hwif.h | 113 + .../ethernet/huawei/hinic3/hw/hinic3_lld.c | 1383 +++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_mbox.c | 1837 ++++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_mbox.h | 267 +++ .../ethernet/huawei/hinic3/hw/hinic3_mgmt.c | 1512 ++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_mgmt.h | 179 ++ .../huawei/hinic3/hw/hinic3_nictool.c | 974 ++++++++ .../huawei/hinic3/hw/hinic3_nictool.h | 35 + .../huawei/hinic3/hw/hinic3_pci_id_tbl.h | 18 + .../huawei/hinic3/hw/hinic3_prof_adap.c | 44 + .../huawei/hinic3/hw/hinic3_prof_adap.h | 109 + .../ethernet/huawei/hinic3/hw/hinic3_sm_lt.h | 160 ++ .../ethernet/huawei/hinic3/hw/hinic3_sml_lt.c | 160 ++ .../ethernet/huawei/hinic3/hw/hinic3_sriov.c | 267 +++ .../ethernet/huawei/hinic3/hw/hinic3_sriov.h | 35 + .../net/ethernet/huawei/hinic3/hw/hinic3_wq.c | 157 ++ .../huawei/hinic3/hw/ossl_knl_linux.c | 107 + drivers/net/ethernet/huawei/hinic3/mag_cmd.h | 818 +++++++ .../ethernet/huawei/hinic3/mgmt_msg_base.h | 27 + .../net/ethernet/huawei/hinic3/nic_cfg_comm.h | 63 + drivers/net/ethernet/huawei/hinic3/ossl_knl.h | 35 + .../ethernet/huawei/hinic3/ossl_knl_linux.h | 268 +++ 99 files changed, 49344 insertions(+) create mode 100644 Documentation/networking/hinic3.rst create mode 100644 drivers/net/ethernet/huawei/hinic3/Kconfig create mode 100644 drivers/net/ethernet/huawei/hinic3/Makefile create mode 100644 drivers/net/ethernet/huawei/hinic3/cfg_mgt_comm_pub.h create mode 100644 drivers/net/ethernet/huawei/hinic3/comm_cmdq_intf.h create mode 100644 drivers/net/ethernet/huawei/hinic3/comm_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/comm_msg_intf.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_comm_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_common.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_crm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_dbg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_dcb.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_dcb.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_ethtool_stats.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_filter.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_hw.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_irq.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_lld.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_main.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_mgmt_interface.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_mt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_netdev_ops.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg_vf.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_dbg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_dbg.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_event.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_prof.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_prof.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_qp.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_ntuple.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_profile.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rss.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rss.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rss_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rx.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rx.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_srv_nic.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_tx.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_tx.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_wq.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_cmdq.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_cmdq.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_common.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_csr.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_devlink.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_devlink.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_eqs.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_eqs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_api.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_api.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_comm.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_comm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_mt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_mt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwdev.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwdev.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mbox.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mbox.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_nictool.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_nictool.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_pci_id_tbl.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_prof_adap.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_prof_adap.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sm_lt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sml_lt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sriov.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sriov.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_wq.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/ossl_knl_linux.c create mode 100644 drivers/net/ethernet/huawei/hinic3/mag_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/mgmt_msg_base.h create mode 100644 drivers/net/ethernet/huawei/hinic3/nic_cfg_comm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/ossl_knl.h create mode 100644 drivers/net/ethernet/huawei/hinic3/ossl_knl_linux.h -- 2.24.0

2 2

[openeuler:OLK-5.10 24826/30000] drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfc_event_cb'
by kernel test robot 18 Mar '24

18 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 32bb7b0a7c87769858fbb9d60574b830383c28f7 commit: c4cd0655c0c898569c0a70162f36258fd5c50eeb [24826/30000] ub: uburma add cmd create jfc implementation. config: arm64-randconfig-003-20240312 (https://download.01.org/0day-ci/archive/20240318/202403180149.ZWPewByz-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240318/202403180149.ZWPewByz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403180149.ZWPewByz-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfc_event_cb' [-Wmissing-prototypes] 144 | void uburma_jfc_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ drivers/ub/urma/uburma/uburma_cmd.c:156:6: warning: no previous prototype for 'uburma_jfs_event_cb' [-Wmissing-prototypes] 156 | void uburma_jfs_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ drivers/ub/urma/uburma/uburma_cmd.c:168:6: warning: no previous prototype for 'uburma_jfr_event_cb' [-Wmissing-prototypes] 168 | void uburma_jfr_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ vim +/uburma_jfc_event_cb +144 drivers/ub/urma/uburma/uburma_cmd.c 143 > 144 void uburma_jfc_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) 145 { 146 struct uburma_jfc_uobj *jfc_uobj; 147 148 if (event->element.jfc == NULL) 149 return; 150 151 jfc_uobj = (struct uburma_jfc_uobj *)event->element.jfc->jfc_cfg.jfc_context; 152 uburma_write_async_event(ctx, event->element.jfc->urma_jfc, event->event_type, 153 &jfc_uobj->async_event_list, &jfc_uobj->async_events_reported); 154 } 155 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 777/4034] arch/loongarch/kernel/legacy_boot.c:39:19: sparse: sparse: symbol 'liointc_domain' was not declared. Should it be static?
by kernel test robot 18 Mar '24

18 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 22a313585b0ee196eb843e8b7182402b92d12ce6 commit: db5bb24abc8dd120fd81b7ce21819e96578d011e [777/4034] LoongArch: Old BPI compatibility config: loongarch-randconfig-r132-20240317 (https://download.01.org/0day-ci/archive/20240318/202403180017.WZB6OP2s-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240318/202403180017.WZB6OP2s-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403180017.WZB6OP2s-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/loongarch/kernel/legacy_boot.c:39:19: sparse: sparse: symbol 'liointc_domain' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:40:19: sparse: sparse: symbol 'pch_lpc_domain' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:41:19: sparse: sparse: symbol 'pch_msi_domain' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:42:19: sparse: sparse: symbol 'pch_pic_domain' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:45:5: sparse: sparse: symbol 'nr_io_pics' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:48:26: sparse: sparse: symbol 'liointc_default' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:55:26: sparse: sparse: symbol 'pchlpc_default' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:61:26: sparse: sparse: symbol 'eiointc_default' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:62:26: sparse: sparse: symbol 'pchmsi_default' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:63:26: sparse: sparse: symbol 'pchpic_default' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:94:6: sparse: sparse: symbol 'register_default_pic' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:341:14: sparse: sparse: symbol 'bpi_init' was not declared. Should it be static? vim +/liointc_domain +39 arch/loongarch/kernel/legacy_boot.c 37 38 struct irq_domain *cpu_domain; > 39 struct irq_domain *liointc_domain; > 40 struct irq_domain *pch_lpc_domain; > 41 struct irq_domain *pch_msi_domain[MAX_IO_PICS]; > 42 struct irq_domain *pch_pic_domain[MAX_IO_PICS]; 43 44 char arcs_cmdline[COMMAND_LINE_SIZE]; > 45 int nr_io_pics; 46 int bpi_version; 47 > 48 struct acpi_madt_lio_pic liointc_default = { 49 .address = LOONGSON_REG_BASE + 0x1400, 50 .size = 256, 51 .cascade = {2, 3}, 52 .cascade_map = {0x00FFFFFF, 0xff000000}, 53 }; 54 > 55 struct acpi_madt_lpc_pic pchlpc_default = { 56 .address = LS7A_LPC_REG_BASE, 57 .size = SZ_4K, 58 .cascade = 19, 59 }; 60 > 61 struct acpi_madt_eio_pic eiointc_default[MAX_IO_PICS]; > 62 struct acpi_madt_msi_pic pchmsi_default[MAX_IO_PICS]; > 63 struct acpi_madt_bio_pic pchpic_default[MAX_IO_PICS]; 64 65 static int 66 acpi_parse_lapic(union acpi_subtable_headers *header, const unsigned long end) 67 { 68 struct acpi_madt_local_apic *processor = NULL; 69 70 processor = (struct acpi_madt_local_apic *)header; 71 if (BAD_MADT_ENTRY(processor, end)) 72 return -EINVAL; 73 74 acpi_table_print_madt_entry(&header->common); 75 set_processor_mask(processor->id, processor->lapic_flags); 76 77 return 0; 78 } 79 80 static int bad_pch_pic(unsigned long address) 81 { 82 if (nr_io_pics >= MAX_IO_PICS) { 83 pr_warn("WARNING: Max # of I/O PCH_PICs (%d) exceeded (found %d), skipping\n", 84 MAX_IO_PICS, nr_io_pics); 85 return 1; 86 } 87 if (!address) { 88 pr_warn("WARNING: Bogus (zero) I/O PCH_PIC address found in table, skipping!\n"); 89 return 1; 90 } 91 return 0; 92 } 93 > 94 void register_default_pic(int id, u32 address, u32 irq_base) 95 { 96 int idx, entries; 97 unsigned long addr; 98 99 if (bad_pch_pic(address)) 100 return; 101 102 idx = nr_io_pics; 103 104 pchpic_default[idx].address = address; 105 if (idx) 106 pchpic_default[idx].address |= nid_to_addrbase(id) | HT1LO_OFFSET; 107 pchpic_default[idx].id = id; 108 pchpic_default[idx].version = 0; 109 pchpic_default[idx].size = 0x1000; 110 pchpic_default[idx].gsi_base = irq_base; 111 112 msi_group[nr_io_pics].pci_segment = nr_io_pics; 113 pch_group[nr_io_pics].node = msi_group[nr_io_pics].node = id; 114 115 addr = pchpic_default[idx].address; 116 /* Read INT_ID.int_num */ 117 entries = (((unsigned long)ls7a_readq(addr) >> 48) & 0xff) + 1; 118 pchmsi_default[idx].msg_address = MSI_MSG_ADDRESS; 119 pchmsi_default[idx].start = entries; 120 pchmsi_default[idx].count = MSI_MSG_DEFAULT_COUNT; 121 122 eiointc_default[idx].cascade = 3; 123 eiointc_default[idx].node = id; 124 eiointc_default[idx].node_map = 1; 125 126 if (idx) { 127 eiointc_default[idx].cascade = 0x4; 128 eiointc_default[0].node_map = 0x1DF; 129 eiointc_default[idx].node_map = 0xFE20; 130 } 131 132 acpi_pchpic[idx] = &pchpic_default[idx]; 133 acpi_pchmsi[idx] = &pchmsi_default[idx]; 134 acpi_eiointc[idx] = &eiointc_default[idx]; 135 136 nr_io_pics++; 137 } 138 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 21426/30000] net/core/sock_map.c:1501:5: sparse: sparse: symbol 'sock_map_prog_lookup' was not declared. Should it be static?
by kernel test robot 17 Mar '24

17 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 32bb7b0a7c87769858fbb9d60574b830383c28f7 commit: 050383882de382969e4fb8362235749b232cccae [21426/30000] bpf: support BPF_PROG_QUERY for progs attached to sockmap config: x86_64-randconfig-123-20240317 (https://download.01.org/0day-ci/archive/20240317/202403171747.MBuYnaps-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240317/202403171747.MBuYnaps-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403171747.MBuYnaps-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> net/core/sock_map.c:1501:5: sparse: sparse: symbol 'sock_map_prog_lookup' was not declared. Should it be static? vim +/sock_map_prog_lookup +1501 net/core/sock_map.c 1500 > 1501 int sock_map_prog_lookup(struct bpf_map *map, struct bpf_prog ***pprog, 1502 u32 which) 1503 { 1504 struct sk_psock_progs *progs = sock_map_progs(map); 1505 1506 if (!progs) 1507 return -EOPNOTSUPP; 1508 1509 switch (which) { 1510 case BPF_SK_MSG_VERDICT: 1511 *pprog = &progs->msg_parser; 1512 break; 1513 case BPF_SK_SKB_STREAM_PARSER: 1514 *pprog = &progs->skb_parser; 1515 break; 1516 case BPF_SK_SKB_STREAM_VERDICT: 1517 *pprog = &progs->skb_verdict; 1518 break; 1519 default: 1520 return -EOPNOTSUPP; 1521 } 1522 return 0; 1523 } 1524 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 24824/30000] drivers/ub/urma/uburma/uburma_cmd.c:156:6: warning: no previous prototype for 'uburma_jfr_event_cb'
by kernel test robot 17 Mar '24

17 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 32bb7b0a7c87769858fbb9d60574b830383c28f7 commit: 79b60243a9ff771b76add8e16cfe55cc4f5edef2 [24824/30000] ub: uburma add cmd create jfr implementation. config: arm64-randconfig-003-20240312 (https://download.01.org/0day-ci/archive/20240317/202403171618.niakwAg5-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240317/202403171618.niakwAg5-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403171618.niakwAg5-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfs_event_cb' [-Wmissing-prototypes] 144 | void uburma_jfs_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/uburma/uburma_cmd.c:156:6: warning: no previous prototype for 'uburma_jfr_event_cb' [-Wmissing-prototypes] 156 | void uburma_jfr_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ vim +/uburma_jfr_event_cb +156 drivers/ub/urma/uburma/uburma_cmd.c 143 > 144 void uburma_jfs_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) 145 { 146 struct uburma_jfs_uobj *jfs_uobj; 147 148 if (event->element.jfs == NULL) 149 return; 150 151 jfs_uobj = (struct uburma_jfs_uobj *)event->element.jfs->jfs_cfg.jfs_context; 152 uburma_write_async_event(ctx, event->element.jfs->urma_jfs, event->event_type, 153 &jfs_uobj->async_event_list, &jfs_uobj->async_events_reported); 154 } 155 > 156 void uburma_jfr_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) 157 { 158 struct uburma_jfr_uobj *jfr_uobj; 159 160 if (event->element.jfr == NULL) 161 return; 162 163 jfr_uobj = (struct uburma_jfr_uobj *)event->element.jfr->jfr_cfg.jfr_context; 164 uburma_write_async_event(ctx, event->element.jfr->urma_jfr, event->event_type, 165 &jfr_uobj->async_event_list, &jfr_uobj->async_events_reported); 166 } 167 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 29325/30000] drivers/powercap/intel_rapl_tpmi.c:141:41: sparse: sparse: incorrect type in initializer (different address spaces)
by kernel test robot 17 Mar '24

17 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 32bb7b0a7c87769858fbb9d60574b830383c28f7 commit: 6b9faa4dfe7e99b19081b54504efce5f57b7abe4 [29325/30000] powercap: intel_rapl: Introduce RAPL TPMI interface driver config: x86_64-randconfig-122-20240317 (https://download.01.org/0day-ci/archive/20240317/202403171427.1vH4xGrU-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240317/202403171427.1vH4xGrU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403171427.1vH4xGrU-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/powercap/intel_rapl_tpmi.c:141:41: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected unsigned long long [usertype] *tpmi_rapl_regs @@ got void [noderef] __iomem * @@ drivers/powercap/intel_rapl_tpmi.c:141:41: sparse: expected unsigned long long [usertype] *tpmi_rapl_regs drivers/powercap/intel_rapl_tpmi.c:141:41: sparse: got void [noderef] __iomem * vim +141 drivers/powercap/intel_rapl_tpmi.c 132 133 static int parse_one_domain(struct tpmi_rapl_package *trp, u32 offset) 134 { 135 u8 tpmi_domain_version; 136 enum rapl_domain_type domain_type; 137 enum tpmi_rapl_domain_type tpmi_domain_type; 138 enum tpmi_rapl_register reg_index; 139 enum rapl_domain_reg_id reg_id; 140 int tpmi_domain_size, tpmi_domain_flags; > 141 u64 *tpmi_rapl_regs = trp->base + offset; 142 u64 tpmi_domain_header = readq((void __iomem *)tpmi_rapl_regs); 143 144 /* Domain Parent bits are ignored for now */ 145 tpmi_domain_version = tpmi_domain_header & 0xff; 146 tpmi_domain_type = tpmi_domain_header >> 8 & 0xff; 147 tpmi_domain_size = tpmi_domain_header >> 16 & 0xff; 148 tpmi_domain_flags = tpmi_domain_header >> 32 & 0xffff; 149 150 if (tpmi_domain_version != TPMI_RAPL_VERSION) { 151 pr_warn(FW_BUG "Unsupported version:%d\n", tpmi_domain_version); 152 return -ENODEV; 153 } 154 155 /* Domain size: in unit of 128 Bytes */ 156 if (tpmi_domain_size != 1) { 157 pr_warn(FW_BUG "Invalid Domain size %d\n", tpmi_domain_size); 158 return -EINVAL; 159 } 160 161 /* Unit register and Energy Status register are mandatory for each domain */ 162 if (!(tpmi_domain_flags & BIT(TPMI_RAPL_REG_UNIT)) || 163 !(tpmi_domain_flags & BIT(TPMI_RAPL_REG_ENERGY_STATUS))) { 164 pr_warn(FW_BUG "Invalid Domain flag 0x%x\n", tpmi_domain_flags); 165 return -EINVAL; 166 } 167 168 switch (tpmi_domain_type) { 169 case TPMI_RAPL_DOMAIN_PACKAGE: 170 domain_type = RAPL_DOMAIN_PACKAGE; 171 break; 172 case TPMI_RAPL_DOMAIN_SYSTEM: 173 domain_type = RAPL_DOMAIN_PLATFORM; 174 break; 175 case TPMI_RAPL_DOMAIN_MEMORY: 176 domain_type = RAPL_DOMAIN_DRAM; 177 break; 178 default: 179 pr_warn(FW_BUG "Unsupported Domain type %d\n", tpmi_domain_type); 180 return -EINVAL; 181 } 182 183 if (trp->priv.regs[domain_type][RAPL_DOMAIN_REG_UNIT]) { 184 pr_warn(FW_BUG "Duplicate Domain type %d\n", tpmi_domain_type); 185 return -EINVAL; 186 } 187 188 reg_index = TPMI_RAPL_REG_HEADER; 189 while (++reg_index != TPMI_RAPL_REG_MAX) { 190 if (!(tpmi_domain_flags & BIT(reg_index))) 191 continue; 192 193 switch (reg_index) { 194 case TPMI_RAPL_REG_UNIT: 195 reg_id = RAPL_DOMAIN_REG_UNIT; 196 break; 197 case TPMI_RAPL_REG_PL1: 198 reg_id = RAPL_DOMAIN_REG_LIMIT; 199 trp->priv.limits[domain_type] |= BIT(POWER_LIMIT1); 200 break; 201 case TPMI_RAPL_REG_PL2: 202 reg_id = RAPL_DOMAIN_REG_PL2; 203 trp->priv.limits[domain_type] |= BIT(POWER_LIMIT2); 204 break; 205 case TPMI_RAPL_REG_PL4: 206 reg_id = RAPL_DOMAIN_REG_PL4; 207 trp->priv.limits[domain_type] |= BIT(POWER_LIMIT4); 208 break; 209 case TPMI_RAPL_REG_ENERGY_STATUS: 210 reg_id = RAPL_DOMAIN_REG_STATUS; 211 break; 212 case TPMI_RAPL_REG_PERF_STATUS: 213 reg_id = RAPL_DOMAIN_REG_PERF; 214 break; 215 case TPMI_RAPL_REG_POWER_INFO: 216 reg_id = RAPL_DOMAIN_REG_INFO; 217 break; 218 default: 219 continue; 220 } 221 trp->priv.regs[domain_type][reg_id] = (u64)&tpmi_rapl_regs[reg_index]; 222 } 223 224 return 0; 225 } 226 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 24823/30000] drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfs_event_cb'
by kernel test robot 17 Mar '24

17 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 32bb7b0a7c87769858fbb9d60574b830383c28f7 commit: dd9641804ad19402838975c28003465d0b42042a [24823/30000] ub: uburma add cmd create/delete jfs implementation. config: arm64-randconfig-003-20240312 (https://download.01.org/0day-ci/archive/20240317/202403170825.fqJgay3X-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240317/202403170825.fqJgay3X-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403170825.fqJgay3X-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfs_event_cb' [-Wmissing-prototypes] 144 | void uburma_jfs_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ vim +/uburma_jfs_event_cb +144 drivers/ub/urma/uburma/uburma_cmd.c 143 > 144 void uburma_jfs_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) 145 { 146 struct uburma_jfs_uobj *jfs_uobj; 147 148 if (event->element.jfs == NULL) 149 return; 150 151 jfs_uobj = (struct uburma_jfs_uobj *)event->element.jfs->jfs_cfg.jfs_context; 152 uburma_write_async_event(ctx, event->element.jfs->urma_jfs, event->event_type, 153 &jfs_uobj->async_event_list, &jfs_uobj->async_events_reported); 154 } 155 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 8e3c931720c17228aca23307a3580b068ef80099
by kernel test robot 17 Mar '24

17 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 8e3c931720c17228aca23307a3580b068ef80099 !5268 crypto: algif_aead - fix uninitialized ctx->init Warning reports: https://lore.kernel.org/oe-kbuild-all/202403170252.zy8ebb02-lkp@intel.com Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized |-- arm64-defconfig | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized `-- x86_64-randconfig-161-20240303 `-- arch-x86-kvm-vmx.c-vmx_set_msr()-warn:inconsistent-indenting elapsed time: 727m configs tested: 11 configs skipped: 148 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240316 gcc arm64 randconfig-002-20240316 gcc arm64 randconfig-003-20240316 gcc arm64 randconfig-004-20240316 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 19590/21873] arch/x86/kvm/vmx.c:4410 vmx_set_msr() warn: inconsistent indenting
by kernel test robot 17 Mar '24

17 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 8e3c931720c17228aca23307a3580b068ef80099 commit: 4c9a908c6bde35918222640d774f08f825abfa3f [19590/21873] KVM: x86/speculation: Disable Fill buffer clear within guests config: x86_64-randconfig-161-20240303 (https://download.01.org/0day-ci/archive/20240317/202403170252.zy8ebb02-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403170252.zy8ebb02-lkp@intel.com/ smatch warnings: arch/x86/kvm/vmx.c:4410 vmx_set_msr() warn: inconsistent indenting vim +4410 arch/x86/kvm/vmx.c cae501397a25dc arch/x86/kvm/vmx.c Jan Kiszka 2014-01-04 4224 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4225 /* 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4226 * Writes msr value into into the appropriate "register". 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4227 * Returns 0 on success, non-0 otherwise. 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4228 * Assumes vcpu_load() was already called. 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4229 */ 8fe8ab46be06fc arch/x86/kvm/vmx.c Will Auld 2012-11-29 4230 static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4231 { a2fa3e9f52d875 drivers/kvm/vmx.c Gregory Haskins 2007-07-27 4232 struct vcpu_vmx *vmx = to_vmx(vcpu); 26bb0981b3ff00 arch/x86/kvm/vmx.c Avi Kivity 2009-09-07 4233 struct shared_msr_entry *msr; 2cc51560aed0ed drivers/kvm/vmx.c Eddie Dong 2007-05-21 4234 int ret = 0; 8fe8ab46be06fc arch/x86/kvm/vmx.c Will Auld 2012-11-29 4235 u32 msr_index = msr_info->index; 8fe8ab46be06fc arch/x86/kvm/vmx.c Will Auld 2012-11-29 4236 u64 data = msr_info->data; 2cc51560aed0ed drivers/kvm/vmx.c Eddie Dong 2007-05-21 4237 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4238 switch (msr_index) { 3bab1f5dda3443 drivers/kvm/vmx.c Avi Kivity 2006-12-29 4239 case MSR_EFER: 8fe8ab46be06fc arch/x86/kvm/vmx.c Will Auld 2012-11-29 4240 ret = kvm_set_msr_common(vcpu, msr_info); 2cc51560aed0ed drivers/kvm/vmx.c Eddie Dong 2007-05-21 4241 break; 16175a796d0618 arch/x86/kvm/vmx.c Avi Kivity 2009-03-23 4242 #ifdef CONFIG_X86_64 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4243 case MSR_FS_BASE: 2fb92db1ec08f3 arch/x86/kvm/vmx.c Avi Kivity 2011-04-27 4244 vmx_segment_cache_clear(vmx); 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4245 vmcs_writel(GUEST_FS_BASE, data); 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4246 break; 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4247 case MSR_GS_BASE: 2fb92db1ec08f3 arch/x86/kvm/vmx.c Avi Kivity 2011-04-27 4248 vmx_segment_cache_clear(vmx); 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4249 vmcs_writel(GUEST_GS_BASE, data); 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4250 break; 44ea2b1758d88a arch/x86/kvm/vmx.c Avi Kivity 2009-09-06 4251 case MSR_KERNEL_GS_BASE: 678e315e78a780 arch/x86/kvm/vmx.c Sean Christopherson 2018-07-23 4252 vmx_write_guest_kernel_gs_base(vmx, data); 44ea2b1758d88a arch/x86/kvm/vmx.c Avi Kivity 2009-09-06 4253 break; 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4254 #endif 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4255 case MSR_IA32_SYSENTER_CS: 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4256 vmcs_write32(GUEST_SYSENTER_CS, data); 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4257 break; 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4258 case MSR_IA32_SYSENTER_EIP: f5b42c3324494e drivers/kvm/vmx.c Avi Kivity 2007-03-06 4259 vmcs_writel(GUEST_SYSENTER_EIP, data); 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4260 break; 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4261 case MSR_IA32_SYSENTER_ESP: f5b42c3324494e drivers/kvm/vmx.c Avi Kivity 2007-03-06 4262 vmcs_writel(GUEST_SYSENTER_ESP, data); 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4263 break; 0dd376e7099757 arch/x86/kvm/vmx.c Liu, Jinsong 2014-02-24 4264 case MSR_IA32_BNDCFGS: 691bd4340bef49 arch/x86/kvm/vmx.c Haozhong Zhang 2017-07-04 4265 if (!kvm_mpx_supported() || d6321d493319bf arch/x86/kvm/vmx.c Radim Krčmář 2017-08-05 4266 (!msr_info->host_initiated && d6321d493319bf arch/x86/kvm/vmx.c Radim Krčmář 2017-08-05 4267 !guest_cpuid_has(vcpu, X86_FEATURE_MPX))) 93c4adc7afedf9 arch/x86/kvm/vmx.c Paolo Bonzini 2014-03-05 4268 return 1; fd8cb433734eeb arch/x86/kvm/vmx.c Yu Zhang 2017-08-24 4269 if (is_noncanonical_address(data & PAGE_MASK, vcpu) || 4531662d1abf6c arch/x86/kvm/vmx.c Jim Mattson 2017-05-23 4270 (data & MSR_IA32_BNDCFGS_RSVD)) 93c4adc7afedf9 arch/x86/kvm/vmx.c Paolo Bonzini 2014-03-05 4271 return 1; 0dd376e7099757 arch/x86/kvm/vmx.c Liu, Jinsong 2014-02-24 4272 vmcs_write64(GUEST_BNDCFGS, data); 0dd376e7099757 arch/x86/kvm/vmx.c Liu, Jinsong 2014-02-24 4273 break; d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4274 case MSR_IA32_SPEC_CTRL: d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4275 if (!msr_info->host_initiated && d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4276 !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL)) d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4277 return 1; d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4278 d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4279 /* The STIBP bit doesn't fault even if it's not advertised */ 9f65fb29374ee3 arch/x86/kvm/vmx.c Konrad Rzeszutek Wilk 2018-05-09 4280 if (data & ~(SPEC_CTRL_IBRS | SPEC_CTRL_STIBP | SPEC_CTRL_SSBD)) d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4281 return 1; d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4282 d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4283 vmx->spec_ctrl = data; d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4284 d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4285 if (!data) d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4286 break; d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4287 d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4288 /* d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4289 * For non-nested: d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4290 * When it's written (to non-zero) for the first time, pass d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4291 * it through. d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4292 * d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4293 * For nested: d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4294 * The handling of the MSR bitmap for L2 guests is done in d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4295 * nested_vmx_merge_msr_bitmap. We should not touch the d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4296 * vmcs02.msr_bitmap here since it gets completely overwritten d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4297 * in the merging. We update the vmcs01 here for L1 as well d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4298 * since it will end up touching the MSR anyway now. d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4299 */ d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4300 vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap, d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4301 MSR_IA32_SPEC_CTRL, d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4302 MSR_TYPE_RW); d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4303 break; 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4304 case MSR_IA32_PRED_CMD: 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4305 if (!msr_info->host_initiated && 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4306 !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL)) 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4307 return 1; 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4308 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4309 if (data & ~PRED_CMD_IBPB) 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4310 return 1; 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4311 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4312 if (!data) 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4313 break; 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4314 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4315 wrmsrl(MSR_IA32_PRED_CMD, PRED_CMD_IBPB); 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4316 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4317 /* 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4318 * For non-nested: 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4319 * When it's written (to non-zero) for the first time, pass 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4320 * it through. 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4321 * 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4322 * For nested: 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4323 * The handling of the MSR bitmap for L2 guests is done in 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4324 * nested_vmx_merge_msr_bitmap. We should not touch the 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4325 * vmcs02.msr_bitmap here since it gets completely overwritten 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4326 * in the merging. 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4327 */ 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4328 vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap, MSR_IA32_PRED_CMD, 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4329 MSR_TYPE_W); 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4330 break; 468d472f3f6510 arch/x86/kvm/vmx.c Sheng Yang 2008-10-09 4331 case MSR_IA32_CR_PAT: 335ce4d43d2262 arch/x86/kvm/vmx.c Paolo Bonzini 2019-09-17 4332 if (!kvm_pat_valid(data)) 4566654bb9be9e arch/x86/kvm/vmx.c Nadav Amit 2014-09-18 4333 return 1; 368d6c8df82ddf arch/x86/kvm/vmx.c Sean Christopherson 2019-09-17 4334 368d6c8df82ddf arch/x86/kvm/vmx.c Sean Christopherson 2019-09-17 4335 if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) { 468d472f3f6510 arch/x86/kvm/vmx.c Sheng Yang 2008-10-09 4336 vmcs_write64(GUEST_IA32_PAT, data); 468d472f3f6510 arch/x86/kvm/vmx.c Sheng Yang 2008-10-09 4337 vcpu->arch.pat = data; 468d472f3f6510 arch/x86/kvm/vmx.c Sheng Yang 2008-10-09 4338 break; 468d472f3f6510 arch/x86/kvm/vmx.c Sheng Yang 2008-10-09 4339 } 8fe8ab46be06fc arch/x86/kvm/vmx.c Will Auld 2012-11-29 4340 ret = kvm_set_msr_common(vcpu, msr_info); 4e47c7a6d714cf arch/x86/kvm/vmx.c Sheng Yang 2009-12-18 4341 break; ba904635d498fe arch/x86/kvm/vmx.c Will Auld 2012-11-29 4342 case MSR_IA32_TSC_ADJUST: ba904635d498fe arch/x86/kvm/vmx.c Will Auld 2012-11-29 4343 ret = kvm_set_msr_common(vcpu, msr_info); 4e47c7a6d714cf arch/x86/kvm/vmx.c Sheng Yang 2009-12-18 4344 break; c45dcc71b794b5 arch/x86/kvm/vmx.c Ashok Raj 2016-06-22 4345 case MSR_IA32_MCG_EXT_CTL: c45dcc71b794b5 arch/x86/kvm/vmx.c Ashok Raj 2016-06-22 4346 if ((!msr_info->host_initiated && c45dcc71b794b5 arch/x86/kvm/vmx.c Ashok Raj 2016-06-22 4347 !(to_vmx(vcpu)->msr_ia32_feature_control & c45dcc71b794b5 arch/x86/kvm/vmx.c Ashok Raj 2016-06-22 4348 FEATURE_CONTROL_LMCE)) || c45dcc71b794b5 arch/x86/kvm/vmx.c Ashok Raj 2016-06-22 4349 (data & ~MCG_EXT_CTL_LMCE_EN)) c45dcc71b794b5 arch/x86/kvm/vmx.c Ashok Raj 2016-06-22 4350 return 1; c45dcc71b794b5 arch/x86/kvm/vmx.c Ashok Raj 2016-06-22 4351 vcpu->arch.mcg_ext_ctl = data; c45dcc71b794b5 arch/x86/kvm/vmx.c Ashok Raj 2016-06-22 4352 break; cae501397a25dc arch/x86/kvm/vmx.c Jan Kiszka 2014-01-04 4353 case MSR_IA32_FEATURE_CONTROL: 37e4c997dadf71 arch/x86/kvm/vmx.c Haozhong Zhang 2016-06-22 4354 if (!vmx_feature_control_msr_valid(vcpu, data) || 3b84080b9512bc arch/x86/kvm/vmx.c Haozhong Zhang 2016-06-22 4355 (to_vmx(vcpu)->msr_ia32_feature_control & cae501397a25dc arch/x86/kvm/vmx.c Jan Kiszka 2014-01-04 4356 FEATURE_CONTROL_LOCKED && !msr_info->host_initiated)) cae501397a25dc arch/x86/kvm/vmx.c Jan Kiszka 2014-01-04 4357 return 1; 3b84080b9512bc arch/x86/kvm/vmx.c Haozhong Zhang 2016-06-22 4358 vmx->msr_ia32_feature_control = data; cae501397a25dc arch/x86/kvm/vmx.c Jan Kiszka 2014-01-04 4359 if (msr_info->host_initiated && data == 0) cae501397a25dc arch/x86/kvm/vmx.c Jan Kiszka 2014-01-04 4360 vmx_leave_nested(vcpu); cae501397a25dc arch/x86/kvm/vmx.c Jan Kiszka 2014-01-04 4361 break; cae501397a25dc arch/x86/kvm/vmx.c Jan Kiszka 2014-01-04 4362 case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC: 62cc6b9dc61eee arch/x86/kvm/vmx.c David Matlack 2016-11-29 4363 if (!msr_info->host_initiated) cae501397a25dc arch/x86/kvm/vmx.c Jan Kiszka 2014-01-04 4364 return 1; /* they are read-only */ 62cc6b9dc61eee arch/x86/kvm/vmx.c David Matlack 2016-11-29 4365 if (!nested_vmx_allowed(vcpu)) 62cc6b9dc61eee arch/x86/kvm/vmx.c David Matlack 2016-11-29 4366 return 1; 62cc6b9dc61eee arch/x86/kvm/vmx.c David Matlack 2016-11-29 4367 return vmx_set_vmx_msr(vcpu, msr_index, data); 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4368 case MSR_IA32_XSS: 08aca7450c7eaf arch/x86/kvm/vmx.c Wanpeng Li 2019-09-17 4369 if (!vmx_xsaves_supported() || 08aca7450c7eaf arch/x86/kvm/vmx.c Wanpeng Li 2019-09-17 4370 (!msr_info->host_initiated && 08aca7450c7eaf arch/x86/kvm/vmx.c Wanpeng Li 2019-09-17 4371 !(guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) && 08aca7450c7eaf arch/x86/kvm/vmx.c Wanpeng Li 2019-09-17 4372 guest_cpuid_has(vcpu, X86_FEATURE_XSAVES)))) 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4373 return 1; 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4374 /* 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4375 * The only supported bit as of Skylake is bit 8, but 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4376 * it is not supported on KVM. 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4377 */ 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4378 if (data != 0) 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4379 return 1; 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4380 vcpu->arch.ia32_xss = data; 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4381 if (vcpu->arch.ia32_xss != host_xss) 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4382 add_atomic_switch_msr(vmx, MSR_IA32_XSS, 989e3992d2eca3 arch/x86/kvm/vmx.c Konrad Rzeszutek Wilk 2018-06-20 4383 vcpu->arch.ia32_xss, host_xss, false); 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4384 else 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4385 clear_atomic_switch_msr(vmx, MSR_IA32_XSS); 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4386 break; 4e47c7a6d714cf arch/x86/kvm/vmx.c Sheng Yang 2009-12-18 4387 case MSR_TSC_AUX: d6321d493319bf arch/x86/kvm/vmx.c Radim Krčmář 2017-08-05 4388 if (!msr_info->host_initiated && d6321d493319bf arch/x86/kvm/vmx.c Radim Krčmář 2017-08-05 4389 !guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP)) 4e47c7a6d714cf arch/x86/kvm/vmx.c Sheng Yang 2009-12-18 4390 return 1; 4e47c7a6d714cf arch/x86/kvm/vmx.c Sheng Yang 2009-12-18 4391 /* Check reserved bit, higher 32 bits should be zero */ 4e47c7a6d714cf arch/x86/kvm/vmx.c Sheng Yang 2009-12-18 4392 if ((data >> 32) != 0) 4e47c7a6d714cf arch/x86/kvm/vmx.c Sheng Yang 2009-12-18 4393 return 1; 4e47c7a6d714cf arch/x86/kvm/vmx.c Sheng Yang 2009-12-18 4394 /* Otherwise falls through */ 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4395 default: 8b9cf98cc7ea73 drivers/kvm/vmx.c Rusty Russell 2007-07-30 4396 msr = find_msr_entry(vmx, msr_index); 3bab1f5dda3443 drivers/kvm/vmx.c Avi Kivity 2006-12-29 4397 if (msr) { 8b3c3104c3f4f7 arch/x86/kvm/vmx.c Andy Honig 2014-08-27 4398 u64 old_msr_data = msr->data; 3bab1f5dda3443 drivers/kvm/vmx.c Avi Kivity 2006-12-29 4399 msr->data = data; 2225fd56049643 arch/x86/kvm/vmx.c Avi Kivity 2012-04-18 4400 if (msr - vmx->guest_msrs < vmx->save_nmsrs) { 2225fd56049643 arch/x86/kvm/vmx.c Avi Kivity 2012-04-18 4401 preempt_disable(); 8b3c3104c3f4f7 arch/x86/kvm/vmx.c Andy Honig 2014-08-27 4402 ret = kvm_set_shared_msr(msr->index, msr->data, 9ee73970c03edb arch/x86/kvm/vmx.c Avi Kivity 2012-03-06 4403 msr->mask); 2225fd56049643 arch/x86/kvm/vmx.c Avi Kivity 2012-04-18 4404 preempt_enable(); 8b3c3104c3f4f7 arch/x86/kvm/vmx.c Andy Honig 2014-08-27 4405 if (ret) 8b3c3104c3f4f7 arch/x86/kvm/vmx.c Andy Honig 2014-08-27 4406 msr->data = old_msr_data; 2225fd56049643 arch/x86/kvm/vmx.c Avi Kivity 2012-04-18 4407 } 3bab1f5dda3443 drivers/kvm/vmx.c Avi Kivity 2006-12-29 4408 break; 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4409 } 8fe8ab46be06fc arch/x86/kvm/vmx.c Will Auld 2012-11-29 @4410 ret = kvm_set_msr_common(vcpu, msr_info); 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4411 } 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4412 4c9a908c6bde35 arch/x86/kvm/vmx.c Pawan Gupta 2022-07-06 4413 /* FB_CLEAR may have changed, also update the FB_CLEAR_DIS behavior */ 4c9a908c6bde35 arch/x86/kvm/vmx.c Pawan Gupta 2022-07-06 4414 if (msr_index == MSR_IA32_ARCH_CAPABILITIES) 4c9a908c6bde35 arch/x86/kvm/vmx.c Pawan Gupta 2022-07-06 4415 vmx_update_fb_clear_dis(vcpu, vmx); 4c9a908c6bde35 arch/x86/kvm/vmx.c Pawan Gupta 2022-07-06 4416 2cc51560aed0ed drivers/kvm/vmx.c Eddie Dong 2007-05-21 4417 return ret; 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4418 } 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4419 :::::: The code at line 4410 was first introduced by commit :::::: 8fe8ab46be06fcd9abfe6fe9928fd95b54ab079a KVM: x86: Add code to track call origin for msr assignment :::::: TO: Will Auld <will.auld.intel(a)gmail.com> :::::: CC: Marcelo Tosatti <mtosatti(a)redhat.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 28517/30000] drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:1232:7: warning: variable 'autoneg_changed' set but not used
by kernel test robot 17 Mar '24

17 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 32bb7b0a7c87769858fbb9d60574b830383c28f7 commit: a0c5bfdbc099daf30cbadb9657803f0cb3f89d0b [28517/30000] drivers: support for rnpm drivers from Mucse Technology N10/N400 config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240317/202403170117.xHb5kcbx-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240317/202403170117.xHb5kcbx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403170117.xHb5kcbx-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:1232:7: warning: variable 'autoneg_changed' set but not used [-Wunused-but-set-variable] 1232 | bool autoneg_changed = false, duplex_changed = false; | ^ >> drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:1232:32: warning: variable 'duplex_changed' set but not used [-Wunused-but-set-variable] 1232 | bool autoneg_changed = false, duplex_changed = false; | ^ >> drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:2029:6: warning: variable 'dma_ch' set but not used [-Wunused-but-set-variable] 2029 | u32 dma_ch; | ^ 3 warnings generated. -- >> drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1003:6: warning: no previous prototype for function 'rnpm_setup_layer2_remapping' [-Wmissing-prototypes] 1003 | void rnpm_setup_layer2_remapping(struct rnpm_hw *hw, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1003:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1003 | void rnpm_setup_layer2_remapping(struct rnpm_hw *hw, | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1027:6: warning: no previous prototype for function 'rnpm_setup_tuple5_remapping' [-Wmissing-prototypes] 1027 | void rnpm_setup_tuple5_remapping(struct rnpm_hw *hw, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1027:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1027 | void rnpm_setup_tuple5_remapping(struct rnpm_hw *hw, | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1098:6: warning: no previous prototype for function 'rnpm_setup_tuple5_remapping_tcam' [-Wmissing-prototypes] 1098 | void rnpm_setup_tuple5_remapping_tcam(struct rnpm_hw *hw, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1098:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1098 | void rnpm_setup_tuple5_remapping_tcam(struct rnpm_hw *hw, | ^ | static 3 warnings generated. -- >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:245:6: warning: no previous prototype for function 'rnpm_pf_service_event_schedule' [-Wmissing-prototypes] 245 | void rnpm_pf_service_event_schedule(struct rnpm_pf_adapter *pf_adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:245:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 245 | void rnpm_pf_service_event_schedule(struct rnpm_pf_adapter *pf_adapter) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:1768:5: warning: no previous prototype for function 'rnpm_rx_ring_reinit' [-Wmissing-prototypes] 1768 | int rnpm_rx_ring_reinit(struct rnpm_adapter *adapter, struct rnpm_ring *rx_ring) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:1768:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1768 | int rnpm_rx_ring_reinit(struct rnpm_adapter *adapter, struct rnpm_ring *rx_ring) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:1957:7: warning: variable 'xdp_xmit' set but not used [-Wunused-but-set-variable] 1957 | bool xdp_xmit = false; | ^ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2142:6: warning: no previous prototype for function 'rnpm_write_eitr' [-Wmissing-prototypes] 2142 | void rnpm_write_eitr(struct rnpm_q_vector *q_vector, bool is_rxframe) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2142:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2142 | void rnpm_write_eitr(struct rnpm_q_vector *q_vector, bool is_rxframe) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2381:6: warning: variable 'packets' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] 2381 | if (!ring_container->ring) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2387:7: note: uninitialized use occurs here 2387 | if (!packets) | ^~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2381:2: note: remove the 'if' if its condition is always true 2381 | if (!ring_container->ring) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ 2382 | 2383 | packets = ring_container->total_packets; drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2374:37: note: initialize the variable 'packets' to silence this warning 2374 | unsigned int avg_wire_size, packets, bytes; | ^ | = 0 >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2969:5: warning: no previous prototype for function 'rnpm_xmit_nop_frame_ring' [-Wmissing-prototypes] 2969 | int rnpm_xmit_nop_frame_ring(struct rnpm_adapter *adapter, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2969:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2969 | int rnpm_xmit_nop_frame_ring(struct rnpm_adapter *adapter, | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2985:5: warning: no previous prototype for function 'rnpm_xmit_nop_frame_ring_temp' [-Wmissing-prototypes] 2985 | int rnpm_xmit_nop_frame_ring_temp(struct rnpm_adapter *adapter, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2985:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2985 | int rnpm_xmit_nop_frame_ring_temp(struct rnpm_adapter *adapter, | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3851:6: warning: no previous prototype for function 'rnpm_vlan_stags_flag' [-Wmissing-prototypes] 3851 | void rnpm_vlan_stags_flag(struct rnpm_adapter *adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3851:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3851 | void rnpm_vlan_stags_flag(struct rnpm_adapter *adapter) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3972:6: warning: no previous prototype for function 'control_mac_rx' [-Wmissing-prototypes] 3972 | void control_mac_rx(struct rnpm_adapter *adapter, bool on) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3972:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3972 | void control_mac_rx(struct rnpm_adapter *adapter, bool on) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5689:6: warning: no previous prototype for function 'rnpm_pf_service_timer' [-Wmissing-prototypes] 5689 | void rnpm_pf_service_timer(struct timer_list *t) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5689:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 5689 | void rnpm_pf_service_timer(struct timer_list *t) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5707:6: warning: no previous prototype for function 'rnpm_service_timer' [-Wmissing-prototypes] 5707 | void rnpm_service_timer(struct timer_list *t) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5707:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 5707 | void rnpm_service_timer(struct timer_list *t) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5853:21: warning: no previous prototype for function 'wait_all_port_resetting' [-Wmissing-prototypes] 5853 | __maybe_unused void wait_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5853:16: note: declare 'static' if the function is not intended to be used outside of this translation unit 5853 | __maybe_unused void wait_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5865:21: warning: no previous prototype for function 'clean_all_port_resetting' [-Wmissing-prototypes] 5865 | __maybe_unused void clean_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5865:16: note: declare 'static' if the function is not intended to be used outside of this translation unit 5865 | __maybe_unused void clean_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6077:5: warning: no previous prototype for function 'rnpm_check_mc_addr' [-Wmissing-prototypes] 6077 | int rnpm_check_mc_addr(struct rnpm_adapter *adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6077:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6077 | int rnpm_check_mc_addr(struct rnpm_adapter *adapter) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6103:6: warning: no previous prototype for function 'update_pf_vlan' [-Wmissing-prototypes] 6103 | void update_pf_vlan(struct rnpm_adapter *adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6103:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6103 | void update_pf_vlan(struct rnpm_adapter *adapter) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6158:6: warning: no previous prototype for function 'rnpm_pf_service_task' [-Wmissing-prototypes] 6158 | void rnpm_pf_service_task(struct work_struct *work) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6158:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6158 | void rnpm_pf_service_task(struct work_struct *work) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7339:6: warning: no previous prototype for function 'rnpm_clear_udp_tunnel_port' [-Wmissing-prototypes] 7339 | void rnpm_clear_udp_tunnel_port(struct rnpm_adapter *adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7339:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 7339 | void rnpm_clear_udp_tunnel_port(struct rnpm_adapter *adapter) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7486:6: warning: no previous prototype for function 'rnpm_assign_netdev_ops' [-Wmissing-prototypes] 7486 | void rnpm_assign_netdev_ops(struct net_device *dev) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7486:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 7486 | void rnpm_assign_netdev_ops(struct net_device *dev) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7575:6: warning: no previous prototype for function 'rnpm_fix_queue_number' [-Wmissing-prototypes] 7575 | void rnpm_fix_queue_number(struct rnpm_hw *hw) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7575:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 7575 | void rnpm_fix_queue_number(struct rnpm_hw *hw) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:8443:5: warning: no previous prototype for function 'rnpm_can_rpu_start' [-Wmissing-prototypes] 8443 | int rnpm_can_rpu_start(struct rnpm_pf_adapter *pf_adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:8443:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 8443 | int rnpm_can_rpu_start(struct rnpm_pf_adapter *pf_adapter) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:8762:18: warning: variable 'hw' set but not used [-Wunused-but-set-variable] 8762 | struct rnpm_hw *hw; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:307:20: warning: unused function 'rnpm_irq_rearm_queues' [-Wunused-function] 307 | static inline void rnpm_irq_rearm_queues(struct rnpm_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7516:29: warning: unused function 'rnpm_tso_features' [-Wunused-function] 7516 | static inline unsigned long rnpm_tso_features(void) | ^~~~~~~~~~~~~~~~~ 23 warnings generated. -- >> drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:448:5: warning: no previous prototype for function 'rnpm_reset_pipeline_n10' [-Wmissing-prototypes] 448 | s32 rnpm_reset_pipeline_n10(struct rnpm_hw *hw) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:448:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 448 | s32 rnpm_reset_pipeline_n10(struct rnpm_hw *hw) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:503:6: warning: variable 'status' set but not used [-Wunused-but-set-variable] 503 | s32 status = 0; | ^ 2 warnings generated. -- >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:14:24: warning: no previous prototype for function 'mbx_cookie_zalloc' [-Wmissing-prototypes] 14 | struct mbx_req_cookie *mbx_cookie_zalloc(int priv_len) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:14:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 14 | struct mbx_req_cookie *mbx_cookie_zalloc(int priv_len) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:28:5: warning: no previous prototype for function 'rnpm_mbx_write_posted_locked' [-Wmissing-prototypes] 28 | int rnpm_mbx_write_posted_locked(struct rnpm_hw *hw, struct mbx_fw_cmd_req *req) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:28:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 28 | int rnpm_mbx_write_posted_locked(struct rnpm_hw *hw, struct mbx_fw_cmd_req *req) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:81:6: warning: no previous prototype for function 'rnpm_link_stat_mark_disable' [-Wmissing-prototypes] 81 | void rnpm_link_stat_mark_disable(struct rnpm_hw *hw) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:81:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 81 | void rnpm_link_stat_mark_disable(struct rnpm_hw *hw) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:86:5: warning: no previous prototype for function 'rnpm_mbx_fw_post_req' [-Wmissing-prototypes] 86 | int rnpm_mbx_fw_post_req(struct rnpm_hw *hw, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:86:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 86 | int rnpm_mbx_fw_post_req(struct rnpm_hw *hw, | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:153:5: warning: no previous prototype for function 'rnpm_fw_send_cmd_wait' [-Wmissing-prototypes] 153 | int rnpm_fw_send_cmd_wait(struct rnpm_hw *hw, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:153:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 153 | int rnpm_fw_send_cmd_wait(struct rnpm_hw *hw, | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:633:5: warning: no previous prototype for function 'rnpm_mbx_lldp_all_ports_enable' [-Wmissing-prototypes] 633 | int rnpm_mbx_lldp_all_ports_enable(struct rnpm_hw *hw, bool enable) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:633:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 633 | int rnpm_mbx_lldp_all_ports_enable(struct rnpm_hw *hw, bool enable) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:936:5: warning: no previous prototype for function 'rnpm_mbx_pluginout_evt_en' [-Wmissing-prototypes] 936 | int rnpm_mbx_pluginout_evt_en(struct rnpm_hw *hw, int in_dir, int enable) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:936:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 936 | int rnpm_mbx_pluginout_evt_en(struct rnpm_hw *hw, int in_dir, int enable) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:963:5: warning: no previous prototype for function 'rnpm_fw_get_capablity' [-Wmissing-prototypes] 963 | int rnpm_fw_get_capablity(struct rnpm_hw *hw, struct phy_abilities *abil) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:963:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 963 | int rnpm_fw_get_capablity(struct rnpm_hw *hw, struct phy_abilities *abil) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1153:6: warning: variable 'err' set but not used [-Wunused-but-set-variable] 1153 | int err; | ^ >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1188:6: warning: variable 'value' set but not used [-Wunused-but-set-variable] 1188 | int value; | ^ >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1184:5: warning: no previous prototype for function 'rnpm_fw_reg_read' [-Wmissing-prototypes] 1184 | int rnpm_fw_reg_read(struct rnpm_hw *hw, int addr, int sz) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1184:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1184 | int rnpm_fw_reg_read(struct rnpm_hw *hw, int addr, int sz) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1255:18: warning: variable 'hw' set but not used [-Wunused-but-set-variable] 1255 | struct rnpm_hw *hw; | ^ >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1476:5: warning: no previous prototype for function 'rnpm_get_port_stats2' [-Wmissing-prototypes] 1476 | int rnpm_get_port_stats2(struct rnpm_hw *hw, int *pabs, int *pspeed, int *plink) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1476:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1476 | int rnpm_get_port_stats2(struct rnpm_hw *hw, int *pabs, int *pspeed, int *plink) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1528:9: warning: variable 'err' is uninitialized when used here [-Wuninitialized] 1528 | return err ? -err : 0; | ^~~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1509:9: note: initialize the variable 'err' to silence this warning 1509 | int err; | ^ | = 0 14 warnings generated. -- >> drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c:263:5: warning: no previous prototype for function 'rnpm_mbx_get_pn_sn' [-Wmissing-prototypes] 263 | int rnpm_mbx_get_pn_sn(struct rnpm_hw *hw, char pn[33], char sn[33]) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c:263:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 263 | int rnpm_mbx_get_pn_sn(struct rnpm_hw *hw, char pn[33], char sn[33]) | ^ | static 1 warning generated. -- >> drivers/net/ethernet/mucse/rnpm/rnpm_ptp.c:91:6: warning: variable 'target' set but not used [-Wunused-but-set-variable] 91 | u32 target; | ^ >> drivers/net/ethernet/mucse/rnpm/rnpm_ptp.c:314:5: warning: no previous prototype for function 'rnpm_ptp_setup_ptp' [-Wmissing-prototypes] 314 | int rnpm_ptp_setup_ptp(struct rnpm_adapter *pf, u32 value) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_ptp.c:314:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 314 | int rnpm_ptp_setup_ptp(struct rnpm_adapter *pf, u32 value) | ^ | static 2 warnings generated. .. vim +/autoneg_changed +1232 drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c 1217 1218 /** 1219 * rnpm_set_link_ksettings - Set Speed and Duplex 1220 * @netdev: network interface device structure 1221 * @ks: ethtool ksettings 1222 * 1223 * Set speed/duplex per media_types advertised/forced 1224 **/ 1225 static int rnpm_set_link_ksettings(struct net_device *netdev, 1226 const struct ethtool_link_ksettings *ks) 1227 { 1228 struct rnpm_adapter *adapter = netdev_priv(netdev); 1229 struct rnpm_hw *hw = &adapter->hw; 1230 struct ethtool_link_ksettings safe_ks; 1231 struct ethtool_link_ksettings copy_ks; > 1232 bool autoneg_changed = false, duplex_changed = false; 1233 int timeout = 50; 1234 int err = 0; 1235 u8 autoneg; 1236 u32 advertising_link_speed; 1237 1238 /* copy the ksettings to copy_ks to avoid modifying the origin */ 1239 memcpy(&copy_ks, ks, sizeof(struct ethtool_link_ksettings)); 1240 /* save autoneg out of ksettings */ 1241 autoneg = copy_ks.base.autoneg; 1242 rnpm_logd(LOG_ETHTOOL, 1243 "%s %s set link: speed=%d port=%d duplex=%d autoneg=%d ", 1244 __func__, netdev->name, copy_ks.base.speed, copy_ks.base.port, 1245 copy_ks.base.duplex, copy_ks.base.autoneg); 1246 rnpm_logd(LOG_ETHTOOL, "phy_address=%d mdix_ctrl=%d\n", 1247 copy_ks.base.phy_address, copy_ks.base.eth_tp_mdix_ctrl); 1248 /* get our own copy of the bits to check against */ 1249 memset(&safe_ks, 0, sizeof(struct ethtool_link_ksettings)); 1250 safe_ks.base.cmd = copy_ks.base.cmd; 1251 safe_ks.base.link_mode_masks_nwords = 1252 copy_ks.base.link_mode_masks_nwords; 1253 1254 if (rnpm_get_link_ksettings(netdev, &safe_ks)) { 1255 /* return err */ 1256 return 0; 1257 } 1258 1259 if (!adapter->pf_adapter->force_10g_1g_speed_ablity) { 1260 /* Checkout the media_type */ 1261 if (hw->phy.media_type != rnpm_media_type_fiber && 1262 hw->phy.media_type != rnpm_media_type_copper && 1263 hw->phy.media_type != rnpm_media_type_backplane && 1264 hw->phy.media_type != rnpm_media_type_cx4 && 1265 hw->phy.media_type != rnpm_media_type_da) 1266 return -EOPNOTSUPP; 1267 } 1268 1269 /* Get link modes supported by hardware and check against modes 1270 * requested by user. Return an error if unsupported mode was set. 1271 */ 1272 if (!bitmap_subset(copy_ks.link_modes.advertising, 1273 safe_ks.link_modes.supported, 1274 __ETHTOOL_LINK_MODE_MASK_NBITS)) 1275 return -EINVAL; 1276 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 24813/30000] drivers/ub/urma/ubcore/ubcore_dp.c:26:5: warning: no previous prototype for 'ubcore_rearm_jfc'
by kernel test robot 16 Mar '24

16 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 32bb7b0a7c87769858fbb9d60574b830383c28f7 commit: ad84f0a92e3fe282d8280d8c45f8d5b8aab1a2b4 [24813/30000] ub: ubcore add event api and add jetty and event api impls to compile config: arm64-randconfig-003-20240312 (https://download.01.org/0day-ci/archive/20240316/202403162310.RbkbvVYd-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240316/202403162310.RbkbvVYd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403162310.RbkbvVYd-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/ubcore/ubcore_dp.c:26:5: warning: no previous prototype for 'ubcore_rearm_jfc' [-Wmissing-prototypes] 26 | int ubcore_rearm_jfc(struct ubcore_jfc *jfc, bool solicited_only) | ^~~~~~~~~~~~~~~~ vim +/ubcore_rearm_jfc +26 drivers/ub/urma/ubcore/ubcore_dp.c 25 > 26 int ubcore_rearm_jfc(struct ubcore_jfc *jfc, bool solicited_only) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH] printk: avoid deadlock in panic
by Ye Weihua 16 Mar '24

16 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I991OV -------------------------------- In the process of load testing against panic, a deadlock issue was discovered. The reason is that in the panic process, console_unlock doesn't handle the printk_context variable evenly, causing printk_context to overflow downwards, allowing vprintk_func to enter the nmi direct branch without disabling interrupt. Upon holding the logbuf_lock lock, an interrupt running wake_up_klogd_work_func was called, resulting in a deadlock. To avoid this issue, move printk_safe_ext_irqrestore after check abandon_console_lock_in_panic(). Fixes: 7c2aff380e41 ([Backport] printk: Drop console_sem during panic) Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> --- kernel/printk/printk.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c index 87cd50ae6cd6..ffd7f90b8f02 100644 --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c @@ -2609,12 +2609,12 @@ void console_unlock(void) return; } - printk_safe_exit_irqrestore(flags); - /* Allow panic_cpu to take over the consoles safely */ if (abandon_console_lock_in_panic()) break; + printk_safe_exit_irqrestore(flags); + if (do_cond_resched) cond_resched(); } -- 2.34.1

1 0

[PATCH OLK-5.10 0/3] Fix CVE-2024-26629
by Li Lingfeng 16 Mar '24

16 Mar '24

The third patch is fix patch. The first two patches are applied to reduce conflict. Chuck Lever (2): NFSD: Modernize nfsd4_release_lockowner() NFSD: Add documenting comment for nfsd4_release_lockowner() NeilBrown (1): nfsd: fix RELEASE_LOCKOWNER fs/nfsd/nfs4state.c | 65 +++++++++++++++++++++++++-------------------- 1 file changed, 36 insertions(+), 29 deletions(-) -- 2.31.1

2 4

[PATCH OLK-6.6] nfsd: fix RELEASE_LOCKOWNER
by Li Lingfeng 16 Mar '24

16 Mar '24

From: NeilBrown <neilb(a)suse.de> mainline inclusion from mainline-v6.8-rc2 commit edcf9725150e42beeca42d085149f4c88fa97afd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I98BN3 CVE: CVE-2024-26629 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The test on so_count in nfsd4_release_lockowner() is nonsense and harmful. Revert to using check_for_locks(), changing that to not sleep. First: harmful. As is documented in the kdoc comment for nfsd4_release_lockowner(), the test on so_count can transiently return a false positive resulting in a return of NFS4ERR_LOCKS_HELD when in fact no locks are held. This is clearly a protocol violation and with the Linux NFS client it can cause incorrect behaviour. If RELEASE_LOCKOWNER is sent while some other thread is still processing a LOCK request which failed because, at the time that request was received, the given owner held a conflicting lock, then the nfsd thread processing that LOCK request can hold a reference (conflock) to the lock owner that causes nfsd4_release_lockowner() to return an incorrect error. The Linux NFS client ignores that NFS4ERR_LOCKS_HELD error because it never sends NFS4_RELEASE_LOCKOWNER without first releasing any locks, so it knows that the error is impossible. It assumes the lock owner was in fact released so it feels free to use the same lock owner identifier in some later locking request. When it does reuse a lock owner identifier for which a previous RELEASE failed, it will naturally use a lock_seqid of zero. However the server, which didn't release the lock owner, will expect a larger lock_seqid and so will respond with NFS4ERR_BAD_SEQID. So clearly it is harmful to allow a false positive, which testing so_count allows. The test is nonsense because ... well... it doesn't mean anything. so_count is the sum of three different counts. 1/ the set of states listed on so_stateids 2/ the set of active vfs locks owned by any of those states 3/ various transient counts such as for conflicting locks. When it is tested against '2' it is clear that one of these is the transient reference obtained by find_lockowner_str_locked(). It is not clear what the other one is expected to be. In practice, the count is often 2 because there is precisely one state on so_stateids. If there were more, this would fail. In my testing I see two circumstances when RELEASE_LOCKOWNER is called. In one case, CLOSE is called before RELEASE_LOCKOWNER. That results in all the lock states being removed, and so the lockowner being discarded (it is removed when there are no more references which usually happens when the lock state is discarded). When nfsd4_release_lockowner() finds that the lock owner doesn't exist, it returns success. The other case shows an so_count of '2' and precisely one state listed in so_stateid. It appears that the Linux client uses a separate lock owner for each file resulting in one lock state per lock owner, so this test on '2' is safe. For another client it might not be safe. So this patch changes check_for_locks() to use the (newish) find_any_file_locked() so that it doesn't take a reference on the nfs4_file and so never calls nfsd_file_put(), and so never sleeps. With this check is it safe to restore the use of check_for_locks() rather than testing so_count against the mysterious '2'. Fixes: ce3c4ad7f4ce ("NFSD: Fix possible sleep during nfsd4_release_lockowner()") Signed-off-by: NeilBrown <neilb(a)suse.de> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Cc: stable(a)vger.kernel.org # v6.2+ Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4state.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 529b3ed3b317..f4cccbf664ce 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -7890,14 +7890,16 @@ check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner) { struct file_lock *fl; int status = false; - struct nfsd_file *nf = find_any_file(fp); + struct nfsd_file *nf; struct inode *inode; struct file_lock_context *flctx; + spin_lock(&fp->fi_lock); + nf = find_any_file_locked(fp); if (!nf) { /* Any valid lock stateid should have some sort of access */ WARN_ON_ONCE(1); - return status; + goto out; } inode = file_inode(nf->nf_file); @@ -7913,7 +7915,8 @@ check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner) } spin_unlock(&flctx->flc_lock); } - nfsd_file_put(nf); +out: + spin_unlock(&fp->fi_lock); return status; } @@ -7923,10 +7926,8 @@ check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner) * @cstate: NFSv4 COMPOUND state * @u: RELEASE_LOCKOWNER arguments * - * The lockowner's so_count is bumped when a lock record is added - * or when copying a conflicting lock. The latter case is brief, - * but can lead to fleeting false positives when looking for - * locks-in-use. + * Check if theree are any locks still held and if not - free the lockowner + * and any lock state that is owned. * * Return values: * %nfs_ok: lockowner released or not found @@ -7962,10 +7963,13 @@ nfsd4_release_lockowner(struct svc_rqst *rqstp, spin_unlock(&clp->cl_lock); return nfs_ok; } - if (atomic_read(&lo->lo_owner.so_count) != 2) { - spin_unlock(&clp->cl_lock); - nfs4_put_stateowner(&lo->lo_owner); - return nfserr_locks_held; + + list_for_each_entry(stp, &lo->lo_owner.so_stateids, st_perstateowner) { + if (check_for_locks(stp->st_stid.sc_file, lo)) { + spin_unlock(&clp->cl_lock); + nfs4_put_stateowner(&lo->lo_owner); + return nfserr_locks_held; + } } unhash_lockowner_locked(lo); while (!list_empty(&lo->lo_owner.so_stateids)) { -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] phonet/pep: refuse to enable an unbound pipe
by Dong Chenchen 16 Mar '24

16 Mar '24

From: Rémi Denis-Courmont <remi(a)remlab.net> stable inclusion from stable-v4.19.222 commit 982b6ba1ce626ef87e5c29f26f2401897554f235 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95RE9 CVE: CVE-2021-47086 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 75a2f31520095600f650597c0ac41f48b5ba0068 upstream. This ioctl() implicitly assumed that the socket was already bound to a valid local socket name, i.e. Phonet object. If the socket was not bound, two separate problems would occur: 1) We'd send an pipe enablement request with an invalid source object. 2) Later socket calls could BUG on the socket unexpectedly being connected yet not bound to a valid object. Reported-by: syzbot+2dc91e7fc3dea88b1e8a(a)syzkaller.appspotmail.com Signed-off-by: Rémi Denis-Courmont <remi(a)remlab.net> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/phonet/pep.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/phonet/pep.c b/net/phonet/pep.c index 63d34e702df5..fe01cc788448 100644 --- a/net/phonet/pep.c +++ b/net/phonet/pep.c @@ -960,6 +960,8 @@ static int pep_ioctl(struct sock *sk, int cmd, unsigned long arg) ret = -EBUSY; else if (sk->sk_state == TCP_ESTABLISHED) ret = -EISCONN; + else if (!pn->pn_sk.sobject) + ret = -EADDRNOTAVAIL; else ret = pep_sock_enable(sk, NULL, 0); release_sock(sk); -- 2.25.1

2 1

[PATCH OLK-5.10] net/smc: fix illegal rmb_desc access in SMC-D connection dump
by Dong Chenchen 16 Mar '24

16 Mar '24

From: Wen Gu <guwen(a)linux.alibaba.com> stable inclusion from stable-v5.10.209 commit 5fed92ca32eafbfae8b6bee8ca34cca71c6a8b6d category: bugfix bugzilla: 189676, https://gitee.com/src-openeuler/kernel/issues/I97NHS CVE: CVE-2024-26615 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dbc153fd3c142909e564bb256da087e13fbf239c ] A crash was found when dumping SMC-D connections. It can be reproduced by following steps: - run nginx/wrk test: smc_run nginx smc_run wrk -t 16 -c 1000 -d <duration> -H 'Connection: Close' <URL> - continuously dump SMC-D connections in parallel: watch -n 1 'smcss -D' BUG: kernel NULL pointer dereference, address: 0000000000000030 CPU: 2 PID: 7204 Comm: smcss Kdump: loaded Tainted: G E 6.7.0+ #55 RIP: 0010:__smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag] Call Trace: <TASK> ? __die+0x24/0x70 ? page_fault_oops+0x66/0x150 ? exc_page_fault+0x69/0x140 ? asm_exc_page_fault+0x26/0x30 ? __smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag] ? __kmalloc_node_track_caller+0x35d/0x430 ? __alloc_skb+0x77/0x170 smc_diag_dump_proto+0xd0/0xf0 [smc_diag] smc_diag_dump+0x26/0x60 [smc_diag] netlink_dump+0x19f/0x320 __netlink_dump_start+0x1dc/0x300 smc_diag_handler_dump+0x6a/0x80 [smc_diag] ? __pfx_smc_diag_dump+0x10/0x10 [smc_diag] sock_diag_rcv_msg+0x121/0x140 ? __pfx_sock_diag_rcv_msg+0x10/0x10 netlink_rcv_skb+0x5a/0x110 sock_diag_rcv+0x28/0x40 netlink_unicast+0x22a/0x330 netlink_sendmsg+0x1f8/0x420 __sock_sendmsg+0xb0/0xc0 ____sys_sendmsg+0x24e/0x300 ? copy_msghdr_from_user+0x62/0x80 ___sys_sendmsg+0x7c/0xd0 ? __do_fault+0x34/0x160 ? do_read_fault+0x5f/0x100 ? do_fault+0xb0/0x110 ? __handle_mm_fault+0x2b0/0x6c0 __sys_sendmsg+0x4d/0x80 do_syscall_64+0x69/0x180 entry_SYSCALL_64_after_hwframe+0x6e/0x76 It is possible that the connection is in process of being established when we dump it. Assumed that the connection has been registered in a link group by smc_conn_create() but the rmb_desc has not yet been initialized by smc_buf_create(), thus causing the illegal access to conn->rmb_desc. So fix it by checking before dump. Fixes: 4b1b7d3b30a6 ("net/smc: add SMC-D diag support") Signed-off-by: Wen Gu <guwen(a)linux.alibaba.com> Reviewed-by: Dust Li <dust.li(a)linux.alibaba.com> Reviewed-by: Wenjia Zhang <wenjia(a)linux.ibm.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/smc/smc_diag.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/smc/smc_diag.c b/net/smc/smc_diag.c index 4dd4f9e694da..5fb64b66a319 100644 --- a/net/smc/smc_diag.c +++ b/net/smc/smc_diag.c @@ -164,7 +164,7 @@ static int __smc_diag_dump(struct sock *sk, struct sk_buff *skb, } if (smc->conn.lgr && smc->conn.lgr->is_smcd && (req->diag_ext & (1 << (SMC_DIAG_DMBINFO - 1))) && - !list_empty(&smc->conn.lgr->list)) { + !list_empty(&smc->conn.lgr->list) && smc->conn.rmb_desc) { struct smc_connection *conn = &smc->conn; struct smcd_diag_dmbinfo dinfo; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net/smc: fix illegal rmb_desc access in SMC-D connection dump
by Dong Chenchen 16 Mar '24

16 Mar '24

From: Wen Gu <guwen(a)linux.alibaba.com> stable inclusion from stable-v4.19.306 commit 27aea64838914c6122db5b8bd4bed865c9736f22 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I97NHS CVE: CVE-2024-26615 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dbc153fd3c142909e564bb256da087e13fbf239c ] A crash was found when dumping SMC-D connections. It can be reproduced by following steps: - run nginx/wrk test: smc_run nginx smc_run wrk -t 16 -c 1000 -d <duration> -H 'Connection: Close' <URL> - continuously dump SMC-D connections in parallel: watch -n 1 'smcss -D' BUG: kernel NULL pointer dereference, address: 0000000000000030 CPU: 2 PID: 7204 Comm: smcss Kdump: loaded Tainted: G E 6.7.0+ #55 RIP: 0010:__smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag] Call Trace: <TASK> ? __die+0x24/0x70 ? page_fault_oops+0x66/0x150 ? exc_page_fault+0x69/0x140 ? asm_exc_page_fault+0x26/0x30 ? __smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag] ? __kmalloc_node_track_caller+0x35d/0x430 ? __alloc_skb+0x77/0x170 smc_diag_dump_proto+0xd0/0xf0 [smc_diag] smc_diag_dump+0x26/0x60 [smc_diag] netlink_dump+0x19f/0x320 __netlink_dump_start+0x1dc/0x300 smc_diag_handler_dump+0x6a/0x80 [smc_diag] ? __pfx_smc_diag_dump+0x10/0x10 [smc_diag] sock_diag_rcv_msg+0x121/0x140 ? __pfx_sock_diag_rcv_msg+0x10/0x10 netlink_rcv_skb+0x5a/0x110 sock_diag_rcv+0x28/0x40 netlink_unicast+0x22a/0x330 netlink_sendmsg+0x1f8/0x420 __sock_sendmsg+0xb0/0xc0 ____sys_sendmsg+0x24e/0x300 ? copy_msghdr_from_user+0x62/0x80 ___sys_sendmsg+0x7c/0xd0 ? __do_fault+0x34/0x160 ? do_read_fault+0x5f/0x100 ? do_fault+0xb0/0x110 ? __handle_mm_fault+0x2b0/0x6c0 __sys_sendmsg+0x4d/0x80 do_syscall_64+0x69/0x180 entry_SYSCALL_64_after_hwframe+0x6e/0x76 It is possible that the connection is in process of being established when we dump it. Assumed that the connection has been registered in a link group by smc_conn_create() but the rmb_desc has not yet been initialized by smc_buf_create(), thus causing the illegal access to conn->rmb_desc. So fix it by checking before dump. Fixes: 4b1b7d3b30a6 ("net/smc: add SMC-D diag support") Signed-off-by: Wen Gu <guwen(a)linux.alibaba.com> Reviewed-by: Dust Li <dust.li(a)linux.alibaba.com> Reviewed-by: Wenjia Zhang <wenjia(a)linux.ibm.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/smc/smc_diag.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/smc/smc_diag.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/smc/smc_diag.c b/net/smc/smc_diag.c index dbf64a93d68a..d0b2f991a9e4 100644 --- a/net/smc/smc_diag.c +++ b/net/smc/smc_diag.c @@ -169,7 +169,7 @@ static int __smc_diag_dump(struct sock *sk, struct sk_buff *skb, } if (smc->conn.lgr && smc->conn.lgr->is_smcd && (req->diag_ext & (1 << (SMC_DIAG_DMBINFO - 1))) && - !list_empty(&smc->conn.lgr->list)) { + !list_empty(&smc->conn.lgr->list) && smc->conn.rmb_desc) { struct smc_connection *conn = &smc->conn; struct smcd_diag_dmbinfo dinfo = { .linkid = *((u32 *)conn->lgr->id), -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] printk: avoid deadlock in panic
by Ye Weihua 16 Mar '24

16 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I991OV -------------------------------- In the process of load testing against panic, a deadlock issue was discovered. The reason is that in the panic process, console_unlock doesn't handle the printk_context variable evenly, causing printk_context to overflow downwards, allowing vprintk_func to enter the nmi direct branch without disabling interrupt. Upon holding the logbuf_lock lock, an interrupt running wake_up_klogd_work_func was called, resulting in a deadlock. To avoid this issue, move printk_safe_ext_irqrestore after check abandon_console_lock_in_panic(). Fixes: 06a14c5f9e7d (printk: Drop console_sem during panic) Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> --- kernel/printk/printk.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c index f52eceb3c48a..11ebe66c473a 100644 --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c @@ -2426,7 +2426,7 @@ void console_unlock(void) static char text[LOG_LINE_MAX + PREFIX_MAX]; static int panic_console_dropped; unsigned long flags; - bool do_cond_resched, retry; + bool do_cond_resched, retry, locked = false; if (console_suspended) { up_console_sem(); @@ -2469,6 +2469,7 @@ void console_unlock(void) printk_safe_enter_irqsave(flags); raw_spin_lock(&logbuf_lock); + locked = true; if (console_seq < log_first_seq) { len = snprintf(text, sizeof(text), "** %llu printk messages dropped **\n", @@ -2520,6 +2521,7 @@ void console_unlock(void) } console_idx = log_next(console_idx); console_seq++; + locked = false; raw_spin_unlock(&logbuf_lock); /* @@ -2539,19 +2541,20 @@ void console_unlock(void) return; } - printk_safe_exit_irqrestore(flags); - /* Allow panic_cpu to take over the consoles safely */ if (abandon_console_lock_in_panic()) break; + printk_safe_exit_irqrestore(flags); + if (do_cond_resched) cond_resched(); } console_locked = 0; - raw_spin_unlock(&logbuf_lock); + if (likely(locked)) + raw_spin_unlock(&logbuf_lock); up_console_sem(); -- 2.34.1

2 1

[OLK-5.10 v2 PATCH] iomap: add support to track dirty state of sub pages
by Yu Kuai 16 Mar '24

16 Mar '24

hulk inclusion category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/I93TU0 CVE: NA ------------------------------------------ commit 9dc55f1389f9 ("iomap: add support for sub-pagesize buffered I/O without buffer heads") replace the per-block structure buffer_head with the per-page structure iomap_page. However, iomap_page can't track the dirty state of sub pages, which will cause performance issue since sub pages will be writeback even if they are not dirty. For example, if block size is 4k and page size is 64k: dd if=/dev/zero of=testfile bs=4k count=16 oflag=sync With buffer_head implementation, the above dd cmd will writeback 4k in each round. However, with iomap_page implementation, the range of writeback in each round is from the start of the page to the end offset we just wrote. Thus add support to track dirty state in iomap_page. test environment: platform: arm64 pagesize: 64k blocksize: 4k test case: dd if=/dev/zero of=/mnt/testfile bs=1M count=128 fio --ioengine=sync --rw=randwrite --iodepth=64 --name=test \ --filename=/mnt/testfile --bs=4k --fsync=1 The test result is: xfs with patch: WRITE: bw=4609KiB/s (4720kB/s) xfs without patch WRITE: bw=2714KiB/s (2780kB/s) ext4: WRITE: bw=3840KiB/s (3932kB/s) Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- Changes in v2: - remove changes to iomap_page_mkwrite_actor(). fs/iomap/buffered-io.c | 83 ++++++++++++++++++++++++++++++++++-------- 1 file changed, 67 insertions(+), 16 deletions(-) diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c index d9092aa5c3fb..25448d5827d2 100644 --- a/fs/iomap/buffered-io.c +++ b/fs/iomap/buffered-io.c @@ -25,13 +25,13 @@ /* * Structure allocated for each page or THP when block size < page size - * to track sub-page uptodate status and I/O completions. + * to track sub-page uptodate and dirty status and I/O completions. */ struct iomap_page { atomic_t read_bytes_pending; atomic_t write_bytes_pending; - spinlock_t uptodate_lock; - unsigned long uptodate[]; + spinlock_t state_lock; + unsigned long state[]; }; static inline struct iomap_page *to_iomap_page(struct page *page) @@ -59,11 +59,13 @@ iomap_page_create(struct inode *inode, struct page *page) if (iop || nr_blocks <= 1) return iop; - iop = kzalloc(struct_size(iop, uptodate, BITS_TO_LONGS(nr_blocks)), + iop = kzalloc(struct_size(iop, state, BITS_TO_LONGS(2 * nr_blocks)), GFP_NOFS | __GFP_NOFAIL); - spin_lock_init(&iop->uptodate_lock); + spin_lock_init(&iop->state_lock); if (PageUptodate(page)) - bitmap_fill(iop->uptodate, nr_blocks); + bitmap_set(iop->state, 0, nr_blocks); + if (PageDirty(page)) + bitmap_set(iop->state, nr_blocks, nr_blocks); attach_page_private(page, iop); return iop; } @@ -78,7 +80,7 @@ iomap_page_release(struct page *page) return; WARN_ON_ONCE(atomic_read(&iop->read_bytes_pending)); WARN_ON_ONCE(atomic_read(&iop->write_bytes_pending)); - WARN_ON_ONCE(bitmap_full(iop->uptodate, nr_blocks) != + WARN_ON_ONCE(bitmap_full(iop->state, nr_blocks) != PageUptodate(page)); kfree(iop); } @@ -109,7 +111,7 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop, /* move forward for each leading block marked uptodate */ for (i = first; i <= last; i++) { - if (!test_bit(i, iop->uptodate)) + if (!test_bit(i, iop->state)) break; *pos += block_size; poff += block_size; @@ -119,7 +121,7 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop, /* truncate len if we find any trailing uptodate block(s) */ for ( ; i <= last; i++) { - if (test_bit(i, iop->uptodate)) { + if (test_bit(i, iop->state)) { plen -= (last - i + 1) * block_size; last = i - 1; break; @@ -143,6 +145,53 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop, *lenp = plen; } +static void +iomap_set_range_dirty(struct page *page, unsigned int off, unsigned int len) +{ + struct inode *inode = page->mapping->host; + unsigned int nr_blocks = i_blocks_per_page(inode, page); + unsigned int first = off >> inode->i_blkbits; + unsigned int last = (off + len - 1) >> inode->i_blkbits; + unsigned long flags; + struct iomap_page *iop; + + if (PageError(page)) + return; + + if (len) + iomap_set_page_dirty(page); + + if (!page_has_private(page)) + return; + + iop = to_iomap_page(page); + spin_lock_irqsave(&iop->state_lock, flags); + bitmap_set(iop->state, first + nr_blocks, last - first + 1); + spin_unlock_irqrestore(&iop->state_lock, flags); +} + +static void +iomap_clear_range_dirty(struct page *page, unsigned int off, unsigned int len) +{ + struct inode *inode = page->mapping->host; + unsigned int nr_blocks = i_blocks_per_page(inode, page); + unsigned int first = off >> inode->i_blkbits; + unsigned int last = (off + len - 1) >> inode->i_blkbits; + unsigned long flags; + struct iomap_page *iop; + + if (PageError(page)) + return; + + if (!page_has_private(page)) + return; + + iop = to_iomap_page(page); + spin_lock_irqsave(&iop->state_lock, flags); + bitmap_clear(iop->state, first + nr_blocks, last - first + 1); + spin_unlock_irqrestore(&iop->state_lock, flags); +} + static void iomap_iop_set_range_uptodate(struct page *page, unsigned off, unsigned len) { @@ -152,11 +201,11 @@ iomap_iop_set_range_uptodate(struct page *page, unsigned off, unsigned len) unsigned last = (off + len - 1) >> inode->i_blkbits; unsigned long flags; - spin_lock_irqsave(&iop->uptodate_lock, flags); - bitmap_set(iop->uptodate, first, last - first + 1); - if (bitmap_full(iop->uptodate, i_blocks_per_page(inode, page))) + spin_lock_irqsave(&iop->state_lock, flags); + bitmap_set(iop->state, first, last - first + 1); + if (bitmap_full(iop->state, i_blocks_per_page(inode, page))) SetPageUptodate(page); - spin_unlock_irqrestore(&iop->uptodate_lock, flags); + spin_unlock_irqrestore(&iop->state_lock, flags); } static void @@ -451,7 +500,7 @@ iomap_is_partially_uptodate(struct page *page, unsigned long from, if (iop) { for (i = first; i <= last; i++) - if (!test_bit(i, iop->uptodate)) + if (!test_bit(i, iop->state)) return 0; return 1; } @@ -708,7 +757,7 @@ static size_t __iomap_write_end(struct inode *inode, loff_t pos, size_t len, if (unlikely(copied < len && !PageUptodate(page))) return 0; iomap_set_range_uptodate(page, offset_in_page(pos), len); - iomap_set_page_dirty(page); + iomap_set_range_dirty(page, offset_in_page(pos), len); return copied; } @@ -1407,6 +1456,7 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc, { struct iomap_page *iop = iomap_page_create(inode, page); struct iomap_ioend *ioend, *next; + unsigned int nr_blocks = i_blocks_per_page(inode, page); unsigned len = i_blocksize(inode); u64 file_offset; /* file offset of page */ int error = 0, count = 0, i; @@ -1422,7 +1472,7 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc, for (i = 0, file_offset = page_offset(page); i < (PAGE_SIZE >> inode->i_blkbits) && file_offset < end_offset; i++, file_offset += len) { - if (iop && !test_bit(i, iop->uptodate)) + if (iop && !test_bit(i + nr_blocks, iop->state)) continue; error = wpc->ops->map_blocks(wpc, inode, file_offset); @@ -1465,6 +1515,7 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc, } } + iomap_clear_range_dirty(page, 0, PAGE_SIZE); set_page_writeback(page); unlock_page(page); -- 2.39.2

1 0

[PATCH openEuler-1.0-LTS 0/2] Fix failure of LTP testcase af_alg05
by GUO Zihua 16 Mar '24

16 Mar '24

This patchset fixes the failure of af_alg05 cause by uninitialized crypto ctx. Herbert Xu (1): crypto: algif_aead - Only wake up when ctx->more is zero Ondrej Mosnacek (1): crypto: algif_aead - fix uninitialized ctx->init crypto/af_alg.c | 11 ++++++++--- crypto/algif_aead.c | 10 ++-------- crypto/algif_skcipher.c | 11 +++-------- include/crypto/if_alg.h | 4 +++- 4 files changed, 16 insertions(+), 20 deletions(-) -- 2.34.1

1 2

[PATCH openEuler-1.0-LTS] printk: avoid deadlock in panic
by Ye Weihua 16 Mar '24

16 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I991OV -------------------------------- In the process of load testing against panic, a deadlock issue was discovered. The reason is that in the panic process, console_unlock doesn't handle the printk_context variable evenly, causing printk_context to overflow downwards, allowing vprintk_func to enter the nmi direct branch without disabling interrupt. Upon holding the logbuf_lock lock, an interrupt running wake_up_klogd_work_func was called, resulting in a deadlock. To avoid this issue, move printk_safe_ext_irqrestore after check abandon_console_lock_in_panic(). Fixes: 06a14c5f9e7d (printk: Drop console_sem during panic) Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> --- kernel/printk/printk.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c index f52eceb3c48a..c164761da3ec 100644 --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c @@ -2539,12 +2539,12 @@ void console_unlock(void) return; } - printk_safe_exit_irqrestore(flags); - /* Allow panic_cpu to take over the consoles safely */ if (abandon_console_lock_in_panic()) break; + printk_safe_exit_irqrestore(flags); + if (do_cond_resched) cond_resched(); } -- 2.34.1

2 1